Re: [PATCH v1] riscv: mm: Define PAGE_KERNEL_RO

[Muchun Song]

> On Oct 18, 2026, at 10:36, Nickolai Zeldovich <nickolai@xxxxxxxxxxxxx> wrote:
> 
> Kernel mappings that generic code creates read-only are writable on
> riscv. With HugeTLB vmemmap optimization (selected by riscv and on by
> default with CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON), the tail
> vmemmap pages of every optimized huge page are remapped to one shared
> page with PAGE_KERNEL_RO so that a stray write to a tail struct page
> faults. On riscv that remap keeps _PAGE_WRITE, so such a write silently
> changes the struct pages of every optimized huge page instead.

Yeah, I knew, I also have a similar fix locally to resolve this issue.

> early_memremap_ro() (EFI system and configuration tables), the
> firmware loader's vmap() of the loaded image, and acpi_os_ioremap() for
> EFI runtime code and NOMAP regions, which asks for a read-only mapping
> precisely to avoid a writable mapping of executable code, are affected
> the same way.

So it also does affect other components other than HVO, right?

> 
> riscv defines PAGE_KERNEL_READ but not PAGE_KERNEL_RO, so
> include/linux/pgtable.h falls back to "#define PAGE_KERNEL_RO
> PAGE_KERNEL". Define PAGE_KERNEL_RO as PAGE_KERNEL_READ. FIXMAP_PAGE_RO
> then follows from asm-generic/fixmap.h: early_memremap_ro() now passes
> 0xe3 instead of 0xe7 to __early_ioremap().
> 
> Tested on QEMU virt (riscv64, defconfig with
> CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON and CONFIG_PTDUMP_DEBUGFS,
> booted with hugepages=8): before, every vmemmap entry in
> /sys/kernel/debug/kernel_page_tables has W set; after, the 28K of tail
> vmemmap of each huge page is mapped R without W.
> 
> Fixes: a3c7d6b642e4 ("riscv: mm: hugetlb: Enable ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP")

If yes, so there may be earlier, more suitable Fixes commits?

> Assisted-by: LLM
> Signed-off-by: Nickolai Zeldovich <nickolai@xxxxxxxxxxxxx>
> ---
> 
> Notes:
>    Reproducer (riscv64 defconfig + CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON=y
>    CONFIG_PTDUMP_DEBUGFS=y, QEMU virt): a static /init that prints the vmemmap
>    part of the kernel page table dump.
> 
>      #include <stdio.h>
>      #include <string.h>
>      #include <sys/mount.h>
>      #include <sys/reboot.h>
> 
>      int main(void)
>      {
>       	char line[256];
>       	int in = 0;
>       	FILE *f;
> 
>       	mount("sysfs", "/sys", "sysfs", 0, NULL);
>       	mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL);
>       	f = fopen("/sys/kernel/debug/kernel_page_tables", "r");
>       	while (f && fgets(line, sizeof(line), f)) {
>       		if (strstr(line, "---[ "))
>       			in = strstr(line, "vmemmap start") != NULL;
>       		if (in)
>       			fputs(line, stdout);
>       	}
>       	fflush(stdout);
>       	reboot(RB_POWER_OFF);
>       	return 0;
>      }
> 
>      riscv64-linux-gnu-gcc -static -O2 -o init init.c
>      qemu-system-riscv64 -M virt -cpu max -smp 2 -m 1G -nographic -kernel Image \
>        -initrd initramfs.cpio -append "console=ttyS0 hugepages=8"
> 
>    Before (all vmemmap entries writable):
>      0xff1c000002000000-0xff1c000002200000  0xbec00000  2M PTE  D A G . . W R V
>      0xff1c000002200000-0xff1c000002800000  0xbea00000  6M PMD  D A G . . W R V
> 
>    After (each huge page: 4K head W, 28K tail read-only, shared page 0x81fd0000):
>      0xff1c0000020a1000-0xff1c0000020a8000  0x81fd0000  28K PTE D A G . . . R V
>      0xff1c0000020a8000-0xff1c0000020a9000  0x81fd6000   4K PTE D A G . . W R V
>      0xff1c0000020a9000-0xff1c0000020b0000  0x81fd0000  28K PTE D A G . . . R V
> 
> arch/riscv/include/asm/pgtable.h | 1 +
> 1 file changed, 1 insertion(+)
> 
> diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
> index 40b1ed4f3ea8..13447181ceb7 100644
> --- a/arch/riscv/include/asm/pgtable.h
> +++ b/arch/riscv/include/asm/pgtable.h
> @@ -189,6 +189,7 @@ extern struct pt_alloc_ops pt_ops __meminitdata;
> 
> #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
> #define PAGE_KERNEL_READ __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
> +#define PAGE_KERNEL_RO PAGE_KERNEL_READ
> #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL | _PAGE_EXEC)
> #define PAGE_KERNEL_READ_EXEC __pgprot((_PAGE_KERNEL & ~_PAGE_WRITE) \
> 					| _PAGE_EXEC)

Acked-by: Muchun Song <muchun.song@xxxxxxxxx>

Thanks.

> 
> base-commit: 58161ead29e50d70a317ea26b472e0c7508e69da
> -- 
> 2.53.0
>