Skip to content
STIMSMITH

Capability Pointer

Concept WIKI v1 · 6/21/2026

A capability pointer is an unforgeable, tagged pointer used in the CHERI architecture that extends an integer memory address with metadata such as bounds, permissions, and object type information. Capability pointers replace traditional integer pointers in CHERI programs, enabling hardware-enforced spatial memory safety and fine-grained protection, and form the substrate for related concepts such as capability bounds and capability permissions.

Capability Pointer

A capability pointer is the fundamental architectural primitive of the CHERI (Capability Hardware Enhanced RISC Instructions) instruction-set extension. It replaces traditional integer memory pointers in compiled programs and is augmented with metadata and a validity tag so that the hardware can enforce how the pointer may be dereferenced.

Definition and Role in CHERI

In CHERI, capabilities are an architectural primitive that compilers, systems software, and applications use to constrain their own future execution. Traditional pointers in programs are replaced by capabilities; every operation that in a conventional ISA would consume a memory address instead consumes a capability pointer whose validity is gated by a tag.

Representation

A CHERI capability pointer widens a conventional address into a 128-bit value:

  • The address portion retains the location of the referenced object in memory.
  • Embedded metadata describes how the pointer may be used.
  • An out-of-band validity tag is stored separately from normal data and is atomically bound to the capability. The tag validates the capability and protects its integrity and legitimate derivation in both registers and memory.

General-purpose registers therefore become 129 bits wide on a CHERI machine (64-bit address + 64 bits of metadata + 1 bit of validity tag), and the program counter itself is extended with a capability. Tagged memory protects capability-sized and capability-aligned words in DRAM by adding the out-of-band validity tag, and the bus architecture is extended to transport those tags. The CHERI ISA is further extended with capability-manipulation instructions that enforce monotonicity and guarded manipulation of capabilities.

Metadata Carried by a Capability Pointer

The metadata portion of a capability pointer encodes several pieces of information that the hardware checks on every use:

  • Bounds — a compressed encoding of the base and top of the authorized memory region, allowing spatial safety checks such as rejecting an out-of-bounds read.
  • Permissions — fine-grained access rights such as Load, Store, and Execute, enabling fine-grained memory protection.
  • Object type — the type of the object that the capability points to, for example supporting validation of object method invocation via the combination of a data capability and an execution capability.
  • Reserved fields — reserved for future architectural use.

The combination of bounds, permissions, and other fields gives capability pointers the ability to enforce both spatial memory safety (e.g., preventing a buffer overflow) and capability-monotonicity properties (e.g., that a derived capability cannot exceed the authority of its parent).

Hybrid-Mode Support

In Hybrid-Mode execution, a capability-mode flag (flag_cap_mode) is required, allowing CHERI-aware and legacy code to run side by side. In this mode, the ISA distinguishes ordinary integer pointers from capability pointers so that legacy code can continue to use conventional addressing while CHERI code can exploit capability pointers.

Example: Bounds Enforcement

The motivating example used in CHERI presentations shows a C program that iterates past the end of a 5-element array. Under non-CHERI execution the program continues reading whatever bytes happen to live past the array, producing nonsensical values. Under CHERI, the capability pointer bounds are checked on each dereference; on the read that exceeds array[4] the hardware raises a LengthViolation exception, demonstrating that the capability pointer has enforced spatial memory safety without requiring software mitigation.

Origin and Adoption

The capability pointer concept originates from CHERI, a hardware-based approach developed by the University of Cambridge beginning in 2010. CHERI is designed to increase the memory safety of RISC processors and is an extension of existing ISAs, with versions available for RISC-V, MIPS, ARM (Morello), and x86. A large ecosystem of supporting software has been built around capability pointers, including operating systems such as CheriBSD.

Significance

By replacing integer pointers with unforgeable, metadata-bearing capability pointers, CHERI transforms memory safety from a software-only problem into a property the hardware can enforce directly. Capability pointers are therefore the building block from which derived concepts such as capability bounds and capability permissions inherit their semantics, and they have been proposed as the foundation for further architectural extensions (such as CHERI-D, which associates object-identification metadata with capability pointers to add temporal memory safety on top of the spatial safety already provided by capability pointers).

LINKED ENTITIES

3 links
CHERI USES
capability bounds EXTENDS
capability permissions EXTENDS

CITATIONS

9 sources
9 citations
[1] Capabilities are an architectural primitive that compilers, systems software, and applications use to constrain their own future execution, and traditional pointers in programs are replaced by capabilities. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture
[2] Capabilities extend integer memory addresses (now 128 bit) and carry metadata (bounds, permissions, etc.) that controls how the capability may be used. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture
[3] General-purpose registers become 129 bits wide (64-bit address + 64-bit metadata + 1-bit validity tag), the program counter is extended with a capability, and tagged memory protects capability-sized and -aligned words in DRAM with an out-of-band validity tag transported over an extended bus architecture. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture
[4] Capability metadata includes bounds (compressed encoding of base and top), permissions (Load, Store, Execute, etc.), an object type field supporting object-method validation, and reserved fields. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture
[5] Tags are stored out-of-band from normal data, are atomically bound to capabilities, and validate capability integrity and derivation in registers and memory. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture
[6] In Hybrid-Mode, the capability-mode flag (flag_cap_mode) is required so that CHERI-aware and legacy code can run side by side. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture
[7] A CHERI execution of an out-of-bounds array read raises a LengthViolation exception, demonstrating hardware-enforced spatial memory safety. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture
[8] CHERI is a hardware-based approach developed by the University of Cambridge beginning in 2010 to increase memory safety of RISC processors, with variants for RISC-V, MIPS, ARM (Morello), and x86. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture
[9] CHERI-D associates object identification metadata with capability pointers to provide temporal integrity of allocations on top of CHERI's spatial safety. CHERI-D: Secure and efficient inline object ID for CHERI temporal memory safety