1. CHERI C/C++ Programming Guide
2. 1. Introduction
3. 1. 1.1. Definitions
4. 2. Background
5. 1. 2.1. CHERI capabilities
   2. 2.2. Architectural rules for capability use
6. 3. CHERI C/C++
7. 1. 3.1. The CHERI C/C++ run-time environment
   2. 3.2. Referential, spatial, and temporal safety
8. 4. Impact on the C/C++ programming model
9. 1. 4.1. Capability-related faults
   2. 4.2. Pointer provenance validity
   3. 1. 4.2.1. Recommended use of C-language types
      2. 4.2.2. Capability alignment in memory
      3. 4.2.3. Single-origin provenance
   4. 4.3. Bounds
   5. 1. 4.3.1. Bounds from the compiler and linker
      2. 4.3.2. Bounds from the heap allocator
      3. 4.3.3. Subobject bounds
   6. 4.4. Other sources of bounds
   7. 1. 4.4.1. Out-of-bounds pointers
   8. 4.5. Pointer comparison
   9. 4.6. Implications of capability revocation for temporal safety
   10. 4.7. Bitwise operations on capability types
   11. 4.8. Function prototypes and calling conventions
   12. 4.9. Data-structure and memory-allocation alignment
   13. 1. 4.9.1. Restrictions in capability locations in memory
10. 5. The CheriABI POSIX process environment
11. 1. 5.1. POSIX API changes
    2. 5.2. Handling capability-related signals
12. 6. CHERI compiler warnings and errors
13. 1. 6.1. Loss of provenance
    2. 6.2. Ambiguous provenance
    3. 6.3. Underaligned capabilities
14. 7. C APIs to get and set capability properties
15. 1. 7.1. CHERI-related header files
    2. 7.2. Retrieving capability properties
    3. 7.3. Modifying or restricting capability properties
    4. 7.4. Capability permissions
    5. 7.5. Bounds alignment due to compression
    6. 7.6. Implications for memory-allocator design
16. 8. Further reading
17. 9. Acknowledgements