1. CHERI C/C++ Programming Guide
  2. Introduction
    1. Definitions
    2. Version history
  3. Background
    1. CHERI capabilities
    2. Architectural rules for capability use
  4. CHERI C/C++
    1. The CHERI C/C++ run-time environment
    2. Referential, spatial, and temporal safety
    3. Non-aliasing vs trapping memory safety
  5. Impact on the C/C++ programming model
    1. Capability-related faults
    2. Pointer provenance validity
      1. Recommended use of C-language types
      2. Capability alignment in memory
      3. Single-origin provenance
    3. Capability representation in memory
    4. Bounds
      1. Bounds from the compiler and linker
      2. Bounds from the heap allocator
      3. Subobject bounds
      4. Other sources of bounds
      5. Out-of-bounds pointers
    5. Pointer comparison
    6. Implications of capability revocation for temporal safety
    7. Bitwise operations on capability types
    8. Function prototypes and calling conventions
    9. Data-structure and memory-allocation alignment
      1. Restrictions in capability locations in memory
  6. CHERI compiler warnings and errors
    1. Loss of provenance
    2. Ambiguous provenance
    3. Underaligned capabilities
  7. C APIs to get and set capability properties
    1. CHERI-related header files
    2. Retrieving capability properties
    3. Modifying or restricting capability properties
    4. Capability permissions
    5. Bounds alignment due to compression
    6. Implications for memory-allocator design
  8. Printing capabilities from C
    1. Generating string representations of capabilities
    2. Printing capabilities with the printf(3) API family
  9. The CheriABI POSIX process environment
    1. POSIX API changes
    2. Handling capability-related signals
    3. Revocation APIs
  10. Further reading
  11. Acknowledgements