CHERI-based computer runs KDE for the first time
- Reference: 1658852409
- News link: https://www.theregister.co.uk/2022/07/26/cheri_computer_runs_kde/
- Source link:
The University of Cambridge's Capability Hardware Enhanced RISC Instructions project, or [1]CHERI for short, has been underway for some years, and usable results are starting to emerge. It aims to bake extra hardware-level security protections into processors, and Arm's [2]Morello board incorporates that research work by CHERI.
And Ruslan Bukin, a researcher at Cambridge's computer science department and also a FreeBSD [3]contributor , has [4]now ported the Wayland display server and KDE desktop to CheriBSD. As he puts it:
I don't have a single C pointer in kernel, DRM, Panfrost, Wayland, Qt, KDE, the entire user space graphical stack. All together, millions (if not billions?) of lines of code. […] Remember this moment, because in 5-10 years, capabilities will be in your jeans pocket.
A few years ago in 2019, we [5]reported when the project got government funding, and earlier this year, when the [6]aforementioned Arm prototype hardware began to ship. Coming just six months later, this experimental port is a significant step forward and a very promising sign.
The CHERI project originally targeted the MIPS processor architecture, but more recently has moved its focus to include RISC-V and Arm as well. Not only is Arm a much more significant processor architecture these days, but because Arm Ltd started out as an offshoot of Acorn Computers, it's also headquartered in Cambridge.
Digital security via hardware design
CHERI brings to modern processors two features of hardware-enforced safety and protection that were part of some computer designs in the relatively early days: a [7]tagged memory architecture and [8]capability-based addressing .
Capabilities were a hardware-enforced protection mechanism that were features of some computers, such as the Burroughs large systems – [9]descendants of which are still around today – and IBM's early [10]System/38 minicomputer. These systems flourished before the rise of Unix and Unix-like systems.
[11]
The S/38 evolved into the AS/400, today known as IBM i, but the designers of those later systems dropped the security mechanism. Similarly, the Multics OS which inspired the creation of Unix had some comparable features, but they were among the things which Dennis Ritchie and Ken Thompson left out of their smaller, simpler system.
[12]
[13]
The boffins at Cambridge's Computer Laboratory worked out a way to add capabilities in a Unix-compatible way, and called it [14]Capsicum , which has been part of FreeBSD since [15]version 9 .
The new desktop stack runs on an experimental OS derived from FreeBSD called [16]CheriBSD , which can make use of the hardware facilities of CHERI-enhanced Arm and RISC-V processors.
[17]
The project has an [18]FAQ which explains some more, as well as some less-technical articles about the [19]design and the [20]OS , although they're not exactly light reading. We particularly recommend Chapter 13, Historical Context and Related Work, of this [21]technical report [PDF], though.
Processor and compiler expert Mark Morgan Lloyd summarized it for us: "They're trying to not be too rude, but they're quite definite that they consider the industry to have taken a wrong turn in walking away from fine-grained hardware protection."
[22]How does £36m sound, mon CHERI? UK.gov pumps cash into Arm security research
[23]Arm rages against the insecure chip machine with new Morello architecture
[24]License to thrill: Ahead of v13.0, the FreeBSD team talks about Linux and the completed toolchain project that changes everything
[25]Arm wants to wrestle industry into a seat on the UK.gov's £70m hardware security train
In older systems, such as Multics, code running on the computer's processor had to run in one of many rings: inner rings had more permissions and control, and outer ones had less. This rings-of-protection approach is also used in, for instance, Intel chips, which have a limited, simpler version, as we explained in our [26]brief history of virtualization back in 2011. Most PC OSes never really used the feature, opting instead to use the CPU's memory management unit and page tables to primarily enforce access protections.
CHERI brings a more granular level of protection. Programs can be limited to accessing only certain permitted areas of memory, in certain restricted ways, and special hardware tags those areas of memory to limit what they can be used for – regardless of what the OS's security mechanisms may be tricked into believing.
CHERI won't make computers cheaper or faster, breaking the pattern of many modern hardware developments. But if it succeeds in its goals, CHERI-flavored computers will be more resistant to exploitation than ordinary ones. We suspect many organizations would be happy to pay for that. ®
Get our [27]Tech Resources
[1] https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/
[2] https://www.arm.com/architecture/cpu/morello
[3] https://wiki.freebsd.org/RuslanBukin
[4] https://www.linkedin.com/posts/onewilshire_so-ive-patched-kde-plasmawayland-under-activity-6951241424117899265-LIMU/
[5] https://www.theregister.com/2019/10/18/arm_security_by_design_research/
[6] https://www.theregister.com/2022/01/21/arm_morello_testing/
[7] https://www.memorymanagement.org/glossary/t.html#tagged.architecture
[8] https://en.wikipedia.org/wiki/Capability-based_addressing
[9] https://www.theregister.com/2022/03/29/non_c_operating_systems/
[10] https://www.ibm.com/ibm/history/exhibits/rochester/rochester_4009.html
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YuBkCbriYmFs3aoFl8Q04gAAARY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YuBkCbriYmFs3aoFl8Q04gAAARY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YuBkCbriYmFs3aoFl8Q04gAAARY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://www.cl.cam.ac.uk/research/security/capsicum/
[15] https://www.freebsd.org/releases/9.0R/announce/
[16] https://www.cheribsd.org/
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YuBkCbriYmFs3aoFl8Q04gAAARY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[18] https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/cheri-faq.html
[19] https://www.lightbluetouchpaper.org/2020/10/29/sri-and-cambridge-release-cheri-software-stack-for-arm-morello/
[20] https://www.lightbluetouchpaper.org/2022/07/22/formal-cheri/
[21] https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-951.pdf
[22] https://www.theregister.com/2019/10/18/arm_security_by_design_research/
[23] https://www.theregister.com/2022/01/21/arm_morello_testing/
[24] https://www.theregister.com/2021/03/10/the_state_of_freebsd/
[25] https://www.theregister.com/2019/01/28/ukgov_secure_by_design_70m_arm_cambridge/
[26] https://www.theregister.com/2011/07/11/a_brief_history_of_virtualisation_part_one/
[27] https://whitepapers.theregister.com/
Breakthrough
Even though capability-based security is almost as old as computer science itself, it has become increasingly in vogue with the almost endless patching of software, hacking, spying and ransomware.
I long for a world where computers are essentially unhackable. I hereby predict that when that day comes intelligence agencies will once again clamor for backdoored operating systems and CPU's.
Re: Breakthrough
"I hereby predict that when that day comes intelligence agencies will once again clamor for backdoored operating systems and CPU's."
Because that's what their political masters insist upon. For the sake of the chldren, of course.
I ported a few C & C++ OpenGL games to CheriBSD as part of my PhD thesis (I wrote a distributed implementation of OpenGL and wanted to test on novel platforms).
It is a fun platform albeit I only used the qemu-cheri emulator from the FreeBSD ports collection rather than actual hardware. Though to be fair, since I didn't go too low level or close to the hardware (I.e kept to C and C++), I didn't really even notice I was on such an experimental platform most of the time.
"CHERI-flavored computers will be more resistant to exploitation than ordinary ones"
Until the some nappy mandates they ship with hidden, total-control "Management" processors driven by an unaudited (and unauditable, until someone hacks it) blob of code.
Capabilities you say?
You mean like the Manchester MU5 of the late sixties?
The machine that was the baseline for the ICL 2900 series?
Why yes I think I might have heard something of such things.
Capabilities that work
I've used both ICL 2966 mainframes running VME/B and IBM AS/400 running OS/400. Both were very reliable and showed a refreshing unwillingness to crash.
IOW, both implemented first-class memory protection that did exactly what it said on the tin.
They had other nice similarities too, in that both had compilable job control languages and carefully thought-out command names (IOW once you know how command names are constructed you can guess seldom-used command names with good accuracy), decent source editors and well-designed program fault analysis tools that made program development easy. And both used excellent full-screen command prompting combined with an online command lookup capability.
However, both had what seemed, even then, like a major fault: neither had a hierarchic filing system, though at least VME/B used nice long names for commands and files.
I thought OS/400 blotted its copybook by restricting all names to nine characters, which made command names difficult to remember despite enforcing a consistent naming system - the PL/I compiler was called CRTPLIPGM - line noise for sure at 1st or even 2nd reading.
neither had a hierarchic filing system,
True.
I'm not sure how widespread such things were outside of Multics at the time. Also there is the "These are business machines, they don't need anything below a single level filing system"
That said i-series nams were not quite that restrictive. Files normally had "members" so "COBOL" is the COBOL source file for all programs in the system
The systematic naming of system commands was also another sign of a highly controlled system (I suspect similar in the HP 3000 series, which were also hardware+OS+database systems) but that's quite attractive as well, once you get used to the conventions, like everything happening by "readers" and "writers" accessing queues (using just Q in the name) and systems commands and roles starting with a Q(supposedly the least common letter used in the english language, so unlikely to clash with something in some customers system already Eg QSECOFR for ). If in doubt, throw the vowles out.
A way to go!
This may be unpopular, but:
I agree with Tony Hoare.
I'm also a strong believer in strong static typing in languages.
Correctness, reliability and maintainability over quick results in almost all situations.