Kernel Hardening for 32-bit Arm Processors
summary
Describes removing thread_info moved into task_struct on 32‑bit ARM so per‑thread metadata leaves the kernel stack, using the user/global fallbacks plus tpidr_u0 register used on newer cores and a boot‑time rewrite for uniprocessor parts; development runs under QEMU with validation on Raspberry Pi hardware; the initial patches landed in Linux 5.16 for v6k/v7 chips, further guard‑page and vmap stack work targets 5.18 and is still in progress.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 2:02Kernel Self Protection Project
- 3:36Why are we still running 32bits
- 5:39Arm 32 is left out
- 6:40What are the bugs
- 9:07Why did I get started
- 11:02Bug 1 Thread Info
- 13:46What does this mean
- 14:45Why is the kernel struct
- 17:04Smashing the thread info and task struct
- 17:31The problem with the stack pointer
- 18:17The problem with perCPU variables
- 20:33Introducing Art
- 21:32Second Attempt
- 23:05Performance Problems
- 25:05Fixing Bug 1
- 26:03Fixing Bug 2
- 36:48Current Status
- 38:10Questions
related talks
38mKernel Hardening: Protecting the Protection Mechanisms
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
30mKernel Hardening With Protection Keys
26mArm64 Linux Kernel Architecture update
50mProtected KVM on Arm64: A Technical Deep Dive
41mUsing Microarchitectural Design to Break KASLR and More
52mKernel Hardening: Ten Years Deep
43mAddress Space Isolation for Enhanced Safety of the Linux Kernel