Re: [PATCH RFC v9 13/25] mm: kpkeys: Introduce early page table allocator

On 8/18/26 16:08, Kevin Brodsky wrote:

The kpkeys_hardened_pgtables feature aims to protect all page table
pages (PTPs) by mapping them with a privileged pkey. This is primarily
handled by kpkeys_pgtable_alloc(), called from pagetable_alloc().
However, this does not cover PTPs allocated early, before the
buddy allocator is available. These PTPs are allocated by architecture
code, either 1. from static pools or 2. using the memblock allocator,
and should also be protected.

This patch addresses the second category: PTPs allocated via memblock.
Such PTPs are notably used to create the linear map. Protecting them as
soon as they are allocated would require modifying the linear map while
it is being created, which seems at best difficult. Instead, a
simple allocator is introduced, obtaining pages from memblock and
keeping track of all allocated ranges to set their pkey once it is
safe to do so. PTPs allocated at that stage are not freed, so there
is no need to manage a free list.

I'm think of ways to avoid remembering these ranges. I guess we get called that
early that we don't even have a ptdesc where we could just link the pages.

If only page tables would be linked in some datastructure where we could find
them all ... ;)

... why can't we just scan the page table hierarchy to find all page tables that
need protection?

-- 
Cheers,

David