FAQs

New processor security technology raises practical questions: what changes, what remains compatible, and which claims can be trusted? These answers provide a starting point and link to more detailed guidance.

What does CHERI stand for?

CHERI stands for Capability Hardware Enhanced RISC Instructions. The name refers to architectural extensions that let processors use hardware-protected capabilities for memory access and software compartmentalisation.

Is CHERI a processor or an operating system?

Neither on its own. CHERI is a capability architecture that can be incorporated into instruction-set architectures and processor implementations. Software must also use those features. Examples in the ecosystem include CHERI-RISC-V architectures, the Arm Morello prototype architecture, CHERIoT for embedded systems, CheriBSD, and CHERI Linux.

What is a capability?

A capability is a protected value that identifies something software may access and carries the authority to access it. For memory, it includes an address together with bounds, permissions, and validity metadata. See Capabilities.

How is a capability different from a conventional pointer?

A conventional pointer normally provides an address. The processor has limited knowledge of the object the programmer intended it to reference. A CHERI capability carries enforceable limits, such as the permitted address range and whether access may read, write, or execute.

Does CHERI prevent every memory-safety bug?

No. CHERI can prevent many invalid accesses and make others easier to contain, but the exact protection depends on the architecture and software. Spatial safety can be enforced with capability bounds. Strong temporal safety, which addresses use-after-free, may also require allocator or operating-system support. Logic errors and non-memory vulnerabilities remain possible.

Does CHERI make C and C++ memory safe?

CHERI-aware compilers and pure-capability application binary interfaces (ABIs) can enforce strong pointer bounds and permissions for adapted C and C++ code. That blocks many behaviours that conventional C and C++ systems allow at runtime. It does not make every C or C++ program correct, and some code must be changed where it relies on invalid or ambiguous pointer assumptions.

Do we have to rewrite existing software?

Usually not from scratch. Well-structured code often builds with few changes. Common porting work involves pointer-to-integer conversions, custom allocators, packed data structures, inline assembly, and code that crosses object boundaries deliberately. Hybrid and pure-capability modes offer different migration choices. See CHERI and Existing Software.

Is CHERI a replacement for Rust?

No. Rust prevents many memory errors through language rules. CHERI enforces authority in hardware and can also constrain unsafe Rust, native libraries, operating systems, and compartment boundaries. The two approaches can reinforce each other.

What is compartmentalisation?

Compartmentalisation divides software into components with separate authority. If one compartment is compromised, it should not automatically gain access to everything in the surrounding process or device. CHERI capabilities can make these boundaries fine-grained and efficient.

What is the difference between hybrid and pure-capability software?

Hybrid software uses conventional pointers alongside explicitly managed capabilities. Pure-capability software represents language-visible pointers as capabilities throughout the relevant ABI. Hybrid mode supports staged adoption; pure-capability mode usually provides broader pointer protection.

What is CHERI-RISC-V?

CHERI-RISC-V applies CHERI capability concepts to the RISC-V instruction-set architecture. It is used across application-class, embedded, FPGA, simulation, operating-system, and commercial processor work. Exact supported features depend on the implementation and specification version.

What is Morello?

Morello is an Arm-developed prototype architecture, system-on-chip, and development board created to evaluate CHERI at application-processor scale. It has supported extensive work on compilers, CheriBSD, Linux, applications, and security evaluation. Morello is a platform for development and evidence, not the definition of CHERI itself.

What is CHERIoT?

CHERIoT is a 32-bit CHERI-based hardware-software platform designed for embedded and Internet of Things systems. It combines a CHERI-enabled RISC-V instruction set, processor cores, a compartmentalised real-time operating system, a toolchain, simulators, and development platforms such as Sonata.

Can I try CHERI without hardware?

Yes. QEMU and formal-model simulators support several CHERI environments. The right route depends on whether you want an application-class CheriBSD environment or an embedded CHERIoT environment. Start with Run CHERI in Simulation.

What is CheriBSD?

CheriBSD is FreeBSD adapted for CHERI-RISC-V and Arm Morello. It provides a mature environment for architecture, operating-system, application-porting, and compartmentalisation work.

What is CHERI Linux?

CHERI Linux is the ecosystem effort to adapt the Linux kernel and user space for CHERI. The CHERI Alliance Linux work coordinates a cross-architecture roadmap and public repositories. Check current project documentation for supported branches, targets, and maturity.

Does a CHERI processor automatically protect every application?

No. Software must use capabilities and a suitable execution mode. A conventional binary running on CHERI-capable hardware does not automatically gain the object-level protection of pure-capability code.

What performance cost should I expect?

There is no single number. Cost depends on the processor, ABI, workload, memory system, compiler, and compartment design. Some changes increase pointer or metadata traffic; others can replace more expensive isolation mechanisms. Measure the real workload on the intended platform and publish the configuration with the result.

Is CHERI ready for commercial use?

The ecosystem includes released processor IP, chips, FPGA platforms, development boards, operating systems, toolchains, and CHERI Enabled products. Product availability and support differ by market and platform, so adoption decisions should be based on current supplier information and the needs of the intended deployment.

What does CHERI Enabled mean?

CHERI Enabled is a CHERI Alliance certification programme for products that meet defined scheme criteria and provide supporting evidence. It is scoped to a specific product and version. It does not guarantee the overall security of a complete product. See About CHERI Enabled.

What does the CHERI Alliance do?

The CHERI Alliance coordinates organisations across the ecosystem to support adoption, technical alignment, open-source work, certification, education, and collaboration. It does not own every CHERI implementation or replace the organisations that develop architectures, processors, operating systems, and tools.

Where should I start?

• For the motivation, read Why CHERI?.
• For the mechanism, read Capabilities.
• To choose an environment, use Choose a Platform.
• For authoritative technical detail, consult the CHERI FAQ and the documentation for your selected platform.