Case Studies
CHERI case studies trace capability hardware from research into operating systems, embedded platforms, software ports, and commercial processors.
Case studies are useful when they distinguish demonstrated results from expected benefits. The examples below identify the system, the intervention, the evidence, and the limits of what can be concluded.
Morello: a full-stack evaluation platform
The Morello programme turned the CHERI protection model into an Arm prototype architecture, processor, board, toolchain, and software stack. Researchers and industry teams used it to port operating systems and substantial C and C++ applications, explore hybrid and pure-capability execution, and measure compatibility and performance.
What it demonstrates: CHERI concepts can be applied across a sophisticated 64-bit processor and general-purpose software environment.
Limit: Morello is an experimental platform, not a production Arm architecture or a claim that every port is complete.
CheriBSD: protecting a large operating-system stack
CheriBSD adapts FreeBSD to CHERI. It includes capability-aware kernels and user space, pure-capability execution, and compartmentalisation work. Its ports and test results have exposed assumptions about pointers, interfaces, and low-level code at operating-system scale.
What it demonstrates: a large existing C codebase can be migrated incrementally and used to study both memory safety and software compartmentalisation.
Limit: results depend on the platform, configuration, port status, and workload. They do not automatically apply to a different operating system or product.
CHERIoT: protection for embedded devices
The CHERIoT platform combines a 32-bit CHERI-RISC-V instruction set, processor core, toolchain, and real-time operating system for fine-grained compartments. Its design addresses both spatial and temporal memory safety in constrained microcontrollers.
In March 2026, the CHERIoT Ibex core became one of the first products listed under the CHERI Enabled programme. Published certification material records the implementation, verification evidence, debug assumptions, and temporal-safety design.
What it demonstrates: capability protection and small compartments can be designed for systems without a memory-management unit.
Limit: an embedded profile makes different trade-offs from an application processor. Integrators still need to evaluate the complete system-on-chip and product.
Commercial processor IP
Codasip’s X730-MP4-Lux is a 64-bit application-processor IP product implementing CHERI-RISC-V. Its published CHERI Enabled record describes supported modes, verification work, temporal-safety support, and implementation assumptions.
What it demonstrates: CHERI-RISC-V is available in commercially licensable processor IP.
Limit: certification covers the named product and scheme criteria. An SoC, operating system, and deployed product require their own integration and assurance.
Reading any case study
Ask which version was used, what code was protected, which attacks or faults were tested, what authority remained, what overhead was measured, and which assumptions were outside scope. These questions turn an interesting example into evidence for a decision.