Re: [PATCH RFC v9 13/25] mm: kpkeys: Introduce early page table allocator

[Kevin Brodsky <kevin.brodsky@arm.com>]

On 27/08/2026 20:08, David Hildenbrand (Arm) wrote:
> On 8/18/26 16:08, Kevin Brodsky wrote:
>> The kpkeys_hardened_pgtables feature aims to protect all page table
>> pages (PTPs) by mapping them with a privileged pkey. This is primarily
>> handled by kpkeys_pgtable_alloc(), called from pagetable_alloc().
>> However, this does not cover PTPs allocated early, before the
>> buddy allocator is available. These PTPs are allocated by architecture
>> code, either 1. from static pools or 2. using the memblock allocator,
>> and should also be protected.
>>
>> This patch addresses the second category: PTPs allocated via memblock.
>> Such PTPs are notably used to create the linear map. Protecting them as
>> soon as they are allocated would require modifying the linear map while
>> it is being created, which seems at best difficult. Instead, a
>> simple allocator is introduced, obtaining pages from memblock and
>> keeping track of all allocated ranges to set their pkey once it is
>> safe to do so. PTPs allocated at that stage are not freed, so there
>> is no need to manage a free list.
> I'm think of ways to avoid remembering these ranges. I guess we get called that
> early that we don't even have a ptdesc where we could just link the pages.

Correct, in both the direct map and (early) vmemmap cases we can't rely
on struct page as storage.

> If only page tables would be linked in some datastructure where we could find
> them all ... ;)
>
> ... why can't we just scan the page table hierarchy to find all page tables that
> need protection?

It makes sense doesn't it :) In fact this is exactly what RFC v5 did [1]
(a year ago already...). Then in RFC v6 I attempted to support block
mappings, and things got a lot more complicated. In that case there are
(at least) two issues with protecting the early page tables by walking them:

1. On arm64 with BBML3 we cannot split blocks in the direct map until
all secondary cores are up. This makes locking pretty difficult if we're
to walk all page tables at that later stage.

2. Without modifying the allocation strategy, early page tables may not
be contiguous and setting their pkey would generate fragmentation.

Naturally neither of these issues is relevant to the present series,
where we force page granularity in the direct map. I still kept the same
approach as in RFC v6 though, as the goal remains to support block
mappings eventually.

That said, as discussed offline it may be sensible to revert to the
"walk early page tables" approach to start with, even if we would
probably need to change it later. This allows us to drop quite a few
patches, since init_pg_dir no longer needs to be explicitly protected.

One caveat is that in RFC v5, any page table page installed after
smp_prepare_boot_cpu() is called, and allocated using memblock (or
anything else but the buddy allocator), won't be protected. Codex can't
find any such case though so we should be good for now.

- Kevin

[1]
https://lore.kernel.org/linux-hardening/20250815085512.2182322-11-kevin.brodsky@arm.com/