[RFC PATCH v2 1/4] arm64: mm: Map fixmap PTE tables r/o in the linear map

[Kevin Brodsky]

On 27/08/2026 18:44, Ard Biesheuvel wrote:
> From: Ard Biesheuvel <ardb at kernel.org>
>
> Without physical KASLR, the fixmap page tables will appear at an a
> priori known offset in the physical address space, and due to the lack
> of randomization, the linear map carries a writeable alias of the fixmap
> PTE pages, which appears at an offset in the kernel VA space that is
> also predictable.
>
> Given that the placement of the fixmap area is never randomized either,
> a single store to this linear alias region is sufficient to map any
> physical page with any permissions at a known offset in the kernel VA
> space, including on top of the PTI trampoline.
>
> Avoid this, by remapping the fixmap PTE pages read-only in the linear
> map. This is possible because all updates to bm_pte[] occur via the
> mapping of the kernel image in the vmap area. A read-only mapping is
> still needed for things like ptdump that walk the page tables.
>
> Signed-off-by: Ard Biesheuvel <ardb at kernel.org>
> ---
>  arch/arm64/include/asm/fixmap.h | 3 +++
>  arch/arm64/mm/fixmap.c          | 8 +++++---
>  arch/arm64/mm/mmu.c             | 8 ++++++++
>  3 files changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/arch/arm64/include/asm/fixmap.h b/arch/arm64/include/asm/fixmap.h
> index 170c3502d723..9191125738e9 100644
> --- a/arch/arm64/include/asm/fixmap.h
> +++ b/arch/arm64/include/asm/fixmap.h
> @@ -112,6 +112,9 @@ enum fixed_addresses {
>  
>  void __init early_fixmap_init(void);
>  
> +extern pte_t fixmap_bm_pte[][PTRS_PER_PTE];

Instead of fixmap_bm_pte_size, why not use the same inner size as the
definition, and then simply use sizeof() where required (or make a macro
out of it)? Both the inner and outer sizes have to match the definition
so there's no risk of things going out of sync I think?

- Kevin

> +extern const size_t fixmap_bm_pte_size;
> [...]