#hardware

CHERI (Next Generation)

Hardware capabilities: 128-bit fat pointers with bounds, permissions and an out-of-band tag, enforced by the ISA. §1 Provenance Watson, Chisnall, Clarke, Davis, Filardo, Laurie, Moore, Neumann, Richardson, Sewell, Witaszczyk, Woodruff. "CHERI: Hardware-Enabled C/C++ Memory Protection at Scale." IEEE Security & Privacy , vol. 22 no. 4, July/Aug 2024, pp. 50-61. DOI 10.1109/MSEC.2024.3396701 (IEEE CS 2024 Best Paper Award for S&P Magazine). https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/20240419-ieeesp-cheri-memory-safety.pdf Watson et al. "Capability Hardware Enhanced RISC Instructions:...

Intel CET Shadow Stack + IBT

A hardware second stack that records return addresses, plus indirect-branch landing pads. Shipping on every modern Intel/AMD CPU, default-on in Windows 11, opt-in on Linux. §1 Provenance Intel, "Control-flow Enforcement Technology Specification." Document 334525, Rev. 3. https://kib.kiev.ua/x86docs/Intel/CET/334525-003.pdf Linux kernel "Control-flow Enforcement Technology (CET) Shadow Stack" docs (v6.14+). https://docs.kernel.org/next/x86/shstk.html LWN, "Shadow stacks for userspace." Sept 2022. https://lwn.net/Articles/913934/ Phoronix, "Glibc Updated For Recent Linux CET Shadow Stack Support." Jan 2024. https://www.phoronix.com/news/Glibc-Intel-CET-Shadow-Stack McGarr,...

Intel LAM (Linear Address Masking) and the x86 top-byte-tag story

Let userspace stash metadata in the unused high bits of a 64-bit pointer. Intel calls it LAM; AMD calls it UAI; Arm has had TBI since v8.0. SLAM (2024) almost killed Linux's LAM support. §1 Provenance Intel SDM, Vol 3 Ch 7, "Linear Address Masking (LAM)." https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html LWN, "Support for Intel's Linear Address Masking." Aug 2022. https://lwn.net/Articles/902094/ LWN, "Linear Address Masking enabling." Oct 2022. https://lwn.net/Articles/911572/ LWN, "Linear Address Masking (LAM)...

Arm Morello

The first industrial-scale CHERI silicon: a Neoverse N1 retrofitted with 128-bit capabilities, the closeout of UK DSbD. §1 Provenance Arm Morello programme overview. https://www.arm.com/architecture/cpu/morello UKRI, "DSbD Final Impact Evaluation Report", published October 2025. https://www.ukri.org/wp-content/uploads/2025/10/IUK-131025-2025-07-04_DSbD-Final-Impact-Evaluation-Report.pdf Watson et al., "CHERI: Hardware-Enabled C/C++ Memory Protection at Scale," IEEE S&P Magazine, July/Aug 2024. https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/20240419-ieeesp-cheri-memory-safety.pdf Grisenthwaite et al., "The Arm Morello Evaluation Platform: Validating CHERI-based Security in a High-performance System." IEEE Micro , 2023. https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/202305ieeemicro-morello-platform.pdf...

CHERIoT

Microsoft's tiny CHERI: a 32-bit capability profile + RTOS that delivers complete spatial, temporal and compartment safety to microcontrollers, now in commercial silicon. §1 Provenance Amar, Chen, Chisnall, Domke, Filardo, Liu, Norton-Wright, Tao, Watson, Xia. "CHERIoT: Complete Memory Safety for Embedded Devices." MICRO 2023 . https://dl.acm.org/doi/pdf/10.1145/3613424.3614266 — and the matching uArch paper, IEEE Micro 2023. https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/202310ieeemicro-cheriot-uarch.pdf "CHERIoT Architecture Specification v1.0." https://cheriot.org/cheriot-sail/cheriot-architecture.pdf Chisnall et al. "CHERIoT RTOS: An OS for Fine-Grained...

Scudo & friends: hardened allocators in production

The bag-of-tricks malloc (guard pages, sized buckets, randomisation, double-free detection) that ships on every Android device and most of Chrome. §1 Provenance LLVM, "Scudo Hardened Allocator." https://llvm.org/docs/ScudoHardenedAllocator.html Android Open Source Project, "Scudo." https://source.android.com/docs/security/test/scudo Serebryany et al., "GWP-ASan: Sampling-Based Detection of Memory-Safety Bugs in Production." ASPLOS 2024 . arXiv 2311.09394. https://arxiv.org/html/2311.09394v2 Chromium Project, "GWP-ASan: Sampling heap memory error detection in-the-wild." https://www.chromium.org/Home/chromium-security/articles/gwp-asan/ Google tcmalloc GWP-ASan docs. https://google.github.io/tcmalloc/gwp-asan.html Chromium PartitionAlloc docs. https://chromium.googlesource.com/chromium/src.git/+/HEAD/base/allocator/partition_allocator/PartitionAlloc.md struct/HardenedPartitionAlloc...

Arm MTE

Per-16-byte 4-bit lock-and-key tags on every allocation granule, in Armv8.5-A and shipping on Pixel 8/9. §1 Provenance Arm, "Armv8.5 Memory Tagging Extension," whitepaper (2019, rev. 2023). https://developer.arm.com/documentation/108035/latest/Introduction-to-the-Memory-Tagging-Extension Serebryany et al. (Google), "MTE: The promising path forward for memory safety." Google Security Blog, Nov 2023. https://security.googleblog.com/2023/11/mte-promising-path-forward-for-memory.html Google Project Zero, "First handset with MTE on the market." November 2023. https://projectzero.google/2023/11/first-handset-with-mte-on-market.html Android Open Source Project: Arm MTE. https://source.android.com/docs/security/test/memory-safety/arm-mte Android NDK guide: Arm Memory...

Hardware Capability Machines and Tagged Memory

MTE in a Managed Runtime

Why hardware tags don't save V8/ART/JSC, and what vm3's 12-bit generation already buys us. §1 Provenance Google V8 Team, "The V8 Sandbox." V8 blog, April 2024. https://v8.dev/blog/sandbox Groß (Project Zero), "V8 Sandbox proposal." Issue thread + 2021 design doc, ongoing. https://docs.google.com/document/d/1FM4fQmIhEqPG8uGp5o9A-mnPB5BOeScZYpkHjo0KKA8/edit Kim et al., "TIKTAG: Breaking ARM's Memory Tagging Extension with Speculative Execution." USENIX Security 2024. https://arxiv.org/abs/2406.08719 TIKTAG-v2 in V8 reproduction notes. https://www.emergentmind.com/open-problems/v8-constructible-tiktag-v1-gadget Android NDK Arm MTE guide (covers ART...

MarkUs and quarantine-style UAF prevention

Defer reuse of freed memory until it's provably unreferenced. The most direct software analogue to vm3's "bump generation on slot reuse". §1 Provenance Ainsworth & Jones, "MarkUs: Drop-in use-after-free prevention for low-level languages." IEEE S&P 2020 . PDF: https://www.cl.cam.ac.uk/~tmj32/papers/docs/ainsworth20-sp.pdf MarkUs prototype code. https://github.com/SamAinsworth/MarkUs-sp2020 Wickman et al., "Preventing Use-After-Free Attacks with Fast Forward Allocation (FFmalloc)." USENIX Security 2021 . https://huhong789.github.io/papers/wickman:ffmalloc.pdf HUSHVAC: "Efficient Use-After-Free Prevention with Opportunistic Page-Level Sweeping." NDSS 2024 ....

Arm PAC + BTI

Pointer Authentication Codes sign code/data pointers in the unused high bits; Branch Target Identification confines indirect jumps to legal landing pads. Both ship on every modern Arm. §1 Provenance Arm, "Providing Protection for Complex Software: Pointer Authentication, BTI, and MTE." Learn-the-Architecture PDF. https://developer.arm.com/-/media/Arm%20Developer%20Community/PDF/Learn%20the%20Architecture/Providing%20protection%20for%20complex%20software.pdf Arm Newsroom, "Better Security at the Flick of a Compiler Switch: PAC + BTI." https://newsroom.arm.com/blog/pac-bti Liljestrand et al., "PACStack: an Authenticated Call Stack." USENIX Security 2021. https://www.usenix.org/conference/usenixsecurity21/presentation/liljestrand...