Module kpti 

Kernel Page Table Isolation (KPTI) for x86_64

Mitigates Meltdown (CVE-2017-5754) by maintaining separate page table hierarchies for user mode and kernel mode. When running in user mode, the shadow page table contains only the minimal kernel mappings needed for the syscall/interrupt trampoline. On kernel entry, CR3 is switched to the full kernel page table.

Design

• Kernel page table: The full L4 table with both user (L4[0..255]) and kernel (L4[256..511]) entries.
• Shadow page table: A separate L4 with user entries copied from the kernel table, but only a single trampoline mapping in the kernel half (L4[511]) that maps the syscall entry/exit code.
• CR3 switching: switch_to_user() loads the shadow CR3 before returning to Ring 3; switch_to_kernel() restores the full CR3 on entry to Ring 0.

Structs

KptiPageTables

Per-process KPTI page table pair.

Functions

create_shadow_tables

Create shadow page tables from the kernel’s L4 table.

get_page_tables

Get the current KPTI page table pair (for diagnostics).

init

Initialize KPTI with shadow page tables derived from the current CR3.

is_active

Check whether KPTI is initialized and active.

on_syscall_entry

Called at the start of every syscall handler.

on_syscall_exit

Called at the end of every syscall handler, just before SYSRET.

switch_to_kernel

Switch to the full kernel page table.

switch_to_user

Switch to the shadow (user-mode) page table.

validate_shadow_tables

Validate shadow table integrity.