CHERI: a research platform deconflating hardware virtualization and protection

Robert N. M. Watson; Peter G. Neumann; Jonathan Woodruff; Jonathan Anderson; Ross Anderson; Nirav Dave; Ben Laurie; Simon W. Moore; Steven J.  Murdoch; Philip Paeps; Michael Roe; Hassen Saidi

CHERI: a research platform deconflating hardware virtualization and protection

Robert N. M. Watson, Peter G. Neumann, Jonathan Woodruff, Jonathan Anderson, Ross Anderson, Nirav Dave, Ben Laurie, Simon W. Moore, Steven J. Murdoch, Philip Paeps, Michael Roe, Hassen Saidi

Research output: Contribution to conference › Paper › peer-review

Abstract / Description of output

Contemporary CPU architectures conflate virtualization and protection, imposing virtualization-related performance, programmability, and debuggability penalties on software requiring finegrained protection. First observed in micro kernel research, these problems are increasingly apparent in recent attempts to mitigate software vulnerabilities through application compartmentalisation. Capability Hardware Enhanced RISC Instructions (CHERI) extend RISC ISAs to support greater software compartmentalisation. CHERI’s hybrid capability model provides fine-grained compartmentalisation within address spaces while maintaining software backward compatibility, which will allow the incremental deployment of fine-grained compartmentalisation in both our most trusted and least trustworthy C-language software stacks. We have implemented a 64-bit MIPS research soft core, BERI, as well as a capability coprocessor, and begun adapting commodity software packages (FreeBSD and Chromium) to execute on the platform.

Original language	English
Number of pages	8
Publication status	Published - 3 Mar 2012
Event	Runtime Environments, Systems, Layering and Virtualized Environments (RESoLVE) 2012 - London, United Kingdom Duration: 3 Mar 2012 → 3 Mar 2012 Conference number: 2 http://www.dcs.gla.ac.uk/conferences/resolve12/index.html

Workshop

Workshop	Runtime Environments, Systems, Layering and Virtualized Environments (RESoLVE) 2012
Abbreviated title	RESoLVE 2012
Country/Territory	United Kingdom
City	London
Period	3/03/12 → 3/03/12
Internet address	http://www.dcs.gla.ac.uk/conferences/resolve12/index.html

Access to Document

http://www.dcs.gla.ac.uk/conferences/resolve12/papers/session1_paper3.pdfLicence: All Rights Reserved
https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/2012resolve-cheri.pdfLicence: All Rights Reserved

Cite this

Watson, R. N. M., Neumann, P. G., Woodruff, J., Anderson, J., Anderson, R., Dave, N., Laurie, B., Moore, S. W., Murdoch, S. J., Paeps, P., Roe, M., & Saidi, H. (2012). CHERI: a research platform deconflating hardware virtualization and protection. Paper presented at Runtime Environments, Systems, Layering and Virtualized Environments (RESoLVE) 2012, London, United Kingdom. http://www.dcs.gla.ac.uk/conferences/resolve12/papers/session1_paper3.pdf

@conference{a7e89878c18d4752babfb70913d9858e,

title = "CHERI: a research platform deconflating hardware virtualization and protection",

abstract = "Contemporary CPU architectures conflate virtualization and protection, imposing virtualization-related performance, programmability, and debuggability penalties on software requiring finegrained protection. First observed in micro kernel research, these problems are increasingly apparent in recent attempts to mitigate software vulnerabilities through application compartmentalisation. Capability Hardware Enhanced RISC Instructions (CHERI) extend RISC ISAs to support greater software compartmentalisation. CHERI{\textquoteright}s hybrid capability model provides fine-grained compartmentalisation within address spaces while maintaining software backward compatibility, which will allow the incremental deployment of fine-grained compartmentalisation in both our most trusted and least trustworthy C-language software stacks. We have implemented a 64-bit MIPS research soft core, BERI, as well as a capability coprocessor, and begun adapting commodity software packages (FreeBSD and Chromium) to execute on the platform.",

author = "Watson, {Robert N. M.} and Neumann, {Peter G.} and Jonathan Woodruff and Jonathan Anderson and Ross Anderson and Nirav Dave and Ben Laurie and Moore, {Simon W.} and Murdoch, {Steven J.} and Philip Paeps and Michael Roe and Hassen Saidi",

year = "2012",

month = mar,

day = "3",

language = "English",

note = "Runtime Environments, Systems, Layering and Virtualized Environments (RESoLVE) 2012, RESoLVE 2012 ; Conference date: 03-03-2012 Through 03-03-2012",

url = "http://www.dcs.gla.ac.uk/conferences/resolve12/index.html",

}

Watson, RNM, Neumann, PG, Woodruff, J, Anderson, J, Anderson, R, Dave, N, Laurie, B, Moore, SW, Murdoch, SJ, Paeps, P, Roe, M & Saidi, H 2012, 'CHERI: a research platform deconflating hardware virtualization and protection', Paper presented at Runtime Environments, Systems, Layering and Virtualized Environments (RESoLVE) 2012, London, United Kingdom, 3/03/12 - 3/03/12. <http://www.dcs.gla.ac.uk/conferences/resolve12/papers/session1_paper3.pdf>

TY - CONF

T1 - CHERI: a research platform deconflating hardware virtualization and protection

AU - Watson, Robert N. M.

AU - Neumann, Peter G.

AU - Woodruff, Jonathan

AU - Anderson, Jonathan

AU - Anderson, Ross

AU - Dave, Nirav

AU - Laurie, Ben

AU - Moore, Simon W.

AU - Murdoch, Steven J.

AU - Paeps, Philip

AU - Roe, Michael

AU - Saidi, Hassen

N1 - Conference code: 2

PY - 2012/3/3

Y1 - 2012/3/3

N2 - Contemporary CPU architectures conflate virtualization and protection, imposing virtualization-related performance, programmability, and debuggability penalties on software requiring finegrained protection. First observed in micro kernel research, these problems are increasingly apparent in recent attempts to mitigate software vulnerabilities through application compartmentalisation. Capability Hardware Enhanced RISC Instructions (CHERI) extend RISC ISAs to support greater software compartmentalisation. CHERI’s hybrid capability model provides fine-grained compartmentalisation within address spaces while maintaining software backward compatibility, which will allow the incremental deployment of fine-grained compartmentalisation in both our most trusted and least trustworthy C-language software stacks. We have implemented a 64-bit MIPS research soft core, BERI, as well as a capability coprocessor, and begun adapting commodity software packages (FreeBSD and Chromium) to execute on the platform.

AB - Contemporary CPU architectures conflate virtualization and protection, imposing virtualization-related performance, programmability, and debuggability penalties on software requiring finegrained protection. First observed in micro kernel research, these problems are increasingly apparent in recent attempts to mitigate software vulnerabilities through application compartmentalisation. Capability Hardware Enhanced RISC Instructions (CHERI) extend RISC ISAs to support greater software compartmentalisation. CHERI’s hybrid capability model provides fine-grained compartmentalisation within address spaces while maintaining software backward compatibility, which will allow the incremental deployment of fine-grained compartmentalisation in both our most trusted and least trustworthy C-language software stacks. We have implemented a 64-bit MIPS research soft core, BERI, as well as a capability coprocessor, and begun adapting commodity software packages (FreeBSD and Chromium) to execute on the platform.

UR - http://www.dcs.gla.ac.uk/conferences/resolve12/program.html

M3 - Paper

T2 - Runtime Environments, Systems, Layering and Virtualized Environments (RESoLVE) 2012

Y2 - 3 March 2012 through 3 March 2012

ER -

CHERI: a research platform deconflating hardware virtualization and protection

Abstract / Description of output

Workshop

Access to Document

Other files and links

Fingerprint

Cite this