Skip to content

Bounds Checking

Bounds-checking primitives

Hardware-flavoured pointer-safety primitives. The capability pair here carries a region descriptor (base, length, permissions) alongside the pointer itself, so a dereference can be validated against the descriptor before the load actually issues. The result is fail-fast unsafe access: out-of-bounds, wrong-permission, and freed-region accesses become observable failures instead of silent corruption.

PrimitiveWhat it carriesUse when
Capabilities (CHERI)A hardware capability (base + length + permissions) on CHERI-aware platforms (Morello / ARM CHERI)Platform-level capability enforcement; pointer arithmetic is bounded by silicon
RASP (Register-Aligned SIMD Pointer)SoA-stored (base, length, perms) per pointer with AVX2 / AVX-512F batch validationx86 silicon where CHERI hardware does not exist; need millions of bounds checks per second across a large pointer fan-out

The two shapes

The CHERI capability uses the silicon to enforce bounds. The processor refuses to dereference outside the capability’s range, and capability arithmetic that escapes the bounds invalidates the capability tag. The crate ships two specialised wrappers: ReadableCapability<T> for read-only access and WritableCapability<T> for read-write access. Both bound the permission set so a ReadableCapability cannot be coerced into a write path. CHERI ships on ARM Morello.

The RASP primitive (RaspBatch<T>) is the x86 sibling: there is no x86 / x86_64 capability ISA, so the same (base, length, perms) descriptor that CHERI carries in silicon is stored in a structure-of-arrays layout that x86 vector instructions can validate in batches. AVX2 checks 4 pointers per loop iteration; AVX-512F checks 8 per iteration; both paths verify the same bounds + permission + sealed predicates the scalar reference does, with runtime CPUID dispatch falling back to scalar on hosts without AVX2.

See also

  • Exotic Pointers - pointer formats with inline metadata that compose with bounds-check enforcement.
  • subetha-cxc Channel<T> - the primary consumer of CHERI capabilities for capability-secured cross-process channels.