The FAQ[0] provides a better overview, > CHERI refers to Capability Hardware Enhanced RISC Instructions, an Instruction-Set Architecture (ISA) extension that i

The FAQ[0] provides a better overview, > CHERI refers to Capability Hardware Enhanced RISC Instructions, an Instruction-Set Architecture (ISA) extension that implements a hybrid capability-system model providing fine-grained memory protection and scalable software compartmentalisation within processes. CHERI capabilities are a new hardware data type intended to support the robust and secure implementation of pointers. Capabilities hold a virtual address as well as metadata describing the memory resources referenced by the pointer (bounds, permissions, ...) ... The architecture (and hence hardware) protects pointers in registers and memory, controlling their creation and use (e.g., nonforgeability and nonbypassability), manipulation (e.g., enforcing monotonicity on bounds modifications and permissions), ensuring only authorized use (e.g., dereference within bounds), and also their in-memory integrity (e.g., detecting pointer corruption or injection). Policies are expressed by the software (OS, compiler, language runtime, and application) and enforced by the hardware. See also [1] for a general overview. [0] https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/cheri-faq.html https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/cheri... [1] https://en.wikipedia.org/wiki/Capability-based_addressing https://en.wikipedia.org/wiki/Capability-based_addressing