How CHERIoT Provides Strong and Usable Isolation Without an MMU

ACM Queue paper explains how CHERIoT uses CHERI hardware capabilities to give microcontroller-class IoT devices memory and privilege isolation without an MMU.

The ACM Queue article (DOI 10.1145/3831361) describes CHERIoT, a RISC-V-derived platform that scales CHERI capability-based hardware down to small embedded and IoT microcontrollers. It provides strong, fine-grained isolation and memory safety without a memory management unit, aiming to make compartmentalization practical for low-cost devices. The piece emphasizes usability of the isolation model alongside its security guarantees.

• Details CHERIoT, a RISC-V-based platform bringing CHERI capability hardware to small IoT microcontrollers.
• Provides memory safety and software compartmentalization without a memory management unit.
• Aims for strong and usable isolation in embedded systems with accompanying toolchain and RTOS support.