How CHERIoT Provides Strong and Usable Isolation Without an MMU
Summary
This article explains how CHERIoT provides robust isolation without an MMU, focusing on its design and benefits for secure computing systems.
Similar Articles
Adopting Memory-Safety and Fine-Grained Compartmentalisation with CHERI
David Chisnall presents CHERI, a hardware capability architecture enabling memory safety and fine-grained compartmentalization through ISA extensions such as ARM Morello, RISC-V, and CHERIoT microcontrollers. The talk emphasizes the importance of practical programming models for secure isolation.
First CHERIoT Silicon
SCI Semiconductor announces the first silicon implementation of CHERIoT, a RISC-V-based security architecture providing deterministic memory safety and compartmentalization. The ICENI chip runs at up to 250 MHz and will be demonstrated at Embedded World.
experiments with isolation on blue pill
Developer notes from experiments building a semi-hypervisor/supervisor for the Cortex-M3 (Blue Pill) using MPU and SVC to provide isolation and privileged access control without MMU or TrustZone.
EC2’s formally verified “isolation engine” provides mathematical assurance of virtual-machine isolation
AWS announced the Nitro Isolation Engine, the first formally verified cloud hypervisor component, providing mathematical assurance of virtual machine isolation on new Graviton5-based EC2 instances. The verification uses Isabelle/HOL and comprises 330,000 lines of machine-checked mathematics.
Maybe we should revisit microkernels
This article argues that modern hardware, particularly IOMMUs, makes microkernels viable again by eliminating overhead from context switches, and suggests revisiting microkernel designs for better security and reliability.