CHERIenabled

CHERIenabled is a term used to describe software, hardware, or computing platforms that implement the CHERI capability-based security architecture. CHERI provides capabilities — pointers augmented with bounds, permissions, and a sealing mechanism — to enable fine-grained memory safety and compartmentalization within a single address space.

In CHERI-enabled systems, pointers carry metadata that encodes the range of accessible memory and the operations permitted on that memory. The hardware enforces bounds checks and permission checks on capability dereference, and sealing allows creation of isolated sub-competencies or compartments that can only be opened by entities possessing the appropriate capability. This model helps reduce memory-safety vulnerabilities such as buffer overflows and use-after-free, while enabling safe cross-domain communication between components.

Software and hardware that are CHERI-enabled typically include a CHERI-enabled compiler toolchain (such as an LLVM/Clang backend for CHERI), a capability-capable runtime and libraries, and an operating system adapted to manage capabilities (for example, a CHERI-enabled BSD variant). The CheriABI and related toolchains facilitate porting existing applications to CHERI-enabled environments.

Platforms and projects described as CHERI-enabled include hardware prototypes and SoCs implemented with CHERI extensions on MIPS64 and RISC-V cores, as well as software ecosystems like CheriBSD and related research distributions that run on these platforms.

Adoption remains primarily in research and experimental settings. Benefits include stronger memory safety, refined isolation, and reduced vulnerability exposure, while challenges include hardware complexity, potential performance overhead, and the need for developer porting and toolchain support.

See also: CHERI, CheriBSD, Capsicum, CHERI-LLVM, CHERI-RISC-V.