PUMP: A Programmable Unit for Metadata Processing
Udit Dhawan,
Nikos Vasilakis,
Raphael Rubin,
Silviu Chiricescu,
Jonathan M. Smith,
Thomas F. Knight, Jr.,
Benjamin C. Pierce, and
André DeHon
Proceedings of the 3rd International Workshop on Hardware and Architectural Support for Security and Privacy, (June 15, 2014)
We introduce the Programmable Unit for Metadata Processing (PUMP), a novel software-hardware element
that allows flexible computation with uninterpreted metadata alongside the main
computation with modest impact
on runtime performance (typically 10---40% for single policies, compared
to metadata-free computation on 28 SPEC CPU2006 C, C++, and Fortran programs).
While a host of
prior work has illustrated the value of ad
hoc metadata processing for specific policies,
we introduce
an architectural model for extensible, programmable metadata processing that
can handle arbitrary metadata and arbitrary sets of software-defined rules
in the spirit of the time-honored 0-1-∞ rule.
Our results
show that we can match or exceed the performance of dedicated hardware
solutions that use metadata to enforce a single policy, while adding the
ability to enforce
multiple policies simultaneously and achieving flexibility comparable to
software solutions for metadata processing.
We demonstrate the PUMP by using it to support four diverse
safety and security policies---spatial and temporal memory safety, code and data
taint tracking, control-flow integrity including
return-oriented-programming protection, and instruction / data separation---and
quantify the performance they achieve, both singly and in combination.
© 2014 held by authors; Publication rights licensed to ACM.
|
