Capability-Based Forward-Edge Control-Flow Integrity Circuitry
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Instruction Set Architectures (ISAs) lack effective solutions for comprehensive control-flow integrity and memory safety, particularly in preventing memory corruption and ensuring correct function calls, leading to vulnerabilities in foundational software layers like operating systems and web browsers.
Innovation Solution
The implementation of capability-based instructions and a capability management circuit that enforce forward-edge control-flow integrity (FECFI) by using capabilities to authorize memory accesses and enforce fine-grained access control, ensuring that only valid capabilities can access protected memory locations, thereby preventing out-of-bound accesses and dangling pointers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If capability-based instructions are implemented to enforce forward-edge control-flow integrity, then security against memory corruption is improved, but device complexity increases
Solution Approach 1:
The capability structure is segmented into distinct fields: address field for memory location, bounds field for access limits, and validity tag field for authorization. This segmentation allows the processor to enforce control-flow integrity through structured, modular capability checks rather than monolithic security logic, improving reliability while managing complexity through organized data structures.
Solution Approach 2:
Capabilities serve as intermediary tokens that mediate between the processor and memory access requests. Instead of direct memory access control, the system uses capability structures as intermediaries that encode authorization information, enabling fine-grained access control and control-flow integrity enforcement without requiring complex hardwired security circuits in the processor.
2Reliability
If fine-grained access control is enforced through capability checks, then memory safety is improved, but processing speed deteriorates
Solution Approach 1:
Authorization information is prepared in advance and embedded within capability structures before memory access occurs. The validity tag and bounds are pre-computed and stored in the capability, allowing the processor to perform rapid validation checks during execution rather than computing access permissions in real-time, thus maintaining memory safety while minimizing processing overhead.
Solution Approach 2:
The capability structure merges multiple security attributes (address, bounds, validity tag) into a single unified data structure that can be processed in one operation. By combining authorization checks and address validation into a single capability verification step, the system enforces memory safety without requiring multiple separate processing stages, thereby maintaining processing speed.
Data Source
AI summary
Techniques for implementing forward-edge control-flow integrity (FECFI) using capability instructions in a hardware processor are described. In certain examples, a hardware processor (e.g., core) includes a capability management circuit to check a capability for a memory access request for a memory, the capability comprising an address field and a bounds field that is to indicate a lower bound and an upper bound of an address space to which the capability authorizes access; a decoder circuit to decode a single instruction into a decoded single instruction, the single instruction comprising: a first capability to indicate a first call table comprising a respective entry for each of a plurality of functions of a first type, a field to indicate a first offset of a first entry for a first function requested for execution, and an opcode to indicate the capability management circuit is to perform a first check that the first offset is within a lower bound and an upper bound of the first capability and a second check that the first offset is a permitted offset for the entries in the first call table, and in response to the first check and the second check both passing, cause an execution circuit to execute the first function; and the execution circuit to execute the decoded single instruction according to the opcode.