Skip to content
STIMSMITH

Capability-Based Memory Protection

Concept WIKI v1 · 7/6/2026

A hardware memory-safety approach in which conventional pointers are replaced by capabilities that carry bounds, permissions, and validity metadata, enforced in hardware through a separate non-addressable tagged memory. CHERI for RISC-V is the most prominent implementation, providing fine-grained spatial and temporal memory safety for memory-unsafe languages such as C and C++.

Capability-Based Memory Protection

Definition

Capability-based memory protection is a hardware-supported memory safety paradigm in which every pointer (a capability) carries not only an address but also metadata describing the memory region it is authorized to access. Hardware checks on every load, store, and instruction fetch consult this metadata, providing fine-grained enforcement of spatial and temporal memory safety even in programs written in memory-unsafe languages such as C and C++. [1]

Key Properties

Capabilities encode the following fields for the memory region they refer to:

  • Bounds — the accessible address range.
  • Permissions — the operations (load, store, execute, etc.) permitted on the region.
  • Validity metadata (tag) — a bit indicating that the capability has not been corrupted or revoked.

Any illegal manipulation of a capability (for example, forging bounds or modifying the tag out-of-band) invalidates the tag and prevents further memory access through the corrupted capability. [1]

Hardware Enforcement Mechanism

Capability tags are propagated through registers, caches, and memory. They are stored in a dedicated, non-addressable tagged memory that is accessible only via capability-specific instructions. Conventional memory operations therefore cannot read or write tag state directly. [1]

During capability store instructions (for example, sc.ddc, sc.cap), the corresponding tag bit must be updated alongside the data word. A conventional implementation transfers the tag-containing memory word to the processor, modifies the tag, and writes it back, which adds memory traffic and latency. [2]

CHERI as the Reference Implementation

The Capability Hardware Enhanced RISC Instructions (CHERI) architecture is described as the most mature capability-based memory safety architecture, providing fine-grained enforcement of pointer bounds and permissions in hardware. [3] In CHERI-enabled RISC-V systems, conventional pointers are replaced by capabilities that encode bounds, permissions, and validity metadata. [1]

CHERI has been implemented and evaluated across multiple platforms, including:

  • Software-based emulation. [3]
  • FPGA prototypes. [3]
  • ASICs. [3]

The architecture is suitable for embedded and IoT systems, where memory-safety violations account for a large fraction of exploitable vulnerabilities, and where hardware-supported protection must be integrated directly into the processor. [1]

Architectural Checks

CHERI enforces strict bounds, permission, and validity checks on every memory access. Without properly prepared capabilities, most generated memory operations will fail at the capability check stage and never reach the underlying tagged memory hardware. [4]

Related Memory-Safety Approaches

Capability-based memory protection is one of several hardware memory-safety mechanisms; the evidence references the following related architectures:

  • SoftBound — a software-based bounds-checking approach cited alongside CHERI. [3]
  • ARM Memory Tagging Extension (MTE) — a tagged-memory architecture. [3]
  • Intel Memory Protection Extensions (MPX) — a tagged-memory/bounds-checking design. [3]

CHERI is distinguished from these by providing hardware-enforced capability semantics rather than tag-based fault detection alone. [3]

Performance Implications

While capability-based protection improves security, the additional metadata handling and memory accesses required for tag storage and propagation can affect system performance and energy efficiency. This motivates architectural optimizations such as in-memory computation (IMC) accelerators for tag updates, which perform tag modifications directly within the memory array to reduce data movement over the system interconnect while preserving security semantics. [2] [1]

Benchmarking and Evaluation

Existing general-purpose benchmark suites (e.g., SPEC, PARSEC, Embench IoT) do not exercise memory-safety mechanisms, and CHERI-specific application-level benchmarks (such as those targeting ARM's Morello platform) depend on a mature execution environment such as CheriBSD. As a result, early-stage, security-aware performance evaluation of capability-based memory protection requires dedicated benchmarks. [3]

Instruction streams used to exercise capability hardware must be filtered and post-processed so that capabilities are constructed with appropriate bounds, permissions, and tags; otherwise the streams fail CHERI's architectural checks and never reach the tagged memory. [4]

See Also

LINKED ENTITIES

1 links
Security-Aware Instruction Stream Post-Processing USES

CITATIONS

11 sources
11 citations
[1] Capability-based memory protection provides hardware-enforced spatial and temporal memory safety for programs written in memory-unsafe languages such as C and C++. Security-Aware Benchmarks for Performance Exploration of CHERI
[2] In capability-based systems, conventional pointers are replaced with capabilities that encode bounds, permissions, and validity metadata for memory regions. Security-Aware Benchmarks for Performance Exploration of CHERI
[3] Capability tags are propagated through registers, caches, and memory, and are stored in a separate, non-addressable tagged memory accessible only via capability-specific instructions. Security-Aware Benchmarks for Performance Exploration of CHERI
[4] Any illegal manipulation invalidates the capability tag and prevents further memory access through the corrupted capability. Security-Aware Benchmarks for Performance Exploration of CHERI
[5] CHERI is the most mature capability-based memory safety architecture, providing fine-grained enforcement of pointer bounds and permissions in hardware. Security-Aware Benchmarks for Performance Exploration of CHERI
[6] CHERI has been implemented and evaluated across software-based emulation, FPGA prototypes, and ASICs. Security-Aware Benchmarks for Performance Exploration of CHERI
[7] During capability store instructions such as sc.ddc and sc.cap, the corresponding tag bit must be updated alongside the data, which in a conventional implementation requires transferring the tag-containing memory word to the processor, modifying the tag, and writing it back. Security-Aware Benchmarks for Performance Exploration of CHERI
[8] CHERI enforces strict bounds, permission, and validity checks on memory accesses; without properly prepared capabilities, generated memory operations fail and never reach the tagged memory. Security-Aware Benchmarks for Performance Exploration of CHERI
[9] Related hardware memory-safety mechanisms include SoftBound, ARM Memory Tagging Extension, and Intel Memory Protection Extensions. Security-Aware Benchmarks for Performance Exploration of CHERI
[10] Capability-based protection introduces additional metadata handling and memory accesses that can affect performance and energy efficiency in embedded systems. Security-Aware Benchmarks for Performance Exploration of CHERI
[11] Raw instruction streams generated for functional verification do not correctly exercise capability mechanisms and must be filtered and post-processed to construct capabilities with appropriate bounds, permissions, and tags before they can be used as security-aware benchmarks. Security-Aware Benchmarks for Performance Exploration of CHERI