Hardware Support for Safety Interlocks and Introspection

• Main Authors: Dhawan, U., Kwon, A., Kadric, E., Hritcu, C., Pierce, B. C., Smith, J. M., DeHon, A., Malecha, G., Morrisett, G., Knight, Thomas F., Sutherland, A., Hawkins, T., Zyxnfryx, A., Wittenberg, D., Trei, P., Ray, S., Sullivan, G.
• Format: Conference Proceeding
• Language: English
• Subjects: complete mediation; hardware interlocks; least privilege; Processor; security; separation of privilege
• DOI: 10.1109/SASOW.2012.11

Hardware interlocks that enforce semantic invariants and allow fine-grained privilege separation can be built with reasonable costs given modern semiconductor technology. In the common error-free case, these mechanisms operate largely in parallel with the intended computation, monitoring the semantic intent of the computation on an operation-by-operation basis without sacrificing cycles to perform security checks. We specifically explore five mechanisms: (1) pointers with manifest bounds (fat pointers), (2) hardware types (atomic groups), (3) processor-supported authority, (4)authority-changing procedure calls (gates), and (5) programmable metadata validation and propagation (tags and dynamic tag management). These mechanisms allow the processor to continuously introspect on its operation, efficiently triggering software handlers on events that require logging, merit sophisticated inspection, or prompt adaptation. We present results from our prototype FPGA implementation of a processor that incorporates these mechanisms, quantifying the logic, memory, and latency requirements. We show that the dominant cost is the wider memory necessary to hold our metadata (the atomic groups and programmable tags), that the added logic resources make up less than 20% of the area of the processor, that the concurrent checks do not degrade processor cycle time, and that the tag cache is comparable to a small L1 data cache.