Hacking the Xbox

Taking a Step Back
Chapter 13 - Onward! 199
There is a problem with the phrase “trusted computing”: it has become
synonymous with cryptographically secured trusted computers. Let’s take a
step back and just talk about alternative approaches to building trusted
computers.
Trustability has always been important in computers. However, back in
the early days of computing, machines were so expensive that the
hardware necessary to enforce strong trust policies was not within the
reach of consumers. For example, many early machines shipped with a
socket for a hardware Memory Management Unit (MMU) chip. The
MMU was one of the first steps toward trustable hardware memory
models; part of an MMU’s job is to enforce page-level memory access
protections. MMUs were sold as an option because they were quite pricey
at the time. Unfortunately, the move toward trustable hardware stopped
at the MMU, partially because computer networks didn’t exist in any
major form until relatively recently. In a non-networked world, data
needed to be protected only from programmer errors and from access
by a few select users with physical access to the machine. Today, computers
need something stronger than just an MMU, something that can
provide trust in the face of viruses and remote attackers attempting to
exploit subtle software weaknesses to run malicious code.
The natural extension to the MMU’s hardware-enforced paged virtual
memory model might be address capabilities with a tagged memory model.
A memory tag is a set of bits that record the type of data or code stored in a
memory location. In a tagged memory model, every memory location has a
set of tag bits, kind of like how every memory location in a conventional
error-correcting memory implementation is associated with some ECC bits.
Tag bits help the hardware enforce data type management policies; for
example, a memory location tagged as piece of data can never be accidentally
or intentionally executed as code. A capability is a pointer granted by a
trusted kernel that cannot be forged. The unforgeability property is preferably
enforced by hardware through tag bits. Many architectures also include
the ability to enforce access boundaries as part of a hardware capability. 1
Capabilities and memory tags are not new ideas; in 1961, the Burroughs
B5000 used capabilities (then called descriptors) and tagged memory to
guard, in hardware, against buffer overflow attacks, and to isolate code
from data. 2 The MIT PDP-1, Intel i432, IBM System/38, and the Mach
and Amoeba operating systems also implemented capabilities in some
1 An efficient, high performance hardware implementation of
precise object boundaries using tagged capabilities can be
found in a tech note titled “A capability representation with
embedded address and nearly-exact object bounds” by
Jeremy Brown, J.P. Grossman, Andrew Huang and Tom Knight.
http://www.ai.mit.edu/projects/aries/Documents/Memos/
ARIES-05.pdf
2 “The Architecture of the Burroughs B5000 — 20 Years Later and Still
Ahead of the Times?” by Alastair J.W. Mayer. http://www.ajwm.net/
amayer/papers/B5000.html