Re: [RFC PATCH 12/16] arm64: mm: Map p4d/pgd with privileged pkey

[RFC PATCH 00/16] pkeys-based page table hardening · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 01/16] mm: Introduce kpkeys · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 02/16] set_memory: Introduce set_memory_pkey() stub · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 03/16] arm64: mm: Enable overlays for all EL1 indirect permissions · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 04/16] arm64: Introduce por_set_pkey_perms() helper · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 05/16] arm64: Implement asm/kpkeys.h using POE · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 06/16] arm64: set_memory: Implement set_memory_pkey() · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 07/16] arm64: Enable kpkeys · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 08/16] mm: Introduce kernel_pgtables_set_pkey() · Kevin Brodsky <hidden> · 2024-12-06
Re: [RFC PATCH 08/16] mm: Introduce kernel_pgtables_set_pkey() · Peter Zijlstra <peterz@infradead.org> · 2024-12-09
Re: [RFC PATCH 08/16] mm: Introduce kernel_pgtables_set_pkey() · Kevin Brodsky <hidden> · 2024-12-10
[RFC PATCH 09/16] mm: Introduce kpkeys_hardened_pgtables · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 10/16] mm: Map page tables with privileged pkey · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 11/16] arm64: kpkeys: Support KPKEYS_LVL_PGTABLES · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 12/16] arm64: mm: Map p4d/pgd with privileged pkey · Kevin Brodsky <hidden> · 2024-12-06
Re: [RFC PATCH 12/16] arm64: mm: Map p4d/pgd with privileged pkey · Peter Zijlstra <peterz@infradead.org> · 2024-12-09
Re: [RFC PATCH 12/16] arm64: mm: Map p4d/pgd with privileged pkey · Kevin Brodsky <hidden> · 2024-12-10
Re: [RFC PATCH 12/16] arm64: mm: Map p4d/pgd with privileged pkey · Peter Zijlstra <peterz@infradead.org> · 2024-12-10
Re: [RFC PATCH 12/16] arm64: mm: Map p4d/pgd with privileged pkey · Kevin Brodsky <hidden> · 2024-12-11
[RFC PATCH 13/16] arm64: mm: Reset pkey in __tlb_remove_table() · Kevin Brodsky <hidden> · 2024-12-06
Re: [RFC PATCH 13/16] arm64: mm: Reset pkey in __tlb_remove_table() · Peter Zijlstra <peterz@infradead.org> · 2024-12-09
Re: [RFC PATCH 13/16] arm64: mm: Reset pkey in __tlb_remove_table() · Kevin Brodsky <hidden> · 2024-12-10
Re: [RFC PATCH 13/16] arm64: mm: Reset pkey in __tlb_remove_table() · Peter Zijlstra <peterz@infradead.org> · 2024-12-10
Re: [RFC PATCH 13/16] arm64: mm: Reset pkey in __tlb_remove_table() · Kevin Brodsky <hidden> · 2024-12-11
[RFC PATCH 14/16] arm64: mm: Guard page table writes with kpkeys · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 15/16] arm64: Enable kpkeys_hardened_pgtables support · Kevin Brodsky <hidden> · 2024-12-06
[RFC PATCH 16/16] mm: Add basic tests for kpkeys_hardened_pgtables · Kevin Brodsky <hidden> · 2024-12-06
Re: [RFC PATCH 00/16] pkeys-based page table hardening · Jann Horn <jannh@google.com> · 2024-12-06
Re: [RFC PATCH 00/16] pkeys-based page table hardening · Kevin Brodsky <hidden> · 2024-12-09

From: Peter Zijlstra <peterz@infradead.org>
Date: 2024-12-09 10:24:45
Also in: linux-hardening, lkml

On Fri, Dec 06, 2024 at 10:11:06AM +0000, Kevin Brodsky wrote:

If CONFIG_KPKEYS_HARDENED_PGTABLES is enabled, map p4d/pgd pages
using a privileged pkey (KPKEYS_PKEY_PGTABLES), so that they can
only be written under guard(kpkeys_hardened_pgtables).

The case where pgd is not page-sized is not currently handled -
this is pending support for pkeys in kmem_cache.

This patch is a no-op if CONFIG_KPKEYS_HARDENED_PGTABLES is disabled
(default).

Should not this live in pagetable_*_[cd]tor() in generic code?

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help