The CHERI capability model Revisiting RISC in an age of risk

Transcription

1 CTS CTSRDCRASH-worthy Trustworthy Systems Research and Development The CHERI capability model Revisiting RISC in an age of risk Jonathan Woodruff, Robert N. M. Watson, David Chisnall, Simon W. Moore, Jonathan Anderson, Brooks Davis, Ben Laurie, Peter G. Neumann, Robert Norton, Michael Roe University of Cambridge, SRI International, Google ISCA June 2014 Approved for public release. This research is sponsored by the Defense Advanced Research Projects Agency (DARPA) and the Air Force Research Laboratory (AFRL), under contract FA C The views, opinions, and/or findings contained in this article/presentation are those of the author/presenter and should not be interpreted as representing the official views or policies, either expressed or implied, of the Defense Advanced Research Projects Agency or the Department of Defense.

2 Memory Safety Crisis ~82% of exploited vulnerabilities in 2012 Software Vulnerability Exploitation Trends, Microsoft How are processors responding? 2

3 Memory Safety Deprecation & Demand Burroughs B5000 IBM System/38 Consensus on paged virtual memory Burroughs Corporation IBM Corporation Cambridge CAP computer RISC Security becoming marketable Hardware support for fine-grained memory safety was the future! Intel MPX 3

4 We ve Built A Real Open Source System CHERI processor + peripherals on FPGA Extension of FreeBSD OS (Including Capsicum software capabilities) Clang & LLVM 4

5 Capability: Unforgeable token of authority. Some capabilities : File descriptors (Capsicum, L4) Segment descriptors (CAP, Intel iapx) Pointers in a virtual machine (Java,.Net) Bounded pointers (M-Machine) 5

6 CHERI Capabilities are Unforgeable Fat Pointers Fat Pointer = Base + Length + Permissions 6

7 Build a RISC Capability Machine Single-cycle instructions Load/Store architecture Compiler & OS manage capabilities 7

8 Build A Useful RISC Capability Machine Keep page-table for virtualisation and backward compatibility Constrain existing loads and stores with implied capability register Integrate with 64-bit MIPS ISA (Applicable to any RISC ISA) 8

9 Paged Memory OS managed Enables swapping Centralized Allows revocation Address validation 9

10 Capabilities Compiler managed Precise Can be delegated Many domains Pointer safety 10

11 Paged Memory + Capabilities OS managed Enables swapping Centralized CHERI Allows revocation Address validation 11 Compiler managed Precise Can be delegated Many domains Pointer safety

12 A CHERI Capability Base of memory of region base [64] Length of region Permissions [16] Access permissions length [64] Experimental [112] 256 bits 12

13 Capability Register File Both Implicit and Explicit Use Implicit Program Counter Capability base length perms C0 (Implicit Data Capability) base length perms C1 base length perms C2 base length perms... C31 base length perms 13

14 Address calculation Instruction Fetch Data Access PC Rn V i r t u a l A d d r e s s TLB P h y s i c a l A d d r e s s Physical Memory 14

15 Address calculation Instruction Fetch Legacy Data Access PC O f f s e t Rn PCC C0 V i r t u a l A d d r e s s TLB P h y s i c a l A d d r e s s Physical Memory 15

16 Address calculation Instruction Fetch Legacy Data Access Capability Data Access PC Rn O f f s e t Rn PCC C0 Cn V i r t u a l A d d r e s s TLB P h y s i c a l A d d r e s s Physical Memory 16

17 Capabilities can Replace Pointers Unprivileged capability manipulation instructions Capability loads and stores for all required memory operations 17

18 Capability Transformations Strictly Reduce Privilege Mnemonic Function CIncBase Increase base and decrease length CSetLen Reduce length CAndPerm Restrict permissions CClearTag Invalidate a capability register Full Instruction Set Reference:

19 LWC2 Complete Set of Capability Loads and Stores Width 0x32 rd cb rt o set 1 0 CLB rd, rt, offset(cb) Mnemonic Function CSC Store capability register CLC Load capability register CL[BHWD][U] Load byte-double via capability register CS[BHWD] Store byte-double via capability register CLLD Load-linked via capability register CSCD Store conditional via capability register Signed Full Instruction Set Reference:

20 Tags to Protect Capabilities in Memory 1 bit 256 bits TAGS DATA Capabilities on the stack and in data structures 20

21 Tag Table in Commodity DRAM TAGS <0.5% Tag Lookup (with cache) DRAM DATA L2 Cache Tags on physical memory Cache line is tag + data 21

22 OS Support is Simple Preserve per-process capability state Deliver capability exception signals Result: Capability machine in each address space 22

23 C-language Support is Straightforward Clang extension to implement pointers as capabilities capability qualifier on pointers Used almost like any other pointer (no subtraction) 23

24 C-language Support is Straightforward! capability char *mystring = ( capability char*)malloc(size);!!! mystring[size] = d ;!!! jalr malloc cincbase $ c1, $c0, returnvalue csetlen $c1, $c1, size csb d, size, 0($c1) 24

25 C-language Support is Straightforward! capability char *mystring = ( capability char*)malloc(size);!!! mystring[size] = d ; 25!!! jalr malloc cincbase $ c1, $c0, returnvalue csetlen $c1, $c1, size csb Run-time Trap! d, size, 0($c1)

26 Program Compartmentalisation is Flexible Coarse-grained using C0, the implicit data capability Fine-grained using native capability addressing 26 Asa Wilson - CC BY-SA 2.0

27 CHERI is Built on BERI Bluespec Extensible RISC Implementation Capability! Unit Mul/Div 64-bit MIPS R4000 ISA 6-stage pipeline FPU Debug Main! Pipeline Single issue, in order >100 MHz on Altera Stratix IV Open source at 27 Tag! Controller Branch Predictor 16k L1D 16k L1I 64k L2 TLB! & CP0

28 Address Calculation Pipeline IF/ID ID/EX EX/MEM MEM/WB PC Instruction Memory General Purpose Registers ALU Data Memory 28

29 Address Calculation Pipeline IF/ID ID/EX EX/MEM MEM/WB PC PCC + Instruction Memory General Purpose Registers ALU + Data Memory PC offset via PCC Capability Registers Data Access offset via arbitrary capability register 29

30 Address Calculation Pipeline IF/ID ID/EX EX/MEM MEM/WB PCC + PC Instruction Memory Use absolute PC instead General Purpose Registers Capability Registers ALU + Data Access offset via arbitrary capability register Data Memory 30

31 See Paper for Limit Study Conclusions: CHERI is competitive Our capability size is the only notable overhead A hypothetical 128-bit CHERI has leading performance

32 CHERI vs. CCured 32 Running in userspace under FreeBSD on CHERI FPGA prototype We ported CCured, an automatic memory-safe transform for C

33 Olden Bounds-checking Overhead(Percentage( 140& 120& 100& 80& 60& 40& 20& 0&,20& & 23.6& 23.72& 23.45& 8.99& 5.19& 29.66& CCured& CHERI&,6.06& Bisort& MST& TreeAdd& Perimeter& 33

34 Protection Slowdown vs. Working Set Size Percent'Run*me'Overhead' 25" 20" 15" 10" 5" 0" TreeAdd" L1 L2 TLB 2" 4" 8" 16" 32" 64" 128" 256" 512" 1024" CHERI'working'set'size'in'Kilobytes' 34

35 Protection Slowdown vs. Working Set Size Percent'Overhead' 25" 20" 15" 10" 5" 0" TreeAdd" BiSort" MST" Perimeter" 2" 4" 8" 16" 32" 64" 128" 256" 512" 1024" CHERI'working'set'size'in'Kilobytes' 35

36 Conclusions Memory safety needs hardware support Current approaches are too weak or too disruptive A hybrid capability approach is compatible and scalable 36

37 Questions? CHERI & SoC RTL, LLVM, & FreeBSD are open source! Thanks to DARPA and Google for support! 37