Linux and CHERI: Back to the Future
summary
CHERI is a capability CPU extension that replaces pointers with 128-bit capabilities, already running a Linux kernel port that reaches kernel 6.16 purecap and userland via Yocto; research silicon Morello exists and RISC-V cores are emerging. LLVM support, a QEMU/Cherry emulator and Yocto build are available for testing. Measured overheads from a purpose-built core are <5% silicon area, about 3.8% extra instructions and under 5% runtime slowdown, and current work focuses on compartmentalized modules, eBPF and upstreaming.
AI-written summary · about
chapters (22)
- 0:00CHERI and Linux intro
- 1:26History of capabilities
- 5:43Capability hardware evolution
- 10:18What is CHERI and goals
- 19:13CHERI capabilities in practice
- 21:44CHERI for Linux security
- 24:39CHERI on Linux now
- 31:10CHERI future challenges
- 34:19CHERI hardware performance
- 36:10Memory safety future
- 36:53Q&A: CHERI vs Rust
- 40:09Q&A: 32-bit Linux future
- 40:53Q&A: Memory overhead
- 42:19Q&A: Compiler efforts
- 43:05Q&A: Compartmentalization progress
- 44:31Q&A: Kernel compartmentalization
- 45:36Q&A: ML project link
- 46:40Q&A: Code changes needed
- 49:11Q&A: Emulation and tools
- 50:14Q&A: CHERI vs MTE
- 51:19Q&A: ARM emulation
- 52:01Q&A: Performance details
related talks
17mHardening Linux and FreeBSD on RISC-V with CHERI
10mCHERI in out-of-order microarchitectures
20mMaking CHERI Accessible
31mMemory Safety: The Pernicious Challenge
11mFast and fine-grained compartmentalisation in CHERI
11mDemo: Securely Booting CHERI on a Full OS to Prevent Buffer Overflow Attacks
18mCVA6-CHERI - An Open-source RV64Y Implementation for Commercialization
18mWhat’s next for memory safety?