Content deleted Content added
simplify heading |
Added the CHERI Alliance in the history |
||
| (7 intermediate revisions by 5 users not shown) | |||
Line 2:
{{Use dmy dates|date=January 2025}}
'''Capability Hardware Enhanced RISC Instructions''' ('''CHERI''') is a
The hardware works by giving each reference to any piece of data or system resource its own access rules. This prevents programs from accessing or changing things they should not. It also makes it hard to trick a part of a program into accessing or changing something that it should be able to access, but at a different time. The same mechanism is used to implement [[privilege separation]], dividing processes into compartments that limit the damage that a bug (security or otherwise) can do.
Line 11:
== Background ==
CHERI is a [[Capability-based addressing|capability]] architecture.<ref name=isca
In the 1970s and 1980s early capability architectures such as the [[CAP computer]] (developed at the University of Cambridge) and the [[Intel iAPX 432]] demonstrated strong security properties. These systems relied on indirection tables to manage capabilities, introducing performance bottlenecks as memory access required multiple lookups. While this approach worked when processors were slow and memory was fast, it became impractical by the mid-1980s as processors became faster and memory access times lagged behind.<ref name="capbook"
In 2010 DARPA launched the Clean-slate design of Resilient, Adaptive, Secure Hosts (CRASH) programme,<ref>{{cite web |year=2010 |title=CRASH: Clean-slate design of Resilient, Adaptive, Secure Hosts |url=https://www.darpa.mil/research/programs/clean-slate-design-of-resilient-adaptive-secure-hosts |access-date=18 January 2025 |publisher=DARPA}}</ref><ref>{{cite web |date=21 December 2012 |title=DARPA's CRASH Program Reinvents The Computer For Better Security |url=https://breakingdefense.com/2012/12/darpa-crash-program-seeks-to-reinvent-computers-for-better-secur/ |access-date=18 January 2025 |publisher=Breaking Defence}}</ref> which tasked participants with redesigning computer systems to improve security. [[SRI International]] and [[University of Cambridge]] team revisited capability architectures, seeking to address memory safety challenges inherent in conventional designs.
Line 23:
This metadata is stored inline, alongside the address, in the computer's memory and protected by a [[Tagged architecture|tag bit]], which is cleared if the capability is tampered with. This informs the computer of which areas of memory can be accessed through a specific operation and how a program can modify or read memory through that operation. This allows CHERI systems to catch cases where memory that was outside the bounds of where the program was supposed to read or write to was operated on. Associating the metadata with the value used to access memory, rather than with the memory being accessed (in contrast to a [[memory management unit]]) means that the hardware can catch cases where a program attempts to access a part of memory that it ''should'' have access to while intending to access a ''different'' piece of memory.
Implementations of CHERI systems also include modifications to the default [[Memory management|memory allocator]]
Depending on the context, CHERI systems can be used to enhance compiler-level checks, build [[Trusted execution environment|secure enclaves]],<ref>{{Cite conference |last1=Van Strydonck |first1=Thomas |last2=Noorman |first2=Job |last3=Jackson |first3=Jennifer |last4=Alves Dias |first4=Leonardo |last5=Vanderstraeten |first5=Robin |last6=Oswald |first6=David |last7=Piessens |first7=Frank |last8=Devriese |first8=Dominique |title=CHERI-TrEE: Flexible enclaves on capability machines |date=1 July 2023 |conference=2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P) |url=https://lirias.kuleuven.be/retrieve/715646/ |publisher=IEEE |pages=1143–1159 |doi=10.1109/EuroSP57164.2023.00070 |isbn=978-1-6654-6512-0|url-access=subscription}}</ref> or even be used to augment existing instruction architectures. A report by [[Microsoft]] in 2019 found that CHERI's protections could be used to mitigate over 70% of memory safety issues found in 2019 at the company.<ref>{{Cite web |title=Security Analysis of CHERI ISA |website=Microsoft Security Response Center blog |url=https://msrc.microsoft.com/blog/2020/10/security-analysis-of-cheri-isa/ |access-date=21 January 2025}}</ref> CHERI architectures are also designed to be backward compatible with existing programming languages such as C and C++. A study performed by University of Cambridge researchers found that porting six million lines of C and C++ [[source code]] to CHERI required changes to 0.026% of the
==
The architecture introduces hardware complexity due to the tag-bit mechanisms and capability checks
Standardisation remains an ongoing effort. While initiatives such as the CHERI Alliance<ref>{{Cite web |title=CHERI Alliance – Industry-led security technology |url=https://cheri-alliance.org |access-date=2025-01-27 |website=CHERI Alliance |language=en-US}}</ref> and RISC-V standardisation<ref name=":2"
== Implementations ==
The CHERI architecture has been implemented across multiple platforms and projects:
*
*
*
*
*
CHERI implementations that target mainstream [[operating
== History ==
By 2012 early CHERI prototypes were presented,<ref>{{cite conference |author1=Robert N.M. Watson |author2=Peter G. Neumann |author3=Jonathan Woodruff |author4=Jonathan Anderson |author5=Ross Anderson |author6=Nirav Dave |author7=Ben Laurie |author8=Simon W. Moore |author9=Steven J. Murdoch |author10=Philip Paeps |author11=Michael Roe |author12=Hassen Saidi |title=CHERI: a research platform deconflating hardware virtualization and protection |conference=Workshop on Runtime Environments, Systems, Layering and Virtualized Environments (RESoLVE 2012) |date=2 March 2012 |url=https://www.cl.cam.ac.uk/~rnw24/papers/201203-resolve-cheri.pdf}}</ref> These prototypes ran a microkernel with hand-written assembly for manipulating capabilities. CHERI was designed to be easy to implement on modern superscalar pipelined architectures. Unlike earlier capability systems, CHERI eliminated the need for indirection tables,<ref name="isca">{{cite conference |author1=Jonathan Woodruff |author2=Robert N. M. Watson |author3=David Chisnall |author4=Simon W. Moore |author5=Jonathan Anderson |author6=Brooks Davis |author7=Ben Laurie |author8=Peter G. Neumann |author9=Robert Norton |author10=Michael Roe |title=The CHERI capability model: Revisiting RISC in an age of risk |conference=2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA) |___location=Minneapolis, MN, USA |date=2014 |pages=457–468 |doi=10.1109/ISCA.2014.6853201}}</ref> avoiding the associated performance issues and proving that modern capability architectures could be efficiently implemented.
In 2014 CHERI hardware demonstrated its ability to run a full UNIX-like operating system, [[FreeBSD]]. This demonstration showed that CHERI's capability model can integrate with existing software ecosystems. CHERI was originally prototyped as an extension to [[MIPS architecture|MIPS-64]].<ref name="isca"
In 2015 CHERI introduced a new capability encoding model that separated the address (referred to as a ''cursor'') from the bounds and permissions. This refinement allowed capabilities to function as pointers in compiled C code,<ref name="pdp11"
In 2019 CheriABI<ref>{{cite conference |author1=Brooks Davis |author2=Robert N. M. Watson |author3=Alexander Richardson |author4=Peter G. Neumann |author5=Simon W. Moore |author6=John Baldwin |author7=David Chisnall |author8=Jessica Clarke |author9=Nathaniel Wesley Filardo |author10=Khilan Gudka |author11=Alexandre Joannou |author12=Ben Laurie |author13=A. Theodore Markettos |author14=J. Edward Maste |author15=Alfredo Mazzinghi |author16=Edward Tomasz Napierala |author17=Robert M. Norton |author18=Michael Roe |author19=Peter Sewell |author20=Stacey Son |author21=Jonathan Woodruff |date=2019 |title=CheriABI: Enforcing Valid Pointer Provenance and Minimizing Pointer Privilege in the POSIX C Run-time Environment |book-title=Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS '19) |publisher=Association for Computing Machinery |___location=New York, NY, USA |pages=379–393 |doi=10.1145/3297858.3304042 |url=https://doi.org/10.1145/3297858.3304042}}</ref> demonstrated a fully memory-safe implementation of POSIX, allowing existing desktop software to become memory safe with a single recompile.
By 2020 it became evident that software vendors were reluctant to port their software without hardware vendor support, while hardware vendors were unwilling to produce chips without sufficient customer demand. [[UK Research and Innovation]] (UKRI) launched the Digital Security by Design (DSbD) programme<ref name="dsbd">{{cite web |author=<!-- not stated --> |year=2020 |title=Digital security by design |url=https://www.ukri.org/what-we-do/browse-our-areas-of-investment-and-support/digital-security-by-design/ |access-date=18 January 2025 |publisher=UK Research and Innovation}}</ref> to address adoption barriers for CHERI. The programme allocated £70M, matched by £100M of industrial investment, to build the CHERI software ecosystem.<ref name="dsbd"
This initiative funded Arm's Morello chip, a ''superset architecture'' designed to evaluate experimental CHERI features for potential production use based on [[AArch64]]. The Morello board was designed to run CheriBSD,
In 2023 Microsoft introduced CHERIoT,<ref name="cheriot"
The CHERI Alliance was launched in 2024.<ref>{{Cite web |last=Flaherty |first=Nick |date=2024-11-12 |title=CHERI builds global chip security alliance |url=https://www.eenewseurope.com/en/cheri-builds-global-chip-security-alliance/ |access-date=2025-07-22 |website=eeNews Europe |language=en-US}}</ref> This non-profit organisation was formed by a number of high-tech companies to accelerate CHERI adoption. It provides a platform for collaboration and helps the technology become more visible and easier to use. Its goal is to aggregate the ecosystem and welcomes members interested in CHERI, from commercial companies to universities, research centres, and open-source communities. It is organised in working groups<ref>{{Cite web |title=CHERI Alliance – Working Groups |url=https://cheri-alliance.org/who-we-are/working-groups/ |access-date=2025-07-22 |website=CHERI Alliance |language=en-US}}</ref> that focus on specific themes (operating systems porting, tools, design recommendations...). It also organises conferences focused on CHERI<ref>{{Cite web |title=CHERI Alliance – Events |url=https://cheri-alliance.org/events/ |access-date=2025-07-22 |website=CHERI Alliance |language=en-US}}</ref> and participates to a number of events to promote the technology.
By 2024 SCI Semiconductors announced ICENI,<ref name=iceni>{{cite web |last1=Flaherty |first1=Nick |date=23 October 2024 |title=First CHERI RISC-V embedded chip and Early Access Programme |url=https://www.eenewseurope.com/en/first-cheri-risc-v-embedded-chip-and-early-access-programme/ |access-date=11 January 2025 |publisher=eeNews Europe}}</ref> a CHERIoT-compatible chip designed specifically for secure embedded systems. Codasip is actively developing a Linux kernel implementation for the RISC-V architecture.<ref>{{cite web |url=https://codasip.com/press-release/2024/10/21/codasip-enables-secure-linux-by-donating-cheri-risc-v-sdk-to-the-cheri-alliance/ |title=Codasip enables secure Linux by donating CHERI RISC-V SDK to the CHERI Alliance |publisher=Codasip |date=21 October 2024 |access-date=20 January 2025}}</ref> The CHERI Alliance, a non-profit organisation based in Cambridge, UK, was established to promote the adoption of CHERI technology and its integration into secure digital products and systems, including Google as a founding member.<ref name="cheri-alliance-launched" />▼
▲By 2024 SCI Semiconductors announced ICENI,<ref name="iceni">{{cite web |last1=Flaherty |first1=Nick |date=23 October 2024 |title=First CHERI RISC-V embedded chip and Early Access Programme |url=https://www.eenewseurope.com/en/first-cheri-risc-v-embedded-chip-and-early-access-programme/ |access-date=11 January 2025 |publisher=eeNews Europe}}</ref> a CHERIoT-compatible chip designed specifically for secure embedded systems. Codasip is actively developing a Linux kernel implementation for the RISC-V architecture.<ref>{{cite web |url=https://codasip.com/press-release/2024/10/21/codasip-enables-secure-linux-by-donating-cheri-risc-v-sdk-to-the-cheri-alliance/ |title=Codasip enables secure Linux by donating CHERI RISC-V SDK to the CHERI Alliance |publisher=Codasip |date=21 October 2024 |access-date=20 January 2025}}</ref> The CHERI Alliance, a non-profit organisation based in Cambridge, UK, was established to promote the adoption of CHERI technology and its integration into secure digital products and systems, including Google as a founding member.<ref name="cheri-alliance-launched" />
In 2025 Wyvern Global's Semiconductors Division announced WARP,<ref name=WARP>{{cite web |date=11 July 2025 |title=Wyvern Advanced RISC-V Processor |url=https://warp.wyvern.global/ |access-date=11 July 2025 |publisher=Wyvern Global}}</ref> the first commercially available CHERI-BSD native RISC-V chipset built from the ground up with CHERI in mind, and announced an OEM adoption programme under the same name for existing manufacturer's to integrate the technology into their existing boards using the WARP chipset. They have also pledged adoption of CHERI into all of their existing products and services end-to-end going forward and joined the CHERI alliance C.I.C <ref name=Wyvern_Global_Joins_CHERI_Alliance>{{cite web |date=11 July 2025 |title=Wyvern Global Joins CHERI alliance |url=https://cheri-alliance.org/member/wyvern-global/ |access-date=11 July 2025 |publisher=CHERI Alliance}}</ref>
==References==
{{
[[Category:Capability systems]]
| |||