Hardware interlocks that enforce semantic invariants and allow fine-grained privilege separation can be built with reasonable costs given modern semiconductor technology. In the common error-free case, these mechanisms operate largely in parallel with the intended computation, monitoring the semantic intent of the computation on an operation-by-operation basis without sacrificing cycles to perform security checks. We specifically explore five mechanisms: (1) pointers with manifest bounds (fat pointers), (2) hardware types (atomic groups), (3) processor-supported authority, (4) authority-changing procedure calls (gates), and (5) programmable metadata validation and propagation (tags and dynamic tag management). These mechanisms allow the processor to continuously introspect on its operation, efficiently triggering software handlers on events that require logging, merit sophisticated inspection, or prompt adaptation. We present results from our prototype FPGA implementation of a processor that incorporates these mechanisms, quantifying the logic, memory, and latency requirements. We show that the dominant cost is the wider memory necessary to hold our metadata (the atomic groups and programmable tags), that the added logic resources make up less than 20% of the area of the processor, that the concurrent checks do not degrade processor cycle time, and that the tag cache is comparable to a small L1 data cache.

No abstract

Toadfish (Opsanus tau} essentially lacking circulating erythrocytes were prepared by repeated exchange transfusion with serum. The rate of nitrogen secretion is not changed by removal of the erythrocytes. Oxygen secretion is slowed drastically. This shows that nitrogen secretion does not require erythrocytes and is not driven by oxygen secretion. In the absence of circulating erythrocytes, oxygen and nitrogen are brought into the swimbladder in proportion to their concentrations in blood plasma. Carbon dioxide partial pressure in the secreted gas mixture is three to fourfold greater than the pressure generated by acidifying arterial blood. This implies counter-current multiplication of the small increment of carbon dioxide pressure brought about by acidification of the blood. In the presence of blood buffers, increased carbon dioxide pressure will increase blood bicarbonate. Three independent estimates indicate that, during gas secretion, gas gland blood is near pH 6.5. Total carbon dioxide (CO 2 , HCO 3 ~, CO 3 = ) is increased from the arterial value near 2 mM to about 14 mAf, divided nearly equally between carbon dioxide and bicarbonate anion. The increment in total blood carbon dioxide concentration together with the well-known increment in lactate anion may serve to salt out inert gases from solution in blood plasma.

SAFE is a large-scale, clean-slate co-design project encompassing hardware architecture, programming languages, and operating systems. Funded by DARPA, the goal of SAFE is to create a secure computing system from the ground up. SAFE hardware provides memory safety, dynamic type checking, and native support for dynamic information flow control. The Breeze programming language leverages the security features of the underlying machine, and the "zero kernel" operating system avoids relying on any single privileged component for overall system security. The SAFE project is working towards formally verifying security properties of the runtime software. The SAFE system sets a new high-water mark for system security, allowing secure applications to be built on a solid foundation rather than on the inherently vulnerable conventional platforms available today.