Skip to content
STIMSMITH

Capability Tag Bit

Concept WIKI v1 · 6/21/2026

A capability tag bit is an out-of-band, single-bit validity marker atomically bound to a capability word that protects capability integrity and derivation in registers and memory, as used in the CHERI capability-based architecture.

Capability Tag Bit

A capability tag bit is a single-bit validity marker that travels alongside a capability to enforce that the capability has not been forged or corrupted. In capability-based architectures such as CHERI, the tag bit is the mechanism by which the hardware distinguishes a legitimate capability from an arbitrary bit pattern that merely resembles one.

Role and Purpose

The tag bit exists to protect capability integrity and derivation in both registers and memory. Because capabilities carry metadata (such as bounds and permissions) that govern how an address may be used, the architecture must be able to prove at the hardware level that a given value was produced by a sanctioned capability-derivation operation rather than constructed by arbitrary data manipulation. The tag bit is that proof: its presence attests that the associated capability is valid.

Storage and Atomicity

The tag bit has the following structural properties:

  • Out-of-band: The tag is stored separately from the normal data payload of the capability rather than being encoded within the capability's address or metadata bits.
  • Atomically bound to the capability: The tag cannot be split from its capability through normal load/store or register operations; the architecture guarantees that tag and data move together.
  • Validates the capability: Hardware consults the tag when a capability is loaded or used, refusing to treat an untagged value as a capability.

Concrete Form in CHERI

In the CHERI architecture described in the ASP-DAC 2026 presentation "A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture":

  • A CHERI capability extends the integer memory address to 128 bits, comprising a 64-bit address plus 64 bits of metadata (bounds, permissions, object type, etc.).
  • General-purpose registers are widened to 129 bits, consisting of the 64-bit address, the 64-bit metadata word, and a 1-bit validity tag that is the capability tag bit.
  • Tagged memory protects capability-sized and capability-aligned words in DRAM by adding a validity tag to each such word.
  • The system bus architecture is extended to transport these out-of-band tags alongside normal data, so the tag remains bound to its capability across register files, caches, and main memory.

The ISA is extended with CHERI-specific instructions that enforce monotonicity of capabilities and guarded manipulation, with the tag bit serving as the hardware-level invariant those instructions rely upon.

Why a Tag Rather Than Encoded Metadata

Storing the tag out-of-band (rather than, for example, reserving a bit inside the 128-bit capability word) allows the tag to be managed by dedicated hardware paths without consuming the in-band bits used for address and metadata encoding. It also means that ordinary data values can occupy capability-sized, capability-aligned words in memory without risk of being misinterpreted as capabilities — only locations whose tag is set are treated as capabilities on load.

See Also

  • CHERI — the capability-based architecture in which this tag bit mechanism is defined.

LINKED ENTITIES

1 links
CHERI USES

CITATIONS

7 sources
7 citations
[1] Tags protect capability integrity and derivation in registers and memory. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture (ASP-DAC 2026)
[2] The tag bit is out-of-band, stored separately from normal data, atomically bound to the capability, and validates the capability. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture (ASP-DAC 2026)
[3] General-purpose registers are widened to 129 bits (64-bit address + 64-bit metadata + 1-bit validity tag). A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture (ASP-DAC 2026)
[4] Tagged memory protects capability-sized and -aligned words in DRAM by adding a validity tag. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture (ASP-DAC 2026)
[5] The bus architecture is extended to transport out-of-bound tags. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture (ASP-DAC 2026)
[6] CHERI capabilities extend integer memory addresses to 128 bits and carry metadata (bounds, permissions, object type, etc.) controlling how they may be used. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture (ASP-DAC 2026)
[7] The CHERI ISA is extended with instructions that enforce monotonicity and guarded manipulation of capabilities. A RISC-V CHERI VP: Enabling System-Level Evaluation of the Capability-Based CHERI Architecture (ASP-DAC 2026)