What is CHERI?

Short for Capability Hardware Enhanced RISC Instructions. An instruction-set extension that replaces pointers with capabilities, which carry the range they may point to and their permissions in addition to the address, so that out-of-bounds accesses and forged pointers are stopped in hardware. It has been developed by the University of Cambridge and SRI International. Arm made Morello, a prototype processor based on it, available to researchers in the early 2020s.

Japanese name: CHERI

CHERI appears in 1 practice question across 1 topic, including Hardware Security: Advanced Topics and Trends.

Field: Hardware Security: Advanced Topics and Trends

What a capability contains

A conventional pointer is just an address, and the hardware has no way to check what it points to. A CHERI capability carries, in addition to the address, the lower and upper bounds of the range it may point to and permissions such as read, write and execute. For 64-bit addresses the bounds are stored in compressed form so that the capability fits in 128 bits, and one more tag bit is kept outside the normal memory contents. The CPU checks the bounds and permissions on every load and store and raises an exception if they are violated, so errors such as buffer overflows stop on the spot.

Tags that prevent forgery

The tag is set only when a capability is created by the proper instructions or derived from an existing capability by narrowing its range. If a capability is overwritten as ordinary data, its tag is cleared, and a value without a tag cannot be used as a pointer. Bounds and permissions can only be narrowed, never widened, so a program cannot create more authority than it was given. This property also allows a single program to be divided into small compartments, each limited to what it may access (compartmentalization).

Challenges for adoption

Because pointers double in size, memory use and cache efficiency are affected, and software that treats pointers as integers needs to be modified. Research has shown that many C and C++ programs run with small changes. As of the mid-2020s, implementations are mainly research prototypes and some microcontroller designs; CHERI is not found in the CPUs of ordinary PCs and smartphones.

Try it: questions about CHERI

Which correctly describes the capabilities used in the instruction-set extension called CHERI?

APointer values are encrypted with a key inside the CPU before being placed in memory and decrypted on each use, so that other programs and the OS cannot read pointer values
BThe CPU checks the digital signature attached to the program's executable file each time it executes one instruction and refuses to execute unsigned instructions
CA pointer carries the range it may access and its permissions, and a 1-bit tag that software cannot write distinguishes in memory whether it was created legitimately

Show answer and explanation

Answer: C. A pointer carries the range it may access and its permissions, and a 1-bit tag that software cannot write distinguishes in memory whether it was created legitimately

CHERI replaces address-only pointers with capabilities that bundle the address, the upper and lower bounds of the range it may point to, and permissions such as read, write and execute (for 64-bit addresses they are compressed into 128 bits, with a separate 1-bit tag). The CPU checks the bounds and permissions on every access, so memory-safety errors such as reading or writing outside an array can be stopped in hardware. The tag is set only when a capability is created with the proper instructions and is cleared when it is overwritten as ordinary data, so pointers cannot be forged. The University of Cambridge and others have led the research, and in the early 2020s Arm made Morello, a prototype processor and evaluation board based on it, available to researchers.

FAQ

What is the difference between CHERI and MTE (Memory Tagging Extension)?

MTE compares 4-bit tags attached to memory and to pointers and finds errors probabilistically. CHERI gives each pointer its own bounds and permissions and stops out-of-bounds accesses deterministically. MTE is easier to bring to existing software, while CHERI gives stronger guarantees at the cost of larger changes to the instruction set and software.

Does CHERI eliminate all memory-safety problems?

It prevents out-of-bounds accesses and pointer forgery, but preventing use of memory after it has been freed needs additional work in the allocator. It also cannot prevent logic errors or the misuse of permissions that were legitimately granted. It is used together with other measures.

CHERI in the explanations

CHERI replaces address-only pointers with capabilities that bundle the address, the upper and lower bounds of the range it may point to, and permissions such as read, write and execute (for 64-bit addresses they are compressed into 128 bits, with a separate 1-bit tag).
Which correctly describes the capabilities used in the inst…

Questions that mention CHERI (1)

Which correctly describes the capabilities used in the instruction-set extension called CHERI?

Books on Hardware Security: Advanced Topics and Trends Ad

Search Amazon for semiconductor Hardware Security: Advanced Topics and Trends

As an Amazon Associate I earn from qualifying purchases.

Back to the glossary