原创 宋宝华 Linux阅码场 2018-03-23

看完这篇文章，可以知道AARCH64平台修复meltdown漏洞的KPTI补丁的基本原理。此文很难很分裂，需要具备大量背景知识，慎重阅读。

看不懂也没有关系，记住最后三张页表的结论即可。

+config UNMAP_KERNEL_AT_EL0

+bool "Unmap kernel when running in userspace (aka \"KAISER\")"

+default y

+help

+ Some attacks against KASLR make use of the timing difference between

+ a permission fault which could arise from a page table entry that is

+ present in the TLB, and a translation fault which always requires a

+ page table walk. This option defends against these attacks by unmapping

+ the kernel whilst running in userspace, therefore forcing translation

+ faults for all of kernel space.

+

+ If unsure, say Y.

+

第二个patch是"arm64: mm: Map entry trampoline into trampoline and kernel page tables"，地址：

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=51a0048beb449682d632d0af52a515adb9f9882e

此处建立了一个只包含EL0陷入EL1和退出的必要的代码的页被映射的页表(trampoline page table),

+#ifdef CONFIG_UNMAP_KERNEL_AT_EL0

+static int _ _init map_entry_trampoline(void)

+{

+extern char _ _entry_tramp_text_start[];

+

+pgprot_t prot = rodata_enabled ? PAGE_KERNEL_ROX : PAGE_KERNEL_EXEC;

+phys_addr_t pa_start = _ _pa_symbol(__entry_tramp_text_start);

+

+/* The trampoline is always mapped and can therefore be global */

+pgprot_val(prot) &= ~PTE_NG;

+

+/* Map only the text into the trampoline page table */

+memset(tramp_pg_dir, 0, PGD_SIZE);

+__create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, PAGE_SIZE,

+ prot, pgd_pgtable_alloc, 0);

+

+/* ...as well as the kernel page table */

+__set_fixmap(FIX_ENTRY_TRAMP_TEXT, pa_start, prot);

+return 0;

+}

+core_initcall(map_entry_trampoline);

+#endif

+.macro tramp_map_kernel, tmp

+mrs\tmp, ttbr1_el1

+sub\tmp, \tmp, #(SWAPPER_DIR_SIZE + RESERVED_TTBR0_SIZE)

+bic\tmp, \tmp, #USER_ASID_FLAG

+msrttbr1_el1, \tmp

+.endm

+

+.macro tramp_unmap_kernel, tmp

+mrs\tmp, ttbr1_el1

+add\tmp, \tmp, #(SWAPPER_DIR_SIZE + RESERVED_TTBR0_SIZE)

+orr\tmp, \tmp, #USER_ASID_FLAG

+msrttbr1_el1, \tmp

tramp_map_kernel可以让EL0陷入EL1的时候，载入FULL的kernel page table，而 tramp_unmap_kernel可以帮助kernel从EL1退回到EL0的时候，TTBR1里面切换到一个只包含最基本EL0到EL1入口和出口代码的向量表等信息映射的页表(trampoline page table)，这样kernel不至于暴露给user。

由此，我们发现AARCH64对meltdown的修复看起来比X86还要复杂，X86好歹只有2个页表，见维基百科：https://en.wikipedia.org/wiki/Kernel_page-table_isolation ：

但是ARM64 Linux的需要3个页表:

kernel完整的页表 TTBR1

kernel的只包含trampoline的trampoline页表(这部分完全是为了让EL0陷入和退出EL1用的，并且帮助完成trampoline页表和kernel完整页表的切换)

user的页表 TTBR0