● Covered by 1 source · 1 reportLow impact1 neutral
CHERI: A Capability-Hardware Enhanced RISC Instruction Set Architecture for Memory Safety
Key points
- CHERI is an ISA extension, not a new ISA.
- It provides hardware-level memory safety and compartmentalization.
- Implementations include ARM's Morello and RISC-V's RVY.
- Software adoption is seen in CheriBSD and Linux porting efforts.
The Challenge of Isolation and Communication
Traditional isolation techniques using Memory Management Units (MMUs) effectively separate workloads on different computers or virtual machines. However, the complexity arises when workloads need to communicate securely without full isolation. This inter-workload communication impacts hardware design and programming models, presenting a difficult problem for CPU vendors.
Understanding CHERI's Nature
CHERI (Capability-Hardware Enhanced RISC Instruction Set Architecture) is not a new instruction set architecture itself, but rather an extension that can be localized to existing ISAs. It functions similarly to SIMD extensions, which adapt vector operations to specific architectures like ARM's NEON or Intel's SSE/AVX. CHERI applies the concept of capability-based security to hardware.
Current Implementations and Standardization
Early CHERI research prototypes extended MIPS. More recent implementations include ARM's Morello extension for Aarch64 and CHERIoT. Efforts are underway to standardize a RISC-V base called RVY, which represents another CHERI localization. These developments show CHERI's adaptability across different processor architectures.
Software Adoption and Impact
On the software side, CHERI work has focused on incremental adoption. The original research was conducted on CheriBSD, a fork of FreeBSD, with many of its concepts being ported to Linux. This focus aims to integrate CHERI into application cores, ranging from mobile phone scale-up to data center environments, to enhance memory safety and security.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
CHERI is a hardware-based approach to memory safety and fine-grained compartmentalization, not a standalone ISA but an extension to existing ISAs like ARM's Morello and RISC-V's RVY. This technology addresses the challenge of secure communication between isolated workloads, which traditional MMU-based isolation struggles with. CHERI matters because it offers a hardware-level solution to memory safety, potentially reducing vulnerabilities in systems from mobile phones to data centers.