论文标题
mprotect：操作系统内存管理无访问
MProtect: Operating System Memory Management without Access
论文作者
论文摘要
假设应用程序信任他们，现代操作系统（OSE）不受限制地访问应用程序数据。但是，在许多情况下，由于OS提供商不值得信赖或由于其较大的攻击表面而可能会损害OS，因此这个假设是有问题的。我们的调查始于以下假设：OS从根本上来说，不受限制地获得记忆的访问是不需要的，而包括管理记忆，包括管理记忆。结果是一个称为MpRotect的系统，该系统利用了比OS更高的特权级别运行的一小部分软件。 mprotect保护过程的整个用户空间，仅需要对操作系统进行少量修改，并支持ARM，X86和RISC-V等主要体系结构。与诉诸于嵌套虚拟化的先前作品不同，在移动和嵌入式系统中通常是不希望的，Mprotect介导了OS如何访问内存并处理异常。我们报告了用ARMV8/Linux的Mprotect的实现，并通过宏观和微重组织进行了评估其性能。我们显示，Mguard的运行时TCB比相关系统小2〜3倍，并且在支持合法的OS访问用户空间的同时享有竞争性能。
Modern operating systems (OSes) have unfettered access to application data, assuming that applications trust them. This assumption, however, is problematic under many scenarios where either the OS provider is not trustworthy or the OS can be compromised due to its large attack surface. Our investigation began with the hypothesis that unfettered access to memory is not fundamentally necessary for the OS to perform its own job, including managing the memory. The result is a system called MProtect that leverages a small piece of software running at a higher privilege level than the OS. MProtect protects the entire user space of a process, requires only a small modification to the OS, and supports major architectures such as ARM, x86 and RISC-V. Unlike prior works that resorted to nested virtualization, which is often undesirable in mobile and embedded systems, MProtect mediates how the OS accesses the memory and handles exceptions. We report an implementation of MProtect called MGuard with ARMv8/Linux and evaluate its performance with both macro and microbenchmarks. We show MGuard has a runtime TCB 2~3 times smaller than related systems and enjoys competitive performance while supporting legitimate OS access to the user space.
