[PATCH 0/4] mm: Enforce read-only shared vmemmap tail mappings

[PATCH 0/4] mm: Enforce read-only shared vmemmap tail mappings

[Muchun Song]

This series is split out from the earlier, larger series "mm: Generalize
HVO for HugeTLB and device DAX" [1]. While the parent series generalizes
vmemmap optimization across HugeTLB and device DAX, this subset addresses
a single, self-contained step: mapping shared vmemmap tail pages read-only
at population time.

After the previous HugeTLB and device DAX conversions, both can install
optimized shared-tail mappings during vmemmap population. These mappings
should be read-only because each shared tail vmemmap page backs metadata
for many tail pages. HugeTLB applies this protection in a later,
subsystem-specific pass, but device DAX currently lacks it.

This series moves the protection into the generic sparse-vmemmap and
powerpc radix population paths. This protects device DAX mappings and
makes the HugeTLB-specific vmemmap_wrprotect_hvo() pass redundant. With
that pass gone, the bootmem-only optimization wrapper has no distinct
work and is removed as well.

This is intended to be the fifth smaller step toward the broader HVO
generalization. The remaining HVO naming and enablement consolidation is
left for follow-up series.

[1] https://lore.kernel.org/all/20260513130542.35604-1-songmuchun@bytedance.com/

Muchun Song (4):
  mm/sparse-vmemmap: map shared vmemmap tail pages as read-only
  powerpc/mm: map shared vmemmap tail pages as read-only
  mm/hugetlb_vmemmap: remove vmemmap_wrprotect_hvo()
  mm/hugetlb_vmemmap: remove hugetlb_vmemmap_optimize_bootmem_folios()

 Documentation/mm/vmemmap_dedup.rst       |  3 +-
 arch/powerpc/mm/book3s64/radix_pgtable.c |  3 ++
 include/linux/mm.h                       |  2 --
 mm/hugetlb.c                             |  2 +-
 mm/hugetlb_vmemmap.c                     | 45 +++++-------------------
 mm/hugetlb_vmemmap.h                     |  6 ----
 mm/sparse-vmemmap.c                      | 26 ++------------
 7 files changed, 17 insertions(+), 70 deletions(-)


base-commit: 2887e63d2e8e0cf55402612d8996ce955a2c3e55
-- 
2.54.0

[PATCH 1/4] mm/sparse-vmemmap: map shared vmemmap tail pages as read-only

[Muchun Song]

Both early HugeTLB HVO and device DAX use the common vmemmap population
path for shared tail mappings. Map these pages read-only so that illegal
writes fault instead of corrupting metadata shared by multiple tail
pages.

For early HugeTLB, this moves existing write protection into initial
population without changing the final mapping. Device DAX gains the same
protection.

Signed-off-by: Muchun Song <songmuchun@bytedance.com>
---
 Documentation/mm/vmemmap_dedup.rst | 3 +--
 mm/sparse-vmemmap.c                | 3 +++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/Documentation/mm/vmemmap_dedup.rst b/Documentation/mm/vmemmap_dedup.rst
index 8c287ae3f86c..76f903975a40 100644
--- a/Documentation/mm/vmemmap_dedup.rst
+++ b/Documentation/mm/vmemmap_dedup.rst
@@ -193,5 +193,4 @@ There's no remapping of vmemmap given that device-dax memory is not part of
 System RAM ranges initialized at boot. Thus the tail page deduplication
 happens at a later stage when we populate the sections.
 
-Deduplicated tail pages are not mapped read-only. The mapping layout is the same
-as HugeTLB.
+The mapping layout is the same as HugeTLB.
diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
index 40eba70c0048..ba0496daf4de 100644
--- a/mm/sparse-vmemmap.c
+++ b/mm/sparse-vmemmap.c
@@ -295,6 +295,9 @@ static pte_t * __meminit vmemmap_pte_populate(pmd_t *pmd, unsigned long addr, in
 			return NULL;
 
 		entry = pfn_pte(PHYS_PFN(__pa(p)), PAGE_KERNEL);
+		/* Map the shared tail page as read-only to catch illegal writes. */
+		if (vmemmap_optimizable_pfn(pfn))
+			entry = pte_wrprotect(entry);
 		set_pte_at(&init_mm, addr, pte, entry);
 	} else if (WARN_ON_ONCE(vmemmap_optimizable_pfn(pfn)))
 		return NULL;
-- 
2.54.0

[PATCH 2/4] powerpc/mm: map shared vmemmap tail pages as read-only

[Muchun Song]

PowerPC radix uses an architecture-specific vmemmap population path for
shared tail mappings, so it does not inherit the read-only protection added
to the common path.

Protect these mappings as well so illegal writes fault instead of
corrupting metadata shared by multiple tail pages.

Signed-off-by: Muchun Song <songmuchun@bytedance.com>
---
 arch/powerpc/mm/book3s64/radix_pgtable.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c
index 44868b62b14e..ebac5f9058f6 100644
--- a/arch/powerpc/mm/book3s64/radix_pgtable.c
+++ b/arch/powerpc/mm/book3s64/radix_pgtable.c
@@ -1059,6 +1059,9 @@ static pte_t * __meminit radix__vmemmap_pte_populate(pmd_t *pmdp, unsigned long
 
 		VM_BUG_ON(!PAGE_ALIGNED(addr));
 		entry = pfn_pte(__pa(p) >> PAGE_SHIFT, PAGE_KERNEL);
+		/* Map the shared tail page as read-only to catch illegal writes. */
+		if (reuse)
+			entry = pte_wrprotect(entry);
 		set_pte_at(&init_mm, addr, pte, entry);
 		asm volatile("ptesync": : :"memory");
 	}
-- 
2.54.0

[PATCH 3/4] mm/hugetlb_vmemmap: remove vmemmap_wrprotect_hvo()

[Muchun Song]

Shared vmemmap tail pages are now mapped read-only during initial
population, so already optimized HugeTLB bootmem folios no longer need a
separate write-protection pass.

Remove vmemmap_wrprotect_hvo() and skip these folios during boot-time
optimization.

Signed-off-by: Muchun Song <songmuchun@bytedance.com>
---
 include/linux/mm.h   |  2 --
 mm/hugetlb_vmemmap.c | 18 ++++++------------
 mm/sparse-vmemmap.c  | 23 -----------------------
 3 files changed, 6 insertions(+), 37 deletions(-)

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 35f5fc43861a..6f5affe54946 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -5359,8 +5359,6 @@ int vmemmap_populate_hugepages(unsigned long start, unsigned long end,
 			       int node, struct vmem_altmap *altmap);
 int vmemmap_populate(unsigned long start, unsigned long end, int node,
 		struct vmem_altmap *altmap);
-void vmemmap_wrprotect_hvo(unsigned long start, unsigned long end, int node,
-			  unsigned long headsize);
 void vmemmap_populate_print_last(void);
 #ifdef CONFIG_MEMORY_HOTPLUG
 void vmemmap_free(unsigned long start, unsigned long end,
diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c
index 0057fa2a16a8..3d72346c2ca2 100644
--- a/mm/hugetlb_vmemmap.c
+++ b/mm/hugetlb_vmemmap.c
@@ -603,19 +603,13 @@ static void __hugetlb_vmemmap_optimize_folios(struct hstate *h,
 	nr_to_optimize = 0;
 	list_for_each_entry(folio, folio_list, lru) {
 		int ret;
-		unsigned long spfn, epfn;
-
-		if (boot && folio_test_hugetlb_vmemmap_optimized(folio)) {
-			/*
-			 * Already optimized by pre-HVO, just map the
-			 * mirrored tail page structs RO.
-			 */
-			spfn = (unsigned long)&folio->page;
-			epfn = spfn + hugetlb_vmemmap_size(h);
-			vmemmap_wrprotect_hvo(spfn, epfn, folio_nid(folio),
-					HUGETLB_VMEMMAP_RESERVE_SIZE);
+
+		/*
+		 * Bootmem gigantic folios may already be marked optimized when
+		 * their vmemmap layout was prepared earlier, so skip them here.
+		 */
+		if (boot && folio_test_hugetlb_vmemmap_optimized(folio))
 			continue;
-		}
 
 		nr_to_optimize++;
 
diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
index ba0496daf4de..0af4b9e791b2 100644
--- a/mm/sparse-vmemmap.c
+++ b/mm/sparse-vmemmap.c
@@ -386,29 +386,6 @@ int __meminit vmemmap_populate_basepages(unsigned long start, unsigned long end,
 	return 0;
 }
 
-/*
- * Write protect the mirrored tail page structs for HVO. This will be
- * called from the hugetlb code when gathering and initializing the
- * memblock allocated gigantic pages. The write protect can't be
- * done earlier, since it can't be guaranteed that the reserved
- * page structures will not be written to during initialization,
- * even if CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled.
- *
- * The PTEs are known to exist, and nothing else should be touching
- * these pages. The caller is responsible for any TLB flushing.
- */
-void vmemmap_wrprotect_hvo(unsigned long addr, unsigned long end,
-				    int node, unsigned long headsize)
-{
-	unsigned long maddr;
-	pte_t *pte;
-
-	for (maddr = addr + headsize; maddr < end; maddr += PAGE_SIZE) {
-		pte = virt_to_kpte(maddr);
-		ptep_set_wrprotect(&init_mm, maddr, pte);
-	}
-}
-
 void __weak __meminit vmemmap_set_pmd(pmd_t *pmd, void *p, int node,
 				      unsigned long addr, unsigned long next)
 {
-- 
2.54.0

[PATCH 4/4] mm/hugetlb_vmemmap: remove hugetlb_vmemmap_optimize_bootmem_folios()

[Muchun Song]

With vmemmap_wrprotect_hvo() removed, the bootmem wrapper no longer
performs any bootmem-specific work.

Call hugetlb_vmemmap_optimize_folios() directly for bootmem folios and
remove the redundant wrapper.

Signed-off-by: Muchun Song <songmuchun@bytedance.com>
---
 mm/hugetlb.c         |  2 +-
 mm/hugetlb_vmemmap.c | 29 ++++-------------------------
 mm/hugetlb_vmemmap.h |  6 ------
 3 files changed, 5 insertions(+), 32 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index b37d7d0db7fc..64a21b7e820f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3297,7 +3297,7 @@ static void __init prep_and_add_bootmem_folios(struct hstate *h,
 	struct folio *folio, *tmp_f;
 
 	/* Send list for bulk vmemmap optimization processing */
-	hugetlb_vmemmap_optimize_bootmem_folios(h, folio_list);
+	hugetlb_vmemmap_optimize_folios(h, folio_list);
 
 	list_for_each_entry_safe(folio, tmp_f, folio_list, lru) {
 		if (!folio_test_hugetlb_vmemmap_optimized(folio)) {
diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c
index 3d72346c2ca2..236e1db9517b 100644
--- a/mm/hugetlb_vmemmap.c
+++ b/mm/hugetlb_vmemmap.c
@@ -588,19 +588,16 @@ static int hugetlb_vmemmap_split_folio(const struct hstate *h, struct folio *fol
 	return vmemmap_remap_split(vmemmap_start, vmemmap_end);
 }
 
-static void __hugetlb_vmemmap_optimize_folios(struct hstate *h,
-					      struct list_head *folio_list,
-					      bool boot)
+void hugetlb_vmemmap_optimize_folios(struct hstate *h, struct list_head *folio_list)
 {
 	struct folio *folio;
-	int nr_to_optimize;
+	unsigned long nr_to_optimize = 0;
 	LIST_HEAD(vmemmap_pages);
 	unsigned long flags = VMEMMAP_REMAP_NO_TLB_FLUSH;
 
 	if (list_empty(folio_list))
 		return;
 
-	nr_to_optimize = 0;
 	list_for_each_entry(folio, folio_list, lru) {
 		int ret;
 
@@ -608,7 +605,7 @@ static void __hugetlb_vmemmap_optimize_folios(struct hstate *h,
 		 * Bootmem gigantic folios may already be marked optimized when
 		 * their vmemmap layout was prepared earlier, so skip them here.
 		 */
-		if (boot && folio_test_hugetlb_vmemmap_optimized(folio))
+		if (folio_test_hugetlb_vmemmap_optimized(folio))
 			continue;
 
 		nr_to_optimize++;
@@ -626,14 +623,7 @@ static void __hugetlb_vmemmap_optimize_folios(struct hstate *h,
 	}
 
 	if (!nr_to_optimize)
-		/*
-		 * All pre-HVO folios, nothing left to do. It's ok if
-		 * there is a mix of pre-HVO and not yet HVO-ed folios
-		 * here, as __hugetlb_vmemmap_optimize_folio() will
-		 * skip any folios that already have the optimized flag
-		 * set, see vmemmap_should_optimize_folio().
-		 */
-		goto out;
+		return;
 
 	flush_tlb_all();
 
@@ -658,21 +648,10 @@ static void __hugetlb_vmemmap_optimize_folios(struct hstate *h,
 		}
 	}
 
-out:
 	flush_tlb_all();
 	free_vmemmap_page_list(&vmemmap_pages);
 }
 
-void hugetlb_vmemmap_optimize_folios(struct hstate *h, struct list_head *folio_list)
-{
-	__hugetlb_vmemmap_optimize_folios(h, folio_list, false);
-}
-
-void hugetlb_vmemmap_optimize_bootmem_folios(struct hstate *h, struct list_head *folio_list)
-{
-	__hugetlb_vmemmap_optimize_folios(h, folio_list, true);
-}
-
 void __init hugetlb_vmemmap_optimize_bootmem_page(unsigned long pfn, unsigned int order)
 {
 	if (!READ_ONCE(vmemmap_optimize_enabled))
diff --git a/mm/hugetlb_vmemmap.h b/mm/hugetlb_vmemmap.h
index 464192e32dec..d717d0d10960 100644
--- a/mm/hugetlb_vmemmap.h
+++ b/mm/hugetlb_vmemmap.h
@@ -24,7 +24,6 @@ long hugetlb_vmemmap_restore_folios(const struct hstate *h,
 					struct list_head *non_hvo_folios);
 void hugetlb_vmemmap_optimize_folio(const struct hstate *h, struct folio *folio);
 void hugetlb_vmemmap_optimize_folios(struct hstate *h, struct list_head *folio_list);
-void hugetlb_vmemmap_optimize_bootmem_folios(struct hstate *h, struct list_head *folio_list);
 void hugetlb_vmemmap_optimize_bootmem_page(unsigned long pfn, unsigned int order);
 
 static inline unsigned int hugetlb_vmemmap_size(const struct hstate *h)
@@ -66,11 +65,6 @@ static inline void hugetlb_vmemmap_optimize_folios(struct hstate *h, struct list
 {
 }
 
-static inline void hugetlb_vmemmap_optimize_bootmem_folios(struct hstate *h,
-						struct list_head *folio_list)
-{
-}
-
 static inline unsigned int hugetlb_vmemmap_optimizable_size(const struct hstate *h)
 {
 	return 0;
-- 
2.54.0

Re: [PATCH 1/4] mm/sparse-vmemmap: map shared vmemmap tail pages as read-only

[Lance Yang]

On Mon, Oct 19, 2026 at 05:08:27PM +0800, Muchun Song wrote:
>Both early HugeTLB HVO and device DAX use the common vmemmap population
>path for shared tail mappings. Map these pages read-only so that illegal
>writes fault instead of corrupting metadata shared by multiple tail
>pages.
>
>For early HugeTLB, this moves existing write protection into initial
>population without changing the final mapping. Device DAX gains the same
>protection.
>
>Signed-off-by: Muchun Song <songmuchun@bytedance.com>
>---
> Documentation/mm/vmemmap_dedup.rst | 3 +--
> mm/sparse-vmemmap.c                | 3 +++
> 2 files changed, 4 insertions(+), 2 deletions(-)
>
>diff --git a/Documentation/mm/vmemmap_dedup.rst b/Documentation/mm/vmemmap_dedup.rst
>index 8c287ae3f86c..76f903975a40 100644
>--- a/Documentation/mm/vmemmap_dedup.rst
>+++ b/Documentation/mm/vmemmap_dedup.rst
>@@ -193,5 +193,4 @@ There's no remapping of vmemmap given that device-dax memory is not part of
> System RAM ranges initialized at boot. Thus the tail page deduplication
> happens at a later stage when we populate the sections.
> 
>-Deduplicated tail pages are not mapped read-only. The mapping layout is the same
>-as HugeTLB.
>+The mapping layout is the same as HugeTLB.
>diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
>index 40eba70c0048..ba0496daf4de 100644
>--- a/mm/sparse-vmemmap.c
>+++ b/mm/sparse-vmemmap.c
>@@ -295,6 +295,9 @@ static pte_t * __meminit vmemmap_pte_populate(pmd_t *pmd, unsigned long addr, in
> 			return NULL;
> 
> 		entry = pfn_pte(PHYS_PFN(__pa(p)), PAGE_KERNEL);
>+		/* Map the shared tail page as read-only to catch illegal writes. */
>+		if (vmemmap_optimizable_pfn(pfn))
>+			entry = pte_wrprotect(entry);

LLM pointed out that an AO MCE before bootmem gather could still reach
TestSetPageHWPoison() on a shared tail, since the head isn't marked
hugetlb yet.

Wouldn't that trigger an Oops ... Anyway, I wouldn't expect to hit that
during boot.

Reviewed-by: Lance Yang <lance.yang@linux.dev>

[...]

Cheers, Lance

Re: [PATCH 1/4] mm/sparse-vmemmap: map shared vmemmap tail pages as read-only

[Muchun Song]

> On Oct 21, 2026, at 12:57, Lance Yang <lance.yang@linux.dev> wrote:
> 
> 
> On Mon, Oct 19, 2026 at 05:08:27PM +0800, Muchun Song wrote:
>> Both early HugeTLB HVO and device DAX use the common vmemmap population
>> path for shared tail mappings. Map these pages read-only so that illegal
>> writes fault instead of corrupting metadata shared by multiple tail
>> pages.
>> 
>> For early HugeTLB, this moves existing write protection into initial
>> population without changing the final mapping. Device DAX gains the same
>> protection.
>> 
>> Signed-off-by: Muchun Song <songmuchun@bytedance.com>
>> ---
>> Documentation/mm/vmemmap_dedup.rst | 3 +--
>> mm/sparse-vmemmap.c                | 3 +++
>> 2 files changed, 4 insertions(+), 2 deletions(-)
>> 
>> diff --git a/Documentation/mm/vmemmap_dedup.rst b/Documentation/mm/vmemmap_dedup.rst
>> index 8c287ae3f86c..76f903975a40 100644
>> --- a/Documentation/mm/vmemmap_dedup.rst
>> +++ b/Documentation/mm/vmemmap_dedup.rst
>> @@ -193,5 +193,4 @@ There's no remapping of vmemmap given that device-dax memory is not part of
>> System RAM ranges initialized at boot. Thus the tail page deduplication
>> happens at a later stage when we populate the sections.
>> 
>> -Deduplicated tail pages are not mapped read-only. The mapping layout is the same
>> -as HugeTLB.
>> +The mapping layout is the same as HugeTLB.
>> diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
>> index 40eba70c0048..ba0496daf4de 100644
>> --- a/mm/sparse-vmemmap.c
>> +++ b/mm/sparse-vmemmap.c
>> @@ -295,6 +295,9 @@ static pte_t * __meminit vmemmap_pte_populate(pmd_t *pmd, unsigned long addr, in
>> return NULL;
>> 
>> 	entry = pfn_pte(PHYS_PFN(__pa(p)), PAGE_KERNEL);
>> + 	/* Map the shared tail page as read-only to catch illegal writes. */
>> + 	if (vmemmap_optimizable_pfn(pfn))
>> + 		entry = pte_wrprotect(entry);
> 
> LLM pointed out that an AO MCE before bootmem gather could still reach
> TestSetPageHWPoison() on a shared tail, since the head isn't marked
> hugetlb yet.

Compared with the RO problem, a more serious issue may be
that the struct page has not yet been initialized, and the
MCE preprocessing flow may all be problematic, performing
various operations based on an uninitialized struct page.
However, this problem is not specific to hugetlb; the same
problem exists when CONFIG_DEFERRED_STRUCT_PAGE_INIT is
enabled.

> 
> Wouldn't that trigger an Oops ... Anyway, I wouldn't expect to hit that
> during boot.

Therefore, I do not think this kind of problem during the boot
stage is a problem, because we have no way to prevent it.

> 
> Reviewed-by: Lance Yang <lance.yang@linux.dev>

THanks.

> 
> [...]
> 
> Cheers, Lance

Re: [PATCH 2/4] powerpc/mm: map shared vmemmap tail pages as read-only

[Lance Yang]

On Mon, Oct 19, 2026 at 05:08:28PM +0800, Muchun Song wrote:
>PowerPC radix uses an architecture-specific vmemmap population path for
>shared tail mappings, so it does not inherit the read-only protection added
>to the common path.
>
>Protect these mappings as well so illegal writes fault instead of
>corrupting metadata shared by multiple tail pages.
>
>Signed-off-by: Muchun Song <songmuchun@bytedance.com>
>---

Nothing jumped out at me, feel free to add:

Reviewed-by: Lance Yang <lance.yang@linux.dev>

Re: [PATCH 3/4] mm/hugetlb_vmemmap: remove vmemmap_wrprotect_hvo()

[Lance Yang]

On Mon, Oct 19, 2026 at 05:08:29PM +0800, Muchun Song wrote:
>Shared vmemmap tail pages are now mapped read-only during initial
>population, so already optimized HugeTLB bootmem folios no longer need a
>separate write-protection pass.
>
>Remove vmemmap_wrprotect_hvo() and skip these folios during boot-time
>optimization.
>
>Signed-off-by: Muchun Song <songmuchun@bytedance.com>
>---

Yep, already read-only, so there's no need to write-protect them again.

LGTM, so 

Reviewed-by: Lance Yang <lance.yang@linux.dev>

Re: [PATCH 4/4] mm/hugetlb_vmemmap: remove hugetlb_vmemmap_optimize_bootmem_folios()

[Lance Yang]

On Mon, Oct 19, 2026 at 05:08:30PM +0800, Muchun Song wrote:
>With vmemmap_wrprotect_hvo() removed, the bootmem wrapper no longer
>performs any bootmem-specific work.
>
>Call hugetlb_vmemmap_optimize_folios() directly for bootmem folios and
>remove the redundant wrapper.
>
>Signed-off-by: Muchun Song <songmuchun@bytedance.com>
>---

No boot-specific work left, LGTM!

Reviewed-by: Lance Yang <lance.yang@linux.dev>