Architectural Support for Software-Defined Metadata Processing

Abstract

Optimized hardware for propagating and checking softwareprogrammable metadata tags can achieve low runtime overhead. We generalize prior work on hardware tagging by considering a generic architecture that supports softwaredefined policies over metadata of arbitrary size and complexity; we introduce several novel microarchitectural optimizations that keep the overhead of this rich processing low. Our model thus achieves the efficiency of previous hardwarebased approaches with the flexibility of the software-based ones. We demonstrate this by using it to enforce four diverse safety and security policies-spatial and temporal memory safety, taint tracking, control-flow integrity, and code and data separation-plus a composite policy that enforces all of them simultaneously. Experiments on SPEC CPU2006 benchmarks with a PUMP-enhanced RISC processor show modest impact on runtime (typically under 10%) and power ceiling (less than 10%), in return for some increase in energy usage (typically under 60%) and area for on-chip memory structures (110%).

TIMBER-V: Tag-Isolated Memory Bringing Fine-grained Enclaves to RISC-V

“…Schemes that associate memory with metadata, like for example dynamic analysis tools [43,44,46], rely on software-based solutions instead. However, recent research on tagged-memory architectures in the system security context [8,19,45] hints that re-establishing hardware-support can considerably improve security.…”

“…Subsequently, many hardware-based tagged memory architectures have been developed. In particular, for DIFT, implementations range from single tag bit schemes with fixed policy (e.g., Minos [14] and CHERI [52]), over multi-bit schemes with partially configurable policy (e.g., Raksha [15], DIFT [48], DIFT with coprocessor [32]), to schemes with configurable bit width and fully programmable policy and enforcement (e.g., FlexiTaint [49], instruction-grain lifeguards [11], Harmoni [17], PUMP [19]).…”

“…TIMBER-V, on the other hand, does not perform any tag propagation but utilizes tags for isolation purposes. Abusing a DIFT architecture solely for isolation, while possible in some schemes like Raksha [15] and PUMP [19], is needlessly wasteful. Secondly, TIMBER-V introduces a new trusted security domain, and the isolation and update policies depend on the currently active domain.…”

“…In particular, data flow isolation [45] cannot provide strong isolation since tags can be destructively written by untrusted software. Other existing solutions are not appropriate for low-end embedded devices due to their memory overhead stemming from large tags [54] or fully programmable but expensive tag engines [11,17,19,49]. Hence, currently no existing tagged memory schemes supports efficient isolated execution on small embedded devices.…”

CHERI Concentrate: Practical Compressed Capabilities

“…Complex tags on memory locations may also encode protection metadata for pointers in memory [29], [30], [31].…”