About

• Specification Name: CHERI

• Task Group:

  Jira Legacy
  server System Jira serverId 4d3dce95-b4be-35da-b49f-ec8432d8f473 key RVG-148

• Task Group Charter: https://github.com/riscv-admin/cheri-tg/blob/main/charter.adoc Charter

• Spec Jira:

  Jira Legacy
  server System Jira serverId 4d3dce95-b4be-35da-b49f-ec8432d8f473 key RVS-2141

Background

The goal of the CHERI TG is to define a capability-based security extension.

...

Building on over a decade of pioneering research by the University of Cambridge and SRI International, the CHERI technology has been implemented by Arm on the Morello 7nm SoC evaluation platform, and many processors have been developed by academia and the industry (Microsoft, Google, Codasip, lowRISC,…)

Overview

The CHERI extension adds a new data type to RISC-V: the CHERI capability. This can be thought of as a (2*XLEN+1)-bit pointer with bounds information, permissions (e.g. read/write), type information and a hardware-tracked validity tag. In combination with new instructions, this allows for fine-grained compartmentalization and memory safety. Importantly, any instruction operating on capabilities can only reduce the access rights granted and any attempt to amplify (e.g. by growing the bounds) will clear the validity tag.

When a core implements CHERI, the general purpose registers and CSRs that hold pointers (e.g. xtvec) are widened to capability size and the memory subsystem propagates the validity tags to memory. New instructions operating on the extended GPRs perform bounds and permission checks when loading/storing to enforce memory safety and new jump instructions allow for efficient compartment switching.

For a more detailed description, please see the introduction of the specification document: https://riscv.github.io/riscv-cheri/#_introduction

Stakeholders Identification

References: Active Groups and Specifications Under Development

...

• Security HC as well as Priv+Unpriv IC

• CHERI SIG

• psABI (to define the new pure-capability ABI)

• Architectural Testing (to define a testsuite for CHERI-RISC-V)

• Formal modelling (to upstream a CHERI-RISC-V Sail model)

• Apps and Tools Software HC

• SBI Specification

Design Considerations

The CHERI extension has been designed to be fully binary compatible with existing RISC-V code. When the extension is enabled, it is also possible to recompile code in a mode uses capability registers (instead of integer GPRs) for all accesses, the so-called pure-capability programming environment.

For opcode space reasons it is not feasible to add new variations of every (vector) load/store instruction using a capability base register, so CHERI adds a decoding mode bit to the program counter that allows changing the interpretation of the base operand between integer and capability.

Proof-of-Concept and Tests

The CHERI specification has been validated in multiple operating systems:

...

In terms of ISA tests, Codasip has an extensive test suite and Cambridge has create a differential testing framework that works with CHERI.

Software Ecosystem Impacts

Freeze Checklists

Key Milestones

Additional Notes

...