Fast Protection-Domain Crossing in the CHERI Capability-System Architecture

Abstract

Capability Hardware Enhanced RISC Instructions (CHERI) supplement the conventional Memory Management Unit (MMU) with Instruction-Set Architecture (ISA) extensions that implement an in-address-space capability-system model. CHERI capabilities can also underpin a hardware-software object-capability model for scalable application compartmentalization that can mitigate broader classes of attack. This paper describes ISA additions to CHERI that support fast protection-domain switching, not only in terms of low cycle count, but also efficient memory sharing with mutual distrust. We propose ISA support for sealed capabilities, hardware-assisted checking during protection-domain switching, a lightweight capability flow-control model, and fast register clearing-while retaining the flexibility of a software-defined protection-domain transition model. We validate this approach through a full-system experimental design including ISA extensions, FPGA prototype (implemented in Bluespec SystemVerilog), and software stack including OS (based on FreeBSD), compiler (based on LLVM), software compartmentalization model, and open-source applications.

Rigorous engineering for hardware security: Formal modelling and proof in the CHERI design and implementation process

“…Then there is a Bluespec [11] FPGA hardware implementation of the architecture, and a software stack above it, adapting LLVM [12] and FreeBSD [13] to CHERI-MIPS. All this has involved extensive work on the interaction between the capability system and systems aspects of memory management (static and dynamic linking, process creation, context switching, page swapping and signal delivery) [14]; on the overhead of compiling pointers to capabilities [5], [15]; on compartmentalisation of legacy software [16]; and on the performance overhead of tagged memory [17] and protectiondomain switches [18]. The underlying ideas are portable, not MIPS-specific, and work is underway on experimental academic RISC-V and industrial Arm versions -the latter in a major project involving Arm and the UK Government [19], [20] to produce prototype silicon and a development board.…”

CheriABI

“…CHERI capabilities extend integer virtual addresses to control access to virtual memory by adjoining bounds constraining the range of addresses and permissions limiting the use of each capability (e.g., load, store, or instruction fetch). We previously described the initial CHERI architecture [45,50], demonstrated an efficient compartmentalization framework above it [46,48], described a C-language compilation mode where all pointers are capabilities [9], and demonstrated the use of those abilities to implement a safer JNI [8]. The architecture enforces the following properties: Provenance validation ensures that only capabilities derived via valid transformations of valid capabilities using capability instructions can be used.…”

Balancing Disruption and Deployability in the CHERI Instruction-Set Architecture (ISA)

“…In contrast to MMU-based approaches, CHERI-based compartmentalization optimizes sharing by allowing cheap delegation and avoiding aliasing problems experienced by TLBs as memory sharing increases [30]. This allows domain crossing to be performed at a low constant cost regardless of the amount of data sharing.…”

“…A key goal of our approach was to differentiate virtualization (requiring tablebased lookups, and already implemented by the MMU) from protection (now implemented as a constant-time extension to the pointer primitive), which would avoid table-oriented overheads being imposed on protection. This applies to C-language protection, but also to the implementation of higher-level security constructs such as compartmentalization [31,30].…”