Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix sentry paragraph for jump instructions #287

Merged
merged 7 commits into from
Jul 1, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 6 additions & 8 deletions src/cap-description.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -280,15 +280,13 @@ it via a superset capability with <<CBLD>>. {cheri_base_ext_name} does not offer
an unseal instruction.

For code capabilities, the sealing bit is used to implement immutable
capabilities that describe function entry points. Such capabilities can be leveraged
to establish a form of control-flow integrity between mutually distrusting code. These
capabilities are known as sealed entry (sentry) capabilities. A program may jump to a
sentry capability to begin executing the instructions it references. The jump
instruction automatically unseals the capability and installs it to the
capabilities that describe function entry points, known as sealed entry (sentry) capabilities. Such capabilities can be leveraged
to establish a form of control-flow integrity between mutually distrusting code. A program may jump to a
sentry capability to begin executing the instructions it references. A <<JALR>>
instruction with zero offset automatically unseals a sentry target capability and installs it in the
program counter capability (see
xref:section_riscv_programmers_model[xrefstyle=short]). The <<JALR>> instruction
also seals the return address capability (if any) since it is the entry point
to the caller function.
xref:section_riscv_programmers_model[xrefstyle=short]). The jump-and-link instructions
also seal the return address capability which serves as an entry point the callee can return to but cannot use to authorize memory loads or stores.

[#section_cap_bounds]
==== Bounds (EF, T, TE, B, BE)
Expand Down
8 changes: 4 additions & 4 deletions src/riscv-integration.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -242,13 +242,13 @@ to the base behaviour as described below.
<<JAL>> sign-extends the offset and adds it to the address of
the jump instruction to form the target address. The target address is
installed in the address field of <<pcc>>. The capability with the address of the
instruction following the jump (<<pcc>> + 4) is written to a *c* register.
instruction following the jump (<<pcc>> + 4) is sealed and written to a *c* register.

<<JALR>>
allows unconditional jumps to a target capability. The target capability is
allows unconditional, indirect jumps to a target capability. The target capability is
obtained by incrementing the capability in the *c* register operand by the
sign-extended 12-bit immediate if the immediate is not zero, then setting the
least significant bit of the result to zero, then unsealing. The capability
sign-extended 12-bit offset, then setting the
least significant bit of the result to zero. The target capability is unsealed if it is a sentry with zero offset. The capability
with the address of the instruction following the jump (<<pcc>> + 4) is sealed
and written to a *c* register.

Expand Down
Loading