Bringing up Linux on a memory-safe CHERI RISC-V system

This talk will discuss our work in bringing Linux to a hardware platform we (lowRISC) are developing - CHERI Mocha - complete with drivers for our hardware devices.

CHERI Mocha is an open-source reference design for a secure enclave, which is a secure environment for running trusted code and security-sensitive applications that boots independently to the rest of the SoC it is co-located with. The modified CVA-6 core at the heart of the system implements CHERI RISC-V - an extension to the RISC-V ISA that extends ordinary registers into permission and bounds-checking capabilities that are checked in hardware, allowing for architectural memory safety guarantees.

In this talk, we will detail the work needed to bring this system - or any other RISC-V system - up from boot ROM to booting into CHERI Linux, explore interactions between hardware and various layers of software, and share the experiences of developing and debugging the hardware platform hand-in-hand with software efforts. We also discuss some of the differences required to support CHERI software/firmware during system bring-up, and where there was little difference over the standard Integer ISA. If you’re interested in novel computing architectures, learning the RISC-V boot stack, and aren’t afraid of debugging a new system with just an instruction trace and wave viewer, then this talk is for you.

CHERI Mocha is part of the COSMIC project, which is funded by DSIT and IUK (grant number 10168492). The hardware design including peripheral IP and software are all licensed under the permissive Apache 2.0 license.