Two Stories for "What Is CHERI?" | Hacker News Reader

Two Stories for "What Is CHERI?"

tratt.net

43 pointsltratt9 comments

Interesting. Very low level though and C(++) centric. She there any thoughts on combining the hardware and OS features with rust or https://vale.dev ?

CHERI is not specific to C/C++ but aims to provide primitives at the hardware level that can be used to make software safer (including programming languages) in terms of (spatial and temporal) memory safety and also to compartmentalize your software stack (e.g., separate third-party software libraries from the core of your application). It is true that the only currently stable CHERI-extended SDKs for programming languages are CHERI LLVM [1] (for CHERI-RISC-V) and LLVM for Morello [2] for CHERI C/C++ [3]. However, there have been more projects that extend other SDKs for CHERI: Rust [4] [5], JavaScriptCore and WebKit [6] [7], OpenJDK [8].

[1] https://github.com/CTSRD-CHERI/llvm-project

[2] https://git.morello-project.org/morello/llvm-project

[3] https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-947.pdf

[4] https://github.com/kent-weak-memory/rust

[5] https://soft-dev.org/events/cheritech22/slides/Cooksey.pdf

[6] https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/cheri...

[7] https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-975.pdf

[8] https://www.dcs.gla.ac.uk/~jsinger/cheritech23_slides/anisbe...

CHERI is primarily targeted at providing safety for codebases that would benefit from moving spatial safety into hardware. Since most C(++) code has none of these checks at all, using CHERI allows you to retrofit the code to make it more secure. Rust and other safe languages currently reliably emit these checks in software which means it’s not as necessary for a hardware implementation of these things, but such code running in these systems could drop some of the software checks and rely on the CHERI primitives instead.

Rust would still benefit from this with unsafe code. & on that front they need to do some changes since Rust code assumes pointers can be converted to/from usize/isize

https://faultlore.com/blah/fix-rust-pointers

Part of CHERI can also be used for software compartmentalisation which Rust has no support for.

There's plenty resources on CHERI/rust

https://news.ycombinator.com/item?id=31024127 Making Rust a Better Fit for Cheri and Other Platforms by same author

https://archive.fosdem.org/2023/schedule/event/rust_a_rusty_...

Where can I buy an ARM Morello board for home use? Still trying to find one.

Because Morello is an experimental platform, only a small number were manufactured. They are/were allocated mostly to people involved in early stages CHERI R&D and, AFAIK, none were made available to the general public. [That said, I don't know whether there are still some unallocated machines!] One can fully emulate Morello with qemu. While the emulator is, unsurprisingly, rather slow, I generally use qemu for quick Morello experiments, even though I have access to physical Morello boards.

"Any UK or international registered business or organisation can request a Morello Board by completing the form below":

https://dsbd.tech/get-involved/morello-board-request/

Alternatively, you can use a Morello board running CheriBSD that is available in the GCC Farm Project:

https://cfarm.tetaneutral.net/news/45

Reply on news.ycombinator.com