A–Z reference
Glossary
Concise meanings for the architecture, software and adoption terms used across this site.
How to use this glossary
Definitions here are explanatory, not normative. CHERI variants, specifications and software projects can use a term more precisely. When behaviour affects code, assurance or procurement, follow the source links and use the exact architecture and version implemented by the target.
A
- ABI — Application Binary Interface
- The rules that let compiled code, libraries and an operating system work together: calling conventions, register use, data layout, system calls and object-file conventions. CHERI systems can provide hybrid and pure-capability ABIs.
- Ambient authority
- Authority available to code without being explicitly passed for the task. Capability-oriented designs try to reduce ambient authority so dependencies are visible and reviewable.
- Authority
- The set of actions a component is able to perform. In CHERI, authority is represented through the capabilities a component can access and the bounds, permissions and state on those capabilities.
B
- Bounds
- The address range a capability authorises. A memory access outside those bounds fails even when the numeric address exists in the machine’s address space.
C
- Capability
- A hardware-recognised value that combines an address with metadata such as bounds, permissions and validity. It acts as both a reference and evidence of authority.
- Capability compression
- A representation technique that stores capability metadata compactly by deriving some fields from the address. Compression can make some requested bounds inexact, so allocators and ABIs account for representability.
- Capability provenance
- The authorised origin and derivation history of a capability. Code can narrow or remove authority from a valid capability, but cannot create stronger authority from an unrelated integer.
- Capability register
- A processor register able to hold and operate on a capability, including its address and protected metadata.
- CHERI
- Capability Hardware Enhanced RISC Instructions: an architectural approach that extends conventional processors with hardware-supported capabilities for memory protection and software compartmentalisation.
- CheriABI
- A pure-capability application binary interface developed for CheriBSD. User-space pointers are capabilities, allowing stronger and more pervasive enforcement than a hybrid ABI.
- CheriBSD
- A CHERI-enabled adaptation of FreeBSD used to research, develop and evaluate CHERI memory safety and compartmentalisation for an application-class operating system.
- CHERIoT
- A CHERI-derived architecture and hardware–software platform designed for embedded and real-time systems, with fine-grained compartments and a small trusted computing base.
- Compartment
- A software component isolated from other components and given only the authority it needs through explicit interfaces and capabilities.
- Compartmentalisation
- Dividing a system into isolated components so a defect or compromise in one has limited reach. CHERI provides architectural mechanisms; the software design must still choose useful boundaries and authority.
D
- DDC — Default Data Capability
- A capability used by some CHERI execution modes to authorise ordinary data accesses that are not made through an explicit capability register. Its role depends on the architecture and ABI.
- Dereference
- Using a pointer or capability to access the object or memory it refers to. CHERI checks validity, bounds and permissions at the point of use.
F
- Fault
- A processor-reported exception caused when an operation violates an architectural rule—for example, dereferencing an untagged capability or writing through a read-only capability. Software decides how the system handles it.
H
- Hybrid ABI
- An ABI in which conventional integer pointers and capability-aware pointers coexist. It can ease incremental porting, but provides less pervasive protection than a pure-capability ABI.
L
- Least authority
- Giving code only the authority required for its current responsibility. This is the capability-oriented form of the least-privilege principle.
M
- Memory safety
- Properties that prevent or detect invalid memory operations, including out-of-bounds access and use after an object’s lifetime. Base CHERI directly strengthens spatial safety and supports system designs for temporal safety.
- Monotonicity
- The rule that ordinary capability derivation can reduce authority but cannot increase it. Bounds may be narrowed and permissions removed, but not expanded beyond the parent capability.
O
- Object capability
- A capability used as an unforgeable reference to an object or service, normally paired with an interface. Object-capability design is a software model; CHERI provides low-level mechanisms that can support it.
P
- PCC — Program Counter Capability
- The capability that authorises instruction fetch and constrains the code region currently executing.
- Permissions
- Bits describing which operations a capability authorises, such as loading, storing or executing. Permissions vary by architecture and can normally be removed but not added during derivation.
- Pure-capability ABI
- An ABI in which pointers used by normal application code are capabilities. This makes bounds, permissions and validity checks the default throughout more of the software stack.
R
- Representable bounds
- Bounds that can be encoded exactly by a compressed capability format. Some sizes and alignments are easier to represent, which can influence allocation and object layout.
- Revocation
- Making previously issued authority unusable. CHERI tags and bounds do not alone solve every use-after-free problem; systems can add revocation, quarantine or allocation strategies to address temporal safety.
S
- Sealing
- Protecting a capability so it cannot be used as an ordinary data or code reference until an authorised operation unseals or invokes it. Sealing supports protected object types and compartment entry mechanisms.
- Spatial memory safety
- Ensuring a memory access stays within the intended object or authorised region. CHERI bounds and permissions enforce this property at dereference time.
T
- Tag
- Protected validity state maintained by the architecture for a capability. Software cannot forge a valid capability by assembling its bits as ordinary data; operations that violate capability integrity clear the tag.
- Temporal memory safety
- Ensuring memory is accessed only during the lifetime of the intended object. Use-after-free is a temporal error. CHERI can support temporal-safety mechanisms, but the complete guarantee depends on the allocator and system design.
- Trusted computing base
- The hardware and software that must behave correctly for a security property to hold. Compartmentalisation aims to keep this set small and explicit.
U
- Unforgeability
- The property that code cannot create a valid capability with new authority from arbitrary bits. Valid capabilities must come from authorised roots and permitted derivation.
V
- Valid capability
- A capability whose protected tag is set. Validity does not mean every operation is allowed: bounds, permissions, sealing state and other checks still apply.