Abstract:With the continuous increase in the number of software-based attacks, there has been a growing effort towards isolating sensitive data and trusted software components from untrusted third-party components. A hardware-assisted intra-process isolation mechanism enables software developers to partition a process into isolated components and in turn secure sensitive data from untrusted components. However, most of the existing hardware-assisted intra-process isolation mechanisms in modern processors, such as ARM and IBM Power, rely on costly kernel operations for switching between trusted and untrusted domains. Recently, Intel introduced a new hardware feature for intra-process memory isolation, called Memory Protection Keys (MPK), which enables a user-space process to switch the domains in an efficient way. While the efficiency of Intel MPK enables developers to leverage it for common use cases such as Code-Pointer Integrity, the limited number of unique domains (16) prohibits its use in cases such as OpenSSL where a large number of domains are required. Moreover, Intel MPK suffers from the protection key use-after-free vulnerability. To address these shortcomings, in this paper, we propose an efficient intra-process isolation technique for the RISC-V open ISA, called SealPK, which supports up to 1024 unique domains. SealPK prevents the protection key use-after-free problem by leveraging a lazy de-allocation approach. To further strengthen SealPK, we devise three novel sealing features to protect the allocated domains, their associated pages, and their permissions from modifications or tampering by an attacker. To demonstrate the feasibility of our design, we implement SealPK on a RISC-V Rocket processor, provide the OS support for it, and prototype our design on an FPGA. We demonstrate the efficiency of SealPK by leveraging it to implement an isolated shadow stack on our FPGA prototype.

Design, Implementation and Evaluation of the SVNAPOT Extension on a RISC-V Processor

Enabling Virtual Memory Research on RISC-V with a Configurable TLB Hierarchy for the Rocket Chip Generator

SPARK: an Automatic Score-Power-Area Efficient RISC-V Processor Microarchitecture SeeKer

Design and implementation of a synchronous Hardware Performance Monitor for a RISC-V space-oriented processor

Scalable and RISC-V Programmable Near-Memory Computing Architectures for Edge Nodes

A First Look at RISC-V Virtualization from an Embedded Systems Perspective

XpulpNN: Enabling Energy Efficient and Flexible Inference of Quantized Neural Network on RISC-V based IoT End Nodes

Culsans: An Efficient Snoop-based Coherency Unit for the CVA6 Open Source RISC-V application processor

From MMU to MPU: adaptation of the Pip kernel to constrained devices

HeapSafe: Securing Unprotected Heaps in RISC-V

KeyVisor -- A Lightweight ISA Extension for Protected Key Handles with CPU-enforced Usage Policies

Design-Technology Co-Optimization for NVM-based Neuromorphic Processing Elements

Mixed-precision Neural Networks on RISC-V Cores: ISA extensions for Multi-Pumped Soft SIMD Operations

CVA6 RISC-V Virtualization: Architecture, Microarchitecture, and Design Space Exploration

A Mixed-Precision RISC-V Processor for Extreme-Edge DNN Inference

MeMPA: A Memory Mapped M-SIMD Co-Processor to Cope with the Memory Wall Issue

Experiments and optimizations for TVM on RISC-V Architectures with P Extension

Compiler-Assisted Dynamic Scratch-Pad Memory Management With Space Overlapping For Embedded Systems

System Evaluation of the Intel Optane Byte-addressable NVM

Efficient Sealable Protection Keys for RISC-V

Co-designing ab initio electronic structure methods on a RISC-V vector architecture