Glossary

Application Binary Interface. The conventions that let compiled code, libraries, and an operating system agree on data layouts, calling conventions, registers, and binary formats.

Authority available to code without being passed explicitly. Capability systems seek to reduce ambient authority so that access is tied to specific capabilities.

All the parts of a system that an attacker could potentially target or exploit to gain access or cause harm.

The right to access a resource or perform an operation. A CHERI capability carries authority through its bounds, permissions, validity, and sealing state.

The lower and upper limits of the memory region that a capability can address. A memory access outside those limits is rejected by the processor.

An encoding technique that represents a capability's bounds compactly alongside its address and other metadata. Some bounds cannot be represented exactly and are rounded to a representable range.

Capability Hardware Enhanced RISC Instructions. An architectural protection model that adds hardware-supported capabilities to conventional processor architectures.

C and C++ language and ABI adaptations that represent pointers with CHERI capabilities and expose capability-aware operations where needed.

A CHERI-based hardware-software platform designed for small embedded systems, with memory safety and fine-grained compartments built into its processor and RTOS model.

A hardware-protected reference that carries a memory location, the bounds of the memory region, the access rights associated with it, and some other metadata.

An exception raised when an operation violates a capability rule, such as using an invalid capability, accessing outside its bounds, or attempting an operation without the required permission.

The valid derivation history that connects a capability to existing authority. Integer values cannot simply be converted into usable capabilities with new authority.

A processor register able to hold a complete capability, including its address and protected metadata.

A pure-capability POSIX process environment developed for CheriBSD in which C and C++ pointers are represented as capabilities.

A FreeBSD-derived research operating system used to develop and evaluate CHERI memory protection and compartmentalisation.

A software component isolated from other components and given only selected access to code, data, devices, or services.

The division of software into isolated components so that a fault or compromise in one component has limited authority over the rest of the system.

A capability representation that encodes bounds relative to the current address, allowing capability metadata and a conventional-sized address to fit within a practical in-memory format.

The current address within a capability. It can move within the authority described by the capability but does not itself define the capability's bounds.

A capability used by some CHERI execution models as the default authority for data accesses that are not made through an explicit capability register.

Using a pointer or capability to read or write the memory it refers to. CHERI checks validity, bounds, permissions, and other relevant rules when a capability is dereferenced.

A field-programmable gate array, or FPGA, is a programmable chip that can be configured to feature a processor and system design. This makes it a practical bridge between simulation and silicon.

An application binary interface in which conventional pointers remain the default while software can explicitly use capabilities for selected data and interfaces.

The programmer-visible contract between software and a processor, including instructions, registers, data types, exceptions, and memory behaviour.

The principle that code should receive only the authority required for its function. Capability bounds and permissions provide mechanisms for expressing narrower authority.

Protection against invalid uses of memory, including accesses outside an object's bounds and, where temporal protection is present, accesses after an object's lifetime has ended.

The rule that deriving a capability can preserve or reduce its authority but cannot increase it beyond the authority of the source capability.

Arm's experimental high-performance processor, SoC, and development board implementing an adaptation of CHERI for the Arm architecture.

The property that software cannot create a valid capability with new authority merely by constructing or modifying its bit pattern.

An unforgeable reference that both identifies an object and authorises a defined set of operations on it.

A right recorded in a capability, such as permission to load data, store data, or execute code. An operation is rejected when the relevant permission is absent.

A pointer is a value that contains the address of a location in memory. In conventional systems, this is just an integer.

Information about where a pointer came from and which storage or object it is authorised to reference. CHERI makes valid provenance a hardware-enforced part of pointer use.

The capability that authorises instruction fetch and constrains the region of code that can execute in the current context.

An application binary interface in which language-level pointers, code pointers, return addresses, and related runtime structures are represented with capabilities.

An open instruction-set architecture. CHERI extensions for RISC-V have been used in research processors, embedded systems, and ongoing standardisation work.

The process of making previously issued capabilities unusable when their authority should no longer apply, such as after memory has been freed or a compartment has been torn down.

A language for describing instruction-set architectures formally. CHERI uses Sail models as executable specifications and as inputs to testing and proof tools.

A capability placed in a protected sealed state. It cannot be used for ordinary memory access until an authorised mechanism unseals or invokes it.

A sealed executable capability used to provide a controlled entry point into code without exposing unrestricted access to the target code capability.

Protection against accessing memory outside the intended bounds of an object, allocation, stack frame, or other region.

A protected validity bit associated with a capability. Ordinary data operations cannot manufacture a set tag, and operations that corrupt a capability representation clear it.

Memory that stores capability validity tags separately from ordinary software-visible data so that the integrity of in-memory capabilities can be enforced.

Protection against using memory outside its valid lifetime, including use-after-free and use-after-reallocation errors.

The hardware and software that must behave correctly for a system's security properties to hold. Compartmentalisation can reduce the amount of code trusted by any one component.

A temporal memory-safety error in which software accesses an allocation after it has been released and may have been reused for another purpose.