Memory safety is paramount for secure systems. Pointer-based memory safety relies on additional information (metadata) to check validity when a pointer is dereferenced. Such operations on the metadata introduce significant performance overhead to the system. This paper presents HWST128, a system to reduce performance overhead by using hardware/software co-design. As a result, the system described achieves spatial and temporal safety by utilizing microarchitecture support, pointer analysis from the compiler, and metadata compression. HWST128 is the first complete solution for memory safety (spatial and temporal) on RISC-V. The system is implemented and tested on a Xilinx ZCU102 FPGA board with 1536 LUTs (+4.11%) and 112 FFs (+0.66%) on top of a Rocket Chip processor. HWST128 is 3.74× faster than the equivalent software-based safety system in the SPEC2006 benchmark suite while providing similar or better security coverage for the Juliet test suite.

Memory corruption vulnerabilities can lead to software attacks. Pointer-based memory safety protection has been shown as a promising solution covering both out-of-bounds and use-after-free errors. Software only approaches have significant performance overhead. Existing hardware/software implementations are largely limited to proprietary closed-source microprocessors, simulation-only studies or require changes to the input source code.In this paper, we present a novel hardware/software co-design methodology consisting of a RISC-V based processor extended with new instructions and microarchitecture enhancements, enabling faster memory safety checks. A compiler is instrumented to provide security operations taking into account the changes to the processor. The entire system is realized by enhancing a RISC-V Rocket-chip system-on-chip (SoC)1. The resultant processor SoC is implemented on an FPGA and evaluated with applications from SPEC 2006 (for generic applications), MiBench (for embedded applications), and Olden benchmark suites for performance. Our experiments show that the proposed approach achieves up to 3. 79X speedup (average 2. 6X) in comparison to the traditional software-based approach for SPEC2006 while possessing an overhead of 6.33% in terms of area. This speedup is better than the state-of-the-art approach. Our security coverage using the NIST Juliet test suite shows better coverage than the software only method.

The cache memory has been a predominant component in modern chips, easily taking up more than 50% of the silicon area. It is then desirable to make the cache memory flexible for different needs. Therefore, many modern processor chips allow users to configure a part of the cache memory as the scratch-pad memory (SPM), a high-speed internal memory for rapid data access. However, such approach uses only the data RAM of the cache memory while leaving the tag RAM unused and thus wasting its capacity. This paper presents a cache organization, called Tag-SPM architecture, which allows the tag RAM to be used as the SPM and thus increases its capacity. It is accomplished with small Tag/Data-SPM controllers and four additional multiplexers in the cache organization. The proposed Tag-SPM architecture has been implemented with an academic ARM-based microprocessor with 4-/4-kB four-way set-associative instruction/data caches at the register transfer level level. Experiments show that the proposed architecture boosts the SPM capacity by 12.5% and requires only 0.08% area (434 gates) overhead without impairing the cache's circuit speed in TSMC's 90-nm standard cell implementation. Furthermore, the power overhead is negligible. When the Tag-SPM architecture is applied to typical cache systems, such as in ARM's Cortex-A5 and Cortex-A53 processors, additional 12.5% SPM space per way can also be gained in both cases. The analyses show that our Tag-SPM architecture is a highly cost-effective way to boost the SPM space.