CHERI is a hybrid capability architecture in that it is able to blend architectural capabilities with conventional MMU-based architectures and microarchitectures, and with conventional software stacks based on virtual memory and C/C++. This approach allows incremental deployment within existing software ecosystems, which we have demonstrated through extensive hardware and software prototyping. CHERI interacts with the design of the full hardware-software stack. We have developed: An abstract CHERI protection model that introduces architectural capabilities, hardware-supported descriptions of permissions that can be used, in place of integer virtual addresses, to refer to data, code, and objects in protected ways; A set of ISA extensions to 64-bit MIPS, 32-bit RISC-V, 64-bit RISC-V, and (in collaboration with Arm) 64-bit Armv8-A, showing that the model is applicable to a range of contemporary ISA designs. New microarchitecture demonstrating that capabilities can be implemented efficiently in hardware, including capability compression and tagged memory to protect capabilities in memory; and Formal models of these ISA extensions enabling mechanised statements and proofs of their security properties, automatic test generation, and automatic construction of executable ISA-level simulators.

We may end up with 128-bit pointers even without a "true" 128-bit architecture. For example, CHERI has 128-bit pointers with 64-bit address space and 64 bits of metadata to crash harder on memory bugs in C and C++:

This “extra information” that distinguishes different pointers to the same address is typically called provenance. This post is another attempt to convince you that provenance is “real”, by telling a cautionary tale of what can go wrong when provenance is not considered sufficiently carefully in an optimizing compiler. The post is self-contained; I am not assuming that you have read the first one. There is also a larger message here about how we could prevent such issues from coming up in the future by spending more effort on the specification of compiler IRs.

just because two pointers point to the same address, does not mean they are equal in the sense that they can be used interchangeably.

// A goroutine can be preempted at any safe-point. Currently, there // are a few categories of safe-points: // // 1. A blocked safe-point occurs for the duration that a goroutine is // descheduled, blocked on synchronization, or in a system call. // // 2. Synchronous safe-points occur when a running goroutine checks // for a preemption request. // // 3. Asynchronous safe-points occur at any instruction in user code // where the goroutine can be safely paused and a conservative // stack and register scan can find stack roots. The runtime can // stop a goroutine at an async safe-point using a signal.

By the age of eight, von Neumann was familiar with differential and integral calculus, and by twelve he had read and understood Borel's Théorie des Fonctions.

Von Neumann was reportedly able to memorize the pages of telephone directories. He entertained friends by asking them to randomly call out page numbers; he then recited the names, addresses and numbers therein.

Von Neumann was a child prodigy who at six years old could divide two eight-digit numbers in his head and could converse in Ancient Greek. When the six-year-old von Neumann caught his mother staring aimlessly, he asked her, "What are you calculating?"

During this time he became a "superstar" defense scientist at the Pentagon. His authority was considered infallible at the highest levels of the US government and military.