CFI CaRE: Hardware-supported Call and Return Enforcement for Commercial Microcontrollers

TL;DR

CaRE is a novel hardware-supported control-flow integrity scheme for microcontrollers in IoT devices, leveraging TrustZone-M to enhance security against memory corruption attacks with minimal performance impact.

Contribution

This paper introduces CaRE, the first interrupt-aware CFI scheme for low-end MCUs that uses TrustZone-M for secure metadata protection and preserves binary layout.

Findings

CaRE effectively protects MCU software against control-flow attacks.

CaRE imposes acceptable performance and memory overheads.

Implementation on Cortex-M demonstrates practical security benefits.

Abstract

With the increasing scale of deployment of Internet of Things (IoT), concerns about IoT security have become more urgent. In particular, memory corruption attacks play a predominant role as they allow remote compromise of IoT devices. Control-flow integrity (CFI) is a promising and generic defense technique against these attacks. However, given the nature of IoT deployments, existing protection mechanisms for traditional computing environments (including CFI) need to be adapted to the IoT setting. In this paper, we describe the challenges of enabling CFI on microcontroller (MCU) based IoT devices. We then present CaRE, the first interrupt-aware CFI scheme for low-end MCUs. CaRE uses a novel way of protecting the CFI metadata by leveraging TrustZone-M security extensions introduced in the ARMv8-M architecture. Its binary instrumentation approach preserves the memory layout of the target MCU software, allowing pre-built bare-metal binary code to be protected by CaRE. We describe our implementation on a Cortex-M Prototyping System and demonstrate that CaRE is secure while imposing acceptable performance and memory impact.

Figures

Tables

Table 1. Table 1. Comparison between some contemporary 32-bit ARM IoT-related devices

Device	Cores $\times$ Clock	RAM	Flash	Processor
Kionix Sensor Hub 111http://www.kionix.com/product/KX23H-1035	32 MHz	16 KB	128 KB	KX23H-1035	(ARM Cortex-M0)
Polar V800 watch 222https://community.arm.com/groups/wearables/blog/2015/01/05/a-closer-look-at-some-of-the-latest-arm-based-wearables	180 MHz	256 KB	2 MB	STM 32F437	(ARM Cortex-M4)
Atmel in-vehicle entertainment 333http://www.atmel.com/applications/automotive/infotainment-hmi-connectivity/audio-amplifier.aspx	300 MHz	384 KB	2 MB	ATSAMV71Q21	(ARM Cortex-M7)
remote audio amplifier
Nintento 3DS 444https://3dbrew.org/wiki/Hardware	2 $\times$ 268 MHz	128MB	1000MB	ARM11MPCore	(ARM11)
handheld video game console	134 MHz			ARM946	(ARM9)
Raspberry Pi Zero 555https://www.raspberrypi.org/products/pi-zero/	1100 MHz	512 MB	External	BCM2835	(ARM11)
Samsung Galaxy S4 666http://www.gsmarena.com/samsung_i9500_galaxy_s4-5125.php	4 $\times$ 1600 MHz	2 GB	16 / 32 GB	Exynos 5410 Octa	(ARM Cortex-A15)
smartphone	4 $\times$ 1200 MHz				(ARM Cortex-A7)

Table 2. Table 2. ARM General Purpose Registers  (ARM Ltd., 2009 )

Register	Usage model
r0 - r3	Argument / scratch register
r4 - r8	Variable register (callee saved)
r9	Platform register
r10 - r11	Variable register (callee saved)
r12 (ip)	Intra-Procedure-call scratch register
r13 (sp)	Stack Pointer
r14 (lr)	Link Register (subroutine return address)
r15 (pc)	Program Counter

Table 3. Table 3. ARM Special Purpose Registers  (ARM Ltd., 2016 )

Register	Usage model
spsel	Stack-Pointer Select Register
xpsr	Combined Program Status Register
apsr	Application Program Status Register
epsr	Execution Program Status Register
ipsr	Interrupt Program Status Register

Table 4. Table 4. Context state stack frame layout  (ARM Ltd., 2016 )

Offset	Stack Contents
0x1C	xpsr
0x18	pc
0x14	lr
0x10	r12
0x0C	r3
0x08	r2
0x04	r1
0x00	r0	$\leftarrow$ sp

Table 5. Table 5. Microbenchmark results. " Monitor traps " shows the number of Branch Monitor invocations during the execution of the microbenchmark routine. " Ratio " shows the ratio of instrumented control-flow transfer instructions in relation to other machine code instructions in the main program image.

Program	Monitor traps	Ratio	Uninstrumented	Instrumented	Overhead
otp	4	$\frac{1}{956}$	0.53 ms	0.59 ms	0.07 ms (13%)
hmac	80	$\frac{1}{588.4}$	0.02 ms	0.09 ms	0.07 ms (369%)

Table 6. Table 6. Dhrystone results. The " One run through Drystone " column shows the average runtime through the Dhrystone benchmark for the " Uninstrumented " and " Instrumented " program versions respectively.

Monitor	Ratio	One run through Drystone
traps		Uninstrumented	Instrumented	Overhead
34	$\frac{1}{26.4}$	0.15 ms	0.76 ms	0.61 ms (513%)

Full text

1. Introduction

Cyber-Physical Systems (CPS) are becoming pervasive across many application areas ranging from industrial applications (manufacturing), transport, and smart cities to consumer products. Internet of Things (IoT) refers to systems incorporating such devices with (typically always-on) communication capability. Estimates put the number of deployed IoT devices at 28 billion by 2021 (Ericssson, 2015). Although programmable CPS devices are not new, connectivity makes them targets for network originating attacks. Gartner highlights device identity (management), code/data integrity and secure communication as the most important security services for IoT (Gartner, 2015).

The system software in IoT devices is often written in memory-unsafe languages like C (Group et al., 2017). The arms race (Szekeres et al., 2013) in runtime exploitation of general purpose computers and network equipment has shown us that memory errors, such as buffer overflows and use-after-free errors, constitute a dominant attack vector for stealing sensitive data or gaining control of a remote system. Over the years, a number of platform security techniques to resist such attacks have been developed and deployed on PCs, servers and mobile devices. These include protections against code injection and code-reuse attacks, such as Control-Flow Integrity (Abadi et al., 2009) (CFI) and Address Space Layout Randomization (Cohen, 1993; Larsen et al., 2014) (ASLR) which aim to ensure the run-time integrity of a device.

CFI (Section 3.1) is a well-explored technique for resisting the code-reuse attacks such as Return-Oriented Programming (ROP) (Shacham, 2007) that allow attackers in control of data memory to subvert the control flow of a program. CFI commonly takes the form of inlined enforcement, where CFI checks are inserted at points in the program code where control flow changes occur. For legacy applications CFI checks must be introduced by instrumenting the pre-built binary. Such binary instrumentation necessarily modifies the memory layout of the code, requiring memory addresses referenced by the program to be adjusted accordingly (Habibi et al., 2015). This is typically done through load-time dynamic binary rewriting software (Microsoft, 2016; Davi et al., 2012).

A prominent class of state-of-the-art CFI schemes is based on the notion of a shadow stack (Dang et al., 2015): a mechanism that prevents overwriting subroutine return addresses on the call stack by comparing each return address to a protected copy kept in the shadow stack before performing the return. This effectively mitigates return-oriented programming attacks that stitch together instruction sequences ending in return instructions (Shacham, 2007). However, it presumes the existence of mechanisms to ensure that the shadow stack cannot be manipulated by the attacker.

As we argue in detail in Section 3.3, the type of IoT scenarios we consider have a number of characteristics that make traditional CFI mechanisms difficult to apply. First, IoT devices are typically architected as interrupt-driven reactive systems, often implemented as bare-metal software involving no loading or relocation. To the best of our knowledge, no existing CFI scheme is interrupt-aware. Second, IoT devices are often based on computing cores that are low-cost, low-power single-purpose programmable microcontrollers (MCUs). Countermeasures for general purpose computing devices, such as ASLR, often rely on hardware features (e.g., virtual memory) that are unavailable in simple MCUs. Prior CFI schemes for embedded systems, such as HAFIX (Davi et al., 2015), and the recently announced Intel Control-flow Enforcement Technology (CET) (Intel, 2016), require changes to the hardware and toolchain, access to source code and do not support interrupts.

On the positive side, hardware-based isolation mechanisms for MCUs have appeared not only in the research literature (Eldefrawy et al., 2012; Koeberl et al., 2014; de Clercq et al., 2014), but also as commercial offerings such as the recently announced TrustZone-M security extensions for the next generation of ARM microcontrollers (Section 2.2) providing a lightweight trust anchor for resource-constrained IoT devices (ARM Ltd., 2016). However, since software (and updates) for IoT devices may come from a different source than the original equipment manufacturer (OEM), it is unrealistic to expect the software vendors to take responsibility for the instrumentation necessary for hardware-assisted CFI protection – OEMs in turn will be incentivized to distribute the same software to all devices, with and without hardware security extensions.

Goal and Contributions.

We introduce the first hardware software co-design based security architecture that (i) enables practical enforcement of control-flow policies, (ii) addresses the unique challenges of low-end IoT devices with respect to CFI deployment, (iii) requires no changes to the underlying hardware, and (iv) operates directly on binary code thereby avoiding the need for source code. Specifically, we target control-flow integrity policies that defend against runtime attacks, such as ROP, that belong to the most prominent software attacks on all modern computing architectures, e.g., Desktop PCs (Shacham, 2007), mobile devices (Kornau, 2009), and embedded systems (Francillon and Castelluccia, 2008).

To this end we present the design and implementation of a novel architecture, \tzmcfi(Call and Return Enforcement), accompanied with a toolchain for achieving robust run-time code integrity for IoT devices. We claim the following contributions:

• •

The first interrupt-aware CFI scheme for low-end MCUs (Section 4) supporting

• –

hardware-based shadow stack protection by leveraging recently introduced TrustZone-M security extensions (Section 4.2).

• –

a new binary instrumentation technique that is memory layout-preserving and can be realized on-device (Section 4.3).

• •

An implementation of \tzmcfion ARM Versatile Express Cortex-M Prototyping System (Section 4.4).

• •

A comprehensive evaluation (Section 5) showing that \tzmcfiensures CFI (Section 5.1), has a lower performance overhead (Section 5.2) compared to software-based shadow stack schemes while imposing comparable impact on program binary size (Section 5.3).

2. Background

2.1. ARM Architecture

ARM microprocessors are RISC-based computer designs that are widely used in computing systems which benefit from reduced cost, heat, and power consumption compared to processors found in personal computers. The ARM architecture is instantiated in three different classes of processors;

Cortex-A series application processors are deployed in mobile devices, networking equipment and other home and consumer devices.

Cortex-R series real-time processors are deployed in embedded devices with strict real-time, fault tolerance and availability requirements such as wireless baseband processors, mass storage controllers and safety critical automotive, medical and industrial systems.

Cortex-M series of processors are geared towards embedded microcontrollers (MCUs) requiring minimal cost and high energy-efficiency such as sensors, wearables and robotics. Some Cortex-M chips integrate Digital Signal Processing (DSP) and accelerated floating point processing capability for improved power efficiency in digital signal control applications.

The current family of Cortex-M processors features five distinct CPUs, ranging from the low power and energy efficient M0 and M0+ (based on the ARMv6-M architecture) to the higher performance M3, M4 and M7 CPUs (based on the ARMv7-M architecture). All these CPUs utilize a mixed 16-bit / 32-bit instruction set (see Thumb instruction set below) and use 32-bit addressing exclusively. The latest generation of the M-class processor architectures, ARMv8-M (Yiu, 2015; ARM Ltd., 2016), is further divided into two subprofiles; ARMv8-M Baseline for processor designs with a low gate count and a simpler instruction set (replacing the ARMv6-M architecture), and ARMv8-M Mainline for high performance embedded systems that demand complex data processing (replacing the ARMv7-M architecture).

Table 1 shows examples of ARM-based IoT devices together with their respective processor and memory specifications. In this paper, we focus primarily on devices in the low end of this device spectrum, i.e., constrained MCUs (up-to Cortex-M7 equivalent) in single-purpose IoT devices, where memory and storage are at a premium. The ARM9, ARM11 and Cortex-A -based devices in Table 1 typically run general purpose operating systems where the kernel security architecture can employ numerous access control and enforcement mechanisms, such as memory isolation and access control on virtual system resources. In contrast the devices we focus on lack a Memory Management Unit (MMU) and the role of the Operating System (OS) is reduced to basic scheduling tasks. Rudimentary isolation capabilities between distinct software components may be provided through the presence of a Memory Protection Unit (MPU), in which case the configuration of the MPU is tasked to the OS.

All 32-bit ARM processors feature 16 general-purpose registers, denoted r0-r15. Registers r13-r15 have special names and usage models. Table 2 lists each register and its corresponding usage model. These registers, including the program counter (pc) can be accessed directly. Cortex-M processors implement two stacks, the Main stack and Process stack. The stack pointer (sp) is banked between processor modes, i.e., multiple copies of a register exists in distinct register banks. Not all registers can be seen at once; the register bank in use is determined by the current processor mode. Register banking allows for rapid context switches when dealing with processor exceptions and privileged operations. Application software on Cortex-M processor executes in Thread mode where the current stack is determined by the stack-pointer select (spsel) register. When the processor executes an exception it enters the Handler mode. In Handler mode the processors always uses the Main stack.

The Combined Program Status Register xpsr is a 32-bit special purpose register that is a combination of the logical Application (apsr), Execution (epsr), and Interrupt (ipsr) Program Status Registers. The apsr contains status bits accessible to application-level software. The epsr contains the execution state bit which describes the instruction set, which on Cortex-M CPUs is only set to Thumb mode. When executing in Handler mode, the ipsr holds the exception number of the exception being handled. The ipsr may only be read using a mrs instruction used to access ARM system registers, and is only updated by the processor itself on exception entry and exit (see Exception behaviour in Section 4.4). Table 3 provides a non-exhaustive list of special registers and their usage.

The Thumb instruction set.

ARM Cortex-M series processors utilize the Thumb instruction set, which is a subset of common commands found in the 32-bit RISC instruction set used in more powerful ARM Cortex-A series of application processors. Thumb is a fixed-length 16-bit instruction set, where each instruction is a compact shorthand for an instruction found among 32-bit ARM instructions. Encoding a program in thumb code is around 25% more size-efficient than its corresponding 32-bit encoding. Modern ARM processors extend the Thumb instruction set with 32-bit instructions, e.g. to achieve a larger range or relative branch destinations. These new instructions are distinct from those used in the 32-bit ARM instruction set, and may be intermixed with 16-bit Thumb instructions. The resulting variable-length instruction set is referred to as Thumb-2777For the remainder of this article, we use the terms Thumb and Thumb-2 interchangeably when referring to machine code that may contain both 16-bit Thumb and 32-bit Thumb-2 instructions.. Unlike the 32-bit ARM instructions, which are encoded as 32-bit words, 32-bit Thumb-2 instructions are encoded as two consecutive 16-bit half-words. The improved code density compared to the 32-bit ARM instruction set makes Thumb better suited for embedded systems where code footprint is often an important consideration due to restricted memory bandwidth and memory cost. On ARM application cores, both 32-bit ARM and variable length Thumb instruction sets are supported and interwork freely. Cortex-M processors only support Thumb and Thumb-2 instructions. Attempts to change the instruction execution state to 32 bit mode causes a processor exception.

ARM calling standard.

As with all processors, ARM provides a calling standard that compiler manufacturers should use to resolve subroutine calls and returns in an interchangeable manner. In programs conforming to the ARM Architecture Procedure Call Standard (AAPCS) (ARM Ltd., 2009) subroutine calls may be performed either through a Branch with Link (bl) or Branch with Link and eXchange (blx) instruction. These instructions load the address of the subroutine to the pc and the return address to the link register (lr). ARM processors do not provide a dedicated return instruction. Instead, a subroutine return is performed by writing the return address to the program counter pc. Hence, any instruction that can write to the pc can be leveraged as an effective return instruction. Two common effective return instructions are bx lr and pop {…, pc}. The bx lr instruction performs a branch to the return address stored in the link register lr. The pop {…, pc} in a subroutine epilogue loads the return address from the stack to the pc. The former is typically used in leaf routines, which do not execute procedure calls to other routines. The latter is typically preceded by a push {…, lr} instruction in the subroutine prologue, which in a non-leaf routine stores the return address in lr (possibly along with other registers that need to be saved) on the stack in preparation for calls to other routines.

2.2. TrustZone-M

TrustZone-M (Yiu, 2015; ARM Ltd., 2016) (TZ-M) is a new hardware security technology present in the ARMv8-M architecture. In terms of functionality, it replicates the properties of processor supported isolation and priority execution provided by TrustZone-enabled Cortex-A application processors (TZ-A), but their respective architectural realizations differ significantly. Both TZ architectures expose a set of secure state non-privileged and privileged processor contexts beside their traditional non-secure state counterparts888Also referred to as the secure world and normal world.. In both TZ variants the memory management is extended to enable splitting the device’s physical memory into secure and non-secure regions. Fig. 1 shows the relationship between the traditional Thread and Handler modes (on the left hand side) and their new secure state counterparts.

In TZ-M, the only general purpose registers banked between the non-secure and secure states are the sp registers used to address the Main and Process stacks. Fig. 2 illustrates the set of registers in a ARMv8-M equipped with TZ-M. The MSP_ns and PSP_ns represent the Main and Process stack pointer in non-secure state, whereas the MSP_s and PSP_s represent the corresponding stack pointers in secure state. The remaining general purpose registers are shared (not banked) between the non-secure and secure states. In practice this means that the secure state software is responsible for sanitizing any sensitive information held in any general purpose registers during a transition from secure to non-secure state999In addition any registers denoted callee save in the AAPCS (ARM Ltd., 2009) must be stored and restored by the secure state software upon secure state entry and exit respectively..

In TZ-A the entry to the secure state occurs via a dedicated hardware exception and the context switch is performed by the exception handler known as the Secure Monitor. In TZ-M the division between the secure and non-secure states is instead based on a memory map set up during device initialization which assigns specific regions of memory as either secure or non-secure. The transitions between secure and non-secure state occur automatically as the flow of execution is transferred from program code in non-secure memory to secure memory (and vice versa). Where in TZ-A the entry into the secure state typically has to manage VM and MMU configuration at the expense of thousands of processor cycles, TZ-M is geared towards embedded processors with no virtual memory support (at most a MPU). In TZ-M a switch of security state only takes a few processor cycles including a pipeline flush (Yiu, 2015).

The hardware support for the division of memory into secure and non-secure regions in ARMv8-M is a Secure Attribution Unit (SAU) inside the processor. The SAU is configurable while the processor executes in secure state. External interrupts may be routed to either non-secure state exception handlers, or secure state exception handlers based on the SAU configuration. Fig. 3 denotes a typical memory layout for a TZ-M equipped device. Each memory region known to the SAU may be declared as either Non-Secure (❶), Secure (❷) or Secure Non-Secure Callable (NSC ❸). While Secure memory contains the secure program image and data, the NSC memory contains secure gateway veneers101010http://www.keil.com/support/man/docs/armclang_link/armclang_link_pge1444644885613.htm, i.e., branch instructions (❼) which point to the actual subroutine code in Secure memory (❹). The purpose of the NSC is to prevent non-secure program code to branch into invalid entry points in secure program code (such as into the middle of a function, as is often done in atleast ROP). To this end, the ARMv8-M instruction set also introduces a Secure Gateway (sg) instruction, which is included in the beginning of each veneer (❻) and acts as a call gate to the secure program code. From the non-secure program code a call to a secure subroutine is performed using a regular bl instruction (❺), targeting the corresponding veneer in the NSC. Calls targeting a memory address in the NSC will automatically cause a context switch to secure state, and the processor will validate that the call targets a valid entry point with a sg instruction. In particular, calls from non-secure state calling secure memory outside the NSC, or non-sg instructions in the NSC will fail in a Secure Fault, a new type of hardware exception which always traps into secure state. Secure subroutines return by executing a bxns lr instruction (❽), which otherwise behaves like a return through bx lr, but additionally switches the processor to non-secure state.

3. Problem Statement

3.1. Code-Reuse Attacks on ARM

Code-reuse attacks are a class of software exploits that allow attackers to execute arbitrary code on a compromised device, even in the presence of hardware countermeasures against code injection, such as W$\oplus$X (Hewlett-Packard, 2006). In a return-to-libc attack (Solar Designer, 1997), the subroutine return address on the call stack is replaced by the address of an entry point to a subroutine in the executable memory of a process. The technique has been generalized into Return-Oriented Programming (Shacham, 2007) (ROP) for the x86 architecture, which has since become the exploitation technique of choice for modern memory-safety vulnerability attacks. Subsequently ROP has been extended to various other CPU architectures (Buchanan et al., 2008; Francillon and Castelluccia, 2008; Checkoway et al., 2009), including ARM microprocessors (Kornau, 2009).

In a ROP attack, the attacker arranges the call stack to point to short sequences of instructions in the executable memory of the victim program. The instruction sequences, commonly referred to as gadgets, are chosen so that each ends in a return instruction, (i.e., a pop {…, pc} or bx lr in the ARM architecture) which, as long as the attacker has control of the return address, causes each gadget to be executed in sequence. The crucial advancement of ROP compared to return-to-libc attacks is that, given a suitable set of gadgets, Turing complete code execution without code injection can be achieved. Hence, a standard result in ROP work is to show the presence of a Turing complete set of gadgets in the victim program executable memory (Shacham, 2007; Buchanan et al., 2008; Francillon and Castelluccia, 2008; Checkoway et al., 2009; Kornau, 2009). Usually such a set of gadgets is sought from a commonly used shared library, such as libc or standard Windows DLLs, to demonstrate the applicability of the attack in arbitrary programs that link to this standard library. However, it should also be noted that a great deal of work prior to 2007 shows that even without a Turing complete gadget set, it is possible to leverage control of the stack to manipulate program execution in meaningful ways (Wojtczuk, 1998; Nergal, 2001; Krahmer, 2005).

Many code-reuse attacks on x86 platforms use unintended instruction sequences found by performing a branch into the middle of otherwise benign instructions. Such unintended sequences cannot be formed in the 32-bit ARM, or in the 16-bit Thumb instruction sets where branch target alignment is enforced on instruction load, and hence may only target the intended instruction stream. However, the presence of both 32-bit and 16-bit instructions in Thumb-2 code introduces ambiguity when decoding program code from memory. When decoding Thumb-2 instructions, ARM processors still enforce 2-byte alignment on instruction fetches, but the variable-length encoding allows the second half-word in a 32-bit Thumb-2 instruction to be interpreted as the first half-word of an unintended instruction. Such unintended instructions have been successfully utilized in prior work (Le, 2011; Lian et al., 2015) to exploit ARM code.

Various proposed defenses against ROP have attempted to leverage properties of the gadgets executed during a ROP attack. The attacks alter the program flow in at least two ways: 1) they contain many return instructions, occurring only a few instructions apart, and 2) the returns unwind the call stack without a corresponding subroutine call.

It has been shown that, on both x86 and ARM, it is also possible to perform ROP attacks without the use of return instructions (Checkoway et al., 2010) in what has become to be known as Jump-Oriented Programming (JOP). On ARM platforms, JOP can be instantiated using indirect subroutine calls.

3.2. Control-Flow Integrity

A well known approach to address code-reuse attacks is enforcing the Control-Flow Integrity (CFI) of the code. The execution of any program can be abstractly represented as a Control-Flow Graph (CFG), where nodes represent blocks of sequental instructions (without intervening branches), and edges represent control-flow changes between such nodes (branch instructions). CFI enforcement strives to ensure that the execution of the programs conforms to a legitimate path in the program’s CFG. CFI builds on the assumption that program code in memory is not writable (i.e., that memory pages can be marked W$\oplus$X) as a countermeasure against code injection attacks. Code immutability allows CFI checks to be omitted for nodes in the CFG that end in direct branch instructions (Abadi et al., 2009; Erlingsson et al., 2006), i.e., branches with a statically determined target offset. As a result, CFI is typically applied to nodes in the CFG that end in an indirect branch. Indirect branches are typically emitted for switch-case statements, subroutine returns, and indirect calls (subroutine calls to dynamic libraries, calls through function pointers, e.g. callbacks, as well as C++ virtual functions).

While the construction of the CFG can occur through static inspection of the program binary, the actual enforcement of CFI must occur at runtime. In inlined CFI enforcement the checks that validate control-flow changes are interspersed with the original program code at subroutine call sites, as well as in the subroutine prologue and epilogue111111The subroutine prologue is a compiler generated sequence of instructions in the beginning of each subroutine which prepares the stack and registers for use within the subroutine. Similarly, the subroutine epilogue appears at the end of the subroutine, which restores the stack and registers to the state prior to the subroutine call.. The insertion of these checks can be achieved through compiler extensions (Chiueh and Hsu, 2001), or by binary machine-code rewriting. Binary instrumentation that adds additional instructions to a pre-built program binary by necessity modifies the memory layout of the code, and hence will require memory addresses referenced by the program to be adjusted accordingly.

Traditional ROP targets return instructions that read the return address off the program stack. A well known technique to enforce that subroutine returns target the original call site is the notion of a shadow call stack (Abadi et al., 2009; Chiueh and Hsu, 2001; Frantzen and Shuey, 2001; Giffin et al., 2002, 2004; Erlingsson et al., 2006; Nebenzahl et al., 2006; Prasad and Chiueh, 2003; Francillon et al., 2009; Davi et al., 2011; Carlini et al., 2015; Intel, 2016). The shadow call stack is used to hold a copy of the return address. On subroutine return the return address on the shadow call stack is compared to the return address on the program stack. If they match, the return proceeds as usual. A mismatch in return addresses on the other hand indicates a failure of CFI and triggers an error which terminates the program prematurely. Recent results show that, in fact, shadow stacks are essential for the security of CFI (Carlini et al., 2015).

3.3. CFI Challenges for Microcontrollers

We identify the following challenges in realizing CFI protection on IoT devices:

• •

Interrupt awareness: Since the software to be protected is a single, interrupt-driven bare-metal program, the CFI scheme needs to handle both interruptible code, as well as execution in interrupt contexts. To the best of our knowledge, no existing CFI scheme meets this requirement.

• •

Hardware-based shadow stack protection: Protection of shadow stack must leverage lightweight hardware-based trust anchors like TrustZone-M. The code size and performance overhead of purely software-based CFI is prohibitive on resource constrained devices and techniques for general purpose computing devices often rely on hardware (such as x86 segmentation support (Abadi et al., 2009)) that is unavailable in simple MCUs.

• •

Layout-preserving instrumentation: Since software for MCUs is commonly deployed as monolithic firmware images with strict size requirements, CFI instrumentation must preserve memory layout of the image so as to avoid extensive rewriting and to minimize the increase in code size.

• •

On-device instrumentation: To avoid having to rely on the developer (or some other external entity) to perform the required instrumentation, the CFI scheme must be amenable to on-device instrumentation.

3.4. Adversarial Model

We consider a powerful adversary with arbitrary read-access to code memory and arbitrary read-write access to data memory of the non-secure state program. This model accounts for buffer overflows or other memory-related vulnerabilities (e.g. an externally controlled format string121212CWE-134: Use of Externally-Controlled Format String

https://cwe.mitre.org/data/definitions/134.html) that, in practice, would allow adversaries to gain such capabilities. The adversary cannot modify code memory, a property that is achievable even on MCU class systems through widespread countermeasure against code injection (e.g. MPU-based W$\oplus$X). Nevertheless, arbitrary read-access necessitates a solution that is able to withstand information disclosure (the strongest attack scenario in Dang et al.’s (Dang et al., 2015) evaluation of prior work on CFI). Our threat model is therefore similar to previous work on CFI, but we also consider an even stronger adversary who can exploit interrupt handling to undermine CFI protection.

This model applies even when an attacker is in active control of a module or thread within the same address space as the non-secure state program, such as gaining control of an unprotected co-processor on the System-On-Chip (SoC). However, the adversary lacks the ability to read or modify memory allocated to the secure state software.

In this work, we do not consider non-control data attacks (Szekeres et al., 2013) such as Data-Oriented Programming (Hu et al., 2016). This class of attacks can achieve privilege escalation, leak security sensitive data or even Turing-complete computation by corrupting memory variables that are not directly used in control-flow transfer instructions. This limitation also applies to prior work on CFI.

4. CFI CaRE

We now present CaRE (Call and Return Enforcement), our solution for ensuring control-flow integrity. \tzmcfispecifically targets constrained IoT devices, which are expected to stay active in the field for a prolonged time and operate unattended with network (Internet) connectivity, possibly via IoT gateways. This kind of deployment necessitates the incorporation of software update mechanisms to fix vulnerabilities, update configuration settings and add new functionality.

We limit our scope to small, more or less bare-metal IoT devices. The system software is deployed as monolithic, statically linked firmware images. The secure and non-secure state program images are distinct from each other (ARM, 2015), with the secure state software stack structured as a library. The configuration of the SAU and the secure state program image is performed before the non-secure code is started. The entry to the secure state library happens through a well-defined interface describing the call gates available to non-secure software. Functions in the secure state are synchronous and run to completion unless interrupted by an exception. The system is interrupt-driven, reacting to external triggers. While it is possible that the non-secure state software is scheduled by a simple Real-Time Operating System (RTOS), the secure state software does not have separate scheduling or isolation between distinct software components for the simple reason that the device is single-purpose rather than a platform for running many programs from many stakeholders in parallel. Even when an RTOS is present, it is seldom necessary for non-secure state code to support dynamic loading of additional code sequences.

4.1. Requirements

Given the above target deployment scenario, we formulate the following requirements that \tzmcfishould meet:

Requirement 1.

It must reliably prevent attacks from redirecting the flow of execution of the non-secure state program.

Requirement 2.

It must be able to protect system software written in standard C and assembler conformant to the AAPCS.

Requirement 3.

It must have minimal impact on the code footprint of the non-secure state program.

Requirement 4.

Its performance overhead must be competitive compared to the overhead of software-based CFI schemes.

We make the following assumptions about the target device:

Assumption 1.

A trust anchor, such as TZ-M, which enables isolated code execution and secure storage of data at runtime is available.

Assumption 2.

All (secure and non-secure) code is subject to a secure boot sequence that prevents tampering of program and update images at rest. This bootstrap sequence itself is not vulnerable to code-reuse attacks, and routines in the bootstrap code are not invoked again after the device startup completes.

Assumption 3.

All code is non-writable. It must not be possible for an attacker to modify the program code in memory at runtime.

Assumption 4.

All data is non-executable. It must not be possible for an attacker to execute data as it were code. Otherwise, an attacker will be able to mount code injection attacks against the device.

Assumption 1 is true for commercial off-the-shelf ARMv8-M MCUs. There also exist several research architectures, such as SMART (Eldefrawy et al., 2012), SANCUS (Noorman et al., 2013), and Intel’s TrustLite (Koeberl et al., 2014) that provide equivalent features. Assumption 2 is true for currently announced ARMv8-M SoCs 131313https://www.embedded-world.de/en/ausstellerprodukte/embwld17/product-9863796/numicro-m2351-series-microcontroller. Assumptions 3 and 4 are in line with previous work on CFI and can be easily achieved on embedded devices that are equipped with MPUs. These assumptions can be problematic in the presence of self-modifying code, runtime code generation, and unanticipated dynamic loading of code. Fortunately, most embedded system software in MCUs is typically statically linked and written in languages that compile directly to native code. Even when an RTOS is present, it is seldom necessary for non-secure state code to support dynamic loading of additional code sequences.

4.2. Architecture

Our design incorporates protection of a shadow call stack on low-end ARM embedded devices featuring TZ-M. The shadow call stack resides in secure memory, and is only accessible when the processor executes in the secure state. We also propose a layout-preserving binary instrumentation approach for Thumb code, with small impact to code footprint, and an opportunity for on-device instrumentation as part of code installation. The main aspect of this property is that the binary program image is rewritten without affecting its memory layout. Fig. 4 shows an overview of the \tzmcfiarchitecture.

The premise for \tzmcfiis instrumentation of non-secure state code in a manner which removes all function calls and indirect branches and replaces them with dispatch instructions that trap control flow to a piece of monitor code, the Branch Monitor (❶), which runs in non-secure state. As a result, each subroutine call and return is now routed through the Branch Monitor. The Branch Monitor maintains the shadow stack by invoking secure functions (❷) only callable from the Branch Monitor, before transferring control to the original branch target. Other indirect branches, such as ones used to branch into switch case jump tables can be restricted by the Branch Monitor to a suitable range and to target direct branches in jump table entries. Thus, the Branch Monitor provides complete mediation of instrumented non-secure state code.

Apart from the Branch Monitor, the program image also contains bootstrap routines (labeled $b_{n}$) that are used to initialize the runtime environment (❸). Such routines may initially need to operate without a stack and other memory structures in place, and as such are typically hand written in assembler. Due to these constraints, the bootstrap routines are likely to deviate from usual AAPCS conventions. In particular, all calls are not guaranteed to result in a subsequent matching return as fragments of bootstrap routines may simply be chained together until eventually transferring control to the named C entry point marking the beginning of main program code. On the other hand, the initialization code is typically not entered again after control has been transfered to the main function until the device is reset.

Hence, from the perspective of maintaining control-flow integrity, both the Branch Monitor and bootstrap code exist outside benign execution paths encountered in the program during normal operation. Henceforth, we will refer to the code reachable from the main function as the main program. The CFG nodes labeled $f_{n}$ in Fig. 4 represent the instrumented main program (❹). The main program and bootstrap code do not share any routines (Assumption 2), even though routines belonging to one or the other may be interleaved in program memory. The main program code constitutes a strongly connected component within the call graph141414A call graph is a control-flow graph which represents the calling relationships between subroutines in a program.. This observation leads us to consider the main program code as a complete ensemble in terms of instrumentation target. It can include an RTOS and/or interrupt handlers. Interrupts handlers labeled $h_{n}$ (❺), with the exception of the supervisor call handler that hosts the Branch Monitor, are considered to be part of the main program. Conceptually, interrupts may be reached from any node in the program’s CFG.

By eliminating non-mediated calls and returns in the non-secure state main program, thus forcing each indirect branch through the Branch Monitor, we can unequivocally eliminate control-flow attacks that utilize such branches.

4.3. Instrumentation

The instrumentation must intercept all subroutine calls and returns. Furthermore, it should have minimal impact on code footprint. Prior shadow stack schemes either instrument the subroutine prologue and epilogue (Chiueh and Hsu, 2001; Dang et al., 2015), or the call site (Dang et al., 2015), pushing the return address to the shadow stack upon a subroutine call, and validating the return address on top of the shadow stack upon return. We propose an alternative approach which is layout-preserving.

In uninstrumented code, the target address of direct subroutine calls (i.e., bl instructions with immediate operands) are encoded as pc-relative offsets (i.e., signed integer values). In other words, the destination address depends on the location of the branch instruction in memory. During instrumentation, we calculate the absolute destination address, and store it in a data structure, called the branch table which at runtime resides in read-only non-secure memory. Each destination address in this branch table is indexed by the memory address of the original branch instruction. The original branch instruction is overwritten with a dispatch instruction, which, when executed, traps into the Branch Monitor. At runtime, whenever an instruction rewritten in this fashion traps into the Branch Monitor, the Branch Monitor will lookup the destination address from the branch table, and redirect control flow to the original destination address.

In a similar manner, indirect branches corresponding to calls and effective returns are replaced with dispatch instructions. The destination address of the branches are only known at runtime, determined by a register value (lr in the case of effective returns), or by a return address stored on the program call stack, and hence do not influence the construction of the branch table during instrumentation.

To address JOP attacks, our CFI enforcement must also be able to determine legal call targets for indirect calls. In the case of indirect subroutine calls, the call target must be a valid entry point to the destination subroutine, i.e., the call must target the beginning of the subroutine prologue. The entry addresses are extracted from the symbol information emitted by the compiler for debug purposes. Further restriction of call targets is possible by means of static or dynamic analysis (see Section 6). Since \tzmcfionly requires the addresses of entry points, not the full debug information, the entry points are included in the software image in a call target table on the device in a similar manner to the branch table. When an indirect call occurs, the Branch Monitor will match the branch target against this record of valid subroutine entry points.

In our implementation, we use the supervisor call svc instruction as the dispatch instruction, and place the Branch Monitor in the supervisor call exception handler. The svc instruction has a number of desirable properties which make it suitable as a dispatch. Firstly, it allows for an 8-bit comment field, which is ignored by hardware, but can be interpreted in software, typically to determine the service requested. We exploit this comment field to identify the type of the original instruction, overwritten during the instrumentation (e.g. bl, blx, pop {pc} etc.). Secondly, the supervisor call handler executes at the highest exception priority, allowing us to pre-empt execution to the Branch Monitor when instrumenting exception handlers. Lastly, because the svc in Thumb instruction is a 16-bit instruction, it can be used for instrumenting both 32-bit and 16-bit instructions. When replacing 32-bit instructions, e.g., a Thumb-2 bl instruction with an immediate operand, we use the sequence 0xb000, which corresponds to the opcode for add sp, #0 (effectively a NOP) as padding to fill the remaining 16 bits of the original bl.

4.4. Implementation

We implemented a proof-of-concept prototype of \tzmcfion the ARM Versatile Express Cortex-M Prototyping System MPS2+ configured as a Cortex-M23 CPU.151515We also tested our prototype on the CMSDK_ARMv8MBL FastModel emulator included in version 1.3.0 of the Cortex Microcontroller Software Development Kit in Keil $\mu$Vision version 5.20.0.0. The prototype uses the version 5.0.0-Beta4 of the Cortex Microcontroller Software Interface Standard (CMSIS). Binaries for instrumentation were produced using ArmClang v6.4 included in MDK-ARM version 5.20..

We implemented a binary rewriter to perform the instrumentation on non-secure state binaries. It utilizes the Capstone disassembly engine161616http://www.capstone-engine.org/ to identify control-flow instructions for rewriting.

Fig. 5 illustrates the altered control-flow changes. When a dispatch instruction is encountered in the program (❶), instead of taking a control-flow transfer directly to the original target (❷), program execution is temporarily halted by a trap into the Branch Monitor (❸). The Branch Monitor will update the shadow stack maintained in secure memory by invoking secure shadow stack operations entry points in the gateway veneer (❹), which allow access to the secure state subroutines handling the actual update (❺). Upon completion, control is returned to the non-secure Branch Monitor code (❻), which finally redirects control flow to the intended destination (❼). The same sequence applies both for calls, and returns (❽).

Branch Monitor.

The Branch Monitor is responsible for dispatching and validating control-flow transfers that occur during program execution. When invoked, it will first determine the reason for the trap based on the svc comment and trigger the corresponding branch handler routine within the Branch Monitor. The routine updates the shadow stack accordingly (pushes return address on subroutine calls, pops and validates return address on subroutine returns) and redirects the control flow to the intended target. For branches corresponding to direct subroutine calls a branch table lookup is needed since the target of a call is not anymore evident from the dispatch instruction. For indirect calls, the Branch Monitor verifies that each call targets a valid subroutine entry within the main program by looking up the target from the call target table.

As the Branch Monitor executes in the supervisor call handler, the main stack contains a context state stack frame corresponding to the processor state at the point the supervisor call exception was taken (see Table 4). Control-flow redirection is triggered by manipulating stored pc and lr values in the context stack frame and performing an exception return from the Branch Monitor (see below), which causes the processor to restore the context stack frame and resume execution from the address in the stored pc.

Interrupt awareness.

An important feature of M-class cores is their deterministic interrupt latency in part attributable to the fact that the context-switch, while entering the exception handler, is performed entirely in hardware. An instruction that triggers an exception, such as the svc used for supervisor calls, causes 1) the hardware to save the current execution context state onto a stack pointed to by one of the sp registers, 2) the ipsr to be updated with the number of the taken exception, and 3) the processor to switch into Handler mode in which exceptions are taken. Table 4 shows the layout of a typical stack frame created during exception entry171717In Cortex-M processors that implement the floating point extensions, the context stack frame may also contain the values of floating point registers.. The value stored at offset 0x18 in the stack frame is the pc value at the point the exception was taken, and represents the return value from which program execution shall continue after the exception handler exits. To facilitate fast restoration of the saved context state, M-class processors support a special return sequence which restores the saved values on the stack into their corresponding registers. This sequence is known as an exception return and occurs when the processor is in Handler mode, and a special Exception Return Value (ERV) is loaded into the pc either via a pop instruction, or a bx with any register. ERVs are of the form 0xFXXXXXXX, and encode in their lower-order bits information about the current processor state and state before the current exception was taken. ERVs are not interpreted as memory addresses, but are intercepted by the processor as they are written to the pc. When this occurs, the processor will validate that there is an exception currently being handled, and that its number matches the exception number in the ipsr. If the exception numbers match, the processor performs an exception return to the processor mode specified by the ERV, restoring the previous register state from the current stack, including the stored pc. This causes the processor to continue execution from the point in the program at which the exception was originally taken. When multiple exceptions are pending, lower priority exceptions may be tail-chained which causes the processor to directly begin executing the next pending exception, without restoring the context state frame between exceptions.

Due to the fact that the context state stack frame contains a stored pc value that is restored on exception return, an exception handler with a vulnerability that allows an attacker to control the content of the context state frame on the stack constitutes a valid attack vector. This attack differs from a traditional ROP attack in that the attacker does not need to control the immediate lr value (which may reside only in the lr register), as during the execution of the exception handler lr contains merely the current ERV value. Instead, by manipulating the pc value in the context state stack frame, an attacker can cause an effective return from the exception handler to an arbitrary address. To avoid this, \tzmcfineeds to be interrupt aware, and accurately record the correct return address for the exception handler onto the shadow stack. However, exceptions (when enabled) may be triggered by events external to the main program execution, effectively pre-empting the main program at an arbitrary position in the code, even during the execution of another exception handler (assuming an exception of higher priority arriving concurrently).

To tackle this challenge this, we introduce exception trampolines. When an exception is received, the trampoline determines the return address, stores it on the shadow stack, and then proceeds to execute the original exception handler. The exception trampolines can be instrumented in place by rewriting the non-secure state exception vector and replacing the address of each exception with the address of a corresponding exception trampoline, that ends in a fixed branch to the original exception handler. That address is the original exception vector entry.

Since \tzmcfimay interrupt the execution of another exception handler, we need to support a nested exception return, i.e. when the pc is being supplied with two consecutive return values in immediate succession. However, pc values in the 0xF0000000 - 0xFFFFFFFF range are only recognized as ERVs when they are loaded to the pc either via a pop instruction, or a bx with any register (see Section 2.1). In particular, when an ERV is loaded to the pc as part of an exception return, it is instead interpreted as a memory address in an inaccessible range thus causing a hard fault in the processor. To overcome this, we also deploy return trampolines, small fragments of instruction sequences that contain the different effective return instructions originally present in the program image prior to binary rewriting. When the Branch Monitor returns from the supervisor call exception handler, it does so via the trampoline corresponding to the original return instruction. APPENDIX A contains an excerpt from the Branch Monitor, which illustrates the update of the pc and the lr through the stored context state frame and exception return via return trampolines.

5. Evaluation

5.1. Security Considerations

A key consideration for the effectiveness of \tzmcfiis the ability of the Branch Monitor to perform complete mediation of indirect control-flow events in untrusted non-secure state program code. After all, any branch instruction for which an adversary can control the destination may potentially be used to disrupt the normal operation of the program. In practice, it is not possible to completely eliminate all instructions that may act as indirect branches from the non-secure state program image. In particular, the bootstrap code, the Branch Monitor itself and the return trampolines must remain uninstrumented. We argue that despite the Branch Monitor and bootstrap code being uninstrumented, \tzmcfiis secure in terms of fulfilling Requirement 1. We demonstrate this with the following reasoning.

Claim 0.

In order to maintain the control-flow integrity of the non-secure state program it is sufficient for the Branch Monitor to mediate calls that occur within the strongly connected component of the main program’s call graph.

We base our reasoning on the following observations:

Observation 1.

The secure state software stack, and the Branch Monitor are trusted and cannot be disabled or modified.

This follows from Assumptions 2 and 3. A secure boot mechanism protects the program code at rest and read-only memory protects it from modification at runtime.

Observation 2.

The main program has been instrumented in a manner which replaces all subroutine calls and indirect branch instructions with Branch Monitor calls.

This follows simply from the operation of our instrumentation.

Based on these observations we formulate the following invariants:

Invariant 1.

Each subroutine within the main program has a fixed entry address that is the entry point for all control-transfer instructions (that are not returns) that branch to the subroutine.

Invariant 2.

All control-transfer instructions in the main program that act as effective returns target a previously executed call site within the main program.

Invariant 1 is true for all subroutines that are entered by control-transfer instructions where the destination address is an immediate operand that is encoded into the machine code instruction itself. This remains true after instrumentation as per Observation 1 and 2, as the destinations addresses are replicated read-only in the branch table, and the control-flow transfer for instrumented calls is mediated by the Branch Monitor. The entry address to an interrupt handler is the address recorded in the interrupt vector, and thus fixed, as interrupt handlers are not called directly from main program code.

As long as Invariant 1 holds control-flow transfers to an offset from the beginning of a subroutine are not possible. This includes branches that target 32-bit Thumb-2 instructions at a 16-bit offset181818Half-word alignment for branch instruction target addresses is enforced by the hardware itself., thus attempting to make use of the ambiguity in the Thumb-2 instruction set encoding.

Invariant 2 follows during benign execution from the structure of the program’s call graph and Assumption 2. It remains true after instrumentation, notably even in the case the return addresses are compromised, because Observations 1, 2 and Invariant 1 imply that the Branch Monitor has complete mediation of control-flow transfers within the main program. Thus, the Branch Monitor has the ability to enforce that no return may target an address from which a matching call site has not been observed.

Based on this, and given that no instrumented subroutine call will neither ever occur from the bootstrap code nor from the Branch Monitor into the main program we may formulate the following corollaries:

Corollary 5.1.

No return within the main program may target the Branch Monitor.

Corollary 5.2.

No return within the main program may target the initialization code.

Hence, as long as the Branch Monitor can correctly mediate all immediate branches corresponding to subroutine calls and all indirect branch instructions within the main program, the call return matching performed by the Branch Monitor enforces that no control-flow transfers to outside the main program occur as a result of mediated calls. $\square$

We evaluated the effectiveness of our Branch Monitor implementation by attempting to corrupt control-flow data on the stack through a buffer overflow introduced into our sample binaries. We also performed simulations where we corrupted the target addresses kept in memory or registers for different branch types (both calls and returns) in a debugger. In each case, we observed the Branch Monitor detecting and preventing the compromised control flow.

5.2. Performance Considerations

On Cortex-M processors a bl instruction typically takes a single cycle

• a pipeline refill ranging between 1 – 3 cycles to execute depending on the alignment and width of the target instruction as well as the result of branch prediction. A subroutine return via a bx lr has a comparable cycle count, while a return through a pop {…, pc} costs an additional cycle per register to be loaded191919http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0439b/CHDDIGAC.html. As a result of the instrumentation, all aforementioned instructions have been eliminated from the program image, and redirected to the Branch Monitor where the additional validations and shadow stack update takes place. Therefore our instrumentation will increase the runtime cost (cycle count) of a branch severalfold. Subroutine calls additionally incur the cost of the branch table lookup to resolve the target of the call. The runtime cost of the lookup has a logarithmic relation to the size of the branch table.

The overhead \tzmcfiadds to program execution is dependent on the number of subroutine calls and returns in the program. We evaluated the impact of \tzmcfion performance using microbenchmarks with varying proportions of subroutine calls (and returns) in relation to other instructions. Our microbenchmarks consisted of an event-based One-Time Password (OTP) generation algorithm that uses the Corrected Block Tiny Encryption Algorithm (XXTEA) block cipher algorithm, and a Hash-based Message Authentication Code (HMAC) implementation using the SHA256 cryptographic hash function. The size of the branch table was kept constant for each experiment. Our microbenchmarks contain only direct subroutine calls and all indirect branches corresponded to effective returns.

We also instrumented the Dhrystone 2.1 benchmark program (Weicker, 1984) in order to estimate the performance impact on larger pieces of software. Dhrystone is a synthetic systems programming benchmark used for processor and compiler performance measurement. It is designed to reflect actual programming practice in systems programming by modeling the distribution of different types of high-level language statements, operators, operand types and locality sourced from contemporary systems programming statistics. In particular, it attempts to reflect good programming practice by ensuring that the number of subroutine calls is not too low. Today Dhrystone has largely been supplanted by more complex benchmarks such as SPEC CPU bencmarks202020https://www.spec.org/benchmarks.html and CoreMark212121http://www.eembc.org/coremark/about.php. The SPEC CPU benchmarks in particular have been used in prior CFI literature (Abadi et al., 2009; Dang et al., 2015). However, the SPEC suite is not practical to port to MCUs cores. The support library accompanying the Dhrystone benchmark contains both direct and indirect subroutine calls, and indirect returns. Other types of indirect branches were not observed in the main program portion of the samples. We followed the guidelines in ARM application notes on Dhrystone benchmarking for ARM Cortex Processors (ARM, 2011).

All measurements were performed on an ARM Versatile Express Cortex-M Prototyping System MPS2+ FPGA configured as a Cortex-M23 processor executing at 25MHz. Table 5 shows the results of the microbenchmarks and Table 6 shows the result for the Dhrystone benchmarks. According to the measurements the overhead of \tzmcfiranges between 13% – 513%. The results compare favorably to existing software protection based shadow stack schemes with reported overheads ranging between 101% - 4400% (Chiueh and Hsu, 2001; Erlingsson et al., 2006) (see Section 7).

5.3. Memory Considerations

While layout preserving instrumentation does not add instructions to the program image, the Branch Monitor and the constructed branch and call target tables and need to be placed in device memory. The Branch Monitor only needs to include the logic to handle branch variants present for a particular program image. For our microbenchmark program image the Branch Monitor implementation adds a fixed 700 bytes (5.1%) to the program image size. The branch table for the microbenchmarks program binary consists of 75 8-byte records, adding 600 bytes (4.3%) to the program image. Overall the memory consumption of our microbenchmark program increased by 9.4%. For out Dhrystone program image the Branch Monitor adds Branch Monitor 1143 bytes (5.5%) and the branch and call target tables 1528 bytes (7.3%) and 376 bytes (1.7 %). Overall the memory consumption of the Dhrystone program increated by 14.5%). The numbers for the Dhrystone program include full instrumentation of the support library.

6. Extensions

Function-Reuse Attacks.

The call target validation as presented in Section 4 does address issue of complete function reuse attacks within the main program code. An attacker might perform a pointer substitution where a pointer to one subroutine is exchanged for another subroutine. As both constitute valid call targets, the control-flow transfer would be allowed. Our instrumentation tools allow a human analyst to reduce the set of subroutines that may be subsitituted for each other by limiting the entries to the call target table known to be targeted by indirect subroutine calls, e.g. subrutines used as callback functions. However, as the call target may be computed by the program only at runtime, it is impractical to programatically fully explore all possible execution paths of a program during static analysis and pre-compute a complete CFG. This remains an open problem for any CFI scheme.

Threading

In our current implementation, the normal state software is limited to using the Main stack. In order to enable CFI for the rudimentary threading supported by Cortex-M processors, the Branch Monitor must be extended to maintain a separate shadow stack for return addresses on the Process call stack. The changes to the Branch Monitor are straightforward as it can consult the spsel register to determine which shadow stack to update.

On-device instrumentation

The layout-preserving instrumentation approach described in Section 4.3 has properties that make it suitable for performing binary rewriting on-device. Firstly, since it does not affect addresses resolved at link-time, it can be completed in a single pass over the binary image. Secondly, the logic consists of a simple search and replace of branch instruction patterns and branch table construction. While our current implementation relies on an separate tool for rewriting, it is straighforward to implement the needed instrumentation as part of the installation process on-device.

Binary patching

Another approach to performing the instrumentation required for CFI is Binary patching (Brown, 2017). In binary patching, instrumented instructions are replaced with dispatch instructions to trampolines that are placed in unused memory. Compared to binary rewriting (Habibi et al., 2015), binary patching does not require adjusting of all pc-relative offsets thanks to minimal impact to the program memory layout. However, as explained in Section 2, Thumb-2 code has properties that makes binary patching more challenging compared to the instrumentation approach described in Section 4.3; dispatch instructions used for ARM binary patching are typically 32-bit Thumb-2 pc-relative branches in order to encode a sufficient offset to reach the trampolines. If the instrumented instruction a 16-bit Thumb instruction, the 32-bit dispatch cannot be inserted without affecting the memory layout of the binary. Instead of adjusting all subsequent instructions, both the 16-bit target instruction, and another (16-bit or 32-bit) is moved to the trampoline to make room for the dispatch instruction. If the moved instruction contains a pc-relative operation, it needs to be adjusted accordingly since the new location of the instruction will have a different pc value. Even for a small instruction set such as Thumb, the required logic to perform such adjustments is not in general practical to be implemented as part of the software update mechanism on a resource constrained device. Additionally, as trampolines may contain instructions moved from the instrumentation point, each instrumentation point requires a corresponding trampoline. However, for use cases where on-device instrumentation may not be a concern, a TZ-M protected shadow stack could be utilized with binary patching. This approach would have the advantage of not requiring Branch Monitor logic in the supervisor call handler.

7. Related Work

Code-reuse attack countermeasures have been a focal topic of research for the past decade. The most widely used mitigation technique against this class of attack is Address Space Layout Randomization (ASLR) (Cohen, 1993; Larsen et al., 2014)), which is deployed by major operating systems today 222222https://www.microsoft.com/security/sir/strategy/default.aspx#!section_3_3 232323https://www.kernel.org/doc/Documentation/sysctl/kernel.txt 242424https://web.archive.org/web/20120104020714/http://www.apple.com/macosx/whats-new/features.html#security. ASLR relies on shuffling the executable (and the stack and heap) base address around in virtual memory, thus requiring an attacker to successfully guess the location of the target code (or data). This makes ASLR impractical for constrained devices that lack MMUs and where memory is a scarce resource.

Dang et.al. (Dang et al., 2015) conduct a comprehensive evaluation of shadow stacks schemes in the face of different adversarial models. Dang et al.’s parallel shadow stack (Dang et al., 2015) and many traditional shadow stacks (Giffin et al., 2002, 2004; Nebenzahl et al., 2006) are based on unprotected shadow stacks, e.g., their integrity can be compromised if the shadow stack location is known as they are located in the same address space as the vulnerable application. Shadow stacks protected by canary values (Erlingsson et al., 2006; Prasad and Chiueh, 2003) can withstand attack that are limited to sequantial writes, but not arbitrary writes to specific memory addresses. Dang et al. identify only two schemes that operate under an equivalent adversary model as \tzmcfi, in particular with regard to the ability to withstand disclosure of the shadow stacks location; Chiueh and Hsu’s Read-Only RAD (Chiueh and Hsu, 2001) and Abadi et al.’s CFI scheme (Abadi et al., 2009). Read-Only RAD incurs a substantial overhead in the order of 1900% – 4400% according to benchmarks by the authors. Abadi et al.’s protected shadow stack achieves a modest overhead between  5% – 55% (21% on average). However, it makes use of x86 memory segments, a hardware feature not available on low-end MCUs. In contrast, \tzmcfiprovides equivalent security guarantees without requiring hardware features unique to high-end general purpose processors and compared to previous work on software-only protected shadow stacks, CaRE performs better.

In addition, we consider an even stronger adversary who can exploit interrupt handling to undermine CFI protection; this has been largely ignored in previous CFI works. Prior work, most notably ROPDefender (Davi et al., 2011) and PICFI (Niu and Tan, 2015) support software exception handling, particularly C++ exceptions. To the best of our knowledge, \tzmcfiis the first scheme to protect hardware interrupts initiated by the CPU, a necessity for CFI in bare-metal programs. We make no claim regarding software exceptions, as our system model assumes C programs.

The prevalence of ROP and JOP exploitation techniques in runtime attacks on modern PC platforms has also prompted processor manufacturers to provide hardware support for CFI enforcement. In June 2016, Intel announced its Control-flow Enforcement Technology (Intel, 2016) that adds support for shadow call stacks and indirect call validation to the x86/x84 instruction set architecture. Similarly the ARMv8.3-A architecture provides Pointer Authentication (PAC) (Qualcomm Technologies, Inc., 2017) instructions for ARM application processors that can be leveraged in the implementation of memory corruption countermeasures such as stack protection and CFI. Countermeasures suitable for resource-constrained embedded devices, however, have received far less attention to date. Kumar et al. (Kumar et al., 2007) propose a software-hardware co-design for the AVR family of microcontrollers that places control-flow data to a separate safe-stack in protected memory. Francillon et al. (Francillon et al., 2009) propose a similar hardware architecture in which the safe-stack is accessible only to return and call instructions. AVRAND by Pastrana et al. (Pastrana et al., 2016) constitutes a software-based defense against code reuse attacks for AVR devices. HAFIX (Davi et al., 2015) is a hardware-based CFI solution for the Intel Siskiyou Peak and SPARC embedded system architectures.

8. Conclusion

Security is paramount for the safe and reliable operation of connected IoT devices. It is only a matter of time before the attacks against the IoT device evolve from very simple attacks such as targeting default passwords to advanced exploitation techniques such as code-reuse attacks. The introduction of lightweight trust anchors (such as TrustZone-M) to constrained IoT devices will enable the deployment of more advanced security mechanisms on these devices. We show why and how a well understood CFI technique needs to be adapted to low-end IoT devices in order to improve their resilience against advanced attacks. Leveraging hardware assisted security is an important enabler in \tzmcfi, but it also meets other requirements important for practical deployment on small devices, such as interrupt-awareness, layout-preserving instrumentation and the possibility for on-device instrumentation. For small, interrupt-driven devices, the ability to ensure CFI in both interruptible code, as well for the code executing in interrupt contexts is essential.

Acknowledgments

This work was supported by the German Science Foundation (project S2, CRC 1119 CROSSING), Tekes — the Finnish Funding Agency for Innovation (CloSer project), and the Intel Collaborative Research Institute for Secure Computing (ICRI-SC).

APPENDIX A. Excerpt of Branch Monitor Code

⬇

1**#define** STATE_BIT (0x00000001U)

2**#define** IS_EXC_RETURN(addr) ((unsigned int)(addr) > (unsigned int)0xF0000000)

3

4void SVC_Handler(void) / supervisor exception handler entry point /

5{

6 __asm( / inline assembler trampoline to branch monitor /

7 "mrs r0, msp\n" / pass pointer to Main stack top as first argument /

8 "b Branch_Monitor_main" / invoke main branch monitor routine /

9 )

10}

11

12void Branch_Monitor_main(unsigned int* svc_args)

13{

14 unsigned int svc_number; / svc comment field number /

15 unsigned int stored_lr; / pointer to lr stored on stack /

16 / Stack frame contains: r0, r1, r2, r3, r12, r14 (lr), pc and xpsr*

17* ***** - r0 = svc_args[0] <- offset from top of *stack

18* ***** - r1 = *svc_args[1]

19* ***** - r2 = *svc_args[2]

20* ***** - r3 = *svc_args[3]

21* ***** - r12 = *svc_args[4]

22* ***** - lr = *svc_args[5]

23* ***** - pc = *svc_args[6]

24* ***** - xpsr = svc_args[7] **/

25 svc_number = ((char *)svc_args[6])[-2]; / read comment field from svc instr /

26

27 switch(svc_number)

28 {

29 case BL_IMM: / branch with link (immediate) /

30 svc_args[5] = svc_args[6] | STATE_BIT; / lr = next_instr_addr<31:1> : ’1’; /

31 Secure_ShdwStk_Push(svc_args[5]); / push ret address on shadow stack /

32 svc_args[6] = btbl_bsearch(svc_args[6]); / branch table lookup for dest addr /

33 goto out;

34 case BX_LR: / branch and exchange (lr) /

35 if (IS_EXC_RETURN(svc_args[5]) { / exception return via bx lr /

36 stored_lr = svc_args[5]; / lr stored in stack context /

37 svc_args[6] = (uint32_t)(&ret_bx_lr) & ~(0x00000001U);

38 goto return_through_trampoline; / bx lr trampoline /

39 } / fast track bybassing trampoline /

40 if (svc_args[5] != Secure_ShdwStk_Pop()) / validate return address on stack /

41 { abort(); } / halt on return address mismatch /

42 svc_args[6] = svc_args[5] & ~(STATE_BIT); / pc = lr<31:1> : ’0’; /

43 goto out;

44 case POP_R4_PC: / pop r4, pc /

45 / Stack frame additionally contains:*

46* ***** - r4 = *svc_args[8]

47* ***** - lr = svc_args[9] **/

48 stored_lr = svc_args[9]; / set pointer to stored lr /

49 svc_args[6] = (uint32_t)(&ret_pop_r4_pc) & ~(STATE_BIT);

50 goto return_through_trampoline; / pop {r4,pc} trampoline /

51 case POP_R4_R5_PC: / pop {r4,r5,pc} /

52 / Stack frame additionally contains:*

53* ***** - r4 = *svc_args[9]

54* ***** - r5 = *svc_args[10]

55* ***** - lr = svc_args[11] **/

56 stored_lr = svc_args[11]; / set pointer to stored lr /

57 svc_args[6] = (uint32_t)&ret_pop_r4_r5_pc & ~(STATE_BIT);

58 goto return_through_trampoline / pop {r4,r5,pc} trampoline /

59 / ... / / addl. cases omitted for brewity /

60 return_through_trampoline:

61 if (stored_lr == Secure_ShdwStk_Pop())

62 { goto out; } / validate return address on stack /

63 default:

64 abort(); / unrecognized svc number /

65 out:

66 return; / return to trampoline / call dest. /

67}