Technical Summary: WATSON - Leveraging Data Watchpoints for Shadow Stack Protection on Embedded Systems

Problem Statement

Embedded and Internet-of-Things (IoT) devices, often programmed in memory-unsafe languages like C, are highly susceptible to control-flow hijacking attacks, particularly Return-Oriented Programming (ROP). These attacks exploit stack-based buffer overflows to overwrite return addresses, redirecting execution to malicious code sequences. While shadow stacks are a proven defense mechanism that stores return addresses in a separate, protected memory region, existing solutions for embedded systems face significant limitations:

1. Incomplete Coverage: Many solutions fail to protect system-wide backward-edge control flows, specifically leaving interrupt and exception handlers unprotected.
2. High Performance Overhead: Solutions relying on security extensions like TrustZone (e.g., CaRE, TzmCFI) incur massive runtime overheads (up to 513%) due to frequent context switches between secure and non-secure states.
3. Hardware Dependencies: Many approaches depend on hardware features not universally available on embedded devices, such as Trusted Execution Environments (TEE) or specific memory protection units (MPU).
4. Compatibility Issues: Solutions that rely on the MPU to restrict access to the shadow stack consume limited configurable memory regions, potentially conflicting with other security mechanisms like compartmentalization.

Methodology: WATSON

The authors propose WATSON, a compiler-based solution that provides a protected shadow stack for embedded systems without relying on TEEs or complex memory management hardware. The core innovation is the repurposing of standard hardware debug units—specifically Data Watchpoints (DWT) found in ARM Cortex-M and debug triggers in RISC-V—which are widely available but underutilized for security.

Key Architectural Components

1. Compact Shadow Stack Transformation:

   • Instead of duplicating the entire main stack (parallel shadow stack), WATSON implements a compact shadow stack that stores only return addresses.
   • The compiler instruments function prologues to save return addresses to the shadow stack and epilogues to retrieve them.
   • To avoid reserving scarce General-Purpose Registers (GPRs), WATSON stores the Shadow Stack Pointer (SSP) in a memory-mapped register (specifically, a repurposed DWT comparator register). This avoids register pressure on resource-constrained microcontrollers.

2. Write Protection via Data Watchpoints:

   • WATSON configures DWT comparators to monitor the shadow stack memory region.
   • Default State: The shadow stack is configured as read-only. Any unauthorized write attempt triggers a DebugMon exception, leading to a system reset or security report.
   • Runtime Enforcement: During legitimate function prologues, the compiler temporarily disables the write protection, updates the shadow stack and SSP, and then re-enables protection before the function body executes. This ensures that only authorized code paths can modify the shadow stack.

3. Exception and Interrupt Handling:

   • WATSON addresses the gap in protecting exception handlers. Upon exception entry, it captures a partial copy of the Exception Stack Frame (ESF) and stores it to the shadow stack.
   • Upon return, it restores the ESF and verifies the return address against the shadow stack.
   • This design ensures that even malicious exception handlers cannot compromise the control flow or escalate privileges.

4. Forward-Edge CFI Integration:

   • To prevent attackers from disabling the write protection via forward-edge attacks (e.g., jumping to code that modifies the DWT configuration), WATSON integrates with LLVM's -fsanitize=cfi-icall option to enforce forward-edge control-flow integrity.

Key Contributions

1. Hardware-Agnostic Protection: WATSON is the first solution to leverage standard debug units (Data Watchpoints) for shadow stack protection, eliminating the need for TEEs or specific MPU configurations. This ensures compatibility with existing security mechanisms like privilege separation and compartmentalization.
2. System-Wide Integrity: Unlike prior work, WATSON provides comprehensive protection for both normal function calls and exception/interrupt handlers, preventing privilege escalation via compromised handlers.
3. Efficient Implementation: By utilizing memory-mapped registers for the SSP and a compact shadow stack, WATSON minimizes register pressure and memory footprint, making it suitable for bare-metal embedded systems.
4. Prototype and Evaluation: The authors implemented a prototype on the ARM Cortex-M4 architecture using LLVM and evaluated it against standard benchmarks and real-world applications.

Results

The evaluation was conducted on the ARM Cortex-M architecture using the BEEBS and CoreMark-Pro benchmark suites, as well as two real-world applications (Pinlock and FatFS RAM).

• Performance Overhead:
  • BEEBS: Average runtime overhead of 7.33% (geometric mean 0.90%).
  • CoreMark-Pro: Average runtime overhead of 1.81% (geometric mean 0.59%).
  • Exception Handling: Negligible runtime overhead (approx. 9e-06%) for handling Usage Fault exceptions.
  • Real-World Apps: Overhead was 0.2% for Pinlock and negligible for FatFS RAM.
• Code Size Overhead:
  • BEEBS: Average increase of 8.58% (geometric mean 7.36%).
  • CoreMark-Pro: Average increase of 2.54% to 3.53%.
  • Real-World Apps: 0.88% for Pinlock and 2.11% for FatFS RAM.
• Security Effectiveness:
  • WATSON successfully prevented attacks that attempted to overwrite return addresses on the main stack.
  • It effectively blocked unauthorized direct modifications to the shadow stack, triggering exceptions when attackers attempted to tamper with the protected memory region.

Significance and Claims

The paper claims that WATSON offers a practical and efficient alternative to existing shadow stack solutions for embedded systems. Its primary significance lies in:

• Compatibility: It works seamlessly with other security mechanisms (e.g., compartmentalization) because it does not consume limited MPU regions or require rare hardware extensions like TEE.
• Accessibility: By using standard debug units available on most modern microcontrollers (ARM Cortex-M, RISC-V), it lowers the barrier to deploying robust control-flow integrity on a wide range of embedded devices.
• Completeness: It addresses the often-overlooked vulnerability of exception handlers, providing true system-wide backward-edge protection.

The authors acknowledge limitations, such as the difficulty of instrumenting pre-compiled third-party libraries and the 32 KB memory limit for the shadow stack on ARMv7-M with a single comparator. However, they argue that these constraints are manageable for typical embedded workloads and that the trade-off between memory footprint and performance is favorable for resource-constrained environments.