pkru: Fix handling of 1GB largepage mappings

pmap_pkru_update_range() did not handle the case where a PDPE has PG_PS
set. More generally, the SET_PKRU and CLEAR_PKRU sysarch
implementations did not

pkru: Fix handling of 1GB largepage mappings

pmap_pkru_update_range() did not handle the case where a PDPE has PG_PS
set. More generally, the SET_PKRU and CLEAR_PKRU sysarch
implementations did not check whether the request covers a "boundary" vm
map entry. Fix this, add the missing PG_PS test, and add some tests.

Approved by: so
Security: FreeBSD-SA-26:11.amd64
Security: CVE-2026-6386
Reported by: Nicholas Carlini <npc@anthropic.com>
Reviewed by: kib, alc
Differential Revision: https://reviews.freebsd.org/D56184

show more ...

pkru.3: Note that the kernel may not respect PKRU protections

There are cases where the kernel will be able to access memory covered
by a PKRU key which nomially prohibits accesses. I believe regul

pkru.3: Note that the kernel may not respect PKRU protections

There are cases where the kernel will be able to access memory covered
by a PKRU key which nomially prohibits accesses. I believe regular
copyin()/copyout() are subject to the contents of PKRU, but memory
accesses via uiomove_fromphys() will not be. This can arise when
performing fault I/O, for instance. I didn't test, but I suspect AIO is
another case.

Update the man page to acknowledge this.

Reviewed by: alc, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D56416

show more ...

pkru.3: Remove a qualifier

Now that i386 kernels are deprecated, we don't really need to mention
this limitation. It's also a bit dated since PKRU is supported with
5-level paging as well.

Reviewe

pkru.3: Remove a qualifier

Now that i386 kernels are deprecated, we don't really need to mention
this limitation. It's also a bit dated since PKRU is supported with
5-level paging as well.

Reviewed by: alc, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D56415

show more ...