CHERI Alliance

Tutorials & Training

Learn CHERI step by step, from your first build to porting and compartmentalisation.

Topic
training

Overview

CHERI spans hardware, compilers, operating systems and software architecture. You do not need to learn everything at once. Start with one platform, get a working environment, and introduce new concepts as you need them.

Start here

1. Understand the fundamentals

Start with:

The goal is to understand the core concepts of bounds, permissions, tags and least privilege before worrying about a particular implementation.

2. Run a prepared environment

Follow Run CHERI in Simulation to start with a prepared environment.

Get an existing example running before changing the code. Then deliberately trigger a capability violation and see how the system reports it.

At this point, you should be able to identify the platform and ABI you are using and reproduce a simple capability fault.

3. Build and debug your first application

Continue with Build Your First Application.

Build a simple application and use the available debugging tools to inspect a capability, including its address, bounds, permissions and tag.

This connects the CHERI concepts you have learned with what actually happens at runtime.

4. Port existing software

Next, try a small existing library or application with a good test suite.

Typical issues to look for include pointer-integer conversions, assumptions about pointer representation, object bounds, custom allocation, serialisation, inline assembly, and ABI boundaries.

Rather than simply fixing compiler errors, understanding why each change is necessary will help you identify assumptions in the original software.

5. Introduce a compartment

Finally, try moving a small component, such as a parser, behind a capability-protected interface.

Define explicitly:

  • what memory it can access
  • which services it can call
  • what capabilities it receives
  • what it must not be able to reach

Then test the boundary by attempting an operation the compartment should not be permitted to perform.

Maintained technical resources

CHERI and CheriBSD

CHERIoT

  • The CHERIoT Programmer’s Guide teaches the platform from architecture concepts through threads, memory management, compartments, drivers, networking, auditing, and board support
  • The CHERIoT getting-started chapter covers the real-time operating-system (RTOS) repository, development container, simulator, and hardware targets
  • The cheriot-rtos repository includes examples, exercises, SDK code, and the issue tracker
  • The CHERIoT project site links current releases, community discussions, hardware, and articles

Linux, Zephyr, and ecosystem projects

Training for teams

A useful team workshop should produce artifacts, not only slides. Ask participants to deliver:

  • a reproducible environment description
  • one valid program and one controlled fault
  • a capability inspection from the debugger
  • a short porting log with root-cause categories
  • a proposed compartment boundary and authority map
  • open questions tied to the intended product

A tutorial demonstrates how CHERI mechanisms work. Product assurance requires deeper consideration of the particular architecture, implementation, software and security requirements.

Keep tutorials current

CHERI platforms and toolchains continue to evolve, so use documentation that matches the platform and software version you are working with.

When using older tutorials or conference material, check that the architecture (Morello, CHERI-RISC-V, or CHERIoT), toolchain and commands still match your environment.

Image preview