Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarify permissions when the level extension is not implemented #501

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+6 −1
Open

Clarify permissions when the level extension is not implemented #501

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/cap-description.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -630,7 +630,7 @@ or 'root' capability.
| SDP | ones | Grants all permissions
| AP (MXLEN=32) | 0x8/0x9^1^ (see xref:cap_perms_encoding32[xrefstyle=short])
| Grants all permissions
| AP (MXLEN=64) | 0xFF (see xref:cap_perms_encoding64[xrefstyle=short])
| AP (MXLEN=64) | 0x3F/0xFF^3^ (see xref:cap_perms_encoding64[xrefstyle=short])
| Grants all permissions
| CL | one^2^| _Global_
| CT | zero | Unsealed
Expand All @@ -652,6 +652,8 @@ or 'root' capability.

^2^ This field only exists if {cheri_levels_ext_name} is implemented.

^3^ When {cheri_levels_ext_name} is not implemented the value is 0x3F since the bits reserved for `EL` and `SL` must be zero.

[#section_cap_representable_check, reftext="Representable Range"]
=== Representable Range Check

Expand Down
3 changes: 3 additions & 0 deletions src/insns/gcperm_32bit.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@ permission bits in `rd` are set to 0.
[#gcperm_bit_field]
include::../img/acperm_bit_field.edn[]

NOTE: When {cheri_levels_ext_name} is not implemented, the `CL`, `SL`, and `EL` fields always report 0.
Therefore, the presence of the {cheri_levels_ext_name} can be detected by checking the <<GCPERM>> result on the <<infinite-cap>>.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I mean, the RISC-V way is to get that information externally, for better or (generally) worse.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's true, happy to use hardwired to 1 instead if that sounds better to you?

I noticed I also need to update the infinite cap format to set those bits to zero/one.

This change is motivated by CHERI-Alliance/sail-cheri-riscv#3 since I noticed the M bit location was wrong.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reserved bits should be 0, and without levels the bits are reserved. When an extension adds meaning to those bits, the existing bit pattern should be unchanged in its meaning. I'm concerned the latter isn't true if the natural default is 1.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree that reserved bits should be zero. The problem is that if we add new permissions, those will generally be '1' for permissive behaviour and '0' for restricted, so the natural default is 1 even though cores that don't implement this extension will be reporting zero and doing the permissive behaviour. I am not sure if this can really be fixed.

Copy link
Collaborator

@jrtc27 jrtc27 Jan 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You invert them, you have RES1 bits or you have separate feature enable bits. #502 is the short dump of thoughts I have on the matter, and that I've brought up many times over the years wanting people to think about this carefully with worked examples, to no avail.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok - so RES1 seems like the way to go

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For the in-memory format it seems like we would have to use inverted bit meaning? Otherwise if we use RES1 we end up having those permissions set to 0 for the null cap which sounds like it would be a problem?


Exceptions::
include::require_cre.adoc[]

Expand Down
Loading