[memory hardware isolation] Add session content #11

cristian-vijelie · 2023-03-23T09:48:59Z

No description provided.

StefanJum

This looks really nice @cristian-vijelie, see the few comments.
Also, will the hardware-isolation directory be used for something else? If not we should just remove it.

StefanJum · 2023-06-25T14:40:58Z

hardware-memory-isolation/README.md

+You have encountered (hopefully) the main protection mechanism that the hardware uses to ensure memory isolation: pages.
+There are other less-known mechanisms for ensuring memory isolation, through which we will go this session: segments, privilege rings, memory protection keys.


Suggested change

You have encountered (hopefully) the main protection mechanism that the hardware uses to ensure memory isolation: pages.

There are other less-known mechanisms for ensuring memory isolation, through which we will go this session: segments, privilege rings, memory protection keys.

You have encountered (hopefully) the main protection mechanism that the hardware uses to ensure memory isolation: [pages](...).

There are other less-known mechanisms for ensuring memory isolation, through which we will go this session: [segments](...), [privilege rings](...), [memory protection keys](...).

Leave links to some relevant pages about the topics.

hardware-memory-isolation/README.md

StefanJum · 2023-06-25T15:02:06Z

hardware-memory-isolation/activities/read-gdt/public/Makefile

+all:
+	make -C /home/cristi/WSL2-Linux-Kernel M=$(shell pwd) modules
+
+clean:
+	make -C /home/cristi/WSL2-Linux-Kernel M=$(shell pwd) clean


Suggested change

all:

make -C /home/cristi/WSL2-Linux-Kernel M=$(shell pwd) modules

clean:

make -C /home/cristi/WSL2-Linux-Kernel M=$(shell pwd) clean

all:

make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules

clean:

make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

Besides this, ask people somewhere in the session to install the kernel header files.

$ apt-cache search linux-headers-`uname -r` $ sudo apt install linux-headers.....

Also ask them to run this from inside a virtual machine.

StefanJum · 2023-06-25T15:06:23Z

hardware-memory-isolation/README.md

+
+##### Tutorial: Reading the GDT of the Linux Kernel
+
+Go to the [`read-gdt`](./activities/read-gdt/) folder.


See the comments on the Makefile.

teodutu

I like this session. There are places where it could use some improvements. See my comments.

hardware-memory-isolation/README.md

teodutu · 2023-06-26T03:56:16Z

hardware-memory-isolation/README.md

+We have the following scenario:
+an application wants to change an area of its memory from read-write to read-only, for reasons.
+To do this it will call `mprotect` on that area.
+What will happen behind the scenes will be that the OS will change permissions for each page that is part of the memory area, then it will flush the TLB.


The TLB appears out of nowhere here. Add the concept of MMU + TLB as a prerequisite altogether, together with paging in general.

hardware-memory-isolation/README.md

teodutu · 2023-06-26T04:28:08Z

hardware-memory-isolation/README.md

+This allows an application to allocate its pages to a `protection domain`.
+When accessing a page, instead of checking only the page permissions, the MMU will also check the protection domain permissions.
+
+Let's take a practical example:


This is too much text. Try to make a practical example out of this somehow (hopefully via a tutorial that modifies the PKRU). You can draw some inspiration from here.

mariasfiraiala

Thanks @cristian-vijelie, this looks nice. See my comments below.

hardware-memory-isolation/README.md

mariasfiraiala · 2023-06-27T16:32:15Z

hardware-memory-isolation/README.md

+
+#### Segmentation
+
+Segmentation is the x86 CPU feature that allows assigning permissions and ownership to a certain memory zone, using segments.


Add a bit more detail as to what segments represent. They can be easily confused with pages by novices.

hardware-memory-isolation/README.md

mariasfiraiala · 2023-06-27T16:48:03Z

hardware-memory-isolation/README.md

+But wait, don't we have the `Stack Canary` for the last one?
+The main problem with that solution is that the canary is placed on the same memory zone as the return address.
+If we can modify the return address, what is stopping someone from reading the canary first, then modifying the return address, while keeping the canary intact?
+The shadow stack places a copy of the return address in a separate memory zone, that can be accessed using only some special instructions.


You might want to show how this can be achieved hardware wise. There are already some compiler enforced mechanism similar to this, that were however, deemed not as efficient (ShadowCallStack, SafeStack).

mariasfiraiala · 2023-06-27T16:49:53Z

hardware-memory-isolation/README.md

+
+#### Indirect Branch Tracking
+
+The main idea behind some attacks is to chain small pieces of code (gadgets), in order to call a system function, usually, in a certain way.


usually, in a certain way

This is quite vague

I'd suggest referring to the ROP session of the Binary track for this since it's beyond the scope of the Hardware track.

cristian-vijelie changed the title ~~[hardware_computing] Add session content~~ [hardware isolation] Add session content Apr 15, 2023

cristian-vijelie force-pushed the hardware_isolation branch from f493623 to 6b74a35 Compare May 21, 2023 18:29

cristian-vijelie requested review from gabrielmocanu, StefanJum and mariasfiraiala May 22, 2023 06:51

cristian-vijelie force-pushed the hardware_isolation branch from 6b74a35 to fc35c4c Compare June 25, 2023 08:59

cristian-vijelie changed the title ~~[hardware isolation] Add session content~~ [memory hardware isolation] Add session content Jun 25, 2023

StefanJum suggested changes Jun 25, 2023

View reviewed changes

teodutu requested changes Jun 26, 2023

View reviewed changes

cristian-vijelie force-pushed the hardware_isolation branch from fc35c4c to 861c43e Compare June 27, 2023 14:19

mariasfiraiala suggested changes Jun 27, 2023

View reviewed changes

cristian-vijelie force-pushed the hardware_isolation branch from 861c43e to 5dbd543 Compare July 6, 2023 15:00

Add session content

1b5d683

cristian-vijelie force-pushed the hardware_isolation branch from 5dbd543 to 1b5d683 Compare July 8, 2023 12:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[memory hardware isolation] Add session content #11

[memory hardware isolation] Add session content #11

cristian-vijelie commented Mar 23, 2023

StefanJum left a comment •

edited

Loading

StefanJum Jun 25, 2023

StefanJum Jun 25, 2023

StefanJum Jun 25, 2023

StefanJum Jun 25, 2023

teodutu left a comment

teodutu Jun 26, 2023

teodutu Jun 26, 2023

mariasfiraiala left a comment

mariasfiraiala Jun 27, 2023

mariasfiraiala Jun 27, 2023

mariasfiraiala Jun 27, 2023

teodutu Jun 28, 2023 •

edited

Loading

		You have encountered (hopefully) the main protection mechanism that the hardware uses to ensure memory isolation: pages.
		There are other less-known mechanisms for ensuring memory isolation, through which we will go this session: segments, privilege rings, memory protection keys.


		##### Tutorial: Reading the GDT of the Linux Kernel

		Go to the [`read-gdt`](./activities/read-gdt/) folder.


		#### Segmentation

		Segmentation is the x86 CPU feature that allows assigning permissions and ownership to a certain memory zone, using segments.


		#### Indirect Branch Tracking

		The main idea behind some attacks is to chain small pieces of code (gadgets), in order to call a system function, usually, in a certain way.

[memory hardware isolation] Add session content #11

Are you sure you want to change the base?

[memory hardware isolation] Add session content #11

Conversation

cristian-vijelie commented Mar 23, 2023

StefanJum left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

teodutu left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mariasfiraiala left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

teodutu Jun 28, 2023 • edited Loading

Choose a reason for hiding this comment

StefanJum left a comment •

edited

Loading

teodutu Jun 28, 2023 •

edited

Loading