Fast Intra-kernel Isolation and Security with IskiOS

TL;DR

IskiOS introduces a novel method leveraging Intel's PKU to enable efficient intra-kernel isolation and security features like execute-only memory and shadow stacks on existing hardware, improving kernel protection with minimal overhead.

Contribution

The paper presents PKK, a new approach that adapts PKU for kernel use, enabling fast intra-kernel isolation and security features in Linux systems.

Findings

PKK incurs about 11% overhead in kernel microbenchmarks.

XOM adds no additional overhead.

Shadow stacks increase total overhead to 22%.

Abstract

The kernels of operating systems such as Windows, Linux, and MacOS are vulnerable to control-flow hijacking. Defenses exist, but many require efficient intra-address-space isolation. Execute-only memory, for example, requires read protection on code segments, and shadow stacks require protection from buffer overwrites. Intel's Protection Keys for Userspace (PKU) could, in principle, provide the intra-kernel isolation needed by such defenses, but, when used as designed, it applies only to user-mode application code. This paper presents an unconventional approach to memory protection, allowing PKU to be used within the operating system kernel on existing Intel hardware, replacing the traditional user/supervisor isolation mechanism and, simultaneously, enabling efficient intra-kernel isolation. We call the resulting mechanism Protection Keys for Kernelspace (PKK). To demonstrate its utility and efficiency, we present a system we call IskiOS: a Linux variant featuring execute-only memory (XOM) and the first-ever race-free shadow stacks for x86-64. Experiments with the LMBench kernel microbenchmarks display a geometric mean overhead of about 11% for PKK and no additional overhead for XOM. IskiOS's shadow stacks bring the total to 22%. For full applications, experiments with the system benchmarks of the Phoronix test suite display negligible overhead for PKK and XOM, and less than 5% geometric mean overhead for shadow stacks.

Figures

Tables

Table 1. Table 1 . IskiOS run-time overhead ( % percent \% over vanilla Linux) on applications from the Phoronix Test Suite. The final row reports average change in the reported metric (geometric mean).

Benchmark	vanilla		pkk		pkk+xom		pkk+ss-swo-inline		pkk+xom+ss-swo-inline
			Mean $\pm$ RSD	Overhead	Mean $\pm$ RSD	Overhead	Mean $\pm$ RSD	Overhead	Mean $\pm$ RSD	Overhead
Apache	$24626\pm 2.20\%$	$\mathrm{𝑟𝑒𝑞}/s$	$20531\pm 1.30\%$	$16.63\%$	$21294\pm 1.81\%$	$13.53\%$	$16048\pm 0.95\%$	$34.83\%$	$15141\pm 2.40\%$	$38.51\%$
Build Apache	$33.24\pm 1.39\%$	$\mathrm{𝑠𝑒𝑐}$	$33.38\pm 0.42\%$	$0.43\%$	$33.58\pm 0.22\%$	$1.04\%$	$33.82\pm 0.56\%$	$1.75\%$	$34.08\pm 0.45\%$	$2.54\%$
Build PHP	$71.00\pm 0.47\%$	$\mathrm{𝑠𝑒𝑐}$	$71.95\pm 1.68\%$	$1.34\%$	$71.83\pm 0.56\%$	$1.17\%$	$72.34\pm 0.27\%$	$1.90\%$	$72.41\pm 0.47\%$	$1.99\%$
C-Ray	$148.30\pm 46.61\%$	$\mathrm{𝑠𝑒𝑐}$	$117.72\pm 28.45\%$	$-20.62\%$	$114.85\pm 43.71\%$	$-22.56\%$	$155.53\pm 22.89\%$	$4.88\%$	$181.50\pm 27.93\%$	$22.39\%$
CompileBench	$296.84\pm 6.59\%$	$\mathrm{𝑀𝐵}/s$	$247.43\pm 3.26\%$	$16.65\%$	$258.08\pm 1.23\%$	$13.06\%$	$219.27\pm 4.19\%$	$26.13\%$	$215.28\pm 3.43\%$	$27.48\%$
Crafty	$5038443\pm 0.25\%$	$\mathrm{𝑛𝑜𝑑𝑒𝑠}/s$	$5016383\pm 0.17\%$	$0.44\%$	$5031947\pm 0.06\%$	$0.13\%$	$5042075\pm 0.04\%$	$-0.07\%$	$5035883\pm 0.09\%$	$0.05\%$
Cryptsetup-sha512	$1016062\pm 0.00\%$	$\mathrm{𝑖𝑡𝑒𝑟}/s$	$1010211\pm 0.58\%$	$0.58\%$	$1014096\pm 0.00\%$	$0.19\%$	$1012801\pm 0.40\%$	$0.32\%$	$1008968\pm 1.05\%$	$0.70\%$
Cryptsetup-whirlpool	$426949\pm 0.43\%$	$\mathrm{𝑖𝑡𝑒𝑟}/s$	$424871\pm 0.32\%$	$0.49\%$	$425561\pm 0.32\%$	$0.33\%$	$426020\pm 0.19\%$	$0.22\%$	$426944\pm 0.00\%$	$0.00\%$
Ebizzy	$524560\pm 3.49\%$	$\mathrm{𝑟𝑒𝑐𝑜𝑟𝑑𝑠}/s$	$515582\pm 0.61\%$	$1.71\%$	$531721\pm 4.19\%$	$-1.37\%$	$537828\pm 4.07\%$	$-2.53\%$	$514557\pm 2.08\%$	$1.91\%$
Encode FLAC	$18.69\pm 3.30\%$	$\mathrm{𝑠𝑒𝑐}$	$18.42\pm 1.08\%$	$-1.44\%$	$18.93\pm 2.27\%$	$1.28\%$	$19.24\pm 3.01\%$	$2.98\%$	$18.64\pm 2.44\%$	$-0.23\%$
Encode MP3	$16.95\pm 0.23\%$	$\mathrm{𝑠𝑒𝑐}$	$16.95\pm 0.27\%$	$0.02\%$	$16.96\pm 0.28\%$	$0.07\%$	$16.95\pm 0.21\%$	$0.02\%$	$16.95\pm 0.31\%$	$0.05\%$
FS-Mark	$24.7\pm 0.84\%$	$\mathrm{𝑓𝑖𝑙𝑒𝑠}/s$	$24.7\pm 3.28\%$	$0.00\%$	$24.8\pm 0.23\%$	$-0.40\%$	$24.3\pm 0.68\%$	$1.62\%$	$22.5\pm 0.26\%$	$8.91\%$
Fhourstones	$8816.50\pm 0.02\%$	$\mathrm{𝐾𝑝𝑜𝑠}/s$	$8812.30\pm 0.28\%$	$0.05\%$	$8797.00\pm 0.33\%$	$0.22\%$	$8834.60\pm 0.04\%$	$-0.21\%$	$8807.50\pm 0.08\%$	$0.10\%$
Git	$88.74\pm 0.35\%$	$\mathrm{𝑠𝑒𝑐}$	$88.87\pm 0.27\%$	$0.15\%$	$89.03\pm 0.20\%$	$0.33\%$	$89.37\pm 0.44\%$	$0.72\%$	$89.94\pm 0.63\%$	$1.35\%$
HMMer	$189.69\pm 0.19\%$	$\mathrm{𝑠𝑒𝑐}$	$190.35\pm 0.04\%$	$0.35\%$	$190.41\pm 0.13\%$	$0.38\%$	$193.30\pm 0.14\%$	$1.90\%$	$193.43\pm 0.15\%$	$1.97\%$
Himeno	$2113.80\pm 0.08\%$	$\mathrm{𝑀𝑓𝑙𝑜𝑝𝑠}$	$2099.09\pm 0.60\%$	$0.70\%$	$2112.68\pm 0.16\%$	$0.05\%$	$2112.08\pm 0.06\%$	$0.08\%$	$2112.72\pm 0.22\%$	$0.05\%$
LuaJIT	$912.22\pm 0.50\%$	$\mathrm{𝑀𝑓𝑙𝑜𝑝𝑠}$	$912.02\pm 0.34\%$	$0.02\%$	$904.81\pm 0.11\%$	$0.81\%$	$915.87\pm 0.32\%$	$-0.40\%$	$915.56\pm 0.10\%$	$-0.37\%$
NGINX	$26850\pm 1.96\%$	$\mathrm{𝑟𝑒𝑞}/s$	$22981\pm 0.52\%$	$14.41\%$	$22646\pm 1.53\%$	$15.66\%$	$17901\pm 5.89\%$	$33.33\%$	$16878\pm 0.20\%$	$37.14\%$
OpenSSL	$3788\pm 0.23\%$	$\mathrm{𝑠𝑖𝑔𝑛𝑠}/s$	$3693\pm 0.45\%$	$2.42\%$	$3792\pm 0.19\%$	$-0.11\%$	$3792\pm 0.13\%$	$-0.13\%$	$3791\pm 0.27\%$	$-0.08\%$
PGBench	$681\pm 6.64\%$	$\mathrm{𝑡𝑟𝑎𝑛𝑠}/s$	$695\pm 6.90\%$	$-2.06\%$	$679\pm 8.76\%$	$0.29\%$	$649\pm 1.68\%$	$4.70\%$	$634\pm 6.59\%$	$6.90\%$
PHPBench	$405719\pm 0.13\%$	$\mathrm{𝑠𝑐𝑜𝑟𝑒}$	$405729\pm 0.10\%$	$0.01\%$	$405094\pm 0.25\%$	$0.15\%$	$406372\pm 0.15\%$	$-0.16\%$	$405861\pm 0.10\%$	$-0.03\%$
Parallel BZIP2	$4.36\pm 16.34\%$	$\mathrm{𝑠𝑒𝑐}$	$4.36\pm 16.35\%$	$0.00\%$	$4.37\pm 16.66\%$	$0.18\%$	$4.24\pm 18.27\%$	$-2.75\%$	$4.30\pm 17.66\%$	$-1.38\%$
PolyBench-C	$5.03\pm 4.12\%$	$\mathrm{𝑠𝑒𝑐}$	$4.91\pm 4.50\%$	$-2.25\%$	$4.91\pm 4.88\%$	$-2.29\%$	$4.82\pm 2.46\%$	$-4.16\%$	$4.83\pm 2.18\%$	$-3.90\%$
PostMark	$4548\pm 3.10\%$	$\mathrm{𝑡𝑟𝑎𝑛𝑠}/s$	$4121\pm 0.95\%$	$9.39\%$	$4237\pm 0.00\%$	$6.84\%$	$3607\pm 2.18\%$	$20.69\%$	$3641\pm 0.84\%$	$19.94\%$
Primesieve	$15.79\pm 0.87\%$	$\mathrm{𝑠𝑒𝑐}$	$16.03\pm 0.65\%$	$1.53\%$	$15.86\pm 0.20\%$	$0.46\%$	$15.80\pm 0.44\%$	$0.08\%$	$15.76\pm 0.26\%$	$-0.16\%$
SVT-AV1	$2.95\pm 1.87\%$	$\mathrm{𝑓𝑟𝑎𝑚𝑒𝑠}/s$	$2.96\pm 0.87\%$	$-0.24\%$	$2.92\pm 1.42\%$	$1.22\%$	$2.95\pm 1.53\%$	$-0.10\%$	$2.99\pm 1.99\%$	$-1.22\%$
SVT-HEVC	$57.45\pm 10.37\%$	$\mathrm{𝑓𝑟𝑎𝑚𝑒𝑠}/s$	$57.05\pm 10.66\%$	$0.70\%$	$57.04\pm 10.47\%$	$0.71\%$	$56.65\pm 10.30\%$	$1.39\%$	$56.70\pm 10.23\%$	$1.31\%$
Stockfish	$27.87M\pm 3.24\%$	$\mathrm{𝑛𝑜𝑑𝑒𝑠}/s$	$28.17M\pm 1.26\%$	$-1.08\%$	$27.11M\pm 2.43\%$	$2.74\%$	$27.59M\pm 2.64\%$	$1.01\%$	$28.12M\pm 3.03\%$	$-0.91\%$
Systemd Kernel	$2975\pm 0.00\%$	$\mathrm{𝑚𝑠𝑒𝑐}$	$2985\pm 0.00\%$	$0.34\%$	$3065\pm 0.00\%$	$3.03\%$	$3252\pm 0.00\%$	$9.31\%$	$3220\pm 0.00\%$	$8.24\%$
TTSIOD 3D Renderer	$319.34\pm 1.60\%$	$\mathrm{𝑓𝑟𝑎𝑚𝑒𝑠}/s$	$383.37\pm 7.65\%$	$-20.05\%$	$377.98\pm 10.90\%$	$-18.36\%$	$361.43\pm 8.35\%$	$-13.18\%$	$352.00\pm 9.29\%$	$-10.23\%$
Geometric Mean Overhead				0.39%		0.36%		3.67%		4.87%

Table 2. Table 2 . Macrobenchmarks with highest overhead for PKK ; top four system calls for each, with percent of CPU time spent running in the kernel.

Benchmark	Syscall	%CPU	Syscall	%CPU	Syscall	%CPU	Syscall	%CPU
CompileBench	write()	$60.57\%$	openat()	$15.49\%$	fstat	$10.77\%$	close()	$5.86\%$
Apache - server	futex()	$91.00\%$	read()	0$4.11\%$	epoll_wait()	0$1.87\%$	accept4()	0$0.45\%$
Apache - client	epoll_ctl()	$23.29\%$	connect()	$18.58\%$	write()	$15.05\%$	read()	$13.16\%$
NGINX - server	close()	$14.61\%$	recvfrom()	$12.91\%$	writev()	$11.79\%$	sendfile()	$10.75\%$
NGINX - client	epoll_ctl()	$29.65\%$	connect()	$18.95\%$	write()	$13.47\%$	read()	$10.70\%$
PostMark	write()	$52.27\%$	read()	$36.67\%$	unlink()	0$6.05\%$	openat()	0$2.34\%$

Table 3. Table 3 . IskiOS Code Size Overheads

Kernel	Code Size	Overhead
vanilla	$28.01\mathrm{𝑀𝐵}$	$-$
pkk	$30.2\mathrm{𝑀𝐵}$	$7.82\%$
pkk+xom	$30.2\mathrm{𝑀𝐵}$	$7.82\%$
pkk+ss	$71.5\mathrm{𝑀𝐵}$	$155.27\%$
pkk+ss-swo	$73.75\mathrm{𝑀𝐵}$	$163.30\%$
pkk+ss-swo-inline	$135.7\mathrm{𝑀𝐵}$	$384.47\%$
pkk+xom+ss	$71.5\mathrm{𝑀𝐵}$	$155.27\%$
pkk+xom+ss-swo	$73.75\mathrm{𝑀𝐵}$	$163.30\%$
pkk+xom+ss-swo-inline	$135.7\mathrm{𝑀𝐵}$	$384.47\%$

Table 4. Table 4 . IskiOS run-time overhead ( % percent \% over vanilla Linux) on latency microbenchmarks of the LMBench suite.

Benchmark	vanilla		pkk		pkk+xom		pkk+ss-swo-inline		pkk+xom+ss-swo-inline
			Mean $\pm$ SD	Overhead	Mean $\pm$ SD	Overhead	Mean $\pm$ SD	Overhead	Mean $\pm$ SD	Overhead
syscall()	$0.24\pm 0.00$	$\mu s$	$0.29\pm 0.00$	$20.88\%$	$0.29\pm 0.00$	$24.05\%$	$0.29\pm 0.01$	$22.98\%$	$0.29\pm 0.00$	$21.92\%$
open()/close()	$1.30\pm 0.00$	$\mu s$	$1.48\pm 0.00$	$14.12\%$	$1.48\pm 0.01$	$14.40\%$	$1.85\pm 0.01$	$42.61\%$	$1.84\pm 0.01$	$41.67\%$
read()	$0.29\pm 0.00$	$\mu s$	$0.35\pm 0.00$	$20.80\%$	$0.35\pm 0.00$	$19.80\%$	$0.39\pm 0.00$	$31.99\%$	$0.39\pm 0.00$	$31.87\%$
write()	$0.27\pm 0.00$	$\mu s$	$0.33\pm 0.00$	$24.66\%$	$0.32\pm 0.00$	$19.84\%$	$0.32\pm 0.01$	$18.21\%$	$0.31\pm 0.00$	$17.98\%$
select(10 fds)	$0.39\pm 0.00$	$\mu s$	$0.46\pm 0.00$	$17.26\%$	$0.47\pm 0.00$	$20.15\%$	$0.47\pm 0.00$	$18.60\%$	$0.45\pm 0.00$	$15.42\%$
select(100 TCP fds)	$3.34\pm 0.04$	$\mu s$	$3.65\pm 0.04$	$9.12\%$	$3.72\pm 0.15$	$11.21\%$	$3.77\pm 0.21$	$12.64\%$	$3.60\pm 0.15$	$7.65\%$
select(200 fds)	$3.07\pm 0.11$	$\mu s$	$3.16\pm 0.00$	$2.97\%$	$3.17\pm 0.00$	$3.36\%$	$3.26\pm 0.03$	$6.24\%$	$3.23\pm 0.01$	$5.45\%$
stat()	$0.65\pm 0.01$	$\mu s$	$0.78\pm 0.00$	$20.11\%$	$0.76\pm 0.00$	$18.01\%$	$0.83\pm 0.01$	$28.52\%$	$0.90\pm 0.00$	$39.75\%$
fstat()	$0.29\pm 0.00$	$\mu s$	$0.36\pm 0.00$	$23.83\%$	$0.36\pm 0.00$	$23.41\%$	$0.39\pm 0.00$	$35.96\%$	$0.45\pm 0.00$	$54.81\%$
fcntl()	$1.93\pm 0.03$	$\mu s$	$2.00\pm 0.03$	$4.01\%$	$2.05\pm 0.03$	$6.37\%$	$2.24\pm 0.02$	$16.57\%$	$2.24\pm 0.02$	$16.27\%$
mmap()/munmap()	$71.90\pm 0.88$	$\mu s$	$76.60\pm 1.17$	$6.54\%$	$76.20\pm 0.63$	$5.98\%$	$88.00\pm 1.76$	$22.39\%$	$86.90\pm 1.52$	$20.86\%$
fork()+exit()	$328.10\pm 12.70$	$\mu s$	$352.94\pm 5.62$	$7.57\%$	$355.22\pm 5.67$	$8.27\%$	$418.47\pm 7.28$	$27.54\%$	$406.75\pm 8.94$	$23.97\%$
fork()+execve()	$335.15\pm 4.63$	$\mu s$	$369.95\pm 5.40$	$10.38\%$	$363.33\pm 5.73$	$8.41\%$	$430.35\pm 7.39$	$28.41\%$	$420.13\pm 7.18$	$25.36\%$
fork()+/bin/sh	$2744.75\pm 8.81$	$\mu s$	$2953.10\pm 3.04$	$7.59\%$	$2967.65\pm 8.68$	$8.12\%$	$3356.80\pm 8.86$	$22.30\%$	$3308.80\pm 13.49$	$20.55\%$
sigaction()	$0.28\pm 0.00$	$\mu s$	$0.34\pm 0.00$	$21.35\%$	$0.36\pm 0.00$	$27.11\%$	$0.36\pm 0.00$	$26.90\%$	$0.36\pm 0.00$	$26.94\%$
Signal Delivery	$1.05\pm 0.00$	$\mu s$	$1.13\pm 0.01$	$7.30\%$	$1.15\pm 0.00$	$8.81\%$	$1.41\pm 0.01$	$34.13\%$	$1.41\pm 0.00$	$33.68\%$
Protection Fault	$0.71\pm 0.00$	$\mu s$	$0.76\pm 0.01$	$6.48\%$	$0.77\pm 0.01$	$8.59\%$	$0.60\pm 0.00$	$-15.75\%$	$0.61\pm 0.01$	$-14.10\%$
Page Fault	$0.22\pm 0.00$	$\mu s$	$0.24\pm 0.00$	$6.01\%$	$0.23\pm 0.00$	$5.28\%$	$0.24\pm 0.01$	$8.14\%$	$0.24\pm 0.00$	$6.82\%$
Pipe I/O	$6.76\pm 0.10$	$\mu s$	$6.96\pm 0.06$	$2.92\%$	$6.96\pm 0.09$	$2.99\%$	$7.48\pm 0.11$	$10.64\%$	$7.44\pm 0.06$	$10.11\%$
Unix Socket I/O	$6.56\pm 0.01$	$\mu s$	$7.42\pm 0.04$	$13.14\%$	$7.31\pm 0.04$	$11.58\%$	$8.24\pm 0.05$	$25.75\%$	$8.15\pm 0.05$	$24.35\%$
TCP Socket I/O	$13.08\pm 0.18$	$\mu s$	$14.02\pm 0.12$	$7.16\%$	$14.07\pm 0.05$	$7.55\%$	$16.87\pm 0.07$	$28.94\%$	$16.93\pm 0.14$	$29.42\%$
UDP Socket I/O	$10.39\pm 0.08$	$\mu s$	$11.25\pm 0.11$	$8.29\%$	$11.52\pm 0.12$	$10.91\%$	$14.16\pm 0.07$	$36.30\%$	$14.48\pm 0.43$	$39.40\%$
Context switch	$2.58\pm 0.06$	$\mu s$	$2.58\pm 0.04$	$0.04\%$	$2.57\pm 0.05$	$-0.35\%$	$2.82\pm 0.06$	$9.18\%$	$2.86\pm 0.03$	$10.77\%$
Geometric Mean Overhead				$11.18\%$		$11.67\%$		$21.01\%$		$22.33\%$

Table 5. Table 5 . IskiOS run-time overhead ( % percent \% over vanilla Linux) on bandwidth microbenchmarks of the LMBench suite.

Benchmark	vanilla		pkk		pkk+xom		pkk+ss-swo-inline		pkk+xom+ss-swo-inline
			Mean $\pm$ SD	Overhead	Mean $\pm$ SD	Overhead	Mean $\pm$ SD	Overhead	Mean $\pm$ SD	Overhead
Pipe I/O	$2879.34\pm 89.88$	$MB/s$	$2760.65\pm 64.33$	$4.12\%$	$2819.08\pm 73.25$	$2.09\%$	$2892.75\pm 55.22$	$-0.47\%$	$2800.93\pm 73.45$	$2.72\%$
Unix Socket I/O	$5903.98\pm 109.51$	$MB/s$	$6145.74\pm 346.57$	$-4.09\%$	$6323.30\pm 269.05$	$-7.10\%$	$6518.00\pm 460.98$	$-10.40\%$	$6901.41\pm 61.81$	$-16.89\%$
TCP Socket I/O	$5033.57\pm 28.51$	$MB/s$	$4889.97\pm 44.86$	$2.85\%$	$4874.17\pm 58.14$	$3.17\%$	$4379.98\pm 29.15$	$12.98\%$	$4354.83\pm 56.52$	$13.48\%$
File I/O	$8155.58\pm 32.22$	$MB/s$	$8704.69\pm 411.54$	$-6.73\%$	$8287.26\pm 529.07$	$-1.61\%$	$8247.62\pm 30.08$	$-1.13\%$	$9240.31\pm 473.58$	$-13.30\%$
MMapped File I/O	$18769.69\pm 115.36$	$MB/s$	$19761.46\pm 270.87$	$-5.28\%$	$18532.37\pm 86.70$	$1.26\%$	$18739.26\pm 930.41$	$0.16\%$	$20225.81\pm 38.04$	$-7.76\%$
Geometric Mean Overhead				$-1.93\%$		$-0.51\%$		$-0.05\%$		$-4.98\%$

Full text

This paper presents an unconventional approach to memory protection, allowing PKU to be used within the operating system kernel on existing Intel hardware, replacing the traditional user/supervisor isolation mechanism and, simultaneously, enabling efficient intra-kernel isolation. We call the resulting mechanism Protection Keys for Kernelspace (PKK). To demonstrate its utility and efficiency, we present a system we call IskiOS: a Linux variant featuring execute-only memory (XOM) and the first-ever race-free shadow stacks for x86-64.

Experiments with the LMBench kernel microbenchmarks display a geometric mean overhead of about 11% for PKK and no additional overhead for XOM. IskiOS’s shadow stacks bring the total to 22%. For full applications, experiments with the system benchmarks of the Phoronix test suite display negligible overhead for PKK and XOM, and less than 5% geometric mean overhead for shadow stacks.

security, operating systems, protection keys, intra-kernel isolation

††journalyear: 2021††copyright: rightsretained††conference: 24th International Symposium on Research in Attacks, Intrusions and Defenses; October 6–8, 2021; San Sebastian, Spain††booktitle: 24th International Symposium on Research in Attacks, Intrusions and Defenses (RAID ’21), October 6–8, 2021, San Sebastian, Spain††doi: 10.1145/3471621.3471849††isbn: 978-1-4503-9058-3/21/10††ccs: Security and privacy Operating systems security

1. Introduction

As the operating system (OS) kernel forms the foundation of the software stack, control-flow hijacking attacks (Roemer et al., 2012) on the OS kernel jeopardize the security of the entire system. To safeguard system integrity, control-flow integrity (CFI) enforcement (Criswell et al., 2014; Ge et al., 2016; Moreira et al., 2017; Li et al., 2018) ensures that only paths in an authorized control-flow graph are followed during execution (Abadi et al., 2009). At the same time, leakage-resilient diversification (Gionta et al., 2016; Pomonis et al., 2019; Crane et al., 2015; Braden et al., 2016; Gionta et al., 2015; Backes et al., 2014) undermines the attacker’s knowledge of the code layout in memory, making successful exploitation more difficult. Both techniques must efficiently isolate memory within the OS kernel. CFI must protect the integrity of return addresses on the stack (Carlini et al., 2015; Göktas et al., 2014; Carlini et al., 2015; Farkhani et al., 2018; Burow et al., 2017; Conti et al., 2015); diversification must prevent attackers from learning the layout of kernel code—e.g., by leveraging buffer overreads (Strackx et al., 2009; Snow et al., 2013).

Existing intra-kernel isolation mechanisms generally rely on software fault isolation (SFI) (Wahbe et al., 1993; Sehr et al., 2010), adding bounds checks to memory writes (Criswell et al., 2014) and reads (Pomonis et al., 2019) to prevent unauthorized access to sensitive data. As the overhead of such checks is proportional to the number of protected regions, SFI-based approaches often group all sensitive information together—typically at the upper end of the virtual address space—so only one bound must be checked (Pomonis et al., 2019; Criswell et al., 2014). Unfortunately, this grouping reduces design flexibility and diversification entropy. The most efficient SFI implementation on x86-64 (Pomonis et al., 2019) relies on Intel’s Memory Protection Extensions (MPX), a hardware feature that has recently been deprecated (Intel Corp., 2013).

In this work, we introduce an alternative approach to intra-kernel memory isolation based on novel use of Intel’s Protection Keys for Userspace (PKU) (Intel Corp., 2021). PKU allows each page table entry (PTE) to specify one of 16 protection keys (PKEYs); at run time, unprivileged software can dynamically disable read access or both read & write access to pages on a PKEY-by-PKEY basis. However, as the name implies, PKU applies only to pages whose PTEs are marked as user space (i.e., accessible to application code).

We have developed a new user/kernel isolation mechanism, dubbed PKK (Protection Keys for Kernelspace), which uses PKU hardware to dynamically disable read and/or write access to pages while running in the OS kernel. Our PKK mechanism is both inexpensive and flexible, and supports both SMEP and SMAP (Supervisor-Mode Execution/Access Prevention (Intel Corp., 2021)). Additionally, while it is fully compatible with Kernel Page Table Isolation (KPTI) (Hansen, 2017), PKK does not require KPTI in order to function, allowing systems that do not need or do not want KPTI to avoid its overhead.111 As part of its Trust Domain Extensions (TDX), Intel has recently announced that certain future processors will provide hardware support for Protection Keys in Supervisor mode (PKS). PKS machines will allow 16 protection keys to be used in supervisor mode in addition to the 16 in user mode. Our PKK mechanism provides PKS-like functionality on existing machines.

To demonstrate the effectiveness of PKK, we developed IskiOS,222“IskiOS” means “shadow” in Greek. a system that provides execute-only memory (XOM) for storing code and write-protected shadow stacks for the Linux kernel. Unlike previous approaches (Pomonis et al., 2019), IskiOS protects both the code and the shadow stacks efficiently, with no changes to virtual address space layout; IskiOS is thus compatible with existing kernel memory allocators and imposes no limits on the entropy of diversification strategies.

To protect the shadow stack, IskiOS incorporates a novel calling convention that is immune not only to control-flow hijacking attacks in the calling thread but also to attacks that leverage cross-thread races (Center, 2018; Clang Documentation, [n.d.]b). Along with this calling convention, we introduce a pair of techniques to reduce the frequency of PKU domain switches. The first technique, dubbed shadow write optimization, avoids redundant writes of return addresses to the shadow stack. The second performs aggressive function inlining, avoiding calls to many smaller functions altogether.

Our contributions can be summarized as follows:

• •

We demonstrate that Intel PKU can be used to enable efficient user/kernel isolation, to widen the set of protection modes for kernel memory, and to change protections cheaply at fine temporal granularity.

• •

We describe a system, IskiOS, that leverages the resulting PKK mechanism to provide execute-only memory (XOM) and protected shadow stacks within the Linux kernel, with arbitrary address space layout. To the best of our knowledge, ours is the first write-protected, race-free shadow stack for the x86-64.

• •

We describe a shadow write optimization which, together with aggressive inlining, serves to significantly reduce the remaining overheads of PKK-based shadow stacks.

• •

Using the LMBench microbenchmark suite (McVoy and Staelin, 1996), we demonstrate a geometric mean overhead, relative to standard Linux, of approximately 11% for PKK and XOM. Adding our protected shadow stacks brings the total to roughly 22%.

• •

Using workloads drawn from performance regression tracking of the mainline Linux kernel (LinuxBenchmarking, [n.d.])), we confirm that overheads are substantially lower for full-size programs: the average overhead of PKK and XOM becomes negligible, and protected shadow stacks add less than 5% geomean overhead.

Source code for IskiOS is available at https://github.com/URSec/iskios.

2. Background

2.1. User/Kernel Isolation on x86

For efficiency, Linux has traditionally mapped kernel code, data, and loadable modules into the address space of every running process. This convention allows system calls, traps, and interrupts to vector into the kernel without flushing entries from the TLB. It also allows the kernel to easily access the active process’s user-level memory.

To support this address space sharing, the x86 includes a User/Supervisor (U/S) flag in every page table entry (PTE) (Intel Corp., 2021). Pages in the upper region of the address space, which map kernel code and data, are marked as supervisor-only: accessing such a page while running in user mode (Ring 3) results in a trap (Intel Corp., 2021).333To mitigate Meltdown (Lipp et al., 2018) attacks, some recent versions of Linux have employed separate page tables for user and supervisor code (i.e., KPTI (Hansen, 2017)). The resulting security comes at a significant performance cost (Bregg, 2018); long-term solutions depend on hardware updates that restore the viability of user/kernel address space sharing.

2.2. Protection Keys for Userspace

In its Skylake generation of processors, Intel introduced Protection Keys for Userspace (PKU) (Intel Corp., 2021). A descendant of mechanisms dating back to the IBM 360 (IBM Corp., 1964), PKU is unusual in that it applies only to user-mode pages and allows permissions to be changed by an unprivileged instruction. While PKU is intended mainly as a memory safety enhancement, researchers have used it (Hedayati et al., 2019; Vahldiek-Oberwagner et al., 2019; Burow et al., 2019; Kjellqvist et al., 2020) to provide intra-process isolation for user-space applications.

PKU introduces a 32-bit register called pkru and instructions (rdpkru and wrpkru) to read and write it (Intel Corp., 2021). Four previously unused bits (bits 62:59) in each PTE are then used to associate the page with one of 16 possible protection domains. The pkru uses two bits per key—dubbed access disable (AD) and write disable (WD)—to encode access rights that are restricted in each domain. On any load or store to a user-space page, the processor checks permissions as usual and then drops all rights (if any) associated with the page’s protection key in the pkru of the currently executing hyperthread. The processor ignores the protection key for instruction fetches and for loads and stores of addresses whose PTE indicates kernel space. Thus, in the expected use case, PKU does not affect accesses to kernel code or data.

To date, intra-address-space isolation in the OS kernel has relied on SFI (Wahbe et al., 1993; Sehr et al., 2010), which adds instrumentation (e.g., bit-masking operations (Criswell et al., 2014) or MPX bounds checks (Dong et al., 2018; Pomonis et al., 2019)) before stores and/or loads. Enabling protection keys in the kernel would bring two key benefits that are difficult or impossible to attain with existing SFI-based approaches.

First, PKU provides more flexibility in address space layout. To improve performance, solutions using SFI (Wahbe et al., 1993) often place pages of the same protection domain in contiguous virtual addresses (Criswell et al., 2014; Pomonis et al., 2019; Carr and Payer, 2017; Dong et al., 2018). This approach requires significant engineering effort (for memory allocators in particular (Pomonis et al., 2019)) and reduces the entropy of code-layout randomization schemes. By contrast, protection keys permit pages in different domains to be located anywhere within the virtual address space with no performance or entropy loss.

Second, PKU easily supports up to 16 protection domains (Intel Corp., 2021). By contrast, the complexity of bit-masking bounds checks increases with the number of protection domains (Criswell et al., 2014), and Intel MPX (Intel Corp., 2021) (which is now deprecated (Intel Corp., 2013)) provides only four bounds registers. With PKU, a single wrpkru instruction can change the access rights of an arbitrary subset of the 16 protection domains.

3. Protection Keys for Kernelspace

Our goal is to enable what one might call Protection Keys for Kernelspace (PKK) while maintaining the traditional guarantees of user/kernel isolation. In a conventional system, however, kernel code and data are placed in pages for which the U/S flag is clear (indicating they can be accessed only in supervisor mode), and the hardware ignores the PKU bits when accessing such pages. Fortunately, we observe that we can use memory protection keys to subsume the functionality of the U/S bit, and then leave that bit set in the PTEs of both user and kernel pages.

There are only two things that the OS kernel can do that user code cannot: execute privileged instructions and access protected OS kernel memory. The execution of privileged instructions is controlled not by the U/S bit in PTEs but by the processor’s execution mode (Ring 3 v. Ring 0) (Intel Corp., 2021), which we do not change. The effect of the U/S bit on loads and stores can then be emulated by assigning user and supervisor pages to different protection domains, enabling and disabling access to these domains when crossing from user to kernel space or vice versa, and preventing changes to pkru from occurring at other times (see Section 3.1 below). As pkru permissions have no impact on instruction fetches, code running in user-mode can jump directly to code within the kernel’s code segment. However, such a jump into kernel code is harmless because the processor is still in user-mode (Ring 3): executing a privileged instruction causes a trap (because the execution mode is still unprivileged), and reading or writing kernel memory causes a trap (because access is locked out by the pkru). As now, the only way to enter the kernel is to use a system call, trap, or interrupt which will change the processor’s mode from user-mode to kernel-mode.

To implement PKK, IskiOS sets the U/S bit in every entry of every page table, with the exception of a few entries used to map trampoline pages that handle system calls and interrupts. This effectively marks all memory as user mode. IskiOS then reserves keys 0–7 for use as kernel protection keys. Every page of kernel memory will be assigned one of these eight keys; IskiOS disables both read and write access to pages with these keys when the system is operating in user mode and enables them (selectively, as dictated by the security policy) when executing kernel code. Existing applications that make legitimate use of PKU can continue to obtain keys from the kernel through the pkey_alloc() (Hansen, [n.d.]) system call, which is modified to return an available key between 8 and 15. As applications may use PKEYs 8–15 to enforce their own security policies, IskiOS saves the value of the pkru on kernel entry and restores it on return to user space.

3.1. Controlling Use of wrpkru

Since wrpkru is not a privileged instruction  (Intel Corp., 2021), application code can modify the pkru at will. IskiOS must therefore prevent application code from enabling read or write access to kernel pages. To do so, IskiOS must address two challenges. First, it must allow applications to use the wrpkru instruction to enforce their own security policies while preventing them from clearing the WD or AD bits for PKEYs 0–7. Second, given that (unprivileged) kernel instructions are now executable in user mode, IskiOS must prevent applications from compromising security by jumping to wrpkru instructions in the kernel.

Restricting Application wrpkrus To address the first challenge, IskiOS borrows techniques from our earlier Hodor project (Hedayati et al., 2019): IskiOS ensures that all application pages with execute permission have write permission disabled; when the kernel maps a page into the virtual address space of an application with execute permissions, it scans the page (including boundaries with the pages before and after it) for any byte sequence that might comprise a wrpkru instruction. If it finds any, it places a debug watchpoint (Intel Corp., 2021) on the address. If the address is ever used for an instruction fetch, the watchpoint generates a trap. IskiOS then inspects the value of the intended write to the pkru to ensure that the process is not modifying PKEYs 0–7 and, if it is, terminates the process. This convention allows applications to continue using PKEYs 8–15 without restriction. Programs that generate code dynamically can write code to a page and then use mprotect() to change the permissions from writable and non-executable to non-writable and executable; IskiOS will scan the page when changing the permissions.

Our work on Hodor showed (Hedayati et al., 2019) that existing Linux applications almost never contain more than one or two wrpkru instructions, confirming that the debug watchpoint approach is practical for existing applications. One might worry that as more applications come to use PKU, the four available watchpoint registers (Intel Corp., 2021) might become a scarce resource. We observe, however, that applications making legitimate use of protection keys can be expected to rely on the routines provided in Linux’s C Standard Library (libc) to change the pkru. To avoid using debug watchpoints in the common case, IskiOS adds lines 4–5 and 7–8 in Listing 1 to the pkey_write library function in GNU’s glibc. These mask the lower 16 bits of the value written to the pkru register. With this change, glibc requires no watchpoint because it will always ensure that access to kernel pages is disabled.444A signal could occur during pkey_write, but IskiOS disables access to PKEYs 0–7 before dispatching signal handlers and when resuming application execution after a signal handler returns.

Protecting Kernel wrpkrus The second challenge reflects the fact that wrprku instructions in the kernel typically will clear the AD and WD bits of kernel PKEYs. To prevent application code from using these instructions, IskiOS inserts a check after each wrpkru in kernel code to ensure that the processor is currently running in Ring 0, as specified by the code segment register (cs)—see lines 5–7 in Listing 2. In addition, IskiOS ensures that the expected permissions have been set, thereby avoiding an attack in which overly generous permissions are placed in eax before jumping to a wrpkru instruction555In a future system using PKS hardware, we would need similar checks to prevent the gadget-ization of wrmsr instructions, which can be used to disable PKS altogether. Unlike wrpkru, which impacts only the protection keys and is therefore relatively rare, wrmsr serves many purposes and appears in many parts of the OS kernel. (lines 13–14 in Listing 2). If any check fails, a production system would terminate the current process; for simplicity, our prototype simply crashes (line 9 in Listing 2).

3.2. SMEP Compatibility

Recent Intel processors provide Supervisor-Mode Execution Prevention (SMEP) (Intel Corp., 2021) to harden the kernel against ret2usr (Kemerlis et al., 2012) attacks. When SMEP is enabled, kernel-mode code cannot fetch instructions from pages whose PTEs are marked as user space; any such access will cause a page fault, allowing the OS to intervene. Since IskiOS configures kernel memory as user memory, we must disable SMEP for kernel code to execute. To prevent the kernel from executing arbitrary user code without SMEP support, IskiOS adopts kGuard’s (Kemerlis et al., 2012) approach and adds control-flow checks on kernel code. These checks, described in more detail in Section 6.2.1, apply to every indirect control transfer and ensure that privileged execution remains within kernel space. If execution attempts to cross to an address in the user portion of the virtual address space, IskiOS can intervene (our prototype simply halts).

3.3. SMAP Compatibility

Supervisor-Mode Access Prevention (SMAP) (Intel Corp., 2021) is a CPU extension that disables supervisor-mode accesses to user pages in an attempt to prevent attacker-controlled pointers from accessing user memory directly, possibly subverting the kernel’s control flow (Corbet, 2009). When the operating system needs to access user memory for legitimate purposes (e.g., copy_to/from_user() (Bovet and Cesati, 2003)), it can temporarily disable SMAP protection by setting the alignment checking flag bit in the EFLAGS status register (Intel Corp., 2021). IskiOS configures all linear addresses to be user mode. Consequently, SMAP must be disabled for kernel code to be able to access its own data. As with SMEP, IskiOS clears the SMAP bit at boot time. To replicate SMAP’s protections, IskiOS disallows kernel access to pages tagged with keys 8–15 (i.e., user pages) by default. The copy_to/from_user() (Bovet and Cesati, 2003) functions temporarily enable access to pages tagged with keys 8–15 when they need to read or write application memory.

3.4. Side Channels

PKK does not introduce any speculative execution side channels on processors following the Skylake generation.666Skylake processors are susceptible to both Meltdown and Meltdown-PK attacks, with or without PKK. Specifically, hardware mitigations against Meltdown (Lipp et al., 2018) guarantee that data will never be loaded, even speculatively, if protection keys do not allow it (Intel Corp., 2018). However, since PKK makes kernel code executable from user space, user programs may hypothetically be able to infer the location of kernel code fragments by jumping to random locations and observing the side effects on processor and memory state. To minimize the window of vulnerability, IskiOS will terminate and blacklist an application, regardless of installed signal handlers, the first time it traps when executing instructions within the kernel code segment in user-space.

4. Enhancing Security with PKK

We now describe our threat model, and how we use Intel PKU to (1) make kernel code unreadable (execute-only), thereby preventing buffer overreads (Strackx et al., 2009) from revealing potential gadgets, and (2) provide the kernel with efficient, race-free shadow stacks.

4.1. Threat Model

We assume the attacker aims to execute a computation within the OS kernel with supervisor privileges. The kernel itself is non-malicious but may have exploitable memory safety errors such as buffer overflows (One, 1996) and dangling pointers (Afek and Sharabani, 2007). Our attacker is an unprivileged user: they can execute arbitrary code in user space but cannot direct the OS kernel to load new kernel modules implementing malicious code.777Systems such as SecVisor (Seshadri et al., 2007) can prevent the loading of such malicious code if privileged user-space tools cannot be trusted. We assume the enforcement of the W^X (Team, [n.d.]; Intel Corp., 2021; Advanced Micro Devices, 2017) policy that prevents the attacker from injecting code directly into kernel memory. Finally, we assume that the hardware is correctly implemented and that side channels are out of scope.

4.2. Kernel XOM

Code reuse attacks (e.g., ROP (Roemer et al., 2012)) utilize information on where and how code has been placed in memory. To thwart such attacks, code diversification schemes randomize the layout and location of code so that attackers cannot locate useful gadgets and functions using a priori knowledge (Kil et al., 2006; Pappas et al., 2012; Crane et al., 2015). Advanced code reuse attacks (e.g., JIT-ROP (Snow et al., 2013)) exploit buffer overread bugs (Strackx et al., 2009) to inspect the code segment to locate reusable code. To prevent such attacks, IskiOS places all kernel and kernel module code pages in eXecute Only Memory (XOM)—memory that can be executed but not read or written. The x86 architecture does not support XOM directly, but IskiOS implements it using PKK.

Specifically, IskiOS reserves one of the 8 OS kernel protection keys for the OS kernel code segment. It configures all page table entries for pages containing kernel code to use this key. It then sets the access disable (AD) bit in the pkru for this key, disabling read access to pages containing kernel code. Since protection keys affect only data accesses, instruction fetch and execution are permitted (Intel Corp., 2021). Unlike SFI-based implementations of XOM (Pomonis et al., 2019; Braden et al., 2016), IskiOS can protect code pages at any virtual address, placing no restrictions on diversification: code pages and data pages can be interspersed and placed wherever desired in the virtual address space.

IskiOS also needs to protect physmap, the direct map of physical memory used in kernel space (Kemerlis et al., 2014). Physmap facilitates dynamic kernel memory allocation, but it also causes address aliasing—more than one virtual address mapping to the same physical address. To prevent buffer overreads from reading the kernel code segment through its mapping in physmap, IskiOS ensures that both mappings of the kernel code segment (including the one in physmap) use the same reserved kernel protection key.

4.3. Kernel Shadow Stack

Advanced code-reuse attacks commonly modify return addresses on the stack (Rudd et al., 2017; Göktas et al., 2018). A shadow stack protects against such attacks by keeping return addresses where they cannot easily be modified. While the location of the shadow stack could simply be obscured via randomization (Kuznetsov et al., 2014), such schemes have proven insufficient (Göktaş et al., 2016; Conti et al., 2015; Zieris and Horsch, 2018). For real protection, we need the shadow stack to be inaccessible.

We also need it to be race free, with no timing windows during which a return address can be modified by an attacker on another core. Previous shadow stack implementations (Chiueh and Hsu, 2001; Davi et al., 2011; Dang et al., 2015; Burow et al., 2019; Center, 2018) have instrumented function prologues to copy the return address from the original stack to the shadow stack. Such designs leave the return address vulnerable to modification by another thread after the call instruction saves it but before the function prologue copies it. Several previous schemes (Chiueh and Hsu, 2001; Davi et al., 2011; Center, 2018) also exhibit races in function epilogues when they verify the validity of the return address (or copy it from the shadow stack back to the original stack) prior to executing a return instruction: the return address can be corrupted after it is validated (or copied from the shadow stack) but before the called function returns. While the windows of vulnerability in these schemes are small, real-world implementations such as Microsoft’s Return Flow Guard (RFG) (Center, 2018) and Clang’s shadow stack for x86-64 (Clang Documentation, [n.d.]b) were removed quickly after their public release as the inherent races were shown to be exploitable.

IskiOS utilizes PKK, together with call-site modification, to provide what we believe to be the first write-protected, race-free shadow stack for the x86. To avoid the need for a separate stack pointer, we utilize a parallel shadow stack (Dang et al., 2015) design in which all shadow stack entries are located at a constant offset from their locations on the original stack. To protect the shadow stack from tampering, we dedicate one of the kernel protection keys to pages used for shadow stacks (and the pages that map to the same frames in physmap). During normal execution, write access to the shadow stack is disabled while read access remains enabled. When IskiOS needs to write a copy of the return address to the shadow stack, it temporarily enables write access to the shadow stack’s protection key (PKEY 2) in the pkru (this impacts only the current hardware thread), writes the return address to the shadow stack, and then revokes write access. Function return requires no changes to the pkru as the shadow stack is always readable.

To provide race-freedom, IskiOS modifies the default calling convention to pass the return address to each function in a register, rather than pushing it onto the stack. We modify the code generator to reserve %r10 for this purpose. When a caller wishes to make a function call, it first stores %r10 (which holds the address of the function to which the caller itself should return) to the shadow stack and then loads the return address for the callee into %r10. On function return, control is redirected to the address saved in %r10 via a jump-through-register instruction. We could also, of course, compare the main and shadow stack copies of the return address and raise an exception if they differ, but there seems to be no point: when running IskiOS, the main-stack return address is entirely unused, and attackers have no motivation to change it.

After each call, the compiler inserts code to load the return address from the shadow stack back into %r10. Since the shadow stack is readable, no wrpkru instruction is needed for this reload. By writing to the shadow stack only when making a nested call, IskiOS avoids the expense of a wrpkru instruction when a function calls no other function—i.e., when it is a dynamic leaf function. Furthermore, when a function makes more than one nested call, the expense is incurred only once—more on this in Section 5.1.

Interrupt Handling One limitation of our shadow stack design is that it does not leverage the hardware’s return address predictor, which is primed by call instructions and employed by ret. It is tempting to pursue a convention that points the stack pointer into the shadow stack and uses a real ret instruction. Unfortunately, such an approach is incompatible with the processor’s interrupt dispatch mechanism: a hardware interrupt that occurs when the stack pointer is pointing to the write-protected shadow stack will cause the kernel to crash when it attempts to save the processor state on what the kernel thinks is the kernel stack before executing the interrupt handler.

For two reasons, IskiOS must save and restore the pkru on the shadow stack during system call, trap, and interrupt dispatch. First, application code can change that register (Intel Corp., 2021), so IskiOS must preserve the value needed in user code. Second, interrupts can occur while an OS kernel function has enabled write access to the shadow stack; IskiOS must disable write access to the shadow stack prior to executing the interrupt handler and restore the pkru when returning from the interrupt.

5. Performance Optimizations

Hedayati et al. (Hedayati et al., 2019) report and our experiments confirm that the cost of executing a wrpkru instruction is roughly 26 cycles. This can lead to overheads ranging from negligible to significant, depending on how protection keys are used. For example, enabling XOM requires a single pkru update to drop the access permissions for code—after that, it’s free. Protected shadow stacks, on the other hand, require IskiOS to execute two wrpkru instructions every time it writes a return address to the shadow stack: one to enable access and one to disable it again, for a cost of about $52$ additional cycles in each dynamic call. To avoid this cost whenever possible, we explore two optimizations to our shadow stack.

5.1. Shadow Write Optimization

We observe that IskiOS can avoid writing the return value to the shadow stack if the desired value is already there. In particular, if a function calls 20 other functions, it only has to save its return address when it makes the first of these calls—the rest will be wrpkru-free. Likewise, if a recursive function has been optimized using tail-call optimization, its caller will use a jmp instruction instead of a call. In this case, the return address has already been pushed to the shadow stack; there is no need to write it again.

To leverage this observation, we designed the Shadow Write Optimization (SWO). With SWO, IskiOS adds code to every callsite that first checks whether the word in the shadow stack to which the return address will be written already contains the return address. If it does, the word is not written a second time. Experiments in Section 7 confirm that the reduction in dynamic executions of wrpkru leads to a dramatic overall improvement in performance.

5.2. Aggressive Inlining

A more obvious optimization opportunity is to minimize the number of function calls, which in turn eliminates the need to save the return address on the shadow stack. To achieve this, we aggressively increased the inlining threshold option to the compiler until we saw no additional performance improvement. Experiments in Section 7 confirm that aggressive inlining almost always leads to better performance at the cost of increased code size.

6. Implementation

We implemented IskiOS as a set of patches to the Linux v5.7 kernel and the Clang/LLVM (Lattner and Adve, 2004) 10.0.0 compiler.

6.1. Kernel Modifications

In our IskiOS prototype, we did not implement the debug watchpoint arming described in Section 3.1. We did, however, use Hodor’s code scanner (Hedayati et al., 2019) to confirm the absence of wrpkru instructions in the binaries used in Section 7.2. We also did not implement the changes to physmap described in Sections 4.2 and 4.3, but we do not expect these to impact performance. Finally, we carefully considered the PKU vulnerabilities described by Connor et al. (Connor et al., 2020). We concluded that, while the design of IskiOS is resistant to these attacks, our prototype implementation would require additional engineering to resist certain attacks on memory permissions (e.g., using process_vm_readv() (Linux Manual Pages, [n.d.]) to read data from a process’s own address space, ignoring the PKU permissions). Fixing the IskiOS prototype to make it complete (and therefore resistant to these attacks) requires that we add simple checks to the relevant memory-related system calls. The changes are straightforward, and we expect their performance impact to be negligible. We built IskiOS as three separate patches to the Linux kernel, adding support for protection keys, execute-only memory, and shadow stacks, respectively. We describe each patch below.

IskiOS-PKK

This patch enables PKU for all of virtual memory. We mark all pages as user mode by setting the U/S bit in every PTE. Since our design associates PKEYs 0–7 with kernel space and PKEYs 8–15 with user space, we change the default protection key for user pages from 0 to 8. By default, the kernel can access only pages with PKEY 0 (and PKEYs 8–15 when it wants to access user memory); user processes can access only pages with PKEY 8.

We also modified Linux to save and restore the pkru on kernel entry and exit. As an optimization, we arranged for interrupt dispatch code to elide the wrpkru instruction if the pkru already holds the correct value; this improves performance if a trap or interrupt occurs while the OS kernel is running. We disable this optimization in the shadow stack patch, as IskiOS must change pkru on every interrupt, trap, and system call.

IskiOS-XOM

This patch changes the 4-bit protection key in every PTE that maps a kernel code page to the value 1. Read and write access to pages with PKEY 1 is already disabled in the pkru.

IskiOS-SS

This patch (1) doubles (from 16 to 32 KB) the size of every stack in the kernel (i.e., every per-thread stack, per-cpu interrupt stack, etc.) and uses the upper half as a shadow stack, with write access disabled using PKK; (2) modifies kernel entry/exit code to save/restore the pkru register to/from the shadow stack, and (3) updates assembly code to conform to the new calling convention (Sec. 4.3). After updating the standard CALL_NOSPEC macro, we had to manually modify fewer than 100 additional call sites.

6.2. Compiler Instrumentation

We implemented two separate plugins to the LLVM 10.0.0 compiler (Lattner and Adve, 2004) to implement our prototype. Both extend the LLVM code generator with MachineFunction passes: one adds control-flow assertions on indirect branches and return instructions to enable SMEP functionality; the other implements shadow stacks.

6.2.1. SMEP Implementation

As suggested in Section 3.2, Listing 3 shows instrumentation inserted before each indirect branch. Assuming that %TargetReg contains the target address, the plugin prepends the indirect call or jmp (line 11) with a bt (line 2) instruction that stores the most significant bit of the target address in the CF flag of the status register. A jb (line 5) instruction continues regular execution if the address was in kernel space; otherwise, an undefined instruction ud2/0x0f0b (line 8) will raise an invalid opcode exception, and the kernel will crash.

Our SMEP plugin also instruments function epilogues to ensure that functions do not return to user space. As Listing 4 shows, the plugin loads the target address to %r10 (line 2), performs the same test as before (lines 5–11), adjusts the %rsp (line 15) to emulate a function return, and replaces the ret instruction with a jmp through %r10 (line 18).

6.2.2. Shadow Stack Implementation

Our second compiler plugin transforms every callsite to save the return address on the shadow stack and every function epilogue to use the return value on the shadow stack as Section 4.3 describes. To support our new calling convention, we modified the compiler to reserve register %r10.

Listing 5 shows IskiOS’s callsite instrumentation with and without SWO. When the shadow-write optimization is disabled, our compiler pass enables access to the shadow stack at each callsite by using wrpkru to clear the write-disable (WD) bit for PKEY 3 (lines 8–11). It then copies the return address of the currently executing function to the shadow stack (line 26) and executes another wrpkru (line 30) to disable write access again. Note that since rdpkru and wrpkru force us to zero %ecx and %edx, the compiler must spill (line 5) and restore (line 44) these registers. Before the call instruction (line 51), our compiler loads the callee’s return address into %r10 (line 48). (The return address saved to the stack by the call instruction is never used.) After the call site, the compiler restores the return address in %r10 from the shadow stack (line 55). When SWO is enabled, the compiler adds a simple check (lines 2–3) which ensures that the return address is pushed onto the shadow stack only if the value already there differs.

Listing 6 shows IskiOS’s instrumentation of function epilogues. The epilogue code adjusts the stack pointer (line 2) to discard the return address on the main stack and performs an indirect jump to the address in %r10 (line 5).

7. Evaluation

We evaluated the performance overhead that IskiOS incurs for its PKK-based user/kernel isolation mechanism, execute-only memory, and protected shadow stacks. We also evaluated the shadow-write and inlining optimizations described in Section 5. Finally, we evaluated the impact of IskiOS on the size of the kernel code segment. We report numbers for the following configurations:

• •

vanilla: Unmodified Linux kernel v5.7

• •

pkk: IskiOS kernel with protection keys for kernel space

• •

pkk+xom: IskiOS with PKK and execute-only memory

• •

pkk+ss: IskiOS with PKK and unoptimized shadow stacks

• •

pkk+ss-swo: IskiOS with PKK, shadow stacks, and the shadow-write optimization (SWO)

• •

pkk+ss-swo-inline: IskiOS with PKK, shadow stacks with SWO, and an increased inlining threshold

• •

pkk+xom+ss-swo-inline: IskiOS with PKK, XOM, shadow stacks with SWO, and an increased inlining threshold

In all the above configurations, we disabled Kernel Address Space Layout Randomization (KASLR) (Edge, 2013), Kernel Page Table Isolation (KPTI) (Hansen, 2017), and hardware SMAP and SMEP. We used the LMBench suite (McVoy and Staelin, 1996) for microbenchmarking and the Phoronix Test Suite (PTS) (Media, [n.d.]) to measure the performance impact on real-world applications. We performed our experiments on a Fedora 32 system equipped with two 3.00 GHz Intel Xeon Silver 4114 (Skylake) CPUs (2$\times$10 cores, 40 total threads), 16 GB of RAM and a 1 TB Seagate 7200 RPM disk. For all our tests, we loaded the intel_pstate performance scaling driver into the kernel to prevent the processor from reducing frequency (for power saving) during our experiments. For the networking experiments, we ran client and server processes on the same machine. We used the default settings for all benchmarks.

7.1. Microbenchmarks

We used LMBench (McVoy and Staelin, 1996) v.3.0-a9 to measure the latency and bandwidth overheads imposed by IskiOS on basic kernel operations. In particular, our set of microbenchmarks measures the latency of critical I/O system calls (open()/close(), read()/write(), select(), fstat(), stat(), mmap()/munmap()), execution mode switches (null system call), and inter-process context switches. We also measured the impact on process creation followed by exit(), execve(), and /bin/sh, as well as the latency of signal installation (via sigaction()) and delivery, protection faults, and page faults. Finally, we measured the latency overhead on pipe and socket I/O (TCP, UDP, and Unix domain sockets) and the bandwidth degradation on pipes, sockets, and file and memory-mapped I/O. We report the arithmetic mean of 10 runs for each microbenchmark.

7.1.1. IskiOS’s Performance

Figures 1 and 2 present our results for latency and bandwidth microbenchmarks, respectively (absolute performance numbers and standard deviations appear in Tables 4 and 5 in Appendix A). First we discuss IskiOS’s effect on the latency of basic kernel operations. Figure 1(a) shows that baseline support for PKK incurs low overhead for most microbenchmarks relative to vanilla Linux: roughly $11\%$ geometric mean and a maximum of $\sim$25% for the write system call. PKK incurs higher overheads on lightweight system call tests. For example, the null test calls getppid(), a system call that does minimal work inside the kernel, in a loop to estimate the round-trip latency of entering and exiting the kernel. The read test reads a single byte from /dev/zero, and the write test writes one byte to /dev/null, estimating a lower bound on the latency of any user/kernel interaction. PKK adds less than ten instructions to the OS kernel entry/exit path and two instructions for every indirect branch in kernel code. As expected, the marginal impact on kernel operations (except for extremely small services as described above) is negligible.

IskiOS’s XOM incurs virtually no overhead (when accounting for standard error) compared to PKK, and an average (geomean) of $\sim$12% for latency microbenchmarks compared to vanilla Linux. The pkk+ss-swo-inline kernel (fully optimized shadow stack, with SWO and aggressive inlining) incurs $\sim$21% overhead compared to vanilla and $10$% compared to PKK. Finally, the pkk+xom+ss-swo-inline kernel, with both XOM and a fully-optimized shadow stack, incurs $\sim$22% overhead compared to vanilla Linux.

Figure 2(a) shows the effect of IskiOS on the bandwidth of various inter-process communication mechanisms. IskiOS imposes the most overhead—roughly $16\%$ over vanilla—when moving data over a TCP/IP socket with both XOM and a fully-optimized shadow stack enabled. The complexity of the underlying TCP/IP protocol combined with the speed of network communication to localhost explains this result: TCP performs congestion, flow, and transmission-error control, and the network stack performs many function calls both within and between layers. These calls increase the number of instructions executed (including the relatively expensive wrpkru) when the shadow stack is enabled, and there is no latency from a real network to hide the additional overhead.

7.1.2. PKK Overhead Breakdown

To assess the contribution to PKK overhead of our software-based SMEP support, we disabled the LLVM SMEP pass and reevaluated PKK’s performance on the LMBench microbenchmarks. Due to space, we summarize the results; Appendix A contains full details for interested readers. Our results show that our SMEP instrumentation causes most of PKK’s overhead: disabling SMEP reduces the geometric mean PKK overhead from 11% to 5% on the LMBench latency benchmarks and from 2% to 1% on the LMBench bandwidth benchmarks. We believe this overhead is due to the extra instructions added to every indirect branch and the loss of utilizing the processor’s return predictor.

7.1.3. Shadow Stack Optimizations

Figures 1(b) and 2(b) assess the importance of our shadow-write and inlining optimizations for the IskiOS shadow stack. The unoptimized shadow stack implementation (pkk+ss) adds an rdpkru and two wrpkru instructions to every callsite in a function, incurring a maximum overhead of nearly $520\%$ for the select100tcp latency microbenchmark. Across all latency microbenchmarks, the unoptimized shadow stack incurs a geometric mean overhead of $\sim$217% compared to our baseline. These results are consistent with the recent work of Burow et. al (Burow et al., 2019), who evaluate various ISA features, including Intel PKU, for protecting a user-space shadow stack. In particular, Burow et. al report a maximum overhead of $\sim$420% on the SPEC CPU2006 (Henning, 2006) benchmark suite when using Intel PKU to write-protect the shadow stack.

When shadow-write optimization (SWO) is enabled, however (i.e., in the pkk+ss-swo kernel), overheads decrease dramatically, to a maximum of $\sim$97% and a geometric mean of $\sim$37%. When both SWO and the inlining optimization are enabled (pkk+ss-swo-inline), the overheads drop to a maximum of $\sim$43% and a geomean of $\sim$21%. While differences in control flow and instruction mix make it difficult to directly compare user and kernel workloads, our results nonetheless demonstrate the viability of PKU for intra-address-space isolation, even for mechanisms like shadow stacks, which require frequent domain switching. In particular, it should be possible to significantly improve the performance of user-space shadow stacks (Burow et al., 2019) using SWO and (perhaps) more aggressive inlining.

7.2. Macrobenchmarks

To assess the overhead of IskiOS on real-world programs, we used the Phoronix Test Suite (Media, [n.d.]) v9.8.0 (Nesodden). Phoronix is an open-source automated benchmarking suite with over 450 different test profiles grouped into categories such as disk, network, processor, graphics, and system.

We chose the set of tests used to track the performance of the mainline Linux kernel (LinuxBenchmarking, [n.d.]). We omitted stress tests, which resemble the LMBench microbenchmarks of Section 7.1.1. Our chosen tests cover (a) web servers (Apache and NGNIX); (b) the build toolchains for Apache (Build Apache) and PHP 7 (Build PHP); (c) encryption software (Cryptsetup-sha215, Cryptsetup-whirlpool, and OpenSSL); (d) the PHP interpreter (PHPBench) and LuaJIT compiler (LuaJIT); (e) the PostgreSQL object-relational database search (PGBench) and a protein sequence database searched via Hidden Markov Models (HMMer); (f) web and mail server workloads (Ebizzy and PostMark); (g) filesystem and disk I/O workloads (FS-Mark and CompileBench); (h) video encoding (SVT-AV1 and SVT-HEVC); (i) audio encoding (FLAC and MP3); (j) file compression (Parallel BZIP2); (k) game engines for chess (Crafty, Stockfish) and Connect-4 (Fhourstones); (l) computation-heavy prime number generation (Primesieve), Poisson equation solving (Himeno), and matrix multiplication (PolyBench-C); (m) system boot-up performance (Systemd Kernel); (n) 3D computer graphics raytracing (C-Ray) and rendering (TTSIOD 3D Renderer); and (o) version control (Git).

Phoronix keeps running a benchmark until the relative standard deviation (RSD) falls below a specific threshold ($3.5\%$ by default) or a maximum number of runs (15 in our experiments) is exhausted. Table 1 presents IskiOS’s overhead on each benchmark. The second column shows the metric used by each benchmark and the result on the vanilla kernel (i.e., our baseline). Columns 3–6 show the percentage overhead of each configuration over the baseline kernel. The final row shows the geometric mean, across all applications, of the change in reported metric ($(\prod_{i}(overhead_{i}+100))^{1/n}-100$). As different applications use different metrics, this average should be taken as merely suggestive; nonetheless, overhead of less than 5% when running on the full version of IskiOS, with XOM and a race-free protected shadow stack, strikes us as a very strong result.

For PKK alone, we observe a maximum overhead of $\sim$17% for CompileBench and Apache, followed by $\sim$14% for NGINX and $\sim$9% for PostMark. Table 2 presents the top four system calls with respect to system time—i.e., CPU time in the kernel—for each of these four macrobenchmarks, as reported by strace. CompileBench tests file system performance by simulating kernel builds (creating, compiling, patching, stating, and reading kernel trees). We examined the initial creation of 1000 1 MB files. Table 2 shows that $\sim$61% of system time is spent on write(), followed by openat(), fstat(), and close(). As Section 7.1 explains, IskiOS’s PKK affects these calls the most, as their total execution time is small. Since CompileBench uses extremely small services frequently, the overhead of PKK is higher. PostMark simulates the behavior of mail servers and thus of small-file testing (file sizes of 5–512 KB). Table 2 shows that PostMark spends most of its system time ($\sim$52%) in write(), followed by read(), unlink(), and openat(). As in CompileBench, frequent use of such short kernel calls leads to higher overheads.

For NGINX and Apache, we used strace to examine both client and server system calls. Table 2 shows that the Apache server spends $91\%$ of its system time in futex(), followed by read(), epoll_wait(), and accept4(). The NGINX server spends roughly the same amount of system time among close(), recvfrom(), writev(), and sendfile(). Table 2 also shows that clients in both cases spend most of their system time in epoll_ctl(), connect(), write(), and read(). This is expected, as the two benchmarks share the Apache Bench (ab) client. Calls to futex() are used for synchronization and are typically very brief. The connect() system call is used to initiate a connection over a socket and accept4() to accept such connections. The recvfrom() and sendfile() system calls are used to receive and send data over a socket, respectively. As Section 7.1 explains, PKK incurs significant overhead on such services, especially when running TCP (as both NGINX and Apache do). The epoll_ctl() and epoll_wait() system calls are used to synchronize communication over a set of file descriptors, and much like select() (discussed in Sec. 7.1), they suffer high overhead when the number of descriptors is high.

Within the bounds of experimental error, IskiOS’s XOM implementation incurs no overhead beyond that of PKK. The fully-optimized shadow stack implementation (pkk+ss-swo-inline), as expected, increases the overheads for macrobenchmarks, such as web servers and file-system workloads, that spend significant time in the kernel. The maximum overhead across all benchmarks and configurations is $38.51\%$; it occurs for the Apache web server when both security defenses are enabled (pkk+xom+ss-swo-inline). NGINX is similar (maximum overhead of $37.14\%$).

7.3. Code Size Overhead

To see IskiOS’s impact on code size, we measured the .text section in the final binary for each configuration (including all the loaded modules). Results appear in Table 3. IskiOS’s PKK instrumentation has relatively little impact—$7.82\%$—as it only adds a few lines of code in the kernel entry/exit path and two instructions for every indirect branch.

As expected, IskiOS’s XOM does not increase the code size relative to PKK. In contrast, SFI-based XOM approaches, which instrument every load instruction, have higher memory overheads: existing implementations of execute-only memory for user-level applications e.g., LR2 (Braden et al., 2016) and uXOM (Kwon et al., 2019), report code-size increases of $10\%$ to $50\%$. Unfortunately, kR^X (Pomonis et al., 2019), the only SFI-based approach for XOM in the Linux kernel, does not report code-size overheads.

IskiOS’s unoptimized shadow stack implementation incurs a $155\%$ increase in code segment size. This is expected, as our shadow stack compiler pass adds 25 instructions to each callsite (Listing 5) and one instruction to each function epilogue (Listing 6). The shadow-write optimization (SWO) adds two more instructions per callsite (Listing 5), for another $\sim$8% overhead compared to the unoptimized shadow stack and $163\%$ compared to our baseline. XOM again adds nothing more to the code size of the shadow stack implementation. Finally, increasing Clang’s inlining threshold to 8000 adds roughly $385\%$ overhead compared to the baseline, which is also the cumulative overhead when both security defenses are enabled. While this increase is high, the absolute size of the kernel along with the loaded modules in IskiOS is less than $136$ MB, which we consider entirely reasonable given the added security and the fact that modern desktop and server machines come with 8 GB or more of physical memory.

8. Related Work

We discuss three areas of related work: intra-address-space memory isolation, execute-only memory defenses, and methods to protect the integrity of return addresses.

8.1. Intra-address-space Isolation

Address-based Isolation Several research efforts (Criswell et al., 2014; Pomonis et al., 2019; Mccamant and Morrisett, 2005; Carr and Payer, 2017; Yee et al., 2010) employ software fault isolation (SFI) (Wahbe et al., 1993; Sehr et al., 2010) to protect sensitive data from untrusted code. Typically, these approaches add a run-time check on each memory access to ensure that the target address is not within the protected region. Additionally, they enforce some form of control-flow integrity (CFI) (Abadi et al., 2009) to ensure that the SFI instrumentation is not bypassed. As the protection overhead is proportional to the complexity of the code performing the checks, solutions using SFI typically

1. protect only a single memory region, and 2) place pages belonging to the same protection domain contiguously within the virtual address space (Criswell et al., 2014; Pomonis et al., 2019; Carr and Payer, 2017; Yee et al., 2010). Unfortunately, this approach restricts the number of protected domains and requires significant engineering effort (memory allocator modifications in particular (Pomonis et al., 2019)). In contrast, our PKK supports up to 8 distinct protection domains and permits pages in different domains to be located anywhere within the virtual address space without incurring additional performance loss.

Domain-based Isolation Other approaches (Hedayati et al., 2019; Vahldiek-Oberwagner et al., 2019; Wang et al., 2020b; Sung et al., 2020; Gu et al., 2020; Wang et al., 2020a; Narayanan et al., 2020) use hardware isolation primitives to create protection domains in which various executable components are granted asymmetric access to sensitive data in memory. Hodor (Hedayati et al., 2019), ERIM (Vahldiek-Oberwagner et al., 2019), and MonGuard (Wang et al., 2020b) use PKU to provide efficient intra-process isolation for user-space programs. Like IskiOS, these systems use memory protection keys. However, IskiOS provides intra-kernel isolation and, consequently, solves several challenges such as retrofitting PKU for protecting kernel memory while maintaining SMAP and SMEP. Sung et al. (Sung et al., 2020) leverage Intel PKU to provide intra-address-space isolation for the RustyHermit (Lankes et al., 2019) unikernel. A RustyHermit (Lankes et al., 2019) unikernel instance consists of a single application, statically linked against a minimal library OS written in Rust (Lankes et al., 2019); application and kernel share the same user address space (i.e., pages with U/S bit set), and they both execute in kernel mode. Sung et al.’s (Sung et al., 2020) proposed mechanism places the application in a different protection domain from the kernel, and it isolates unsafe Rust code blocks that handle low-level hardware operations from the rest of the kernel. As all code uses user-space memory pages, the use of Intel PKU is straightforward. Since the goal is to increase fault tolerance within a single domain of trust, Sung et al. (Sung et al., 2020) do not prevent reconfiguration of the pkru register. Even if they did, their system would not need to differentiate between wrpkru instructions in user and kernel space. In contrast, IskiOS retrofits Linux’s existing user/kernel isolation mechanism to use protection keys. In doing so, IskiOS takes additional measures to ensure that user-space application code cannot misuse the wrpkru instruction to break IskiOS’s isolation mechanism. UnderBridge (Gu et al., 2020), developed concurrently to our work, restructures microkernel OSes by moving user-space system servers to kernel space; it uses PKU in conjunction with Kernel Page Table Isolation (KPTI) (Hansen, 2017) to isolate system servers running in kernel mode. While compatible with KPTI, our PKK mechanism does not require it, and therefore PKK does not incur KPTI’s additional overhead (Bregg, 2018).

Other x86 hardware primitives can be used for intra-address-space isolation. Several works (Narayanan et al., 2020; Mi et al., 2019; Hedayati et al., 2019; Liu et al., 2015; Koning et al., 2017; Proskurin et al., 2020) use Intel’s VMFUNC (Intel Corp., 2021) to switch between preset Extended Page Tables (EPTs) that correspond to different protection domains. Among them, SkyBridge (Mi et al., 2019) uses VMFUNC to improve the latency of IPCs in a microkernel setting, LVDs (Narayanan et al., 2020) use VMFUNC to isolate device drivers from the core Linux kernel, and xMP (Proskurin et al., 2020) uses the same mechanism to protect sensitive user and kernel data from data-only attacks. VMFUNC requires that these systems execute under a hypervisor, which incurs non-trivial virtualization overheads on normal execution. Conversely, IskiOS uses no hypervisor, keeping its overheads during normal execution low. Additionally, as VMFUNC is 3–5$\times$ slower than wrpkru (Hedayati et al., 2019; Vahldiek-Oberwagner et al., 2019; Wang et al., 2020a), its use for defenses requiring frequent domain switching (e.g., shadow stacks) is prohibitive (Vahldiek-Oberwagner et al., 2019; Wang et al., 2020a).

SEIMI (Wang et al., 2020a) uses SMAP (Intel Corp., 2021) to protect sensitive data in user-space programs. It enables SMAP and maps all pages with the supervisor bit except for those that store sensitive user data. SEIMI then executes all (trusted and untrusted) user code in privileged mode and allows trusted components to temporarily disable SMAP to access the protected memory. To prevent user code from executing privileged instructions, SEIMI places the system under the control of a hypervisor and forces all privileged instructions to cause a VM exit. Both IskiOS and SEIMI make unconventional use of x86 hardware to efficiently isolate memory. Unlike SEIMI, IskiOS does not require a hypervisor to protect its isolation mechanism and security defenses. In addition, SEIMI’s use of SMAP no longer protects the kernel from inadvertently accessing user memory. In contrast, IskiOS’s PKK mechanism still allows user programs to use PKU (though it does halve the number of user-level keys available).

8.2. eXecute-Only Memory

Defenses in user space prevent code pages from being read (Crane et al., 2015; Braden et al., 2016; Gionta et al., 2015; Backes et al., 2014; Kwon et al., 2019) and use code-pointer hiding techniques (Crane et al., 2015; Braden et al., 2016) to protect against indirect memory disclosure attacks. Inspired by their user-space counterparts, recent approaches in the OS kernel (Gionta et al., 2016; Pomonis et al., 2019) combine execute-only memory with kernel diversification to prevent gadgets from being leaked. KHide (Gionta et al., 2016) uses a hypervisor to prevent read accesses to kernel code. IskiOS does not require more privileged software for its execution, keeping its trusted computing base small and avoiding unnecessary virtualization overheads. kR^X (Pomonis et al., 2019) instruments all read instructions with run-time checks to ensure that they never read the code segment. In its fully-optimized software-based implementation, kR^X performs roughly the same as IskiOS; however, kR^X must place all code in a contiguous region, weakening diversification schemes such as KASLR (Edge, 2013). To make up for the entropy loss, kR^X re-arranges code in the protected region using function permutation and basic block reordering (Pomonis et al., 2019). In contrast, IskiOS does not break the memory layout, provides more flexibility (i.e., supports more than one protected area in memory), and preserves the protection guarantees of existing randomization schemes. A faster implementation of kR^X exists but relies on Intel MPX which is now deprecated (Intel Corp., 2013).

8.3. Return Address Protection

Stack canaries (Cowan et al., 1998; Etoh, 2004; Wagle and Cowan, 2003) and systems that encrypt return addresses (Cowan et al., 2003; Team, 2015; Pomonis et al., 2019; Onarlioglu et al., 2010; Liljestrand et al., 2019; Inc., 2017) can detect return address corruption on the stack but are susceptible to memory disclosure (Cowan et al., 2003), brute-force (Liljestrand et al., 2019), signing-key forgery (Zero, 2019), and substitution attacks (Liljestrand et al., 2019; Inc., 2017). LLVM Safestack (Clang Documentation, [n.d.]a) stores return addresses on a second separate stack which it stores in a randomized location. Other defenses create a separate (shadow) stack in memory and, on each function call, store a copy of the return address to the shadow stack (Vendicator, 2000; Chiueh and Hsu, 2001; Dang et al., 2015; Burow et al., 2019). Shadow stacks may or may not be write-protected. Systems deploying the latter (e.g., Shadesmar (Burow et al., 2019)) place the shadow stack at a random location in memory like the LLVM Safestack (Clang Documentation, [n.d.]a). While these solutions make attacks more difficult—the base address needs to be guessed correctly and, in the case of shadow stacks, two return addresses must be corrupted in memory—they are still susceptible to information leaks and memory corruption attacks (Zieris and Horsch, 2018; Burow et al., 2019; Clang Documentation, [n.d.]a; Evans et al., 2015).

Write-protected shadow stacks (e.g., Read-Only RAD (Chiueh and Hsu, 2001)), if implemented correctly to be thread-safe, offer the strongest protection for return addresses. Prior works (Burow et al., 2019; Wang et al., 2020a) examine the performance overheads of various hardware mechanisms to preserve the integrity of a user-space shadow stack. Burow et al. (Burow et al., 2019) report a $12.12\%$ geomean overhead over the SPEC CPU2006 (Henning, 2006) benchmark suite when using Intel MPX (Intel Corp., 2021) and a $61.18\%$ geomean overhead when using Intel PKU. Wang et al. (Wang et al., 2020a) report a $14.57\%$ geomean overhead over the same set of benchmarks for the MPX-based implementation of a shadow stack, and a $21.08\%$ geomean overhead for the PKU-based shadow stack. Unfortunately, Intel MPX is deprecated and will be unavailable in future processors (Intel Corp., 2013). SEIMI’s SMAP-based solution incurs $12.49\%$ geomean overhead but, as noted above, requires hardware virtualization, adding significant overheads to the entire system—$68.37\%$ and $33.56\%$ geomean overhead on process- and filesystem-related kernel operations, respectively; it also no longer supports SMAP’s original purpose. In contrast, IskiOS uses hardware that is available in all processors following the Intel Skylake generation, does not require any virtualization support, keeping the overheads of kernel operations low, maintains half of the protection keys for userspace protection, and incurs only $22\%$ geomean overhead on the LMBench latency microbenchmarks while providing robust race-free protection to kernel shadow stacks.

Microsoft’s Hardware-enforced Stack Protection (Pulapaka, 2020) is the first security mechanism to use the long-awaited Intel Control-Flow Enforcement Technology (CET) for return addresses. On each function call, CET stores the return address on both the program stack and a hardware-enforced read-only shadow stack. On return, it compares the two addresses and raises an exception in case of a mismatch. Unfortunately, at the time of this writing, CET is available only on certain Tiger Lake mobile and embedded processors.

9. Discussion and Future Work

Side Channels As Section 3.4 discusses, PKK introduces a side channel through which user code may infer locations in the kernel code segment. An alternative design for PKK would be to only set the U/S bit on kernel data pages and let kernel code reside in supervisor-mode pages. Such a design would offer equivalent security guarantees and would avoid the additional overheads of our SMEP instrumentation, but it would not support kernel XOM. Note that enabling shadow stack support in our current prototype narrows the window of side channel vulnerability by introducing vetted wrpkru instructions at each function call site.

Intel PKS When available, we could leverage Intel’s supervisor protection keys (Intel Corp., 2021) and eliminate the need for SMEP emulation. Such a system would still require additional code after wrmsr instructions to prevent code reuse attacks from disabling protection (as IskiOS does for wrpkru instructions). Our shadow stack optimizations should be compatible with PKS.

Register Allocation Given better integration with local register allocation, IskiOS could often avoid spilling the three registers used to instrument call sites. Inter-procedural register allocation could similarly avoid spilling the return address to the shadow stack in many cases, further reducing the frequency of wrpkru instructions.

Fine-grained Intra-kernel Isolation Additional future work might use PKK to protect sensitive kernel data regions—e.g., process control blocks (PCBs), credential structures, and interrupt vector tables—against unauthorized accesses. We also hope to investigate the use of PKK to better isolate kernel components. Previous work in this area (Dautenhahn et al., 2015) relies on expensive serializing instructions and can only protect data integrity; PKK offers a potentially faster mechanism that can ensure both integrity and confidentiality.

10. Conclusions

IskiOS is, to the best of our knowledge, the first system to implement race-free write-protected shadow stacks and flexible (non-entropy-compromising) execute-only memory for the OS kernel. Shadow stacks protect return addresses from corruption, and execute-only memory enables state-of-the-art leakage-resilient diversification schemes by hiding code from buffer overread attacks. Unlike previous work, IskiOS imposes no restrictions on virtual address space layout, allowing the OS to place kernel stacks and code pages at arbitrary locations. IskiOS achieves these benefits through a novel use of Intel’s PKU for protection inside the OS kernel. Our “PKK”-based implementation of XOM (with software-emulated SMEP) incurs roughly $12\%$ geomean overhead on the LMBench microbenchmarks, relative to the vanilla Linux kernel and virtually no performance overhead on most real-world applications (less than 16%, worst case, on the Phoronix programs used for Linux regression analysis). IskiOS’s protected shadow stacks incur about 22% geomean overhead on LMBench and less than 5% (geomean) across the chosen Phoronix applications (less than 39%, worst case).

Acknowledgements.

The authors thank the anonymous referees and our shepherd, Erik van der Kouwe, for their helpful feedback and suggestions. This work was supported in part by NSF grants CNS-1618213, CNS-1900803, and CNS-1955498, by a Google Faculty Research award, and by ONR Award N00014-17-1-2996.

Appendix A Details of LMBench Experiments

This appendix includes detailed results from our experiments for interested readers.

Tables 4 and 5 show results for our LMBench experiments. In each, the second column shows the arithmetic mean and standard deviation (SD) for ten runs of each latency and bandwidth microbenchmark on the unmodified Linux kernel (i.e., our baseline). Similarly, columns 3–6 show the arithmetic mean and standard deviation, as well as the percentage overhead, of each configuration over the baseline kernel. The last row of each table shows the geometric mean (in reported metric ($(\prod_{i}(overhead_{i}+100))^{1/n}-100$)) overhead across latency and bandwidth microbenchmarks, respectively, for each IskiOS configuration.

Figures 3 and 4 show the detailed overhead of using PKK with and without our SMEP instrumentation on the LMBench bandwidth and latency experiments, respectively.