Efficient Tagged Memory

Joannou, Alexandre; Woodruff, Jonathan; Kovacsics, Robert; Moore, Simon W.; Bradbury, Alex; Xia, Hongyan; Watson, Robert N. M.; Chisnall, David; Roe, Michael; Davis, Brooks; Napierala, Edward; Baldwin, John A.; Gudka, Khilan; Neumann, Peter G.; Mazzinghi, Alfredo; Richardson, Alexander; Son, Stacey; Markettos, A. Theodore

doi:10.1109/iccd.2017.112

Cited by 38 publications

(86 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To estimate the runtime in CPU cycles, we map executed instructions to actual CPU cycles using different pipelined CPU models. We first define a simple baseline model, against which we then compare two possible realizations of TIMBER-V, namely TIMBER-V Model A, capturing unoptimized implementations, and TIMBER-V Model [31,45,48]. We outline these CPU models in the following and summarize them in Table V.…”

Section: A Methodologymentioning

confidence: 99%

“…A tag cache can serve tags in parallel to ordinary memory accesses and thus, hide the tag checking latency for all cached tags. By comparing state-of-the-art literature on tagged memory architectures, we observe that tag caching can reduce the average overhead of tag accesses into the low single digit range [31,45,48]. Considering that our work utilizes two tag bits per word, we conservatively estimate the expected performance impact of the tag operations with 10%, which is reflected in Model B.…”

Section: A Methodologymentioning

confidence: 99%

“…Tagged memory transparently associates blocks of memory with additional metadata. It has been used for dynamic information flow tracking [48] as well as access control [53], and is still an active subject of research [31,45]. While tagged memory has been shown to support a variety of security policies like protection of control data [14], pointers [18] or capabilities [52], strong, efficient and flexible isolated execution is still an open problem for small embedded systems.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

TIMBER-V: Tag-Isolated Memory Bringing Fine-grained Enclaves to RISC-V

Weiser

Werner

Brasser

et al. 2019

Proceedings 2019 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Embedded computing devices are used on a large scale in the emerging internet of things (IoT). However, their wide deployment raises the incentive for attackers to target these devices, as demonstrated by several recent attacks. As IoT devices are built for long service life, means are required to protect sensitive code in the presence of potential vulnerabilities, which might be discovered long after deployment. Tagged memory has been proposed as a mechanism to enforce various fine-grained security policies at runtime. However, none of the existing tagged memory schemes provides efficient and flexible compartmentalization in terms of isolated execution environments. We present TIMBER-V, a new tagged memory architecture featuring flexible and efficient isolation of code and data on small embedded systems. We overcome several limitations of previous schemes. We augment tag isolation with a memory protection unit to isolate individual processes, while maintaining low memory overhead. TIMBER-V significantly reduces the problem of memory fragmentation, and improves dynamic reuse of untrusted memory across security boundaries. TIMBER-V enables novel sharing of execution stacks across different security domains, in addition to interleaved heaps. TIMBER-V is compatible to existing code, supports real-time constraints and is open source. We show the efficiency of TIMBER-V by evaluating our proofof-concept implementation on the RISC-V simulator.

show abstract

Section: A Methodologymentioning

confidence: 99%

Section: A Methodologymentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

TIMBER-V: Tag-Isolated Memory Bringing Fine-grained Enclaves to RISC-V

Weiser

Werner

Brasser

et al. 2019

Proceedings 2019 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Then there is a Bluespec [11] FPGA hardware implementation of the architecture, and a software stack above it, adapting LLVM [12] and FreeBSD [13] to CHERI-MIPS. All this has involved extensive work on the interaction between the capability system and systems aspects of memory management (static and dynamic linking, process creation, context switching, page swapping and signal delivery) [14]; on the overhead of compiling pointers to capabilities [5], [15]; on compartmentalisation of legacy software [16]; and on the performance overhead of tagged memory [17] and protectiondomain switches [18]. The underlying ideas are portable, not MIPS-specific, and work is underway on experimental academic RISC-V and industrial Arm versions -the latter in a major project involving Arm and the UK Government [19], [20] to produce prototype silicon and a development board.…”

Section: A the Cheri Contextmentioning

confidence: 99%

Rigorous engineering for hardware security: Formal modelling and proof in the CHERI design and implementation process

Nienhuis

Joannou

Bauereiss

et al. 2020

2020 IEEE Symposium on Security and Privacy (SP)

Self Cite

View full text Add to dashboard Cite

The root causes of many security vulnerabilities include a pernicious combination of two problems, often regarded as inescapable aspects of computing. First, the protection mechanisms provided by the mainstream processor architecture and C/C++ language abstractions, dating back to the 1970s and before, provide only coarse-grain virtual-memory-based protection. Second, mainstream system engineering relies almost exclusively on test-and-debug methods, with (at best) prose specifications. These methods have historically sufficed commercially for much of the computer industry, but they fail to prevent large numbers of exploitable bugs, and the security problems that this causes are becoming ever more acute. In this paper we show how more rigorous engineering methods can be applied to the development of a new security-enhanced processor architecture, with its accompanying hardware implementation and software stack. We use formal models of the complete instruction-set architecture (ISA) at the heart of the design and engineering process, both in lightweight ways that support and improve normal engineering practice-as documentation, in emulators used as a test oracle for hardware and for running software, and for test generation-and for formal verification. We formalise key intended security properties of the design, and establish that these hold with mechanised proof. This is for the same complete ISA models (complete enough to boot operating systems), without idealisation. We do this for CHERI, an architecture with hardware capabilities that supports fine-grained memory protection and scalable secure compartmentalisation, while offering a smooth adoption path for existing software. CHERI is a maturing research architecture, developed since 2010, with work now underway on an Arm industrial prototype to explore its possible adoption in mass-market commercial processors. The rigorous engineering work described here has been an integral part of its development to date, enabling more rapid and confident experimentation, and boosting confidence in the design.

show abstract

“…Dynamic analysis techniques as in [Nethercote and Seward 2007;Rosu et al 2009;Serebryany et al 2012] instrument program executables and report errors as they occur during program execution. Recently, there has also been emerging interest in enforcing runtime memory safety using hardware and software support for tagged memory [Joannou et al 2017;lowRISC 2019;Oleksenko et al 2018;Serebryany et al 2018;Watson et al 2015].…”

Section: Related Workmentioning

confidence: 99%

Deciding memory safety for single-pass heap-manipulating programs

Mathur

Murali

Krogmeier

et al. 2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

We investigate the decidability of automatic program verification for programs that manipulate heaps, and in particular, decision procedures for proving memory safety for them. We extend recent work that identified a decidable subclass of uninterpreted programs to a class of alias-aware programs that can update maps. We apply this theory to develop verification algorithms for memory safetyÐ determining if a heap-manipulating program that allocates and frees memory locations and manipulates heap pointers does not dereference an unallocated memory location. We show that this problem is decidable when the initial allocated heap forms a forest data-structure and when programs are streaming-coherent, which intuitively restricts programs to make a single pass over a data-structure. Our experimental evaluation on a set of library routines that manipulate forest data-structures shows that common single-pass algorithms on data-structures often fall in the decidable class, and that our decision procedure is efficient in verifying them.Deciding Memory Safety for Single-Pass Heap-Manipulating Programs 35:3 must either be the case that x is different from z in any data-model/heap or it must be the case that x is equal to z in all data-models/heaps.We show that alias-awareness is a panacea for our problems. For alias-aware programs (programs whose executions are all alias-aware), we show we can associate terms with variables after a computation that updates maps, and further show that the notion of coherence extends naturally to programs that update maps. We then show that for coherent alias-aware programs, the verification problem becomes decidable. These results constitute the first main contribution of the paper. Application to Verifying Memory SafetyWe then study the application of our framework to verifying memory safety. Our key observation is that for programs that manipulate forest data-structures (data-structures consisting of disjoint tree-like structures), programs are naturally alias-aware. Intuitively, when traversing forest datastructures, aliasing information is implicitly present. For instance, if x points to a location of a forest data-structure, we know that the location pointed to by x, the one pointed to by the left child x·left, and the one pointed to by the right child x·right are all different.In this paper, we define memory safety as follows. A heap-manipulating program starts with a set of allocated heap locations. During its execution, it dereferences pointers on heap locations, and allocates and frees locations. A program is memory safe if it never dereferences a location that is not in the allocated set. The above definition of memory safety captures the usual categories of memory safety errors such as null-pointer dereferences, use after free, use of uninitialized memory, illegal freeing of memory, etc. [Hicks 2014]. However, in this paper, we do not consider allocation of contiguous blocks of arbitrary size of memory (and hence do not handle arrays and buffer overflows of arrays in languages like ...

show abstract

Efficient Tagged Memory

Cited by 38 publications

References 21 publications

TIMBER-V: Tag-Isolated Memory Bringing Fine-grained Enclaves to RISC-V

TIMBER-V: Tag-Isolated Memory Bringing Fine-grained Enclaves to RISC-V

Rigorous engineering for hardware security: Formal modelling and proof in the CHERI design and implementation process

Deciding memory safety for single-pass heap-manipulating programs

Contact Info

Product

Resources

About