raspi2 中的安全功能 kernel

Question

I want to demontsrate kernel exploitation on raspberry pi, by using qemu for emulation. When I use vexpress-v2p-ca9.dtb it work, kernel want to execute the userspace code, but when I try to use another dtb for raspi machine which is bcm2709-rpi-2-b.dtb it won't work and there is no error message from the kernel, it just hanging on before it jump to userspace address.

I have unable PAN in kernel config.

I want kernel in raspi dtb able to execute userpace code.

Answer 1

You cannot simply pass a different DTB file to QEMU to cause it to emulate a different machine type. What controls the kind of machine that QEMU emulates is the '-machine' option. The DTB is just a file passed to the guest kernel to tell the guest kernel what it is running on. If this doesn't match what it's actually running on, then the kernel will crash in early bootup, usually without being able to print a message. All of these things need to match up:

• the QEMU -machine command line option
• the guest kernel (ie it needs to be built with support for the machine and its devices)
• the guest DTB