[RFC PATCH] arm64: mm: Map fixmap PTE tables r/o in the linear map

[Kevin Brodsky]

On 27/08/2026 12:16, Ard Biesheuvel wrote:
>>> I'm currently experimenting with using __put_kernel_nofault() to update
>>> the descriptors at all levels (including PTE) and handling the fault
>>> using the fixmap approach. That way, all statically allocated page
>>> tables could move to .rodata (except bm_pte[]) and there should be no
>>> substantial performance impact.
>> Doesn't that still mean modifying a fixmap PTE every time we update
>> kernel page tables? That doesn't exactly sound cheap.
>>
> Only the ones that were allocated statically, which cover the region
> around the kernel image, and the special cases (fixmap, kasan). Everything
> else is allocated dynamically, using memblock_alloc() if very early
> during the boot.

Ah yes I see! Then it does sound very reasonable, those page tables
should rarely be written if at all. For kpkeys that would mean we would
just need to map bm_pte with the special pkey to complete the
protection, the rest being already RO or pkey-protected.

- Kevin