IMIX: In-Process Memory Isolation EXtension
summary
IMIX extends x86 with a new memory-access permission and a compact SMOVE instruction that only touches marked pages, enforces two isolation rings at page granularity, and prevents regular loads/stores from touching protected regions. A proof-of-concept modifies Clang/LLVM, the OS page tables, and the MMU/CPU model and runs on the Intel Simulation and Analysis Engine. Applied to CPI safe-region protection, it demonstrates feasibility and performance near segmentation (much lower overhead than MPX/MPK approaches) for high-frequency domain switches.
AI-written summary · about
chapters (9)
- 0:00Introduction to I-MIX
- 1:26Memory isolation motivation
- 4:03Limitations of current work
- 5:38Design goals and requirements
- 8:29I-MIX technical architecture
- 11:13Implementation and evaluation
- 13:59Use case: Code Pointer Integrity
- 17:25Conclusions and future work
- 19:10Question and answer session
related talks
19mCoSMIX: A Compiler-based System for Secure Memory Instrumentation and Execution in Enclaves
32mSeeing Through The Same Lens...
40mUpcoming x86 Technologies for Malicious Hypervisor Protection
20mLimitations and Opportunities of Modern Hardware Isolation Mechanisms
41mBreaking and Securing Memory Isolation in Texas Instruments Microcontrollers
21mI/O Virtualization Use Cases and the RISC-V IOMMU Overview
43mAddress Space Isolation for Enhanced Safety of the Linux Kernel
18mGuest Memory Protection -- Current Status and Future