PTI中的SMEP模拟技术解析

原创

qife122

发布于 2025-08-10 14:27:00

1360

PTI中的SMEP模拟

近期内核页表隔离补丁(CONFIG_PAGE_TABLE_ISOLATION)带来了一项额外优势：当内核模式运行时，可见的用户空间页表缺少可执行位。这使得不具备SMEP CPU特性的系统(Ivy-Bridge之前的处理器)能"免费"获得该特性的模拟实现。

非SMEP系统测试案例

关闭PTI的情况（使用"pti=off"启动参数）：

# grep smep /proc/cpuinfo
# dmesg -c | grep isolation
[    0.000000] Kernel/User page tables isolation: disabled on command line.
# cat <(echo EXEC_USERSPACE) > /sys/kernel/debug/provoke-crash/DIRECT
# dmesg
[   17.883754] lkdtm: Performing direct entry EXEC_USERSPACE
[   17.885149] lkdtm: attempting ok execution at ffffffff9f6293a0
[   17.886350] lkdtm: attempting bad execution at 00007f6a2f84d000

系统未崩溃！内核成功执行了用户空间内存。

开启PTI的情况：

# grep smep /proc/cpuinfo
# dmesg -c | grep isolation
[    0.000000] Kernel/User page tables isolation: enabled
# cat <(echo EXEC_USERSPACE) > /sys/kernel/debug/provoke-crash/DIRECT
Killed
# dmesg
[   33.657695] lkdtm: Performing direct entry EXEC_USERSPACE
[   33.658800] lkdtm: attempting ok execution at ffffffff926293a0
[   33.660110] lkdtm: attempting bad execution at 00007f7c64546000
[   33.661301] BUG: unable to handle kernel paging request at 00007f7c64546000
[   33.662554] IP: 0x7f7c64546000
...