On Tue, 1 Sep 2026, at 11:21, Kevin Brodsky wrote:
> On 27/08/2026 18:44, Ard Biesheuvel wrote:
>> From: Ard Biesheuvel <[email protected]>
>>
>> This v2 now covers intermediate level page tables as well as the PTE
>> level page table for the fixmap. The latter is a special case, as it
>>
>> a) is only accessed via the kernel image's mapping, and never via the
>> linear map (except for ptdump etc)
>>
>> b) must be accessible via a read-write mapping, as all manipulation of
>> read-only page table descriptors relies on the fixmap itself
>>
>> and so it is treated separately. The intermediate page tables may be
>> shared with other mappings in the upper kernel/vmalloc region, so they
>> must be updatable using the ordinary APIs.
>>
>> Build tested and boot tested on a Lenovo Yoga C630 using 16k pages.
>>
>> v1: https://lore.kernel.org/all/[email protected]/
>>
>> Cc: Ryan Roberts <[email protected]>
>> Cc: Anshuman Khandual <[email protected]>
>> Cc: Kevin Brodsky <[email protected]>
>> Cc: Liz Prucka <[email protected]>
>> Cc: Seth Jenkins <[email protected]>
>> Cc: Kees Cook <[email protected]>
>> Cc: Jann Horn <[email protected]>
>> Cc: [email protected]
>
> Looks like the Cc's didn't propagate to the actual patches, fortunately
> my lei filters did catch this series ;)
>
Ugh I must have forgotten to put --cc-cover
> Either way I quite like this series, it's an elegant approach and it
> should increase security without overhead, what's not to like!
>
> I also considered it from the perspective of kpkeys protection [1] and I
> think they should work together fine. The kpkeys series still allows
> page table setters to write to all page tables, so if we get a fault
> there it must be because the target is read only, and not because of a
> pkey fault.
>
Excellent, thanks for confirming.
