Skip to content
STIMSMITH

CHERI Capability Architecture

Concept WIKI v1 · 7/3/2026

The CHERI capability architecture is a hardware capability-system design that augments conventional ISAs with memory-protecting capabilities. It is the subject of formal ISA-semantics work spanning ARMv8-A, RISC-V, and CHERI-MIPS variants, and has been extended in research prototypes such as BLACKOUT to support data-oblivious computation via blinded capabilities.

CHERI Capability Architecture

The CHERI Capability Architecture is a hardware capability-system architecture that extends conventional instruction set architectures (ISAs) with architectural capabilities — unforgeable, bounded tokens of authority that authorize memory accesses and other privileged operations. Capabilities are intended as a foundation for fine-grained memory safety and software compartmentalization at hardware speed.

Role in the ISA Specification Landscape

CHERI is treated as a first-class ISA in the formal-semantics literature. The Sail-based work "ISA semantics for ARMv8-A, RISC-V, and CHERI-MIPS" (armstrong:popl19:2019) develops machine-checked ISA semantics covering CHERI-MIPS alongside mainstream architectures, and the surrounding "ISA specification" related-work notes catalogue additional CHERI-related entries:

  • "CHERI: A hybrid capability-system architecture for scalable software compartmentalization" — watson:sandp:2015, the foundational CHERI architecture paper.
  • "Verified security for the Morello capability-enhanced prototype Arm architecture" — bauereiss:ucam:2021, an industrial instantiation of CHERI on Arm.
  • "End-to-end formal verification of a RISC-V processor extended with capability pointers" — gao:fmcad:2021, verification of a CHERI-style RISC-V extension.

These references treat CHERI as both an ISA in its own right and as a capability architecture that can be grafted onto existing ISAs (MIPS, RISC-V, Arm/Morello).

Architectural Relationship

CHERI is an instance of the broader Capability Architecture concept. Within a related-entity graph, the CHERI Capability Architecture has an outgoing PART_OF relation to Capability Architecture, while the Sail ISA-semantics paper armstrong:popl19:2019 has an incoming EVALUATES relation to CHERI (i.e., that paper evaluates/specifies CHERI semantics).

Extensions and Implementations

Recent research has layered additional security features on top of the base CHERI architecture:

  • BLACKOUT (2025) extends CHERI with blinded capabilities to enable data-oblivious computation. It is realized on the speculative, out-of-order CHERI-Toooba FPGA softcore, with corresponding support added to the CHERI-enabled Clang/LLVM toolchain and the CheriBSD operating system. Non-data-oblivious operations performed through blinded capabilities explicitly fault, easing the authoring of side-channel-resistant code. The authors report a geometric-mean performance overhead of ~1.5% versus the baseline CHERI-Toooba processor on comparable benchmarks, alongside memory-safety guarantees for memory accessed through blinded capabilities.

Verified Derivative Work

Verification efforts around CHERI-style processors include Gao et al.'s end-to-end formal verification of a RISC-V processor extended with capability pointers and the verified Morello security work for the Arm-based prototype. Such efforts reflect CHERI's positioning as a research vehicle for capability-based hardware security.

Key Properties (as supported by evidence)

  • Capability-based, hardware-enforced memory protection and compartmentalization.
  • Specified for multiple ISAs including MIPS (CHERI-MIPS), RISC-V, and Arm (Morello).
  • Subject of formal ISA semantics in Sail (armstrong:popl19:2019).
  • Has been extended with blinded capabilities for data-oblivious programming (BLACKOUT).
  • Supported by an ecosystem that includes CHERI-enabled Clang/LLVM and CheriBSD.

LINKED ENTITIES

2 links
ISA Semantics for ARMv8-A, RISC-V, and CHERI-MIPS (armstrong:popl19:2019) EVALUATES
Capability Architecture PART_OF

CITATIONS

7 sources
7 citations
[1] CHERI is a hardware capability-system architecture that augments conventional ISAs with unforgeable, bounded capabilities authorizing memory access. CHERI: A hybrid capability-system architecture for scalable software compartmentalization
[2] Formal Sail-based ISA semantics have been developed for ARMv8-A, RISC-V, and CHERI-MIPS. ISA semantics for ARMv8-A, RISC-V, and CHERI-MIPS
[3] CHERI is treated as a first-class ISA alongside ARMv8-A and RISC-V in formal-semantics and verification literature. Specifications of instruction set architectures (related-work notes)
[4] The Morello prototype is a capability-enhanced Arm architecture built on CHERI principles. Verified security for the Morello capability-enhanced prototype Arm architecture
[5] A RISC-V processor extended with capability pointers has been formally verified end-to-end. End-to-end formal verification of a RISC-V processor extended with capability pointers
[6] BLACKOUT extends CHERI with blinded capabilities enabling data-oblivious userspace computation, realized on the CHERI-Toooba FPGA softcore with CHERI-enabled Clang/LLVM and CheriBSD support. BLACKOUT: Data-Oblivious Computation with Blinded Capabilities
[7] BLACKOUT reports ~1.5% geometric-mean performance degradation versus the baseline CHERI-Toooba processor while ensuring memory operated on through blinded capabilities is securely allocated, used, and reclaimed. BLACKOUT: Data-Oblivious Computation with Blinded Capabilities