Re: [PATCH RFC v10 13/22] mm: kpkeys: Protect early kernel page tables

[Kevin Brodsky <kevin.brodsky@arm.com>]

On 10/11/2026 17:02, sashiko-bot@kernel.org wrote:
>> +static int __init protect_p4d_table(pgd_t *pgd, unsigned long addr,
>> +				    unsigned long next, struct mm_walk *walk)
>> +{
>> +	pgd_t entry;
>> +
>> +	if (mm_p4d_folded(walk->mm))
>> +		return 0;
>> +
>> +	entry = pgdp_get(pgd);
>> +	if (!pgd_present(entry) || pgd_leaf(entry))
>> +		return 0;
>> +
>> +	protect_pgtable_page(p4d_offset(pgd, 0));
>> +
>> +	return 0;
>> +}
> [Severity: Medium]
> When CONFIG_KASAN_GENERIC or CONFIG_KASAN_SW_TAGS is enabled, does this walk
> and call set_direct_map_pkey() millions of times on the shared
> kasan_early_shadow_{p4d,pud,pmd,pte} tables?

Yes, KASAN support needs to be addressed, as mentioned in the cover letter.

> kasan_init() runs in setup_arch() before mm_core_init() calls
> kpkeys_hardened_pgtables_init(), populating unbacked shadow ranges in
> [PAGE_OFFSET, ULONG_MAX) with shared static tables where all 512 entries at
> each level point to the same next-level kasan_early_shadow_* page.  Unlike
> mm/ptdump.c, which detects those tables and sets walk->action =
> ACTION_CONTINUE, the callbacks here descend through every entry and invoke
> set_direct_map_pkey() (including a direct-map page table walk and broadcast
> TLB flush) for every 2 MiB PMD slot across the multi-terabyte shadow range,
> stalling boot.
>
> [ ... ]
>
>> +static void __init protect_early_kernel_pgtables(void)
>> +{
>> +	int ret;
>> +
>> +	mmap_write_lock(&init_mm);
>> +	/*
>> +	 * [PAGE_OFFSET, ULONG_MAX) covers all early kernel mappings on arm64
>> +	 * and x86 (at least).
>> +	 */
>> +	ret = walk_kernel_page_table_range(PAGE_OFFSET, ULONG_MAX,
>> +					   &protect_pgtable_ops, NULL, NULL);
>> +	mmap_write_unlock(&init_mm);
>> +	WARN_ON_ONCE(ret);
>> +}
> [Severity: Medium]
> On arm64 with CONFIG_ARM64_LPA2=y running on hardware where the top page
> table level is dynamically folded (vabits_actual < VA_BITS), does starting
> at PAGE_OFFSET walk and re-protect swapper_pg_dir 16 or 32 times?
>
> On arm64, PAGE_OFFSET is the compile-time _PAGE_OFFSET(VA_BITS) rather than
> _PAGE_OFFSET(vabits_actual).  When !pgtable_l5_enabled() on 4K pages (or
> !pgtable_l4_enabled() on 16K pages), pgd_none() is always false and
> pgd_to_folded_p4d() (or p4d_to_folded_pud()) wraps each top-level step in
> [PAGE_OFFSET, ULONG_MAX) back to the start of swapper_pg_dir:
>
> arch/arm64/include/asm/pgtable.h:pgd_to_folded_p4d() {
> 	return (p4d_t *)PTR_ALIGN_DOWN(pgdp, PAGE_SIZE) + p4d_index(addr);
> }
>
> As a result, walk_kernel_page_table_range() traverses the entire kernel page
> table hierarchy and flushes TLBs across all page table pages 16 times on 4K
> pages (or 32 times on 16K pages) during boot.

Right. Addresses don't really matter here, so for the next version I'm
planning to use the synthetic range [0, SZ) where SZ is PTRS_PER_PXX *
PXX_SIZE and PXX is the highest non-folded level (PGD if there is no
folding).

- Kevin