The CHERI Capability Model - Revisiting RISC for an Age of Risk
Duration: 29 mins 44 secs
Share this media item:
Embed this media item:
Embed this media item:
About this item
| Description: | Talk presented at the International Symposium on Computer Architecture, 2014. |
|---|
| Created: | 2014-06-25 19:21 |
|---|---|
| Collection: |
Computer Architecture & Security
Computer Architecture Group |
| Publisher: | University of Cambridge |
| Copyright: | J.D. Woodruff |
| Language: | eng (English) |
| Keywords: | Computer Architecture; Security; |
| Abstract: | Motivated by contemporary security challenges, we reevaluate and refine capability-based addressing for the RISC era. We present CHERI, a hybrid capability model that extends the 64-bit MIPS ISA with byte-granularity memory protection. We demonstrate that CHERI enables language memory model enforcement and fault isolation in hardware rather than software, and that the CHERI mechanisms are easily adopted by existing programs for efficient in-program memory safety.
In contrast to past capability models, CHERI complements, rather than replaces, the ubiquitous page-based protection mechanism, providing a migration path towards deconflating data-structure protection and OS memory management. Furthermore, CHERI adheres to a strict RISC philosophy: it maintains a load-store architecture and requires only single-cycle instructions, and supplies protection primitives to the compiler, language runtime, and operating system. We demonstrate a mature FPGA implementation that runs the FreeBSD operating system with a full range of software and an open-source application suite compiled with an extended LLVM to use CHERI memory protection. A limit study compares published memory safety mechanisms in terms of instruction count and memory overheads. The study illustrates that CHERI is performance-competitive even while providing assurance and greater flexibility with simpler hardware. |
|---|---|