Re: [kernel-hardening] [RFC, PATCH] x86_64: KAISER - do not map kernel in user mode
From: Daniel Gruss
Date: Fri May 05 2017 - 04:24:19 EST
On 04.05.2017 17:28, Thomas Garnier wrote:
Please read the documentation on submitting patches  and coding style .
I will have a closer look at that.
- How this approach prevent the hardware attacks you mentioned? You
still have to keep a part of _text in the pagetable and an attacker
could discover it no? (and deduce the kernel base address).
These parts are moved to a different section (.user_mapped) which is at
a possibly predictable location - the location of the randomized parts
of the kernel is independent of the location of .user_mapped.
The code/data footprint for .user_mapped is quite small, helping to
reduce or eliminate the attack surface...
You also need to make it clear that btb attacks are still possible.
By just increasing the KASLR randomization range, btb attacks can be
mitigated (for free).
- What is the perf impact?
It will vary for different machines. We have promising results (<1%) for
an i7-6700K with representative benchmarks. However, for older systems
or for workloads with a lot of pressure on some TLB levels, the
performance may be much worse.