1. Fast Protection-Domain Crossing in the CHERI Capability-System Architecture.
- Author
-
Watson, Robert N.M., Norton, Robert M., Woodruff, Jonathan, Moore, Simon W., Neumann, Peter G., Anderson, Jonathan, Chisnall, David, Davis, Brooks, Laurie, Ben, Roe, Michael, Dave, Nirav H., Gudka, Khilan, Joannou, Alexandre, Markettos, A. Theodore, Maste, Ed, Murdoch, Steven J., Rothwell, Colin, Son, Stacey D., and Vadera, Munraj
- Subjects
- *
REDUCED instruction set computers , *COMPUTER architecture , *COMPUTER memory management , *COMPUTER input-output equipment , *FLOW control (Data transmission systems) , *FIELD programmable gate arrays - Abstract
Capability Hardware Enhanced RISC Instructions (CHERI) supplement the conventional memory management unit (MMU) with instruction-set architecture (ISA) extensions that implement a capability system model in the address space. CHERI can also underpin a hardware-software object-capability model for scalable application compartmentalization that can mitigate broader classes of attack. This article describes ISA additions to CHERI that support fast protection-domain switching, not only in terms of low cycle count, but also efficient memory sharing with mutual distrust. The authors propose ISA support for sealed capabilities, hardware-assisted checking during protection-domain switching, a lightweight capability flow-control model, and fast register clearing, while retaining the flexibility of a software-defined protection-domain transition model. They validate this approach through a full-system experimental design, including ISA extensions, a field-programmable gate array prototype (implemented in Bluespec SystemVerilog), and a software stack including an OS (based on FreeBSD), compiler (based on LLVM), software compartmentalization model, and open-source applications. [ABSTRACT FROM AUTHOR]
- Published
- 2016
- Full Text
- View/download PDF