MPK support

[Red-Panda64]

I read in your paper from Eurosys 21 that Unikraft has some MPK support. In the source I found that you enable protection keys when the feature is present and HAVE_x86PKU is configured. But when I went to try it out, it looked like the pkey syscalls were not implemented. Is there already a library for these syscalls or do I need to figure out how to modify the page table myself?

[hlef]

Interesting question @Red-Panda64, indeed we are working on MPK as part of FlexOS, recently published in HotOS (paper, presentation). The support is functional however we did not implement the Linux pkey interface. Our code is not public yet - we are working on a full paper and will release the source as part of the artifact evaluation. May I ask, what are you planning to do? If possible/helpful, we could merge some of our code into the main tree.

Thanks for cc-ing @nderjung.

[Red-Panda64]

Thanks a lot to both of you for getting back to me so quickly! I am writing a bachelor's thesis on memory corruption mitigations in state of the art unikernels. I am trying to isolate some management data from the user application. What I need for the experiment is the equivalent of pkey_mprotect, some way of setting the protection key for a user page (PKU). It would be very helpful if you could merge this functionality. If not, I would appreciate some hints on how to implement this myself.

[hlef]

Right, so the "kernel" part of your approach might be as simple as setting some bits in the page table. For that I recommend working on top of @StefanTeodorescu's page table support patches that will be pull requested in the next weeks. Note that you will also have to shield the page table itself and the scheduler (since both hold protection state and are not protected by a user-kernel separation). This gets much trickier. I don't think that we can merge our code to do this as our current approach is a bit different. In any case, good luck, and feel free to post your patches here we will consider them!

[Red-Panda64]

Thanks for the advice! I'll try to set the appropriate bits myself once I figure out how exactly virtual addresses correspond to page table entries

[razvand]

Everyone, since we are already (viciously) using the Unikraft Discord server for discussions, meetings, brainstorming and jokes (mostly bad, we do what we can), we will close the Discussions tab. We will do this on Friday, March 31, 2023.

Please move any discussions or questions on the Unikraft Discord server. See you all there! 🤝