[jhvkjhk]

> “CHERI is not an extension; CHERI is a new base,” Asanović clarified to the keynote audience.

> Addressing concerns that creating a new base ISA might fracture the open-source community, Asanović offered a devoted defense to EE Times. “CHERI is too invasive to be a simple extension on regular RISC-V, and so needs a new base ISA for that reason,”

To me it sounds like they're creating RISC-VI before RISC-V even winning the market.

[embedding-shape]

What a circular argument that avoids answering the question. How does "it needs a new base ISA" address the concern about "might fracture the open-source community" even one bit? Why does the "journalist"/writer call that reply "a devoted defense", in what world is that any sort of defense?

[unprovable]

I've been trying to get access to CHERI for quite a while - I have a background in hardware security so was very curious to have a play. But only 'approved partners' are allowed to have access... guessing even in projects like this, Security through Obscurity still reigns.

[timhh]

> Security through Obscurity still reigns.

That's not the case at all. The spec is developed in the open: https://riscv.github.io/riscv-cheri/

If you want to run CHERI code, it's true that silicon isn't easily available, but that's simply because it takes time. Various companies are working on it (Codasip, SCI, Secqai, lowRISC, etc.).

But you don't need silicon to run CHERI code. There are various emulators available that support it. There's QEMU: https://github.com/CHERI-Alliance/qemu There's also the RISC-V Sail model, this is the latest CHERI branch: https://github.com/CHERI-Alliance/sail-riscv (unfortunately it is a bit behind upstream master, and also a bit behind the latest CHERI spec which is still evolving).

There are also a few open source chips available that implement CHERI which you can run in Verilator or an FPGA. For example cheriot-ibex https://github.com/microsoft/cheriot-ibex . This is actually a variant of CHERI for microcontrollers called CHERIoT. Long story but the plan is to merge CHERIoT back into CHERI so it is just a "profile" of CHERI.

[kwitaszczyk]

That is not true. During the Digital Security by Design programme UKRI was shipping Morello boards to organisations that requested them. Since DSbD is over, the CHERI Alliance has taken over that initiative. You can request an Arm Morello board via the following link:

https://cheri-alliance.org/discover-cheri/cheri-products/mor...

Also, you can buy a Sonata board with CHERIoT from Mouser:

https://www.mouser.co.uk/en/ProductDetail/NewAE/NAE-SONATA-O...

[rwmj]

There's zero chance CHERI will go anywhere, I wouldn't worry about it.

[kwitaszczyk]

That is not true. Two days ago lowRISC announced that OpenTitan used in Google Chromebooks will include CHERI:

https://lowrisc.org/news/opentitan-earl-grey-2-to-support-ch...

Last year, Google announced that their Coral NPU will include CHERI:

https://developers.googleblog.com/en/introducing-coral-npu-a...

There are more cores that companies are actively working on:

X730 from Codasip https://codasip.com/solutions/riscv-processor-safety-securit...

ICENI from SCI Semiconductor: https://www.scisemi.com/products/iceni-device-family/

[pjmlp]

ARM and Microsoft care about CHERI, that is enough to eventually make it happen, even if only on high integrity computing, like folks that still care about paying for Unisys ClearPath MCP.

Or eventually have its ideas come into the evolution of ARM MTE, Pluton, and Silicon, which increasingly becoming adopted, alongside the oldie SPARC ADI.

It is the x86 linage that keeps getting it wrong on hardware memory tagging solutions.

[rwmj]

ARM and Microsoft don't "care" enough to do anything beyond a bit of token research. Maybe there will be some extremely niche chips one day, or maybe not because the problem can be solved 90% as well in software on ordinary hardware.

[imtringued]

Microsoft and Apple will probably switch to CHERI RISC-V for their Secure Enclave/TPMs once it has proven itself in the field. That means there will be hundreds of millions of CHERI RISC-V processors in the world.

Not to mention the smartcard market which would mean billions of processors around the world.

[crote]

The Intel Management Engine famously runs MINIX. Tanenbaum has called it "the most widely used computer operating system in the world" - but it hasn't exactly led to mainstream MINIX adoption.

Smartcards often run Java Card, which solves the whole memory safety problem the other way around. You don't need CHERI for this kind of limited platforms: want to run memory-safe C today? Just ban all dynamic memory allocations. Throw in the usual UB restrictions and stick to a single thread and very little can go wrong.

What's important to remember is that, despite its large deployment figures, those are still niche applications. The number of people developing for them is a rounding error. There is no clear path from there to mainstream adoption.

[pjmlp]

More important to remember is that not everything needs to be Web scale to be a success.

We don't need to measure technology adoption by the late stage capitalism of Silicon Valley VCs.

Many technologies do leave an impact in the industry even when adopted in niche domains.

[Veserv]

Have they figured out how to implement free() yet?

Last I looked you need a garbage collector to deallocate at which point you might as well use Java which is actually designed for that use case.

[rando1234]

Yeah, I feel like Rust has killed Cheri.

[Timshel]

Do you have more details on why ? I just found stuff like: https://cheri-alliance.org/discover-cheri/rust-and-cheri/ Or https://rust.cheriot.org/2026/02/15/status-update.html

[pjmlp]

CHERI is valuable even for unsafe Rust code.

[rwmj]

The problems with CHERI are not whether it's technically good or not, it's organizational. It's an academic project that requires everyone to boil the ocean. They tried to get ARM interested and that didn't go anywhere and now they're trying to get RISC-V interested. But they haven't addressed any of the problems of why manufacturers would ever make a complex and completely incompatible chip for a problem that they (the manufacturers) don't have and don't care about, that can probably be solved 90% as well in software.

[panick21_]

The manufactures will do what costumers demand and if they demand safty then cheri will make a lot of sense to many costumers.

And you cant rewritte 50 years of C in Rust. And even in Rust you can still run into various issues.

[crote]

> And you cant rewritte 50 years of C in Rust

You don't have to. Google already showed that the vast majority of memory safety bugs are in newly-written C code. Stop writing new C code (which the industry already seems to be moving towards) and the problem will eventually solve itself - even with plenty of C code still around.

Besides, very few (if any) pieces of code have been around for anywhere close to 50 years. Over time components naturally get refactored or rewritten for all sorts of reasons. And if you're rewriting anyways, why not switch to a more secure language? Don't allow C for rewrites and over the years every C component will eventually be replaced by a non-C one without forcing a big C-to-Rust rewrite.

[rwmj]

However you can do what Airbus do and formally prove your C code and use a formally proven toolchain like compcert to compile it. Or you can take a performance hit and add bounds checking to the C code[1]. Aircraft systems are probably the best chance that CHERI has, and that's pretty niche, small runs and very expensive, and still better solved in software.

[1] I literally wrote the paper on this back in 1996: https://www.doc.ic.ac.uk/~phjk/BoundsChecking.html

[mort96]

I haven't exactly seen an outpouring of consumer demand for CHERI.

[fragmede]

> And you cant rewritte 50 years of C in Rust.

How many tokens do you think that would cost?

[timhh]

Is it valuable enough though. Looking at Google's stats Rust has several orders of magnitude fewer memory vulnerabilities even with `unsafe` (kind of the point). If C was at that level there's no way CHERI would have ever been proposed.

There are two counter-arguments:

1. There's a lot of C/C++ code still out there. You can't rewrite it all. I'm not totally convinced by that though because, a) do you need to? Google has shown that just writing new code in Rust is very effective, and b) AI is actually pretty decent at porting from C/C++ to Rust so maybe you can?

2. CHERI also allows really strong and fine grained compartmentalisation. This is absolutely fantastic for robustness, supply chain security and so on. If you want the absolute 100% most secure code possible, then Rust + CHERI with compartmentalisation is basically the best thing you can do. (Though Rust compartmentalisation is still not actually ready yet; it's in progress though.) That's really great but I'm not sure that level of security is needed by most projects, and also I think you can get pretty good compartmentalisation (though definitely not CHERI level) by doing something like what Xous does (basically isolation with processes/virtual memory, combined with the ability to call functions in other processes; IIRC Hubris OS does something similar).

CHERI is clever tech though and it would definitely be a boon for RISC-V if it succeeds.

[pjmlp]

The problem is that with LLVM, GCC, CUDA, Vulkan, POSIX, V8 and co, there will be lots of new C and C++ getting written as well.

Even on OpenJDK and CLR side, as new language features allow to rewrite even more runtime code from C++ into Java and C#, there is still new runtime code getting written in C++.

There is already clever tech for hardware memory tagging (SPARC ADI, and ARM MTE), CHERI is yet another way to tame unsafety on our computing stacks.

[timhh]

There's no real need for LLVM, GCC or CUDA to be memory safe. POSIX libc is of course C by definition but libc's are normally extremely well tested, and it is possible to avoid libc entirely if you want.

V8 is actually a nice case for CHERI since you can easily sandbox the JIT'd code. If you were to just rewrite V8 in Rust then you wouldn't get that benefit (you can't run the borrow checker on generated assembly). I assume they have some other sandboxing methods instead though.

But in general if you think about things like V8, that's used on high performance application class consumer CPUs. It's going to be at least 10 years before anyone has one of those with CHERI (unless ARM changes its mind about Morello). I would not bet against V8 being ported to Rust before that.

As I said I think CHERI is great technology and I hope it does succeed, but it does seem like the business case for it is not as strong as it was just a few years ago.