ARCHITECTURE Signal 422
CHERI adds spatial and temporal memory safety to C/C++ with lightweight compartmentalization
↗
David Chisnall presented how the CHERI hardware architecture provides spatial and temporal memory safety for C/C++ and enables lightweight compartmentalization without requiring massive codebase rewrites.
CHERI addresses the hard problem of secure sharing between isolated workloads, not isolation itself, which MMUs have solved for decades. For engineers working with C/C++, CHERI offers a hardware-enforced path to memory safety that doesn't require abandoning existing codebases, and it scales from data center cores down to microcontrollers via CHERIoT.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
CHERI is not a single ISA but an extension concept with localizations to MIPS, ARM (Morello), and RISC-V (RVY), similar to how SIMD has different implementations across platforms.
CHERI enables spatial and temporal memory safety for C/C++ without requiring massive codebase rewrites on application cores.
CHERIoT scales CHERI's compartmentalization model down to microcontrollers, replacing costly OS-level RPC mechanisms with lightweight, auditable alternatives.
THE CLUSTER