How CHERIoT Locks Down Chips With No Memory Manager at All
Hardware / explainer
How CHERIoT Locks Down Chips With No Memory Manager at All
The Microsoft-born project reaches memory safety on cheap embedded chips by putting bounds and permissions inside every pointer instead of relying on hardware most of them don't have.
What CHERIoT is, and why it skips the MMU
Most computers stop a program from reading another program's memory with a memory management unit, or MMU, a chip component that translates addresses and blocks the ones a process should not see. Cheap embedded chips, the kind inside a light switch or a car's door lock, usually ship without one, because an MMU adds cost, power draw and unpredictable delay that safety-critical, real-time code cannot tolerate.
CHERIoT, short for Capability Hardware Extension to RISC-V for IoT, is a hardware-software project that gives those chips memory safety anyway, without an MMU or its lighter cousin, the memory protection unit, or MPU. It began at Microsoft Research in 2019, according to CHERIoT's own project site, and is now built across three organizations: Microsoft Research, the University of Cambridge and SCI Semiconductor, which fabricates CHERIoT silicon.
Every pointer carries its own bounds and permissions
| Mechanism | Protection granularity | Extra hardware needed |
|---|---|---|
| MMU | Per virtual-memory page | Full memory management unit |
| MPU / RISC-V PMP | A small number of fixed regions | Lightweight protection unit |
| CHERIoT capability | Each individual memory access | None; encoded in the pointer itself |
An MPU, where one exists on a small chip, defines a limited number of fixed memory regions, cheriot.org explains, so protection is coarse: a whole region is allowed or blocked, not a single object inside it. CHERIoT instead extends every pointer into a capability: a wider value that carries an address, a bound on how far it can read or write, and a permission list, checked by the processor on every single memory access rather than against a handful of preset regions.
That granularity is what a Microsoft Community Hub post on CHERIoT-Ibex, the project's RISC-V processor core, calls hardware-enforced isolation between components: even if a device's networking stack is compromised, the post says, the attacker's capability does not extend to the code handling system initialization or telemetry, so a bug in one part of the firmware cannot silently rewrite another part's memory.
Temporal safety without stopping the program
Spatial bounds checking is one half of memory safety; the other is temporal, stopping code from using a pointer after the memory it points to has been freed, a bug class behind a large share of real-world security flaws in C and C++ programs. On a normal computer, catching that requires either an MMU trick or a garbage collector that pauses execution, neither of which is available on a CHERIoT-class chip.
CHERIoT's answer, per cheriot.org, is a hardware load filter: when a heap object is freed, capabilities that still point to it become unusable the next time they are loaded into a register, without the processor ever pausing the whole system to sweep memory. The project site says this gives CHERIoT deterministic use-after-free protection, meaning the timing is predictable rather than dependent on when a garbage collector happens to run, a property real-time firmware needs to keep meeting its deadlines.
What the project has not published
cheriot.org lists the ISA specification, an RTOS, an LLVM compiler toolchain, audit tools, the Ibex processor core and an FPGA emulation platform as the pieces available today, and says the current specification is version 1.0. The site's own news items describe 2026 work on bitpacking the capability encoding and removing now-unneeded instructions, plus a first-silicon milestone, but it does not publish a silicon area-overhead figure on the pages The Terminal reviewed, nor does the Microsoft Community Hub post on CHERIoT-Ibex.
That gap matters because the whole pitch rests on cost: an embedded chip maker adopting CHERIoT is trading die area and design complexity for a guarantee that a networking bug cannot silently corrupt an unrelated part of the firmware. Without a published number, that trade is one a chip team has to measure for itself rather than take from the project's own marketing.
The same three-way collaboration underpins other silicon security work covered on this site, including the tradeoffs in Samsung's zHBM stacking and Intel's tokens-per-watt accelerator design, where, as with CHERIoT, a vendor's own performance claims outrun the numbers it has actually published.
Sources
More in Hardware
- 01Washington Finds Robot Imports a Security Threat and Sets No Tariff, Date or Product ListThe October 28 Section 232 proclamation orders negotiations rather than duties, so the cost of the finding sits in components nobody has priced yet.
- 02Electric Trucks Hit 50.3% of China Heavy-Truck Sales in September, in a Market Down 21%September sits below the December 2025 peak of 53.9%, and electric sales grew 37% while total sales fell, and the 2026 year-to-date figure is 38.1%.
- 03Ola Electric Registered 12,096 Scooters in October, Down 10%, as India Added 7% to 223,847Entrackr and Autocar Professional use different Vahan pulls for September, which moves the growth figure from 7.3% to about 10%.
- 04Battery Self-Tests Cause a One-Minute Dip in Grid Frequency, and Jülich Measured It on a 1.5 MW UnitA Forschungszentrum Jülich team traced a worldwide 60-second ripple in grid frequency to battery power supplies that all test themselves at the top of the minute. The preprint measured one site; the scale claims come from a press release.