Hardening Linux and FreeBSD on RISC-V with CHERI
summary
CHERI adds hardware capability pointers to RISC‑V so user and kernel memory accesses carry bounds, permissions and a hardware tag; FreeBSD already has spatial kernel protection and 10,000+ memory‑safe packages, Linux work targets a Pure capability mode full boot to userspace. Toolchain and QEMU builds are being released, CHERI WG approval and v0.9 draft standard are in place, and early performance shows near parity with extra cache pressure from doubled pointer size. Linux porting so far is small scale—~3 people 9 months—with a working prototype kernel.
AI-written summary · about
chapters (12)
- 0:00Introduction to CHERI
- 0:31Understanding CHERI basics
- 3:09Capability-based addressing
- 4:34Implementation on RISC-V
- 6:24Software design and benefits
- 8:29Software adaptation impact
- 9:48CheriBSD overview
- 10:58Progress on CHERI Linux
- 11:36Performance metrics
- 13:44Standardization and status
- 14:43Software availability
- 15:49Q&A and closing
related talks
53mLinux and CHERI: Back to the Future
25mLightning Talk: Protecting Zephyr Against Memory Safety Vulnerabilities With the New CHERI Hardware Architecture
10mCHERI in out-of-order microarchitectures
31mMemory Safety: The Pernicious Challenge- 25mLightning Talk: Protecting Zephyr Against Memory Safety Vulnerabilities With the New CHERI Hardware Architecture
18mWhat’s next for memory safety?
20mMaking CHERI Accessible
11mFast and fine-grained compartmentalisation in CHERI