1*ee65728eSMike Rapoport.. SPDX-License-Identifier: GPL-2.0 2*ee65728eSMike Rapoport 3*ee65728eSMike Rapoport:Original: Documentation/mm/page_table_check.rst 4*ee65728eSMike Rapoport 5*ee65728eSMike Rapoport:翻译: 6*ee65728eSMike Rapoport 7*ee65728eSMike Rapoport 司延腾 Yanteng Si <siyanteng@loongson.cn> 8*ee65728eSMike Rapoport 9*ee65728eSMike Rapoport:校译: 10*ee65728eSMike Rapoport 11*ee65728eSMike Rapoport 12*ee65728eSMike Rapoport======== 13*ee65728eSMike Rapoport页表检查 14*ee65728eSMike Rapoport======== 15*ee65728eSMike Rapoport 16*ee65728eSMike Rapoport概述 17*ee65728eSMike Rapoport==== 18*ee65728eSMike Rapoport 19*ee65728eSMike Rapoport页表检查允许通过确保防止某些类型的内存损坏来强化内核。 20*ee65728eSMike Rapoport 21*ee65728eSMike Rapoport当新的页面可以从用户空间访问时，页表检查通过将它们的页表项（PTEs PMD等）添加到页表中来执行额外 22*ee65728eSMike Rapoport的验证。 23*ee65728eSMike Rapoport 24*ee65728eSMike Rapoport在检测到损坏的情况下，内核会被崩溃。页表检查有一个小的性能和内存开销。因此，它在默认情况下是禁用 25*ee65728eSMike Rapoport的，但是在额外的加固超过性能成本的系统上，可以选择启用。另外，由于页表检查是同步的，它可以帮助调 26*ee65728eSMike Rapoport试双映射内存损坏问题，在错误的映射发生时崩溃内核，而不是在内存损坏错误发生后内核崩溃。 27*ee65728eSMike Rapoport 28*ee65728eSMike Rapoport双重映射检测逻辑 29*ee65728eSMike Rapoport================ 30*ee65728eSMike Rapoport 31*ee65728eSMike Rapoport+-------------------+-------------------+-------------------+------------------+ 32*ee65728eSMike Rapoport| Current Mapping | New mapping | Permissions | Rule | 33*ee65728eSMike Rapoport+===================+===================+===================+==================+ 34*ee65728eSMike Rapoport| Anonymous | Anonymous | Read | Allow | 35*ee65728eSMike Rapoport+-------------------+-------------------+-------------------+------------------+ 36*ee65728eSMike Rapoport| Anonymous | Anonymous | Read / Write | Prohibit | 37*ee65728eSMike Rapoport+-------------------+-------------------+-------------------+------------------+ 38*ee65728eSMike Rapoport| Anonymous | Named | Any | Prohibit | 39*ee65728eSMike Rapoport+-------------------+-------------------+-------------------+------------------+ 40*ee65728eSMike Rapoport| Named | Anonymous | Any | Prohibit | 41*ee65728eSMike Rapoport+-------------------+-------------------+-------------------+------------------+ 42*ee65728eSMike Rapoport| Named | Named | Any | Allow | 43*ee65728eSMike Rapoport+-------------------+-------------------+-------------------+------------------+ 44*ee65728eSMike Rapoport 45*ee65728eSMike Rapoport启用页表检查 46*ee65728eSMike Rapoport============ 47*ee65728eSMike Rapoport 48*ee65728eSMike Rapoport用以下方法构建内核: 49*ee65728eSMike Rapoport 50*ee65728eSMike Rapoport- PAGE_TABLE_CHECK=y 51*ee65728eSMike Rapoport 注意，它只能在ARCH_SUPPORTS_PAGE_TABLE_CHECK可用的平台上启用。 52*ee65728eSMike Rapoport 53*ee65728eSMike Rapoport- 使用 "page_table_check=on" 内核参数启动。 54*ee65728eSMike Rapoport 55*ee65728eSMike Rapoport可以选择用PAGE_TABLE_CHECK_ENFORCED来构建内核，以便在没有额外的内核参数的情况下获得页表 56*ee65728eSMike Rapoport支持。 57