The CHERI capability model: Revisiting RISC in an age of risk

Proceedings - International Symposium on Computer Architecture

Volumn , Issue , 2014, Pages 457-468

  Woodruff, Jonathan ^a   Watson, Robert N M ^a   Chisnall, David ^a   Moore, Simon W ^a   Anderson, Jonathan ^a   Davis, Brooks ^b   Laurie, Ben ^c   Neumann, Peter G ^b   Norton, Robert ^a   Roe, Michael ^a  

^a UNIVERSITY OF CAMBRIDGE   (United Kingdom)

^b SRI INTERNATIONAL   (United States)

^c GOOGLE   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER SCIENCE; COMPUTERS;

CAPABILITY MODEL; FAULT ISOLATION; MEMORY MODELING; MEMORY PROTECTION; MEMORY SAFETY; SECURITY CHALLENGES;

COMPUTER ARCHITECTURE;

EID: 84905455833     PISSN: 10636897     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ISCA.2014.6853201     Document Type: Conference Paper

References (48)

1. T. Alves and D. Felton, "ARM TrustZone: Integrated hardware and software security," Information Quarterly, vol. 3, no. 4, July 2004.
2. T. M. Austin, S. E. Breach, and G. S. Sohi, "Efficient detection of all pointer and array access errors," in Proceedings of the ACM SIGPlAN 1994 conference on Programming language design and implementation, ser. PLDl ' 94. New York, NY, USA: ACM, 1994, pp. 290-301.
3. A. Belay, A. Bittau, A. Mashtizadeh, D. Terei, D. Mazieres, and C. Kozyrakis, "Dune: safe user-level access to privileged CPU features;' in Proceedings of the 10th USENIX coriference on Operating Systems Design and Implementation, ser. OSDI' 12, 2012, pp. 335-348.
4. Bluespec SystemVerilog Version 3.8 Reference Guide, Bluespec, Inc., Waltham, M A , November 2004.
5. N. P. Carter, S. W. Keckler, and W. J. Dally, "Hardware support for fast capability-based addressing," SIGPLAN Not., vol. 29, no. 11 , pp. 319-327, Nov. 1994.
6. B. Chess, "Improving computer security using extended static checking," in Proceedings of the 2002 Symposium on Security and Privacy. Oakland, California: IEEE Computer Society, May 2002, pp. 160-173.
7. R. Childs Jr, J. Crawford, D. House, and R. Noyce, "A Processor Family for Personal Computers," Proceedings of the 1EEE, vol. 72, no. 3 , pp. 363-376, 1984.
8. S. Cleveland, "x86-64 technology white paper," Advanced Micro Devices, Tech. Rep., 02 2002.
9. C. Cowan, F. Wagle, C. Pu, S. Beattie, and J. Walpole, "Buffer overflows: Attacks and defenses for the vulnerability of the decade," in DARPA Iriformation Survivability Coriference and Exposition, 2000. DlSCEX'OO. Proceedings, vol. 2. IEEE, 2000, pp. 119-129.
10. P. Denning, "Virtual memory," ACM Computing Surveys (CSUR), vol. 2, no. 3, pp. 153-189, 1970.
11. J. B. Dennis and E. C. Van Horn, "Programming semantics for multiprogrammed computations," Commun. ACM, vol. 9, no. 3, pp. 143-155, 1966.
12. J. Devietti, C. Blundell, M. M. K. Martin, and S. Zdancewic, "Hardbound: architectural support for spatial safety of the C programming language," SIGARCH Comput. Archit. News, vol. 36, no. 1 , pp. 103-114, Mar. 2008.
13. J. Evans, " A scalable concurrent malloc(3) implementation for FreeBSD," in BSDCan, 2006.
14. J. Fotheringham, "Dynamic storage allocation in the Atlas computer, including an automatic use of a backing store," Communications of the ACM, vol. 4, no. 10, pp. 435-436, 1961.
15. A. Frame and C. Turner, "Introducing new ARM Cortex-R technology for safe and reliable systems," ARM, Tech. Rep., 03 2011.
16. J. Gosling and H. McGilton, The Java language environment. Sun Microsystems Computer Company, 1995, vol. 2550.
17. Intel Pic., "Introduction to Intel® memory protection ex tensions," http://software. intel.com/en-us/articles/introduction-to-intel- memory-protection-extensions, July 2013.
18. T. Jim, J. G. Morrisett, D. Grossman, M. W. Hicks, J. Cheney, and Y. Wang, "Cyclone: A safe dialect of C," in ATEC '02: Proceedings of the USENIX Annual Technical Conference, 2002, pp. 275-288.
19. G. Klein, J. Andronick, K. Elphinstone, G. Heiser, D. Cock, P. Derrin, D. Elkaduwe, K. Engelhardt, R. Kolanski, M. Norrish, T. Sewell, H. Tuch, and S. Winwood, "seL4: Formal verification of an operatingsystem kernel," Commun. ACM, vol. 53, pp. 107-115 , June 2009.
20. A. Kwon, U. Dhawan, J. M. Smith, T. F. Knight, Jr., and A. DeHon, "Low-fat pointers: Compact encoding and efficient gate-level implementation of fat pointers for spatial safety and capability-based security," in 20th ACM Conference on Computer and Communications Security, November 2013.
21. L. Lam and T. Chiueh, "Checking array bound violation using segmentation hardware," in IEEE International Conference on Dependable Systems and Networks, 2005, pp. 388-397.
22. c. Lattner and V. Adve, "LLVM: A compilation framework for lifelong program analysis & transformation," in Proceedings of the International Symposium on Code Generation and Optimization: Feedbackdirected and runtime optimization, ser. CGO ' 04, 2004, pp. 75-86.
23. H. M. Levy, Capability-Based Computer Systems. Newton, MA, USA: Butterworth-Heinemann, 1984.
24. Y. Mao, H. Chen, D. Zhou, X. Wang, N. Zeldovich, and M. F. Kaashoek, "Software fault isolation with API integrity and multi-principal modules," in SOSP 2011: Proceedings of the 23rd ACM Symposium on Operating Systems Principles, 2011.
25. A. J. Mayer, 'The architecture of the Burroughs B5000: 20 years later and still ahead of the times?" ACM SIGARCH Computer Architecture News, vol. 10, no. 4, pp. 3-10, 1982.
26. M. K. McKusick and G. V. Neville-Neil, The design and implementation of the FreeBSD operating system. Pearson Education, 2004.
27. J. Navarro, S. Iyer, P. Druschel, and A. L. Cox, "Practical, transparent operating system support for superpages," in OSDI, 2002.
28. G. C. Necula, S. McPeak, and W. Weimer, "CCured: Type-safe retrofitting of legacy code," in ACM SIGPLAN Notices, vol. 37, no. 1 , 2002, pp. 128-139.
29. D. A. Patterson and C. H. S equin, "RISC I : A reduced instruction set VLSI computer," in Proceedings of the 8th Annual Symposium on Computer Architecture, 1981 , pp. 443-457.
30. F. J. Pollack, G. W. Cox, D. W. Hammerstrom, K. C. Kahn, K. K. Lai, and J. R. Rattner, "Supporting Ada memory management in the iAPX-432," in ACM SIGARCH Computer Architecture News, vol. 10, no. 2, 1982, pp. 117-131.
31. F. Qian, L. Hendren, and C. Verbrugge, "A comprehensive approach to array bounds check elimination for Java," in Compiler Construction. Springer, 2002, pp. 325-341.
32. B. Randell and C. Kuehner, "Dynamic Storage Allocation Systems," Communications of the ACM, vol. 11 , no. 5, pp. 297-306, 1968.
33. c. Reis and S. D. Gribble, "Isolating web programs in modern browser architectures," in EuroSys '09: Proceedings of the 4th ACM European Conference on Computer Systems. New York, NY, USA: ACM, 2009, pp. 219-232.
34. A. Rogers, M. C. Carlisle, J. H. Reppy, and L. J. Hendren, "Supporting dynamic data structures on distributed-memory machines," ACM Trans. Program. Lang. Syst., vol. 17 , no. 2, pp. 233-263, Mar. 1995.
35. J. Saltzer and M. Schroeder, "The protection of information in computer systems," Proceedings of the IEEE, vol. 63, no. 9, pp. 1278-1308, September 1975.
36. M. Schroeder and J. Saltzer, "A hardware architecture for implementing protection rings," Communications of the ACM, vol. 15 , no. 3, March 1972.
37. K. Serebryany, D. Bruening, A. Potapenko, and D. Vyukov, "AddressSanitizer: A fast address sanity checker," in USENIX ATC, vol. 12, 2012.
38. R. Shetty, M. Kharbutli, Y. Solihin, and M. Prvulovic, "Heapmon: A helper-thread approach to programmable, automatic, and low-overhead memory bug detection," IBM J. Res. Dev., vol. 50, no. 2/3, pp. 261-275 , Mar. 2006.
39. R. Wahbe, S. Lucco, T. E. Anderson, and S. U. L. Graham, "Efficient software-based fault isolation," in SOSP '93: Proceedings of the fourteenth ACM Symposium on Operating Systems Principles, New York, NY, USA, 1993, pp. 203-216.
40. R. N. M. Watson, J. Anderson, B. Laurie, and K. Kennaway, "Capsicum: Practical capabilities for Unix," in Proceedings of the 19th USENIX Security Symposium. USENIX, August 2010.
41. R. N. M. Watson, P. G. Neumann, J. Woodruff, J. Anderson, D. Chisnall, B. Davis, B. Laurie, S. W. Moore, S. J. Murdoch, and M. Roe, "Capability Hardware Enhanced RISC Instructions: CHERI Instruction-S et Architecture," University of Cambridge, Computer Lab., Tech. Rep. UCAM-CL-TR-850, May 2014. [Online]. Available: http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-850.html
42. M. Wilkes and R. Needham, The Cambridge CAP computer and its operating system. Elsevier North Holland, New York, 1979.
43. A. Wilkinson et al., "A penetration study of a Burroughs large system," ACM Operating Systems Review, vol. 15, no. 1, pp. 14-25, January 1981.
44. J. Williams and M. Wolczko, "An obj ect-based memory architecture," in Fourth International Workshop on Persistent Objects. Morgan Kaufmann, 1990, pp. 114-130.
45. E. Witchel, J. Cates, and K. Asanovic, Mondrian memory protection. ACM, 2002, vol. 37, no. 10.
46. E. Witchel, J. Rhee, and K. Asanoví, "Mondrix: Memory isolation for Linux using Mondriaan memory protection;' in Proceedings of the 20th ACM Symposium on Operating Systems Principles, October 2005.
47. G. Wright, M. L. Seidl, and M. Wolczko, "An object-aware memory architecture," Science of Computer Programming, vol. 62, pp. 145-163, 2006.
48. B. Yee, D. Sehr, G. Dardyk, J. B. Chen, R. Muth, T. Ormandy, S. Okasaka, N. Narula, and N. Fullagar, "Native client: A sandbox for portable, untrusted x86 native code," in SP '09: Proceedings of the 2009 30th IEEE Symposium on Security and Privacy, 2009, pp. 79-93.