# CHERIvoke Data Repository

This repository contains the code and data required to validate results from the paper:

CHERIvoke: Characterising Pointer Revocation using CHERI Capabilities for Temporal Memory Safety
Hongyan Xia, Jonathan Woodruff, Sam Ainsworth, Nathaniel W. Filardo, Michael Roe, Alexander Richardson, Peter Rugg, Peter G. Neumann, Simon W. Moore, Robert N. M. Watson and Timothy M. Jones
MICRO, 2019

Please cite this paper if you produce any work that builds upon this code and / or data.

## Licence

All code in this repository is licensed under a FreeBSD licence, included at the top of each source file.

## Benchmarks

In order to reproduce the results in the paper, one must compile the code and run the benchmarks (ffmpeg and SPEC-CPU2006) on x86\_64 FreeBSD 12.0.

## Code for dlmalloc\_cherivoke

The code for the allocator is located in the `dlmalloc_cherivoke` sub-directory.
The allocator works best when compiled and linked by the default tools on FreeBSD 12.0, which is done by `CC=clang LD=ld.lld DEBUG=0 make`.
This produces a shared library `libdlmalloc_nonreuse.so` which should be `LD_PRELOAD`ed to override system libc's allocator when running the benchmarks.

### Configurations

The header file `dlmalloc_nonreuse.h` includes multiple parameters that can be tweaked.

To reproduce the trade-off between quarantine size and performance, change `DEFAULT_FREEBUF_PERCENT` and recompile to adjust the ratio of the quarantine versus the total heap.

To capture the free rates and other statistics to derive the results in the paper, change the `SWEEP_STATS` parameter from 0 to 1, which prints the statistics at the end of each benchmark run.
The `SWEEP_STATS` should be off when measuring the execution time of benchmarks, since the statistical counters have a noticeable probing effect.

## Code for the sweeper

The sweeper program to simulate sweeping revocation is located in the `sweeper/` directory.
`sweeper_elf.c` and `sweeper_elf_count.c` are standalone C programs that should be compiled with `cc -O3 -mavx2 file.c -o file`.
The former is to simulate the actual sweeping, which should be carefully timed to measure the sweeping overhead.
The latter reports the pointer densities including page density and cache line density.
Both programs take a single argument which is the file name of the core dump to be analysed.

### Core dumps

The core dumps are the memory images of the benchmarks.
This paper gets core dumps by forking the benchmark process before a revocation event is triggered and aborting immediately.
The easiest way to do this is to modify the allocator:

(Line 3234)
```c
     ...
     if(fm->freebufbytes > (size_t)(fm->footprint*DEFAULT_FREEBUF_PERCENT)) {
+      pid_t pid = fork();
+      if(pid == 0) abort();
     ...
```

Please note, this can potentially create core dumps occupying TiBs of the disk space.
Remember to have enough disk space left or to sample at a lower frequency before core dumping during benchmarks.

### Sweeper inner loops

By default, `sweeper_elf.c` uses AVX2 instructions for sweeping.
The paper also presents a simple sweeper and a manually optimised one which are ifdef'ed out in the code.
The code also provides a `sweep_page_512` function for machines supporting Intel AVX-512.

## Off-core traffic overhead

We measure the off-core traffic using FreeBSD's pmcstat framework.
On 7th generation Intel CPUs, this is measured with:

```sh
pmcstat -w 99999999 -p offcore_requests.all_requests benchmark
```
