Skip to content
STIMSMITH

CHERI

Concept

CHERI (Capability Hardware Enhanced RISC Instructions) is a hardware-supported capability-based memory-safety architecture originating from a 2010 University of Cambridge project. It extends conventional RISC ISAs with architectural capabilities carrying bounds, permissions, and out-of-band validity tags, and has a growing software ecosystem including CheriBSD, CHERI-RISC-V virtual prototypes, security-aware early benchmarks, and downstream research on temporal safety and allocator hardening. The architecture is being adopted into mainstream RISC-V via an ongoing CHERI extension standardization effort and is exercised by randomized tandem verification on processors such as Toooba and CVA6.

First seen 5/29/2026
Last seen 7/19/2026
Evidence 51 chunks
Wiki v9

WIKI

Overview

CHERI stands for Capability Hardware Enhanced RISC Instructions. It is a hardware-supported memory-safety architecture, developed from a 2010 University of Cambridge project, that extends existing instruction-set architectures with architectural capabilities rather than replacing them wholesale. Public evidence describes CHERI as a leading hardware/software system that provides native spatial safety and a foundation for temporal memory safety, and as the most mature capability-based memory-safety architecture. It has been implemented and evaluated across multiple platforms including software-based emulation, FPGA prototypes, and ASICs such as Arm's Morello. [CHERI-D characterization] [DDECS 2026 framing]

CHERI addresses memory-safety problems such as buffer overflows and use-after-free vulnerabilities, which are framed in the evidence as a major source of security vulnerabilities and motivate hardware-supported memory-safety mechanisms where software-only mitigations are described as partial and costly. The DDECS 2026 paper situates CHERI among hardware-assisted spatial and temporal memory-safety techniques alongside bounds-checking mechanisms such as HardBound and SoftBound, tagged-memory architectures such as ARM Memory Tagging Extension, and other capability-based systems. [Memory-safety motivation]

READ FULL ARTICLE →

NEIGHBORHOOD

9 nodes · 23 edges
graph · CHERI · depth=1

RELATIONSHIPS

41 connections
TestRIG ← evaluates 100% 13e
TestRIG is used to verify CHERI security extensions on RISC-V processors.
tagged memory uses → 100% 5e
CHERI uses a dedicated tagged memory to store capability validity bits.
Toooba ← implements 100% 4e
Toooba is a CHERI-enabled RISC-V processor.
Randomized Testing of RISC-V CPUs using Direct Instruction Injection ← evaluates 100% 3e
The paper evaluates TestRIG on the CHERI security extension, finding and fixing multiple bugs.
RISC-V part of → 85% 2e
CHERI is described as an experimental security extension to RISC-V.
CHERI Alliance ← introduces 85% 2e
The CHERI Alliance was founded to drive standardization and industrial adoption of CHERI.
tag controller uses → 100% 2e
CHERI uses a tag controller for tagged memory to track capability validity.
CHERI-RISC-V VP++ ← implements 100% 2e
CHERI-RISC-V VP++ implements CHERI architectural features in a virtual prototype.
capability pointer uses → 100% 2e
CHERI uses capability pointers to replace traditional integer memory addresses.
merged register file uses → 100% 2e
CHERI implementations use a merged register file combining integer and capability registers.
Program Counter Capability uses → 100% 2e
CHERI extends the program counter to include capability metadata as PCC.
capability mode bit uses → 100% 2e
CHERI uses a capability mode bit to switch between capability and legacy modes.
CHERI Early Benchmarks ← uses 100% 2e
The CHERI Early Benchmarks are designed to exercise CHERI's capability and tag-management mechanisms.
Sail RISC-V Model ← implements 90% 2e
The Sail RISC-V model has been extended to include CHERI.
MIPS architecture derived from → 100% 2e
CHERI was initially designed for MIPS and the RISC-V implementation is derived from that work.
RISC-V extends → 95% 2e
CHERI is a security extension to the RISC-V architecture.
Piccolo ← implements 100% 2e
Piccolo is extended with CHERI modifications providing CHERI capability support.
Flute ← implements 100% 2e
Flute is extended with CHERI modifications providing CHERI capability support.
University of Cambridge ← introduces 100% 2e
CHERI was initiated by the University of Cambridge in 2010.
capability tag bit uses → 100% 1e
CHERI uses a tag bit stored out-of-band to validate capabilities.
hybrid mode uses → 100% 1e
CHERI supports hybrid mode allowing CHERI-aware and legacy code to run side by side.
RISC-V VP ← implements 95% 1e
The RISC-V VP is extended with the CHERI extension for RISC-V.
CVA6 ← implements 1e
CVA6 is a CHERI-enabled RISC-V processor.
QCVEngine ← evaluates 95% 1e
QCVEngine was used to test CHERI processor extensions and build an archive of counterexamples.
TestRIG ← uses 1e
TestRIG supports CHERI extensions for RISC-V verification.
Sail ← evaluates 1e
Sail can be built with CHERI support for evaluation of CHERI extensions.
Sail ← implements 90% 1e
The Sail model includes a CHERI function that is tested via mutation-based testing.
Who tests the TestRIG? Tooling for randomised tandem verification ← mentions 100% 1e
The paper discusses testing CHERI security extensions as a motivating application.
UCAM-CL-TR-984 ← uses 100% 1e
The thesis investigates the implementation of CHERI secure capabilities for RISC-V microarchitectures.
Sail CHERI-RISC-V ← implements 100% 1e
Sail CHERI-RISC-V is a model implementation of the CHERI RISC-V architecture.
bounds checking uses → 100% 1e
CHERI enforces spatial safety through capability bounds checking.
CHERI-Concentrate uses → 100% 1e
CHERI uses CHERI-Concentrate for capability compression encoding.
Sentry mechanism uses → 100% 1e
CHERI uses the Sentry mechanism for secure entry into capability-protected code.
capability compression uses → 95% 1e
CHERI uses capability compression to represent bounds efficiently.
Instruction Set Architecture extends → 100% 1e
CHERI extends conventional ISAs with new architectural features.
CheriBSD ← implements 100% 1e
CheriBSD is a CHERI-enabled FreeBSD operating system.
QEMU-CHERI ← implements 100% 1e
QEMU-CHERI is a generic emulator with CHERI support.
Program Counter Capability ← part of 90% 1e
Program Counter Capability is a special capability defined in CHERI.
Property Checking ← evaluates 93% 1e
Property checking is used to verify CHERI-RISC-V instructions in the formal verification flow.
capability bounds uses → 100% 1e
CHERI capabilities include bounds metadata controlling memory access.
capability permissions uses → 100% 1e
CHERI capabilities include permissions metadata.

LINKED ENTITIES

2 links
Toooba IMPLEMENTS Extracted graph relationship
CVA6 IMPLEMENTS Extracted graph relationship

CITATIONS

8 sources
8 citations — click to expand
[1] CHERI is a leading hardware/software system providing native spatial safety and a foundation for temporal memory safety, and lacks intrinsic architectural support for temporal memory safety. CHERI-D: Secure and efficient inline object ID for CHERI temporal memory safety
[2] Several open-source memory allocators were ported to CHERI and evaluated under CheriBSD on Arm's experimental Morello platform; all but one allocator were vulnerable to at least some of the introduced attacks, including the default CheriBSD allocator; comparing allocator performance between hybrid and pure-capability modes did not appear meaningful. Picking a CHERI Allocator: Security and Performance Considerations
[3] The RISC-V community is in the process of standardizing CHERI extensions, and TestRIG is in use to test CHERI in the Toooba and CVA6 processors; the project URL is cheri-cpu.org. Who tests the TestRIG? Tooling for randomised tandem verification
[4] TestRIG is an ecosystem for cross-verifying RISC-V implementations using a standard RVFI-DII interface, with QuickCheckVEngine using Haskell's QuickCheck to generate tests and shrink divergences to a minimal reproducer; the RISC-V golden Sail model implements RVFI-DII. Who tests the TestRIG? Tooling for randomised tandem verification
[5] TestRIG has seen community engagement from Microsoft Research, lowRISC, and SCI Semiconductor; the repository links to 10 RVFI-DII-extended implementations and has community forks. Who tests the TestRIG? Tooling for randomised tandem verification
[6] Mutation coverage mutates Sail code to simulate real bugs and check whether the test framework would catch them; currently supported mutation types are deleting encdec mappings, deleting code lines, and replacing branch conditions. Who tests the TestRIG? Tooling for randomised tandem verification
[7] TestRIG supports a single-implementation mode that asserts more liberal properties such as instruction count in equals instruction count out, relying on DII to test without reasoning about control flow. Who tests the TestRIG? Tooling for randomised tandem verification
[8] CHERI checks may be exercised on capabilities whose integrity tag is already clear, hiding the error from naive code-coverage metrics; this motivates mutation coverage. Who tests the TestRIG? Tooling for randomised tandem verification