SGX Talk - Ruslan Bukin
- Enclave Page Cache - memory for enclaves (part of DRAM)
- FreeBSD kernel driver
- Userspace SDK
- Use cases: cloud providers
- Extant side channel attacks against SGX
- What should the ideal SDK look like? Do we run FreeBSD binaries in the enclave?
ARMv8.1-v8.3 - Andy Turner, Mark Rutland
- Added support for Execute Never bits (PXN, UXN)
- Added support for PAN - prevents kernel accessing memory except through specific instructions
- UAO not needed on FreeBSD
Pointer authentication codes
- Could sign return address stack
- 128-bit key (8 hardware keys)
- 64-bit context
- PAC is 7 bits to 32 bits
AMD memory encryption
- VEE paper describes some limitations
libcrunch - Stephen Kell
- Cast checking
- Bounds checking
RISC-V security - Ruslan Bukin
- PMP - specify permissions for 16 memory regions in machine mode to restrict memory access
- Composable with virtual memory. Address translation checked then PMP consulted
- PMP is configured in firmware
CheriABI - Brooks Davis
- System call layer made CHERI-aware
- Possibly use sparse to annotate user pointers