CHERI: A Modern Capability Architecture

The talk opens with the argument that memory safety bugs such as buffer overflows and use-after-free still account for most serious software vulnerabilities, decades after the problem was first widely understood. Using a short C program on a RISC-V target, the speaker shows how a processor that treats pointers as plain addresses cannot notice an out-of-bounds write, so corruption spreads silently until the program fails far from the original bug.

The core of the talk explains CHERI, an extension to existing instruction sets that turns pointers into hardware capabilities carrying an address, bounds, and permissions. Memory keeps a hidden validity tag for each 16-byte granule, and any operation that tampers with a capability clears its tag, so the processor traps instead of silently corrupting state. The speaker covers how compilers, the loader, and the kernel adapt, how ported software such as FreeBSD and much of KDE needed little change, and how sealed capabilities support compartmentalization and cheap communication within one address space. Temporal safety is addressed with quarantine and revocation sweeps, and performance results from the research hardware are reported.

In closing, the speaker argues that capabilities complement safe languages such as Rust, since a sandbox around unsafe code can turn hardware traps into recoverable errors for the safe side. Arm's Morello prototype shows the design running on real silicon, though it is an experimental platform rather than a product. The Q&A covered speculative execution, where capabilities reduce some attacks but do not stop side-channel leaks of ordinary data.