Memory safety for low-level software/hardware interactions
John Criswell, Nicolas Geoffray, Vikram Adve · 2009
Systems that enforce memory safety for today’s oper-ating system kernels and other system software do not account for the behavior of low-level software/hardware interactions such as memory-mapped I/O, MMU config-uration, and context switching. Bugs in such low-level interactions can lead to violations of the memory safety guarantees provided by a safe execution environment and can lead to exploitable vulnerabilities in system software. In this work, we present a set of program analysis and run-time instrumentation techniques that ensure that er-rors in these low-level operations do not violate the as-sumptions made by a safety checking system. Our de-sign introduces a small set of abstractions and interfaces for manipulating processor state, kernel stacks, memory mapped I/O objects, MMU mappings, and self modify-ing code to achieve this goal, without moving resource allocation and management decisions out of the kernel. We have added these techniques to a compiler-based vir-tual machine called Secure Virtual Architecture (SVA), to which the standard Linux kernel has been ported previ-ously. Our design changes to SVA required only an addi-tional 100 lines of code to be changed in this kernel. Our experimental results show that our techniques prevent re-ported memory safety violations due to low-level Linux operations and that these violations are not prevented by SVA without our techniques. Moreover, the new tech-niques in this paper introduce very little overhead over and above the existing overheads of SVA. Taken together, these results indicate that it is clearly worthwhile to add these techniques to an existing memory safety system. 1