The CHERI capability model

Abstract

Motivated by contemporary security challenges, we reevaluate and refine capability-based addressing for the RISC era. We present CHERI, a hybrid capability model that extends the 64-bit MIPS ISA with byte-granularity memory protection. We demonstrate that CHERI enables language memory model enforcement and fault isolation in hardware rather than software, and that the CHERI mechanisms are easily adopted by existing programs for efficient in-program memory safety. In contrast to past capability models, CHERI complements, rather than replaces, the ubiquitous page-based protection mechanism, providing a migration path towards deconflating data-structure protection and OS memory management. Furthermore, CHERI adheres to a strict RISC philosophy: it maintains a load-store architecture and requires only singlecycle instructions, and supplies protection primitives to the compiler, language runtime, and operating system. We demonstrate a mature FPGA implementation that runs the FreeBSD operating system with a full range of software and an open-source application suite compiled with an extended LLVM to use CHERI memory protection. A limit study compares published memory safety mechanisms in terms of instruction count and memory overheads. The study illustrates that CHERI is performance-competitive even while providing assurance and greater flexibility with simpler hardware

SEIMI: Efficient and Secure SMAP-Enabled Intra-process Memory Isolation

“…Tagged architectures. Recent research has revisited tagged architectures [46,56], in which the hardware associates a "tag" with each byte in memory that encodes a security policy. Tags can be used to, for example, grant call instructions exclusive rights for writing to certain memory regions, preventing return addresses from being overwritten [46].…”

ISA semantics for ARMv8-a, RISC-v, and CHERI-MIPS

“…It has also pointed out ambiguities in the specification of interrupt delegation, and cases of missing reservation yields in Spike. CHERI-MIPS [Watson et al 2018Woodruff et al 2014] is an experimental research architecture that extends 64-bit MIPS with support for fine-grained memory protection and secure compartmentalisation. It provides hardware capabilities, compressed 128-bit values including a base virtual address, an offset, a bound, and permissions; and object capabilities that link code and data pointers.…”

Exploring C semantics and pointer provenance

“…FreeBSD CHERI port annotation data CHERI Watson et al 2018Woodruff et al 2014] is an experimental architecture providing hardware support for fine-grained pointer-based memory protection and secure encapsulation. It has been developed as an extension of 64-bit MIPS, but similar features could be added elsewhere.…”

“…Cerberus now also identifies many of the clauses of the ISO C standard text captured by its definitions of type-checking and elaboration, displaying these in the GUI. The project page includes data for various compilers and other tools for these tests: GCC 8.1, Clang 6.0, ICC 19, UBSAN, ASAN, MSAN, CompCert [Leroy 2009;Leroy et al 2018], RV-Match [Guth et al 2016], CH2O [Krebbers 2015], and CHERI Watson et al 2018Woodruff et al 2014]. We include extensive validation of the combination of Cerberus and our provenance semantics on various existing test suites (ğ9): the GCC torture tests [FSF 2018a], the ITC Toyota benchmark [Shiraishi et al 2015], the KCC example test suite [Hathhorn et al 2015;KCC 2018], and a family of Csmith tests [Regehr et al 2012].…”

“…We do so in three ways. For the first two, we exploit data from the CHERI project Watson et al 2018Woodruff et al 2014], which has designed experimental architectures with hardware support for fine-grained memory protection and secure encapsulation, using capabilities, and ported software including the FreeBSD kernel and userspace to this. The CHERI-adapted FreeBSD userspace includes hundreds of libraries, daemons, and command-line tools, such as zlib, OpenSSL, and OpenSSH; other ported applications include Postgres, nginx, and WebKit, representing a broad range of code functionality, style, and vintage.…”