David Chisnall argues that the greatest challenge in software isolation is not completely separating two workloads, but isolating components that need to communicate and share data. In a presentation published through InfoQ, Chisnall explains how the CHERI architecture combines security capability concepts with extended pointers to provide hardware protection for pointers, while supporting memory safety and fine-grained isolation within the same address space.
Chisnall is the co-founder and director of systems engineering at SCI Semiconductor, and is also a visiting researcher at the University of Cambridge. The presentation draws on CHERI research and its software and hardware implementations, from CheriBSD and ARM Morello extensions to CHERIoT, which targets microcontrollers, in addition to the RISC-V profile called RVY, whose standardization work he said was in its final stages.
The Pointer Becomes a Hardware-Protected Entity
CHERI does not provide an independent instruction set in the traditional sense, but rather a set of ideas that can be adapted to different architectures, similar to how SIMD concepts are implemented across multiple extensions. Under this model, a pointer is no longer merely a number representing an address in memory, but becomes a capability carrying the address, the object's bounds, and a set of permissions, along with a hardware tag indicating whether the value is a valid pointer.
These capabilities enforce one-way properties: bounds can be narrowed or permissions removed, but they cannot be expanded or restored from the pointer itself. The hardware also verifies that a pointer is valid and tagged before using it in load, store, or jump operations. If a program attempts to use a value that has been treated as data or tampered with to produce an address, the operation fails instead of automatically turning it into a usable pointer.
According to the presentation, this design provides direct protection against several common stages of memory-exploitation attacks, such as overwriting a pointer with a value controlled by an attacker. It also allows general copying operations such as memcpy without prior knowledge of pointer locations, because the pointer tag moves with the value or is cleared when part of the capability space is overwritten.
Bounds and Permissions That Can Be Narrowed
CHERI capabilities include permissions for reading and writing, as well as separate permissions for handling pointers contained within data. Chisnall explains that this precision makes it possible, for example, to grant a program permission to read the data inside a complex structure without granting it the ability to store new pointers in it. In this way, a read-only view can be provided across an entire data tree rather than superficially protecting a single object.
The sealing mechanism also enables the creation of safe opaque pointers similar to handles or file descriptors, but without necessarily requiring a kernel-managed translation table. The capability is sealed using a type token, so it cannot be modified, dereferenced, or used for jumping, loading, or storing while sealed. When it is returned to its owner, unsealing succeeds only if the type token matches.
Spatial and Temporal Memory Safety
In the case of out-of-bounds errors, CHERI can turn undefined behavior in C into a deterministic hardware halt. Chisnall presents an example of an array containing 14 elements in which element 14 is accessed. On a conventional system, the access may overwrite the return address, whereas on a CHERI system the operation is trapped because the pointer is constrained by the array's bounds.
The proposal is not limited to spatial safety. In CHERIoT, pointer tags and shadow memory containing one bit for each allocation unit are used so that pointers associated with freed memory can be invalidated. When a capability is loaded into a register, the load filter can check the block's status and clear the tag if the memory has been freed. A periodic hardware mechanism also scans memory and removes tags from pointers referring to objects that are no longer live, allowing the memory to be reused after the invalidation cycle is complete.
From Memory Safety to Fine-Grained Isolation
According to Chisnall, CHERI's original goal was to build fine-grained isolation that goes beyond the boundaries of traditional process isolation. Isolating every component in a separate process imposes costs associated with page tables, RPC mechanisms, data serialization, and copying. This may be acceptable for dozens of isolated domains, but becomes less suitable when browsers, for example, need to run thousands or tens of thousands of sandboxes for components such as image and audio decoders or JavaScript JIT execution.
The CHERI model makes it possible to regard the set of memory reachable from the capabilities held in execution registers as a protection domain. Two domains within the same address space can share some data while other parts remain isolated, because sharing begins with specific capabilities and can extend to complex data structures and everything reachable from them.
On larger systems, the presentation describes a gradual path through the coexecve call, which creates a new process without creating a new address space, then installs a set of root capabilities defining what the new process can access. CHERIoT, meanwhile, adopts strict separation of permissions within a real-time operating system, with a switching component responsible for context switching and calls between compartments, and is approximately 350 instructions in size according to the presentation.
Chisnall's conclusion is that memory protection and isolation should not depend on completely rewriting code or placing every component in a separate process. Keeping the C model close to the familiar one, while making pointers and access capabilities hardware-understandable and hardware-controlled, may provide a gradual path to reducing memory errors and building more auditable sharing. Implementation details still differ between large systems and microcontrollers, and the presentation reflects its speaker's perspective and direct experience with CHERI rather than a general standard that automatically guarantees the elimination of all security problems.