CHERI Security Extension

Concept

Capability Hardware Enhanced RISC Instructions (CHERI) is a security extension for conventional instruction-set architectures that introduces capabilities—unforgeable, bounded tokens implemented as fat pointers carrying an address plus permissions and bounds metadata, with validity protected by a hidden tag. CHERI has been instantiated as CHERI-RISC-V, and processors carrying the extension have been validated through model-based randomized testing with TestRIG/QuickCheck VEngine as well as through end-to-end formal verification of CHERI-Flute.

First seen 5/27/2026

Last seen 6/21/2026

Evidence 9 chunks

Wiki v2

WIKI

Overview

Capability Hardware Enhanced RISC Instructions (CHERI) is a security extension for conventional instruction-set architectures. The extension adds capabilities, described as unforgeable and bounded tokens. A capability is a fat pointer containing an address and metadata, including permissions and bounds information. Capability validity is ensured by a hidden tag, and a capability authorizes access to a region of memory. [C1]

Architectural role

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

2 connections

TestRIG ← evaluates 100% 2e

TestRIG was used to test the experimental CHERI security extension.

RISC-V part of → 90% 2e

CHERI is a security extension added to RISC-V processors to enhance security properties.

LINKED ENTITIES

1 links

RISC-V PART_OF Extracted graph relationship

CITATIONS

4 sources

4 citations — click to collapse

[1] CHERI is a security extension of conventional ISAs that adds capabilities (unforgeable, bounded tokens) implemented as fat pointers containing an address plus permissions and bounds metadata, with validity protected by a hidden tag and authority over memory-region access. Randomized Testing of RISC-V CPUs using Direct...

[2] TestRIG was applied not only to RISC-V but also to CHERI-RISC-V, identified as the authors' security extension. Randomized Testing of RISC-V CPUs using Direct...

[3] A 'CHERI with security extension' processor instantiated in Chipyard was verified with TestRIG and QuickCheck VEngine over RVFI and DII sockets to exhaustively test faulty instructions in the pipeline, discovering cache bugs and memory mistakes and detecting micro-architectural mistakes (register forwarding, pipeline flushing) plus memory mistakes and unexpected behaviors; the approach is extensible, with ongoing research to extend it to other RISC processors. Survey of Verification of RISC-V Processors

[4] CHERI-Flute (an open-source 64-bit RISC-V Flute core with a five-stage, in-order pipeline extended with CHERI) was verified end-to-end by translating the Sail CHERI-RISC-V specification into SystemVerilog Assertions and using property checking, achieving single-instruction and sequence-dependent bug detection that identifies most bugs in CHERI instructions and distinguishes bugs from features, with the focus on CHERI instructions and no proof reported for existing non-CHERI RISC-V instructions. Survey of Verification of RISC-V Processors