From: Kevin Brodsky <kevin.brodsky@arm.com>
To: linux-hardening@vger.kernel.org
Cc: Kevin Brodsky <kevin.brodsky@arm.com>,
Andrew Morton <akpm@linux-foundation.org>,
Andy Lutomirski <luto@kernel.org>,
Catalin Marinas <catalin.marinas@arm.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
"David Hildenbrand (Arm)" <david@kernel.org>,
Ira Weiny <ira.weiny@intel.com>, Jann Horn <jannh@google.com>,
Jeff Xu <jeffxu@chromium.org>, Joey Gouly <joey.gouly@arm.com>,
Kees Cook <kees@kernel.org>, Linus Walleij <linusw@kernel.org>,
Marc Zyngier <maz@kernel.org>, Mark Brown <broonie@kernel.org>,
Matthew Wilcox <willy@infradead.org>,
Maxwell Bland <mbland@motorola.com>,
"Mike Rapoport (IBM)" <rppt@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
Pierre Langlois <pierre.langlois@arm.com>,
Quentin Perret <qperret@google.com>,
Rick Edgecombe <rick.p.edgecombe@intel.com>,
Ryan Roberts <ryan.roberts@arm.com>,
Will Deacon <will@kernel.org>,
Yang Shi <yang@os.amperecomputing.com>,
Yeoreum Yun <yeoreum.yun@arm.com>,
linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org,
x86@kernel.org, Lorenzo Stoakes <ljs@kernel.org>,
Thomas Gleixner <tglx@kernel.org>,
Vlastimil Babka <vbabka@kernel.org>
Subject: [PATCH RFC v7 16/24] arm64: kpkeys: Implement arch_supports_kpkeys_early()
Date: Tue, 05 May 2026 17:06:05 +0100 [thread overview]
Message-ID: <20260505-kpkeys-v7-16-20c0bdd97197@arm.com> (raw)
In-Reply-To: <20260505-kpkeys-v7-0-20c0bdd97197@arm.com>
We need to check if the kpkeys_hardened_pgtables feature is going to
be enabled very early during boot, to decide how to set up the
linear map and how to allocate early page tables. This happens even
before boot CPU features are detected.
Implement the arch_supports_kpkeys_early() helper by directly
checking if the boot CPU supports POE, if it is called before boot
CPU features are detected. It may also be called later, in which
case we simply check the POE feature.
Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
---
arch/arm64/include/asm/cpufeature.h | 12 ++++++++++++
arch/arm64/include/asm/kpkeys.h | 7 +++++++
2 files changed, 19 insertions(+)
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 4de51f8d92cb..8722e9e62702 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -1078,6 +1078,18 @@ static inline bool cpu_has_lpa2(void)
#endif
}
+static inline bool cpu_has_poe(void)
+{
+ u64 mmfr3;
+
+ if (!IS_ENABLED(CONFIG_ARM64_POE))
+ return false;
+
+ mmfr3 = read_sysreg_s(SYS_ID_AA64MMFR3_EL1);
+ return cpuid_feature_extract_unsigned_field(mmfr3,
+ ID_AA64MMFR3_EL1_S1POE_SHIFT);
+}
+
#endif /* __ASSEMBLER__ */
#endif
diff --git a/arch/arm64/include/asm/kpkeys.h b/arch/arm64/include/asm/kpkeys.h
index 7dad3532cacf..ea915f78936b 100644
--- a/arch/arm64/include/asm/kpkeys.h
+++ b/arch/arm64/include/asm/kpkeys.h
@@ -21,6 +21,13 @@ static inline bool arch_supports_kpkeys(void)
return system_supports_poe();
}
+static inline bool arch_supports_kpkeys_early(void)
+{
+ /* POE is a boot feature */
+ return boot_capabilities_finalized() ?
+ system_supports_poe() : cpu_has_poe();
+}
+
#ifdef CONFIG_ARM64_POE
static inline u64 por_set_kpkeys_context(u64 por, int ctx)
--
2.51.2
next prev parent reply other threads:[~2026-05-05 16:08 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-05 16:05 [PATCH RFC v7 00/24] pkeys-based page table hardening Kevin Brodsky
2026-05-05 16:05 ` [PATCH RFC v7 01/24] mm: Introduce kpkeys Kevin Brodsky
2026-05-05 16:05 ` [PATCH RFC v7 02/24] set_memory: Introduce set_memory_pkey() stub Kevin Brodsky
2026-05-05 16:05 ` [PATCH RFC v7 03/24] arm64: mm: Enable overlays for all EL1 indirect permissions Kevin Brodsky
2026-05-05 16:05 ` [PATCH RFC v7 04/24] arm64: Introduce por_elx_set_pkey_perms() helper Kevin Brodsky
2026-05-05 16:05 ` [PATCH RFC v7 05/24] arm64: Implement asm/kpkeys.h using POE Kevin Brodsky
2026-05-05 16:05 ` [PATCH RFC v7 06/24] arm64: set_memory: Implement set_memory_pkey() Kevin Brodsky
2026-05-05 16:05 ` [PATCH RFC v7 07/24] arm64: Context-switch POR_EL1 Kevin Brodsky
2026-05-05 16:05 ` [PATCH RFC v7 08/24] arm64: Initialize POR_EL1 register on cpu_resume() Kevin Brodsky
2026-05-05 16:05 ` [PATCH RFC v7 09/24] arm64: Enable kpkeys Kevin Brodsky
2026-05-05 16:05 ` [PATCH RFC v7 10/24] memblock: Move INIT_MEMBLOCK_* macros to header Kevin Brodsky
2026-05-05 16:06 ` [PATCH RFC v7 11/24] mm: kpkeys: Introduce kpkeys_hardened_pgtables feature Kevin Brodsky
2026-05-05 16:06 ` [PATCH RFC v7 12/24] mm: kpkeys: Protect regular page tables Kevin Brodsky
2026-05-05 16:06 ` [PATCH RFC v7 13/24] mm: kpkeys: Introduce early page table allocator Kevin Brodsky
2026-05-05 16:06 ` [PATCH RFC v7 14/24] mm: kpkeys: Protect vmemmap page tables Kevin Brodsky
2026-05-05 16:06 ` [PATCH RFC v7 15/24] mm: kpkeys: Introduce hook for protecting static " Kevin Brodsky
2026-05-05 16:06 ` Kevin Brodsky [this message]
2026-05-05 16:06 ` [PATCH RFC v7 17/24] arm64: kpkeys: Support KPKEYS_CTX_PGTABLES Kevin Brodsky
2026-05-05 16:06 ` [PATCH RFC v7 18/24] arm64: kpkeys: Ensure the linear map can be modified Kevin Brodsky
2026-05-05 16:06 ` [PATCH RFC v7 19/24] arm64: kpkeys: Protect early page tables Kevin Brodsky
2026-05-05 16:06 ` [PATCH RFC v7 20/24] arm64: kpkeys: Protect init_pg_dir Kevin Brodsky
2026-05-05 16:06 ` [PATCH RFC v7 21/24] arm64: kpkeys: Guard page table writes Kevin Brodsky
2026-05-05 16:06 ` [PATCH RFC v7 22/24] arm64: kpkeys: Batch KPKEYS_CTX_PGTABLES switches Kevin Brodsky
2026-05-05 16:06 ` [PATCH RFC v7 23/24] arm64: kpkeys: Enable kpkeys_hardened_pgtables support Kevin Brodsky
2026-05-05 16:06 ` [PATCH RFC v7 24/24] mm: Add basic tests for kpkeys_hardened_pgtables Kevin Brodsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260505-kpkeys-v7-16-20c0bdd97197@arm.com \
--to=kevin.brodsky@arm.com \
--cc=akpm@linux-foundation.org \
--cc=broonie@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=dave.hansen@linux.intel.com \
--cc=david@kernel.org \
--cc=ira.weiny@intel.com \
--cc=jannh@google.com \
--cc=jeffxu@chromium.org \
--cc=joey.gouly@arm.com \
--cc=kees@kernel.org \
--cc=linusw@kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=luto@kernel.org \
--cc=maz@kernel.org \
--cc=mbland@motorola.com \
--cc=peterz@infradead.org \
--cc=pierre.langlois@arm.com \
--cc=qperret@google.com \
--cc=rick.p.edgecombe@intel.com \
--cc=rppt@kernel.org \
--cc=ryan.roberts@arm.com \
--cc=tglx@kernel.org \
--cc=vbabka@kernel.org \
--cc=will@kernel.org \
--cc=willy@infradead.org \
--cc=x86@kernel.org \
--cc=yang@os.amperecomputing.com \
--cc=yeoreum.yun@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox