[RFC PATCH v5 13/18] mm: Map page tables with privileged pkey

Kevin Brodsky
2025-08-15T08:56:32Z

If CONFIG_KPKEYS_HARDENED_PGTABLES is enabled, map allocated page
table pages using a privileged pkey (KPKEYS_PKEY_PGTABLES), so that
page tables can only be written under guard(kpkeys_hardened_pgtables).

This patch is a no-op if CONFIG_KPKEYS_HARDENED_PGTABLES is disabled
(default).

Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
---
include/linux/mm.h | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/include/linux/mm.h b/include/linux/mm.h
index d9371d992033..4880cb7a4cb9 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -34,6 +34,7 @@
#include <linux/slab.h>
#include <linux/cacheinfo.h>
#include <linux/rcuwait.h>
+#include <linux/kpkeys.h>

struct mempolicy;
struct anon_vma;
@@ -2979,6 +2980,8 @@ static inline bool __pagetable_ctor(struct ptdesc *ptdesc)

__folio_set_pgtable(folio);
lruvec_stat_add_folio(folio, NR_PAGETABLE);
+ if (kpkeys_protect_pgtable_memory(folio))
+ return false;
return true;
}

@@ -2989,6 +2992,7 @@ static inline void pagetable_dtor(struct ptdesc *ptdesc)
ptlock_free(ptdesc);
__folio_clear_pgtable(folio);
lruvec_stat_sub_folio(folio, NR_PAGETABLE);
+ kpkeys_unprotect_pgtable_memory(folio);
}

static inline void pagetable_dtor_free(struct ptdesc *ptdesc)
--
2.47.0