[Paper Review] RV-CURE: A RISC-V Capability Architecture for Full Memory Safety

Yonghae Kim, Anurag Kar+3 more|arXiv (Cornell University)|Aug 5, 2023

Security and Verification in ComputingComputer Science3 citations

TL;DR

RV-CURE is a RISC-V capability architecture that achieves full memory safety through data-pointer tagging (DPT), a compiler-level technique that embeds pointer tags in unused pointer bits and enforces hardware-accelerated capability checks. It integrates lightweight hardware extensions into the BOOM RISC-V core, achieving full-system memory safety with only a 10.8% average slowdown on SPEC 2017 C/C++ workloads.

ABSTRACT

Despite decades of efforts to resolve, memory safety violations are still persistent and problematic in modern systems. Various defense mechanisms have been proposed, but their deployment in real systems remains challenging because of performance, security, or compatibility concerns. In this paper, we propose RV-CURE, a RISC-V capability architecture that implements full-system support for full memory safety. For capability enforcement, we first propose a compiler technique, data-pointer tagging (DPT), applicable to protecting all memory types. It inserts a pointer tag in a pointer address and associates that tag with the pointer's capability metadata. DPT enforces a capability check for every memory access by a tagged pointer and thereby prevents illegitimate memory accesses. Furthermore, we investigate and present lightweight hardware extensions for DPT based on the open-source RISC-V BOOM processor. We observe that a capability-execution pipeline can be implemented in parallel with the existing memory-execution pipeline without intrusive modifications. With our seamless hardware integration, we achieve low-cost capability checks transparently performed in hardware. Altogether, we prototype RV-CURE as a synthesized RTL processor and conduct full-system evaluations on FPGAs running Linux OS. Our evaluations show that RV-CURE achieves strong memory safety at a 10.8% slowdown across the SPEC 2017 C/C++ workloads.

Motivation & Objective

• Address the persistent challenge of memory safety violations in modern systems, which remain a leading cause of security vulnerabilities.
• Overcome the limitations of prior software and hardware defenses that suffer from high performance overhead, poor compatibility, or incomplete security coverage.
• Design a practical, full-system memory safety solution that maintains source and binary compatibility while enforcing both spatial and temporal memory safety.
• Enable efficient, low-overhead capability enforcement through compiler and hardware co-design, avoiding intrusive changes to existing software stacks.

Proposed method

• Propose Data-Pointer Tagging (DPT), a generalized pointer-tagging technique that stores capability metadata in unused upper bits of pointers across all memory types (stack, heap, global).
• Use a software-managed Capability Metadata Table (CMT) to store per-object capability information, including bounds and permissions, linked to pointer tags.
• Integrate lightweight hardware extensions into the RISC-V BOOM core to perform atomic capability checks in parallel with the memory execution pipeline, minimizing performance impact.
• Enforce capability checks at every memory access involving a tagged pointer, rejecting invalid accesses via hardware trap.
• Support temporal safety by removing metadata from the CMT upon object deallocation while preserving the tag on the pointer, ensuring dangling pointer access fails at runtime.
• Leverage existing RISC-V instruction set and pipeline structure to enable seamless integration without requiring changes to the OS, compiler, or runtime.

Experimental results

Research questions

• RQ1 Can a pointer-tagging approach achieve full memory safety across all memory types (stack, heap, global) without expanding pointer size?
• RQ2 Can hardware-accelerated capability checks be implemented with minimal performance overhead and without intrusive modifications to the processor pipeline?
• RQ3 Can full memory safety be achieved while preserving source and binary compatibility with existing software stacks?
• RQ4 How does the performance of a hardware-optimized, compiler-assisted capability system compare to existing software-only or hardware-only solutions?
• RQ5 Can the proposed mechanism effectively prevent both spatial (out-of-bounds) and temporal (use-after-free) memory safety violations?

Key findings

• RV-CURE achieves full memory safety across all memory types—stack, heap, and global—by enforcing per-object capability checks via data-pointer tagging.
• The hardware extensions for DPT are seamlessly integrated into the RISC-V BOOM core, enabling capability checks in parallel with the memory pipeline without modifying the core’s fundamental structure.
• The system incurs only a 10.8% average performance slowdown across the SPEC 2017 C/C++ workloads, significantly lower than software-only solutions like AddressSanitizer (73% slowdown).
• The approach maintains source and binary compatibility by avoiding changes to the instruction set or pointer size, relying instead on compiler-inserted tags and a software-managed CMT.
• Temporal memory safety is enforced without revocation-based metadata sweeping; instead, metadata is removed from the CMT upon deallocation, rendering dangling pointers invalid at access time.
• The solution is compatible with multi-threaded environments, as the CMT is shared across threads and cache coherency mechanisms (e.g., TSO) handle metadata consistency across cores.