MPK/PKS Linux Kernel Compartmentalization
summary
Prototype uses Intel PKS to flip protection via two MSR writes on entry/exit, turning most kernel pages inaccessible and leaving a minimal eBPF isolation set (stack, maps, helpers). Hardware uses 4 PTE bits (max 16 keys) and 32-bit MSR controls; switching is cheap and a tracer benchmark shows ~1% overhead. Also implements a drop-in ASI replacement (no CR3 switch). Limitations: cannot revoke execute permission, limited key count, some helpers require temporary disable.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:04Why compartmentalize?
- 2:35Transient execution attacks Spectre & friends
- 9:00Memory Protection Keys: PKU/PKS
- 10:27PKS in-depth
- 20:38Challenges
- 23:30PKS eBPF isolation
- 28:21eBPF mitigations
- 38:15ASI: Address Space Isolation
- 42:06Conclusion
related talks
19mEPK: Scalable and Efficient Memory Protection Keys
30mKernel Hardening With Protection Keys
20mlibmpk: Software Abstraction for Intel Memory Protection Keys (Intel MPK)
20mLimitations and Opportunities of Modern Hardware Isolation Mechanisms
16mUsing PMP, ePMP and Rust to Protect Embedded Kernels, Even from Themselves
33mKernel Runtime Security Instrumentation
43mAddress Space Isolation for Enhanced Safety of the Linux Kernel
38mTaking Kernel Hardening to the Next Level