3 ms·

Is it technically possible to design a MMU that prevents a process reading or writing to a region of memory that don't belong to it?

moonbug 7y ago
that is exactly what an MMU is for.
- saagarjha 7y ago
  MMUs work on much larger regions than what is useful for many classes of memory safety issues. Luckily, ARMv8.5 adds support for memory tagging at a more granular level.
  - twic 7y ago
    Aha, a chance to mention my favourite dead processor design, the 432, which had an MMU designed to work at much finer, object-sized, granularity: https://en.wikipedia.org/wiki/Intel_iAPX_432#Object-oriented_memory_and_capabilities https://en.wikipedia.org/wiki/Intel_iAPX_432#Object-oriented...
  - gpderetta 7y ago
    Let's resurrect segments!
  - tyingq 7y ago
    Here's a presentation from lowrisc.org on their plans for tagged memory on a RISCV chip: https://riscv.org/wp-content/uploads/2017/05/Wed0930riscv201705_ppt.pdf https://riscv.org/wp-content/uploads/2017/05/Wed0930riscv201...
aseipp 7y ago
Yes, absolutely. There are a lot of possible approaches in this design space, but recent CPUs from ARM can do this using memory tagging at a much finer granularity than process-wide. I don't think any silicon is actually shipping with this feature yet, unfortunately.
pdkl95 7y ago
yes: http://millcomputing.com/wiki/Protection http://millcomputing.com/wiki/Protection Regarding ROP, that entire class of attack isn't possible if return addresses are stored in hardware that isn't accessible to the program. > "[Stacks on the Mill architecture] contain no control flow information. In particular, no return addresses. The control stacks are maintained entirely within the hardware, inaccessible from programs. They get saved and restored by the Spiller as needed. This makes several classes of common security exploits simply impossible."
kjs3 7y ago
Yes; you're looking for 'capability based MMU'. The Intel i960MX/MC MMU had one, and development tools to support it (mostly in Ada). Unfortunately, Intel stripped/disabled the MMU in the vast majority of i960s it shipped and really only sold the MMU version in the military market.

moonbug 7y ago

that is exactly what an MMU is for.

saagarjha 7y ago
MMUs work on much larger regions than what is useful for many classes of memory safety issues. Luckily, ARMv8.5 adds support for memory tagging at a more granular level.
- twic 7y ago
  Aha, a chance to mention my favourite dead processor design, the 432, which had an MMU designed to work at much finer, object-sized, granularity: https://en.wikipedia.org/wiki/Intel_iAPX_432#Object-oriented_memory_and_capabilities https://en.wikipedia.org/wiki/Intel_iAPX_432#Object-oriented...
- gpderetta 7y ago
  Let's resurrect segments!
- tyingq 7y ago
  Here's a presentation from lowrisc.org on their plans for tagged memory on a RISCV chip: https://riscv.org/wp-content/uploads/2017/05/Wed0930riscv201705_ppt.pdf https://riscv.org/wp-content/uploads/2017/05/Wed0930riscv201...

aseipp 7y ago

Yes, absolutely. There are a lot of possible approaches in this design space, but recent CPUs from ARM can do this using memory tagging at a much finer granularity than process-wide. I don't think any silicon is actually shipping with this feature yet, unfortunately.

pdkl95 7y ago

yes: http://millcomputing.com/wiki/Protection http://millcomputing.com/wiki/Protection Regarding ROP, that entire class of attack isn't possible if return addresses are stored in hardware that isn't accessible to the program. > "[Stacks on the Mill architecture] contain no control flow information. In particular, no return addresses. The control stacks are maintained entirely within the hardware, inaccessible from programs. They get saved and restored by the Spiller as needed. This makes several classes of common security exploits simply impossible."

kjs3 7y ago

Yes; you're looking for 'capability based MMU'. The Intel i960MX/MC MMU had one, and development tools to support it (mostly in Ada). Unfortunately, Intel stripped/disabled the MMU in the vast majority of i960s it shipped and really only sold the MMU version in the military market.