Skip to content

Commit 23a54b5

Browse files
bsdjhbbsdjhb
committed
Make the CHERI exception codes architecture-specific.
Move the tables out of the architecture chapter and into each architecture spec. Morello already uses a different scheme for reporting exceptions that doesn't follow this code. For RISC-V I moved the description of xtval out into a new subsection next to exception handling rather than being buried in a section about new CSRs. For both RISC-V and x86-64 I have kept the existing values, but have condensed the tables slightly since they otherwise float several pages away.
1 parent 3a236db commit 23a54b5

File tree

3 files changed

+175
-121
lines changed

3 files changed

+175
-121
lines changed

‎chap-architecture.tex‎

Lines changed: 3 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -2352,8 +2352,7 @@ \subsubsection{New Exceptions for Existing and New Instructions}
23522352
In general, CHERI attempts to provide useful cause information when exceptions
23532353
fire, including to identify whether an exception was triggered by using an
23542354
invalid capability, dereferencing a sealed capability, or an access request
2355-
not being authorized by capability permissions or bounds (see
2356-
Section~\ref{sec:capability_exception_causes} for details).
2355+
not being authorized by capability permissions or bounds.
23572356

23582357
\subsubsection{Exception Delivery}
23592358

@@ -2439,61 +2438,8 @@ \subsubsection{Capability Exception Causes}
24392438
In each of the target ISAs (RISC-V and x86-64), we introduce a new
24402439
exception to report capability violations.
24412440
Since this exception covers a variety of error cases, each CHERI ISA
2442-
must provide a capability exception code in an architecture-specific
2443-
manner which indicates the specific violation.
2444-
While the capability exception code delivery is architecture-specific,
2445-
the capability exception codes are shared across all architectures.
2446-
The possible capability exception codes are shown in Table~\ref{table:capability-cause}.
2447-
2448-
\begin{table}
2449-
\begin{center}
2450-
\begin{threeparttable}
2451-
\begin{tabular}{ll}
2452-
\toprule
2453-
Value & Description \\
2454-
\midrule
2455-
0x00 & None \\
2456-
0x01 & Length Violation \\
2457-
0x02 & Tag Violation \\
2458-
0x03 & Seal Violation \\
2459-
0x04 & Type Violation \\
2460-
0x05 & \emph{reserved} \\
2461-
0x06 & \emph{reserved} \\
2462-
0x07 & \emph{reserved} \\
2463-
0x08 & Software-defined Permission Violation \\
2464-
0x09 & \emph{reserved} \\
2465-
0x0a & \emph{reserved} \\
2466-
0x0b & Unaligned Base \tnote{1} \\
2467-
0x0c & \emph{reserved} \\
2468-
0x0d & \emph{reserved} \\
2469-
0x0e & \emph{reserved} \\
2470-
0x0f & \emph{reserved} \\
2471-
0x10 & \cappermG Violation \\
2472-
0x11 & \cappermX Violation \\
2473-
0x12 & \cappermL Violation \\
2474-
0x13 & \cappermS Violation \\
2475-
0x14 & \cappermLC Violation \\
2476-
0x15 & \cappermSC Violation \\
2477-
0x16 & \cappermSLC Violation \\
2478-
0x17 & \emph{reserved} \\
2479-
0x18 & \cappermASR Violation \\
2480-
0x19 & \cappermInvoke Violation \\
2481-
0x1a & \emph{reserved} \\
2482-
0x1b & \emph{reserved} \\
2483-
0x1c & \cappermCid Violation \\
2484-
0x1d & \emph{reserved} \\
2485-
0x1e & \emph{reserved} \\
2486-
0x1f & \emph{reserved} \\
2487-
\bottomrule
2488-
\end{tabular}
2489-
\begin{tablenotes}
2490-
\item [1] Only used on CHERI-RISC-V.
2491-
\end{tablenotes}
2492-
\end{threeparttable}
2493-
\end{center}
2494-
\caption{Capability Exception Codes}
2495-
\label{table:capability-cause}
2496-
\end{table}
2441+
must provide an architecture-specific capability exception code
2442+
which indicates the specific violation.
24972443

24982444
\subsubsection{Capability Exception Priority}
24992445
\label{sec:capability_exception_priority}
@@ -2524,38 +2470,6 @@ \subsubsection{Capability Exception Priority}
25242470
architecture-specific prioritization for capability-related exceptions
25252471
relative to other exception types.
25262472

2527-
If an instruction could potentially throw more than one capability exception,
2528-
the capability exception code is set to the highest priority exception (numerically lowest
2529-
priority value) as shown in Table~\ref{table:exception-priority}.
2530-
2531-
\begin{table}
2532-
\begin{center}
2533-
\begin{tabular}{ll}
2534-
\toprule
2535-
Priority & Description \\
2536-
\midrule
2537-
1 & \cappermASR Violation \\
2538-
2 & Tag Violation \\
2539-
3 & Seal Violation \\
2540-
4 & Type Violation \\
2541-
5 & \cappermInvoke Violation \\
2542-
& \cappermCid Violation \\
2543-
6 & \cappermX Violation \\
2544-
7 & \cappermL Violation \\
2545-
& \cappermS Violation \\
2546-
8 & \cappermLC Violation \\
2547-
& \cappermSC Violation \\
2548-
9 & \cappermSLC Violation \\
2549-
10 & \cappermG Violation \\
2550-
11 & Length Violation \\
2551-
12 & Software-defined Permission Violation \\
2552-
\bottomrule
2553-
\end{tabular}
2554-
\end{center}
2555-
\caption{Exception Priority}
2556-
\label{table:exception-priority}
2557-
\end{table}
2558-
25592473
\subsection{Virtual Memory}
25602474
\label{sec:virtual_memory}
25612475

‎chap-cheri-riscv.tex‎

Lines changed: 105 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,7 @@ \subsection{Unique Architectural Features}
216216
Additional capability-specific exception cause information, such
217217
as more specific cause information and the identity of the faulting
218218
register is reported in the existing \xtval{} CSRs (see
219-
Section~\ref{subsubsec-cheri-tval}).
219+
Section~\ref{subsection:riscv:cheri-exception-reporting}).
220220
\item New per-mode capability CSRs are added as \xccsr{} (see
221221
Section~\ref{subsubsec-ccsrs}).
222222
\item CHERI-related page permissions are added to RISC-V architectural
@@ -473,35 +473,6 @@ \subsubsection{Controlling Access to CSRs}
473473
\label{tab:risc-v-access-system-registers-whitelist}
474474
\end{table}
475475

476-
\subsubsection{Capability Exception Reporting}
477-
\label{subsubsec-cheri-tval}
478-
479-
CHERI-RISC-V extends the definition of the Trap Value CSRs, \xtval{}, to
480-
report capability exception details as described in
481-
Figure~\ref{fig-cheri-tval} (shown for XLEN=32):
482-
483-
\begin{figure}[!h]
484-
\begin{center}
485-
\begin{bytefield}[bitwidth=\textwidth/34]{32}
486-
\bitheader[endianness=big]{0,4,5,10,31} \\
487-
\bitbox{21}{\textbf{WPRI}}
488-
\bitbox{6}{\texttt{cap idx}}
489-
\bitbox{5}{\texttt{cause}}
490-
\end{bytefield}
491-
\caption{\xtval{} register format for Capability Exception}
492-
\label{fig-cheri-tval}
493-
\end{center}
494-
\end{figure}
495-
496-
\begin{description}
497-
\item [cause] The \texttt{cause} field reports the capability exception code as described in Section~\ref{sec:capability_exception_causes}.
498-
\item [cap idx] The \texttt{cap idx} field reports the index of the capability register that caused the last exception. When
499-
the most significant bit is set, the 5 least significant bits are used to index
500-
the special purpose capability register file described in
501-
Table~\ref{tab:risc-v-special-capability-registers}, otherwise, they index the
502-
general-purpose capability register file.
503-
\end{description}
504-
505476
\subsubsection{Capability Control and Status Registers (CCSRs)}
506477
\label{subsubsec-ccsrs}
507478
New per HART \xccsr{} \texttt{XLEN}-bit RISC-V CSRs are defined as per
@@ -922,7 +893,7 @@ \subsection{Exception Handling}
922893
CHERI-RISC-V introduces several new exception-related Special Capability Registers
923894
to supplement existing RISC-V exception CSRs with new capability-related functionality.
924895
In addition, when a capability exception is raised, \xtval{} will provide
925-
details about the exception as described in Section~\ref{subsubsec-cheri-tval}.
896+
details about the exception as described in Section~\ref{subsection:riscv:cheri-exception-reporting}.
926897

927898
\subsubsection{Exceptions to Machine Mode}
928899
We define the following new special capability registers that can be read and
@@ -1008,6 +979,109 @@ \subsubsection{Exceptions to User Mode}
1008979
%for tag loss at suitable moments (e.g., after potentially tag-stripping
1009980
%operations such as pointer manipulation).
1010981

982+
\subsection{Capability Exception Reporting}
983+
\label{subsection:riscv:cheri-exception-reporting}
984+
985+
CHERI-RISC-V extends the definition of the Trap Value CSRs, \xtval{}, to
986+
report capability exception details as described in
987+
Figure~\ref{fig-cheri-tval} (shown for XLEN=32):
988+
989+
\begin{figure}[!h]
990+
\begin{center}
991+
\begin{bytefield}[bitwidth=\textwidth/34]{32}
992+
\bitheader[endianness=big]{0,4,5,10,31} \\
993+
\bitbox{21}{\textbf{WPRI}}
994+
\bitbox{6}{\texttt{cap idx}}
995+
\bitbox{5}{\texttt{cause}}
996+
\end{bytefield}
997+
\caption{\xtval{} register format for Capability Exception}
998+
\label{fig-cheri-tval}
999+
\end{center}
1000+
\end{figure}
1001+
1002+
\begin{description}
1003+
\item [cause] The \texttt{cause} field reports the capability
1004+
exception code from Table~\ref{tab:risc-v-capability-cause}.
1005+
\item [cap idx] The \texttt{cap idx} field reports the index of the capability register that caused the last exception. When
1006+
the most significant bit is set, the 5 least significant bits are used to index
1007+
the special purpose capability register file described in
1008+
Table~\ref{tab:risc-v-special-capability-registers}, otherwise, they index the
1009+
general-purpose capability register file.
1010+
\end{description}
1011+
1012+
\begin{table}
1013+
\begin{center}
1014+
\begin{tabular}{ll}
1015+
\toprule
1016+
Value & Description \\
1017+
\midrule
1018+
0x00 & None \\
1019+
0x01 & Length Violation \\
1020+
0x02 & Tag Violation \\
1021+
0x03 & Seal Violation \\
1022+
0x04 & Type Violation \\
1023+
0x05-0x07 & \emph{reserved} \\
1024+
0x08 & Software-defined Permission Violation \\
1025+
0x09-0x0a & \emph{reserved} \\
1026+
0x0b & Unaligned Base \\
1027+
0x0c-0x0f & \emph{reserved} \\
1028+
0x10 & \cappermG Violation \\
1029+
0x11 & \cappermX Violation \\
1030+
0x12 & \cappermL Violation \\
1031+
0x13 & \cappermS Violation \\
1032+
0x14 & \cappermLC Violation \\
1033+
0x15 & \cappermSC Violation \\
1034+
0x16 & \cappermSLC Violation \\
1035+
0x17 & \emph{reserved} \\
1036+
0x18 & \cappermASR Violation \\
1037+
0x19 & \cappermInvoke Violation \\
1038+
0x1a-0x1b & \emph{reserved} \\
1039+
0x1c & \cappermCid Violation \\
1040+
0x1d-0x1f & \emph{reserved} \\
1041+
\bottomrule
1042+
\end{tabular}
1043+
\end{center}
1044+
\caption{CHERI-RISC-V Capability Exception Codes}
1045+
\label{tab:risc-v-capability-cause}
1046+
\end{table}
1047+
1048+
\jhbnote{The current exception code values are inherited from
1049+
CHERI-MIPS. They should probably be renumbered at some point.}
1050+
1051+
If an instruction could potentially throw more than one capability exception,
1052+
the capability exception code is set to the highest priority exception (numerically lowest
1053+
priority value) as shown in Table~\ref{table:risc-v-exception-priority}.
1054+
1055+
\begin{table}
1056+
\begin{center}
1057+
\begin{tabular}{ll}
1058+
\toprule
1059+
Priority & Description \\
1060+
\midrule
1061+
1 & \cappermASR Violation \\
1062+
2 & Tag Violation \\
1063+
3 & Seal Violation \\
1064+
4 & Type Violation \\
1065+
5 & \cappermInvoke Violation \\
1066+
& \cappermCid Violation \\
1067+
6 & \cappermX Violation \\
1068+
7 & \cappermL Violation \\
1069+
& \cappermS Violation \\
1070+
8 & \cappermLC Violation \\
1071+
& \cappermSC Violation \\
1072+
9 & \cappermSLC Violation \\
1073+
10 & \cappermG Violation \\
1074+
11 & Length Violation \\
1075+
12 & Software-defined Permission Violation \\
1076+
\bottomrule
1077+
\end{tabular}
1078+
\end{center}
1079+
\caption{CHERI-RISC-V Capability Exception Priority}
1080+
\label{table:risc-v-exception-priority}
1081+
\end{table}
1082+
1083+
\jhbnote{Missing the unaligned base cause in the priority table}
1084+
10111085
\subsection{Virtual Memory and Page Tables}
10121086
\label{subsection:riscv:pagetables}
10131087

‎chap-cheri-x86-64.tex‎

Lines changed: 67 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1059,9 +1059,75 @@ \subsection{Capability Violation Faults}
10591059
exception vector. This new exception would report an error code
10601060
pushed as part of the exception frame similar to GP\# and PF\# faults.
10611061
This error code would contain the capability exception code as
1062-
described in Section~\ref{sec:capability_exception_causes} to indicate
1062+
described in Table~\ref{table:x86:capability-cause} to indicate
10631063
the specific violation.
10641064

1065+
\begin{table}
1066+
\begin{center}
1067+
\begin{tabular}{ll}
1068+
\toprule
1069+
Value & Description \\
1070+
\midrule
1071+
0x00 & None \\
1072+
0x01 & Length Violation \\
1073+
0x02 & Tag Violation \\
1074+
0x03 & Seal Violation \\
1075+
0x04 & Type Violation \\
1076+
0x05-0x07 & \emph{reserved} \\
1077+
0x08 & Software-defined Permission Violation \\
1078+
0x09-0x0f & \emph{reserved} \\
1079+
0x10 & \cappermG Violation \\
1080+
0x11 & \cappermX Violation \\
1081+
0x12 & \cappermL Violation \\
1082+
0x13 & \cappermS Violation \\
1083+
0x14 & \cappermLC Violation \\
1084+
0x15 & \cappermSC Violation \\
1085+
0x16 & \cappermSLC Violation \\
1086+
0x17 & \emph{reserved} \\
1087+
0x18 & \cappermASR Violation \\
1088+
0x19 & \cappermInvoke Violation \\
1089+
0x1a-0x1b & \emph{reserved} \\
1090+
0x1c & \cappermCid Violation \\
1091+
0x1d-0x1f & \emph{reserved} \\
1092+
\bottomrule
1093+
\end{tabular}
1094+
\end{center}
1095+
\caption{CHERI-x86-64 Capability Exception Error Codes}
1096+
\label{table:x86:capability-cause}
1097+
\end{table}
1098+
1099+
If an instruction could potentially throw more than one capability exception,
1100+
the capability exception error code is set to the highest priority exception (numerically lowest
1101+
priority value) as shown in Table~\ref{table:x86:exception-priority}.
1102+
1103+
\begin{table}
1104+
\begin{center}
1105+
\begin{tabular}{ll}
1106+
\toprule
1107+
Priority & Description \\
1108+
\midrule
1109+
1 & \cappermASR Violation \\
1110+
2 & Tag Violation \\
1111+
3 & Seal Violation \\
1112+
4 & Type Violation \\
1113+
5 & \cappermInvoke Violation \\
1114+
& \cappermCid Violation \\
1115+
6 & \cappermX Violation \\
1116+
7 & \cappermL Violation \\
1117+
& \cappermS Violation \\
1118+
8 & \cappermLC Violation \\
1119+
& \cappermSC Violation \\
1120+
9 & \cappermSLC Violation \\
1121+
10 & \cappermG Violation \\
1122+
11 & Length Violation \\
1123+
12 & Software-defined Permission Violation \\
1124+
\bottomrule
1125+
\end{tabular}
1126+
\end{center}
1127+
\caption{CHERI-x86-64 Capability Exception Priority}
1128+
\label{table:x86:exception-priority}
1129+
\end{table}
1130+
10651131
CHERI-RISC-V includes the name of the register which
10661132
triggers a capability violation. It is not feasible to provide a
10671133
direct analog of this on x86. Indirect jumps and calls may raise an

0 commit comments

Comments
 (0)