capability permissions

Capability Permissions

Concept

Capability permissions are a category of in-band metadata carried by CHERI capability values that govern which operations (such as Load, Store, or Execute) a capability authorizes. Together with bounds and object-type fields, permissions provide the fine-grained, hardware-enforced memory protection that distinguishes CHERI capabilities from plain integer memory addresses.

First seen 6/21/2026

Last seen 6/21/2026

Evidence 1 chunks

Wiki v1

WIKI

Overview

In the CHERI capability-based architecture, a capability is an unforgeable, 128-bit token that replaces traditional integer memory pointers. Unlike a bare address, a capability carries metadata — including bounds, object type, a validity tag, and permissions — that the hardware consults on every memory operation performed through that capability. The permissions field is the mechanism by which a capability expresses what the holder is allowed to do with the memory it addresses, as distinct from which memory it addresses (the bounds field).

Role within a CHERI capability

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

2 connections

CHERI ← uses 100% 1e

CHERI capabilities include permissions metadata.

capability pointer ← extends 90% 1e

Capability pointers include permissions as part of their metadata.

LINKED ENTITIES

2 links

CHERI USES Extracted graph relationship

capability pointer EXTENDS Extracted graph relationship

CITATIONS

5 sources

5 citations — click to expand

[1] Capabilities extend integer memory addresses to 128 bits and carry metadata (bounds, permissions, …) that controls how the capability may be used, replacing traditional pointers in programs. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture (ASP-DAC 2026)

[2] CHERI capabilities include a permissions field that allows fine-grained memory protection, with examples such as Load, Store, and Execute. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture (ASP-DAC 2026)

[3] A capability carries an object-type field that, together with permissions such as the Execute permission, is used to validate object-method invocation by combining a Data capability with an Execution capability. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture (ASP-DAC 2026)

[4] Capability values include a bounds field (with a relative compression algorithm), a `flag_cap_mode` flag for Hybrid-Mode coexistence of CHERI and legacy code, a tag bit stored out-of-band and atomically bound to the capability, and reserved fields. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture (ASP-DAC 2026)

[5] CHERI hardware changes to enforce capability permissions and other metadata include 129-bit general-purpose registers (64-bit address + 64-bit metadata + 1-bit validity tag), a capability-extended program counter, tagged memory for capability-aligned words, an extended bus for out-of-band tags, ISA extensions, and instructions that enforce monotonicity and guarded manipulation. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture (ASP-DAC 2026)