Capabilities

Why it matters

Replacing unconstrained machine-word pointers with protected capabilities makes pointer authority explicit and difficult for buggy or malicious code to invent.

In brief

What is a capability in plain language?

A CHERI capability is a protected value that identifies a memory location and carries limits on how it may be used. In addition to an address, it includes bounds, permissions and validity information that the processor checks.

Text-only capability check

1. Software attempts to access a memory address.
2. The processor checks whether the capability is valid.
3. It checks whether the address is inside the capability bounds.
4. It checks whether the requested action is permitted.
5. A valid request continues. An invalid request faults at the point of use and can be contained at a compartment boundary.

Key considerations

1. Unforgeable

Software cannot create a valid capability merely by constructing bits or guessing an address.

2. Limited

Bounds and permissions restrict the memory region and operations available through the capability.

3. Delegable

Code can pass a narrower capability to another component without granting all of its own authority.

Evidence and caveats

Capabilities enforce the authority they represent; they do not decide whether that authority was wisely granted or whether application logic is correct.

Use the exact architecture and software specification implemented by the target. Separate architectural guarantees from system-level outcomes.

Primary routes

• University of Cambridge CHERI