Not really like CHERI at all
Not really like CHERI at all
Posted Feb 19, 2026 13:59 UTC (Thu) by daroc (editor, #160859)In reply to: Not really like CHERI at all by Vorpal
Parent article: Kernel control-flow-integrity support comes to GCC
CHERI supports using sealed function pointers that encode type information about the function being jumped to:
https://cheriot.org/isa/ibex/2024/06/26/sentries-cfi.html
https://cheriot.org/rtos/sealing/2025/11/06/sealing.html
So saying that CHERI is unrelated to control flow is incorrect. It might help to know that the accesses through a pointer that CHERI metadata controls includes whether the resulting address can be executed or not. And capability sealing, which was originally intended to allow passing opaque handles to untrusted code, combines well with that ability.