Developing and Evaluating an Open-Source Desktop for Arm Morello

该项目正在为ARM Morello板适应一个全面的开源桌面软件环境，新颖地利用Cheri的细粒度内存安全和可扩展的软件划分功能，以减少该软件堆栈中预计四分之三的过去软件漏洞。该项目将由三个关键要素组成，将实际工程与经验计算机科学相结合：(1)在我们之前的DSbD‘de Minimis’项目的基础上，我们将开发一个内存安全的分区桌面环境，说明ARM Morello板上的关键Cheri保护属性。软件组件将包括GPU设备驱动程序、窗口系统、KDE桌面环境和Chromium网络浏览器；(2)除了将这项工作作为开源开发外，我们还将在整个项目中定期发布软件，以确保它们可供更广泛的DSbD社区使用；(3)我们将从适配和长期维护难度、性能开销(尤其是面向用户的延迟)和安全影响等方面对此工作进行全面评估。结果将是一个适合在ARM Morello板上使用的开源桌面环境，通过超过60MLoC的Cheri软件语料库展示其硬件保护功能，是目前展示的30MLoC语料库的两倍多。我们将报告工作和评价的所有方面，争取通过技术报告并酌情出版研究出版物。

This project is adapting a full-scale open-source desktop software environment for the ARM Morello board, making novel use of CHERI's fine-grained memory safety and scalable software compartmentalisation features to mitigate an expected three quarters of past software vulnerabilities in that software stack. This project will consist of three key elements combining practical engineering with empirical computer science:(1) Building on foundations laid in our prior DSbD 'de minimis' project, we will develop a memory-safe and compartmentalized desktop environment illustrating key CHERI protection properties on the Arm Morello board. Software components will include GPU device drivers, windowing system, KDE desktop environment, and Chromium web browser;(2) As well as developing this work as open source, we will produce software releases at regular intervals throughout the project to ensure that they are available for use by the broader DSbD community; and(3) We will thoroughly evaluate this work considering aspects such as adaptation and longer-term maintenance difficulty, performance overheads (especially user-facing latency), and security impact.The result will be an open-source desktop environment suitable for use on the Arm Morello board, demonstrating its hardware protection features with a CHERI software corpus exceeding 60MLoC, more than doubling the size of the 30MLoC corpus demonstrated to date. We will report on all aspects of the work and evaluation, seeking to publish via technical reports and, as appropriate, research publications.