CHERI: Hardware-Enforced Memory Safety and Fine-Grained Compartmentalization for System Design
This presentation introduces CHERI (Capabilities Hardware Enhanced RISC Instructions), a hardware architecture that redefines pointer safety to address isolation and sharing challenges in modern systems. CHERI enables spatial and temporal memory safety for C/C++ and allows for lightweight, auditable compartmentalization, offering a novel approach to building more secure and robust systems from microcontrollers to data centers. It highlights how architectural changes at the hardware level can significantly impact software security and system design paradigms.
Read original on InfoQ ArchitectureThe Challenge of Isolation and Sharing
Traditional approaches to isolation, like MMUs in processes or VMs, are effective for fully isolated workloads but struggle when components need to communicate. The difficulty lies in designing programming models and hardware that facilitate secure and efficient sharing without compromising isolation. CHERI addresses this by introducing a new hardware-software contract around pointers, enabling fine-grained control over memory access and delegation.
What is CHERI?
CHERI is not a single ISA but an abstract set of ideas for extending ISAs (like ARM's Morello or RISC-V's RVY) to incorporate hardware-enforced capabilities. At its core, CHERI teaches the hardware that pointers are not just addresses but 'capabilities' – unforgeable tokens of authority. These capabilities carry metadata, including bounds and permissions, which are enforced by the hardware. This contrasts with conventional systems where pointer rules are language-level abstractions, making them vulnerable to memory corruption.
Key CHERI Principle
Capabilities are monotonic: You can restrict bounds and remove permissions from a capability, but you can never gain more permissions or expand bounds. This principle is fundamental to its security model.
CHERI Capabilities: Structure and Function
A CHERI capability extends a traditional pointer with metadata, typically doubling its size (e.g., 64-bit address + 64-bit metadata on a 64-bit system). Key components include: - Address: The actual memory location. - Bounds: Hardware-enforced start and end addresses for the allocated object, compressed efficiently. - Permissions: Granular controls (e.g., load, store, execute, load mutable capabilities) that dictate what actions can be performed using the capability. - Tag Bit: A critical bit indicating whether the data truly is a valid capability. If overwritten by data, the tag is cleared, rendering it invalid. - Object Type: Used for sealed capabilities, enabling secure object-capability models.
The hardware ensures that pointers cannot be forged or created from thin air. Any instruction (load, store, jump) that uses an address must now take a CHERI capability, and the hardware validates its bounds and permissions. This provides robust spatial and temporal memory safety, significantly reducing common vulnerabilities like buffer overflows and use-after-free errors.
Impact on System Design
CHERI enables fine-grained compartmentalization, allowing developers to isolate components within a single address space with hardware-guaranteed boundaries. This can replace costly OS-level RPC mechanisms with more lightweight, auditable, and secure inter-component communication. This approach is scalable, demonstrated from large data center applications with incremental adoption (CheriBSD) down to microcontrollers (CHERIoT), significantly impacting how secure embedded systems and high-assurance software can be architected without extensive code rewrites.