Beyond the PDP-11: Architectural support for a memory-safe C abstract machine
View / Open Files
Authors
Chisnall, David
Rothwell, C
Watson, Robert
Woodruff, Jonathan
Vadera, M
Roe, M
Davis, B
Neumann, PG
Publication Date
2015-04-01Journal Title
Proceedings of the Twentieth International Conference on Architectural Support for Programming Languages and Operating Systems
Conference Name
ASPLOS '15 20th International Conference on Architectural Support for Programming Languages and Operating Systems
ISSN
1523-2867
Publisher
ACM
Pages
117-130
Language
English
Type
Conference Object
This Version
AM
Metadata
Show full item recordCitation
Chisnall, D., Rothwell, C., Watson, R., Woodruff, J., Vadera, M., Moore, S., Roe, M., et al. (2015). Beyond the PDP-11: Architectural support for a memory-safe C abstract machine. Proceedings of the Twentieth International Conference on Architectural Support for Programming Languages and Operating Systems, 117-130. https://doi.org/10.1145/2694344.2694367
Abstract
We propose a new memory-safe interpretation of the C abstract machine that provides stronger protection to benefit security and debugging. Despite ambiguities in the specification intended to provide implementation flexibility, contemporary implementations of C have converged on a memory model similar to the PDP-11, the original target for C. This model lacks support for memory safety despite well documented impacts on security and reliability. Attempts to change this model are often hampered by assumptions embedded in a large body of existing C code, dating back to the memory model exposed by the original C compiler for the PDP-11. Our experience with attempting to implement a memory-safe variant of C on the CHERI experimental microprocessor led us to identify a number of problematic idioms. We describe these as well as their interaction with existing memory safety schemes and the assumptions that they make beyond the requirements of the C specification. Finally, we refine the CHERI ISA and abstract model for C, by combining elements of the CHERI capability model and fat pointers, and present a softcore CPU that implements a C abstract machine that can run legacy C code with strong memory protection guarantees.
Sponsorship
This work is part of the CTSRD and MRC2 projects that are sponsored by the Defense Advanced Research Projects Agency (DARPA) and the Air Force Research Laboratory (AFRL), under contracts FA8750-10-C-0237 and FA8750- 11-C-0249. The views, opinions, and/or findings contained in this paper are those of the authors and should not be interpreted as representing the official views or policies, either expressed or implied, of the Department of Defense or the U.S. Government. We gratefully acknowledge Google, Inc. for its sponsorship.
Funder references
EPSRC (EP/K008528/1)
Identifiers
External DOI: https://doi.org/10.1145/2694344.2694367
This record's URL: https://www.repository.cam.ac.uk/handle/1810/264318
Rights
Licence:
http://www.rioxx.net/licenses/all-rights-reserved