Capabilities for Coders
Lead Research Organisation:
University of Glasgow
Department Name: School of Computing Science
Abstract
The 'Capabilities for Coders' project involves the creation and curation of a set of freely available Morello coding resources for system developers. Standard developer behaviour involves interactive searching through online forums like StackOverflow and web tutorials like W3Schools. Currently there are no relevant targeted resources available for the Arm Morello system, and very few sites covering CHERI concepts in a developer-friendly style. This project will set up a one-stop shop for Morello programming, in the form of an open-access, online, interactive textbook called 'Capabilities for Coders'. This will be in the best tradition of programming language books - written by coders for coders. The unique appeal of this learning resource will be the inclusion of a large set of open-source code templates and fragments, effectively a library of reusable software samples for Morello applications written in C and C++ with assembler code where necessary.
The textbook and accompanying code samples will serve to enrich understanding of the current and evolving Morello stacks, providing support for existing developers and new arrivals in this domain. Because the learning resources are hosted online, it will be straightforward to keep them up-to-date (unlike hardcopy textbooks). Because the learning resources will be developed using the github platform, any user will be able to submit corrections and change requests. This will ensure the ongoing relevance of the project as the Morello technology evolves over time.
The project outputs will be open-access and freely available online. There will be no registration requirement or paywall. The site will be indexed by all major search engines. The resources will be clear, globally visible and highly accessible. These resources will provide direct, immediate benefit to the Morello ecosystem of developers.
At this stage, it is not possible to give a full table of contents for the online textbook. However, topics broadly covered will include: motivating the need for memory safety in systems code, hardware capabilities for memory safety, motivating compartmentalization in modern systems software, hardware capabilities for compartments, porting legacy applications to Morello, debugging capability-based code, performance engineering for capability-based code, and future directions. Each topic will be accompanied by an extensive range of open-source code examples to illustrate the various concepts. These software samples will be easily reusable by developers in their own code projects.
Additionally, the 'Capabilities for Coders' project will serve the community by posting relevant answers on StackOverflow and producing a podcast series.
The textbook and accompanying code samples will serve to enrich understanding of the current and evolving Morello stacks, providing support for existing developers and new arrivals in this domain. Because the learning resources are hosted online, it will be straightforward to keep them up-to-date (unlike hardcopy textbooks). Because the learning resources will be developed using the github platform, any user will be able to submit corrections and change requests. This will ensure the ongoing relevance of the project as the Morello technology evolves over time.
The project outputs will be open-access and freely available online. There will be no registration requirement or paywall. The site will be indexed by all major search engines. The resources will be clear, globally visible and highly accessible. These resources will provide direct, immediate benefit to the Morello ecosystem of developers.
At this stage, it is not possible to give a full table of contents for the online textbook. However, topics broadly covered will include: motivating the need for memory safety in systems code, hardware capabilities for memory safety, motivating compartmentalization in modern systems software, hardware capabilities for compartments, porting legacy applications to Morello, debugging capability-based code, performance engineering for capability-based code, and future directions. Each topic will be accompanied by an extensive range of open-source code examples to illustrate the various concepts. These software samples will be easily reusable by developers in their own code projects.
Additionally, the 'Capabilities for Coders' project will serve the community by posting relevant answers on StackOverflow and producing a podcast series.
People |
ORCID iD |
| Jeremy Singer (Principal Investigator) |
Publications
Bramley J
(2023)
Picking a CHERI Allocator: Security and Performance Considerations
Jacob D
(2022)
Boehm-Demers-Weiser Garbage Collection on Morello
Lowther D
(2023)
CHERI Performance Enhancement for a Bytecode Interpreter
Lowther D
(2023)
CHERI Performance Enhancement for a Bytecode Interpreter
Lowther D
(2025)
Secure Scripting with CHERIoT MicroPython
Lowther D
(2023)
Morello MicroPython: A Python Interpreter for CHERI
Singer J
(2023)
Towards Secure MicroPython on Morello (WIP)
| Description | That CHERI-style capabilities are a viable approach to enforcing memory safety for legacy C and C++ applications. This project provides a set of awareness-raising resources and more specialist developer documentation and demonstrations to show how CHERI capabilities can be used effectively - enabling improved cyber security for digital infrastructure. |
| Exploitation Route | The resources are still being curated and maintained after the funding period ends. The website will remain live for developers to access. The materials can be extended and enhanced for other people to learn about CHERI - and might be adapted for future CHERI instantiations. |
| Sectors | Digital/Communication/Information Technologies (including Software) Education Electronics Security and Diplomacy |
| URL | https://capabilitiesforcoders.com/ |
| Description | The learning resources and developer documentation generated by this project has contributed to the growing Digital Security by Design ecosystem, enabling faster on-boarding and good awareness raising about CHERI and Morello systems. |
| First Year Of Impact | 2023 |
| Sector | Digital/Communication/Information Technologies (including Software),Education |
| Impact Types | Societal |
| Description | M4Secure: Making Memory Management More Secure |
| Amount | £457,857 (GBP) |
| Funding ID | EP/X037525/1 |
| Organisation | Engineering and Physical Sciences Research Council (EPSRC) |
| Sector | Public |
| Country | United Kingdom |
| Start | 08/2023 |
| End | 08/2026 |
| Description | Scotland-Asia Partnerships Higher education Research (SAPHIRE) Fund |
| Amount | £5,500 (GBP) |
| Organisation | Royal Society of Edinburgh (RSE) |
| Sector | Charity/Non Profit |
| Country | United Kingdom |
| Start | 03/2024 |
| End | 06/2024 |
| Description | Secure MicroPython for Morello |
| Amount | £99,662 (GBP) |
| Funding ID | DSTL0000013741 |
| Organisation | Defence Science & Technology Laboratory (DSTL) |
| Sector | Public |
| Country | United Kingdom |
| Start | 03/2023 |
| End | 12/2023 |
| Description | CHERI workshop (Australia) |
| Form Of Engagement Activity | A talk or presentation |
| Part Of Official Scheme? | No |
| Geographic Reach | International |
| Primary Audience | Industry/Business |
| Results and Impact | 30 technical experts attended a briefing session on CHERI technology, to learn about how to apply it to legacy C/C++ systems code. |
| Year(s) Of Engagement Activity | 2024 |
| URL | https://comp.anu.edu.au/foundations/seminars/past/2024-05-17/ |
| Description | CHERI workshop (Singapore) |
| Form Of Engagement Activity | Participation in an activity, workshop or similar |
| Part Of Official Scheme? | No |
| Geographic Reach | International |
| Primary Audience | Professional Practitioners |
| Results and Impact | 50 software engineers from university and industry attended a briefing session on CHERI technology. |
| Year(s) Of Engagement Activity | 2024 |
| Description | Capabilities for Coders podcast series |
| Form Of Engagement Activity | A broadcast e.g. TV/radio/film/podcast (other than news/press) |
| Part Of Official Scheme? | No |
| Geographic Reach | International |
| Primary Audience | Professional Practitioners |
| Results and Impact | The Capabilities for Coders podcast is an interview series, talking about the CHERI / Morello computer systems and the Digital Security by Design initiative. It is aimed at a general audience, giving insight into the importance of Cyber Security and current hardware innovations that improve system security. This is an ongoing series. |
| Year(s) Of Engagement Activity | 2023 |
| URL | https://capabilitiesforcoders.com/podcasts/ |
| Description | Capabilities for Coders website |
| Form Of Engagement Activity | Engagement focused website, blog or social media channel |
| Part Of Official Scheme? | No |
| Geographic Reach | International |
| Primary Audience | Professional Practitioners |
| Results and Impact | Capabilities for Coders is a documentation and developer engagement project, aiming to generate useful resources for the CHERI and Morello software ecosystem. Basically, this project aims to be 'all you wanted to know about capabilities but were afraid to ask'. |
| Year(s) Of Engagement Activity | 2022,2023 |
| URL | https://capabilitiesforcoders.com/ |
| Description | Computing Education Practices workshop talk on cybersecurity |
| Form Of Engagement Activity | A talk or presentation |
| Part Of Official Scheme? | No |
| Geographic Reach | National |
| Primary Audience | Professional Practitioners |
| Results and Impact | Facilitated discussion about CHERI and capabilities, in terms of how to explain systems cybersecurity concepts to non-expert audiences using analogies. Generated some useful teaching resources. |
| Year(s) Of Engagement Activity | 2023 |
| URL | https://www.ease.ws/ |
| Description | Cyber UK Conference 2023 |
| Form Of Engagement Activity | Participation in an activity, workshop or similar |
| Part Of Official Scheme? | No |
| Geographic Reach | National |
| Primary Audience | Professional Practitioners |
| Results and Impact | I had a demonstration on the UKRI stand at the Cyber UK 2023 event in Belfast, showing how memory safety worked on CHERI in the context of garbage collected applications. Over two days, around 200 people attended the demo and interacted with it. |
| Year(s) Of Engagement Activity | 2023 |
| URL | https://www.cyberuk.uk/ |
| Description | DSbD showcase event |
| Form Of Engagement Activity | Participation in an activity, workshop or similar |
| Part Of Official Scheme? | No |
| Geographic Reach | National |
| Primary Audience | Industry/Business |
| Results and Impact | We demonstrated secure CHERI runtime technologies in a booth at the DSbD showcase event in London. |
| Year(s) Of Engagement Activity | 2024 |
| URL | https://www.dsbd.tech/event/uks-digital-security-by-design-showcase-2025/ |
| Description | Digital DNA Glasgow 2023 event |
| Form Of Engagement Activity | Participation in an activity, workshop or similar |
| Part Of Official Scheme? | No |
| Geographic Reach | Regional |
| Primary Audience | Industry/Business |
| Results and Impact | We had a UKRI-sponsored stand at this Cyber Security trade show. Around 50 people attended and interacted with our Morello/Arm CHERI demo device. We had interesting discussions about cyber security. |
| Year(s) Of Engagement Activity | 2023 |
| URL | https://digitaldna.org.uk/digital-dna-glasgow-2023/ |
| Description | Digital Security by Design workshop |
| Form Of Engagement Activity | Participation in an activity, workshop or similar |
| Part Of Official Scheme? | No |
| Geographic Reach | National |
| Primary Audience | Professional Practitioners |
| Results and Impact | Workshop on 'Capabilities for Coders', crowd-sourcing frequently asked questions about CHERI and capabilities from people who are working in the area and people who are new to the area. Lots of questions, which we catalogued and are generating answers to post online. |
| Year(s) Of Engagement Activity | 2022 |
| URL | https://capabilitiesforcoders.com/ |
| Description | FutureScot Cyber Security Show |
| Form Of Engagement Activity | Participation in an activity, workshop or similar |
| Part Of Official Scheme? | No |
| Geographic Reach | National |
| Primary Audience | Professional Practitioners |
| Results and Impact | Around 200 people attended the FutureScot Cyber Security show in Glasgow, 27 Feb 2024. We had a stall demonstrating CHERI hardware and capability-enabled software - which provoked lots of conversations, raising awareness about memory-safe technologies. We also had a Q+A time in the plenary session with more than 200 participants. |
| Year(s) Of Engagement Activity | 2024 |
| URL | https://futurescot.com/futurescot-conferences/cyber-security-2024/ |
| Description | FutureScot CyberSecurity Show |
| Form Of Engagement Activity | Participation in an activity, workshop or similar |
| Part Of Official Scheme? | No |
| Geographic Reach | National |
| Primary Audience | Industry/Business |
| Results and Impact | Stand at the FutureScot Cybersecurity Show in Glasgow. Over 100 people visiting the show learned about CHERI Secure Hardware Technologies, as researched at the University of Glasgow. |
| Year(s) Of Engagement Activity | 2025 |
| URL | https://futurescot.com/futurescot-conferences/cyber-security-2026/ |
| Description | High School visit (Gryffe) |
| Form Of Engagement Activity | Participation in an activity, workshop or similar |
| Part Of Official Scheme? | No |
| Geographic Reach | Local |
| Primary Audience | Schools |
| Results and Impact | At a school careers event, I spoke to around 50 pupils about Cybersecurity, and gave a high-level overview of CHERI / Digital Security by Design. |
| Year(s) Of Engagement Activity | 2022 |
| Description | SICSA PhD summer school |
| Form Of Engagement Activity | Participation in an activity, workshop or similar |
| Part Of Official Scheme? | No |
| Geographic Reach | National |
| Primary Audience | Postgraduate students |
| Results and Impact | 30 PhD students attended an interactive workshop on CHERI technologies as part of a cybersecurity summer school. |
| Year(s) Of Engagement Activity | 2024 |
| URL | https://sicsa.ac.uk/event/2024-sicsa-phd-conference/ |
| Description | Singapore DSO lab visit |
| Form Of Engagement Activity | Participation in an open day or visit at my research institution |
| Part Of Official Scheme? | No |
| Geographic Reach | International |
| Primary Audience | Policymakers/politicians |
| Results and Impact | Visitors from Singapore came to our lab to learn about Digital Security by Design, in particular about hardware assisted mechanisms for secure systems. They were interested in the work and would like to launch some collaborative activities. |
| Year(s) Of Engagement Activity | 2022 |
| URL | https://www.gla.ac.uk/colleges/socialsciences/research/interdisciplinaryresearchthemes/headline_8779... |
| Description | Strathclyde Cybersecurity summer school |
| Form Of Engagement Activity | Participation in an activity, workshop or similar |
| Part Of Official Scheme? | No |
| Geographic Reach | International |
| Primary Audience | Postgraduate students |
| Results and Impact | 50 computing students learned about CHERI technologies in a hands-on workshop. |
| Year(s) Of Engagement Activity | 2024,2025 |
| URL | https://www.strath.ac.uk/science/computerinformationsciences/strathcyber/cybercrimesummerschool/ |
| Description | Summer School lecture on Capabilities |
| Form Of Engagement Activity | Participation in an activity, workshop or similar |
| Part Of Official Scheme? | No |
| Geographic Reach | National |
| Primary Audience | Postgraduate students |
| Results and Impact | Around 100 people attended the PhD summer school on Programming Languages and Verification, at which I gave an invited lecture on 'Capabilities for Coders' - a generalist introduction to CHERI. There were many questions and comments following the talk, and a number of students followed up by downloading the software for CHERI. |
| Year(s) Of Engagement Activity | 2022 |
| URL | https://www.macs.hw.ac.uk/splv/splv-2022/ |
| Description | Talk about CHERI allocators and ChatGPT |
| Form Of Engagement Activity | A talk or presentation |
| Part Of Official Scheme? | No |
| Geographic Reach | International |
| Primary Audience | Industry/Business |
| Results and Impact | Presentation about using ChatGPT and LLMs to synthesize code for systems software including memory allocators. |
| Year(s) Of Engagement Activity | 2023 |
| URL | https://www.youtube.com/watch?v=CGE905k-ils |
| Description | Vietnam visitor hosting |
| Form Of Engagement Activity | Participation in an activity, workshop or similar |
| Part Of Official Scheme? | No |
| Geographic Reach | International |
| Primary Audience | Professional Practitioners |
| Results and Impact | Visit of academics and administrators from Vietnam to Glasgow, to learn about cyber security |
| Year(s) Of Engagement Activity | 2023 |
| Description | Visit to Heriot Watt University |
| Form Of Engagement Activity | A talk or presentation |
| Part Of Official Scheme? | No |
| Geographic Reach | Local |
| Primary Audience | Postgraduate students |
| Results and Impact | Presentation about profiling cybersecure systems, for ensuring efficiency of memory allocators in CHERI. Lots of followup questions; one researcher then ordered a Morello machine for their own research project. |
| Year(s) Of Engagement Activity | 2023 |