On 27/08/2026 18:44, Ard Biesheuvel wrote: > From: Ard Biesheuvel <[email protected]> > > This v2 now covers intermediate level page tables as well as the PTE > level page table for the fixmap. The latter is a special case, as it > > a) is only accessed via the kernel image's mapping, and never via the > linear map (except for ptdump etc) > > b) must be accessible via a read-write mapping, as all manipulation of > read-only page table descriptors relies on the fixmap itself > > and so it is treated separately. The intermediate page tables may be > shared with other mappings in the upper kernel/vmalloc region, so they > must be updatable using the ordinary APIs. > > Build tested and boot tested on a Lenovo Yoga C630 using 16k pages. > > v1: https://lore.kernel.org/all/[email protected]/ > > Cc: Ryan Roberts <[email protected]> > Cc: Anshuman Khandual <[email protected]> > Cc: Kevin Brodsky <[email protected]> > Cc: Liz Prucka <[email protected]> > Cc: Seth Jenkins <[email protected]> > Cc: Kees Cook <[email protected]> > Cc: Jann Horn <[email protected]> > Cc: [email protected]
Looks like the Cc's didn't propagate to the actual patches, fortunately my lei filters did catch this series ;) Either way I quite like this series, it's an elegant approach and it should increase security without overhead, what's not to like! I also considered it from the perspective of kpkeys protection [1] and I think they should work together fine. The kpkeys series still allows page table setters to write to all page tables, so if we get a fault there it must be because the target is read only, and not because of a pkey fault. - Kevin [1] https://lore.kernel.org/all/[email protected]/
