CHERI заменяет указатели на capability-объекты, которые не являются целыми числами и не могут быть подделаны. Это нарушает исторически сложившиеся предположения в Clang и LLVM о том, что указатели могут быть без потерь преобразованы в целые числа и обратно. Это также касается обхода системы типов через память.

const Slice = struct(u128) {
    address: u64,
    len: u64,
}

const Capability = struct(u128) {
    address: u64,
    metadata: struct(u64) {
        permissions: ... // bitfield,
        type: ... // enum или boolean
        bounds: ... // специальной свой мини-float
    }
}

const a: []const u8 = ...;
const b = a[1000]; // panic если вышел за диапазон

We have been demonstrating the second by porting large software stacks to Morello. This includes the entire FreeBSD userland and kernel (Linux is not quite finished), the userspace graphics stack, Weston (including 3D acceleration), the Qt and KDE core libraries, and a bunch of applications (Chromium is nearly finished). This is now at the point where people are starting to believe our claims about compatibility.

Our results are extremely exciting: It appears that key elements of the stack
were adapted for memory-safe execution with little difficulty (0.026% LoC changed), and that
CHERI memory safety and CHERI software compartmentalization had a strong potential
mitigation impact (ranging from 40% of past vulnerabilities for KDE up to 100% in key
supporting libraries). We described a number of limitations to our study, and key directions
for ongoing research and development

In total we compiled more than 6 million source lines of code for CHERI C/C++ successfully with only a very few changes: 2071 LoC or 0.034%