Skip to content
STIMSMITH

Capability Hardware Security

Concept

Capability hardware security refers to ISA-level approaches in which processor hardware enforces memory protection and authority by requiring capabilities (unforgeable tokens of authority) to be presented on each memory access. The most prominent contemporary example is the CHERI (Capability Hardware Enhanced RISC Instructions) ISA, which augments an existing architecture (originally MIPS, now also RISC-V via the Piccolo/Flute/Toooba cores, and Arm via the Morello research prototype) so that pointers are replaced or accompanied by capabilities carrying bounds, permissions, and other provenance metadata. Capability hardware security is contrasted with coarser hardware mechanisms such as Memory Protection Units (MPUs) and RISC-V Physical Memory Protection (PMP), and is positioned as a way to retrofit spatial safety to existing C and C++ code.

First seen 6/8/2026
Last seen 6/8/2026
Evidence 3 chunks
Wiki v1

WIKI

Definition

Capability hardware security is the class of processor designs that enforce memory safety and authority at the hardware level by requiring code to possess and present a capability (an unforgeable, hardware-protected token) for every memory access. Rather than relying solely on virtual-memory-based privilege rings, the capability itself carries the address, bounds, and permissions that the hardware checks on use. The defining property is that the intended capability must be quoted on access, so the executing code's authority is explicit and decentralised, rather than inferred from a global configuration.

CHERI as the Canonical Example

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

1 connections
UCAM-CL-TR-984 ← uses 100% 1e
Capability hardware security is the central security concept of the thesis.

LINKED ENTITIES

1 links
UCAM-CL-TR-984 USES Extracted graph relationship

CITATIONS

10 sources
10 citations — click to expand
[1] Capability hardware security is exemplified by CHERI, which is described as 'hardware enforcing properties inferred from the programmer's code'. UCAM-CL-TR-984.pdf (CHERI on RISC-V thesis)
[2] CHERI was originally demonstrated on a MIPS processor and is being adapted to RISC-V (Piccolo, Flute, Toooba) and to Arm through the Morello research prototype. UCAM-CL-TR-984.pdf (CHERI on RISC-V thesis)
[3] RISC-V Physical Memory Protection (PMP) is a fixed set of CSRs (16 or 64 entries depending on implementation) that restrict read, write, and execute access to memory regions and can only be changed in machine mode. UCAM-CL-TR-984.pdf (CHERI on RISC-V thesis), §2.2.1.2
[4] The security offered by the PMP mechanism is a strict subset of that offered by capabilities: PMP restricts region access only on coarse granularity, lacks intentionality, and cannot delegate different access rights to the same physical region to different compartments without reconfiguration on every context switch. UCAM-CL-TR-984.pdf (CHERI on RISC-V thesis), §2.2.1.2
[5] PMP must perform an associative lookup on every access, incurring area and power cost that grows linearly with the number of PMP registers, whereas capabilities avoid associative lookups by requiring the intended capability to be quoted on access. UCAM-CL-TR-984.pdf (CHERI on RISC-V thesis), §2.2.1.2
[6] Revocation is simpler under PMP (add a PMP entry to forbid a region) but requires scanning or maintaining an invariant in a capability system, because authority is decentralised and capabilities to a region may exist in many places. UCAM-CL-TR-984.pdf (CHERI on RISC-V thesis), §2.2.1.2
[7] Capabilities require at least recompilation of code to provide their full protections, whereas PMP can be used to protect existing binaries unchanged. UCAM-CL-TR-984.pdf (CHERI on RISC-V thesis), §2.2.1.2
[8] Memory Protection Units (MPUs) implement a subset of MMU privilege-protection mechanisms without translation, and can be composed with MMUs to protect machine-mode code; some RISC-V cores offer a standardised MPU that RISC-V calls a PMP. UCAM-CL-TR-984.pdf (CHERI on RISC-V thesis), §2.2.1.2
[9] Capability hardware security is one of three strategies for spatial safety in C and C++: hardware memory protection, safe languages (Java, C#, Python using dynamic bounds checks), and capabilities (CHERI). The document notes that even a universally adopted safe language would not displace billions of lines of existing critical C and C++ code, motivating the hardware-capability approach. UCAM-CL-TR-984.pdf (CHERI on RISC-V thesis), §2.2.1.3
[10] The thesis articulates four hypotheses (H.1–H.4) that capability hardware security via CHERI can be applied with small overheads to RISC-V microcontrollers (H.1), to out-of-order superscalar application-class cores (H.2), that overheads decrease as cores grow (H.3), and that temporal safety can be efficiently added atop CHERI (H.4). UCAM-CL-TR-984.pdf (CHERI on RISC-V thesis), §1.2