CTSRD-CHERI · jrtc27 · Mar 17, 2025 · Feb 27, 2025 · Feb 27, 2025 · Feb 27, 2025
diff --git a/clang/include/clang/Basic/Features.def b/clang/include/clang/Basic/Features.def
@@ -240,6 +240,7 @@ FEATURE(experimental_library, LangOpts.ExperimentalLibrary)
 
 // CHERI features:
 FEATURE(capabilities, PP.getTargetInfo().SupportsCapabilities())
+FEATURE(cheri, PP.getTargetInfo().SupportsCapabilities())
 FEATURE(pointer_interpretation, PP.getTargetInfo().SupportsCapabilities())
 FEATURE(cheri_casts, PP.getTargetInfo().SupportsCapabilities())
 

diff --git a/clang/lib/Frontend/InitPreprocessor.cpp b/clang/lib/Frontend/InitPreprocessor.cpp
@@ -997,7 +997,6 @@ static void InitializePredefinedMacros(const TargetInfo &TI,
   if (TI.SupportsCapabilities()) {
     const uint64_t CapWidth = TI.getCHERICapabilityWidth();
     const uint64_t CapRange = TI.getPointerRangeForCHERICapability();
-    Builder.defineMacro("__CHERI__", "1"); // TODO: or define __CHERI__ to 128/256?
     Builder.defineMacro("__CHERI_CAPABILITY_WIDTH__", Twine(CapWidth));
     DefineTypeSizeof("__SIZEOF_CHERI_CAPABILITY__", CapWidth, TI, Builder);
     Builder.defineMacro("__CHERI_ADDRESS_BITS__", Twine(CapRange));
@@ -1012,6 +1011,8 @@ static void InitializePredefinedMacros(const TargetInfo &TI,
     DefineTypeSize("__UINTCAP_MAX__", TI.getIntTypeByWidth(CapRange, false), TI, Builder);
 
     if (TI.areAllPointersCapabilities()) {
+      Builder.defineMacro("__CHERI__");
+
       // XXXAR is there a reason we use two instead of just defining it?
       // I don't think we have any checks that rely on the value
       Builder.defineMacro("__CHERI_PURE_CAPABILITY__", "2");
@@ -1023,6 +1024,8 @@ static void InitializePredefinedMacros(const TargetInfo &TI,
       if (LangOpts.getCheriBounds() > LangOptions::CBM_Conservative)
         Builder.defineMacro("__CHERI_SUBOBJECT_BOUNDS__",
                             Twine(LangOpts.getCheriBounds()));
+    } else {
+      Builder.defineMacro("__CHERI_HYBRID__");
     }
   }
 

diff --git a/clang/test/CodeGen/builtin-align.c b/clang/test/CodeGen/builtin-align.c
@@ -40,7 +40,7 @@
 #error MISSING TYPE
 #endif
 
-#ifndef __CHERI__
+#if !__has_feature(cheri)
 #define __capability
 #endif
 

diff --git a/clang/test/CodeGen/cheri/warn-ctoptr-functions.c b/clang/test/CodeGen/cheri/warn-ctoptr-functions.c
@@ -22,7 +22,7 @@ typedef	__sighandler_t	* __kerncap sig_t;	/* type of pointer to a signal functio
 typedef long sigset_t;
 struct __siginfo;
 
-#if __has_feature(capabilities)
+#if __has_feature(cheri)
 struct sigaction_c {
 	union {
 		void    (* __capability __sa_handler)(int);
@@ -42,7 +42,7 @@ struct sigaction_native {
 	sigset_t sa_mask;		/* signal mask to apply */
 };
 
-#if __has_feature(capabilities)
+#if __has_feature(cheri)
 typedef struct sigaction_c	ksigaction_t;
 #else
 typedef	struct sigaction_native	ksigaction_t;

diff --git a/clang/test/CodeGenCXX/cheri/constinit-zero-to-pointer.cpp b/clang/test/CodeGenCXX/cheri/constinit-zero-to-pointer.cpp
@@ -24,7 +24,7 @@ const AttributeData kBarcodeAttributeData{
 AttributeData test() { return kBarcodeAttributeData; }
 
 /// Also check enums with underlying type __intcap for CHERI targets:
-#if __has_feature(capabilities)
+#if __has_feature(cheri)
 enum class IntCapEnum : __intcap { Zero };
 
 void *intcapEnumToPtrConstant = (void *)IntCapEnum::Zero;

diff --git a/clang/test/Driver/cheri/bounds-mode.c b/clang/test/Driver/cheri/bounds-mode.c
@@ -17,3 +17,4 @@
 // CHECK: #define __CHERI_PURE_CAPABILITY__ 2
 // SUBOBJECT-DISABLED-NOT: __CHERI_SUBOBJECT_BOUNDS__
 // SUBOBJECT-SAFE: #define __CHERI_SUBOBJECT_BOUNDS__ 2
+// CHECK: #define __CHERI__ 1
diff --git a/clang/test/Preprocessor/cheri-cap-sizes.c b/clang/test/Preprocessor/cheri-cap-sizes.c
@@ -37,8 +37,10 @@
 // CHECK: #define __CHERI_ADDRESS_BITS__ 64
 // CHERI128: #define __CHERI_CAPABILITY_WIDTH__ 128
 // PURECAP: #define __CHERI_PURE_CAPABILITY__ 2
+// PURECAP: #define __CHERI__ 1
 // MIPS-NOT: __CHERI_PURE_CAPABILITY__
-// CHECK: #define __CHERI__ 1
+// MIPS-NOT: __CHERI__
+// MIPS: #define __CHERI_HYBRID__ 1
 // Note: 64-bit range for intcap makes more sense than the full range for pointers
 // CHECK: #define __INTCAP_MAX__ 9223372036854775807L
 

diff --git a/clang/test/Preprocessor/cheri-features.c b/clang/test/Preprocessor/cheri-features.c
@@ -5,6 +5,15 @@
 // RUN:   2>&1 | FileCheck --check-prefix=CHECK-MIPS %s
 
 
+#if __has_feature(cheri)
+#pragma message("__has_feature(cheri)")
+// CHECK-CHERI: warning: __has_feature(cheri)
+void* __capability w = 0;
+#else
+#pragma message("no cheri")
+// CHECK-MIPS: warning: no cheri
+#endif
+
 #if __has_feature(capabilities)
 #pragma message("__has_feature(capabilities)")
 // CHECK-CHERI: warning: __has_feature(capabilities)
@@ -16,13 +25,22 @@ void* __capability x = 0;
 
 #if defined(__CHERI__)
 #pragma message("__CHERI__ defined")
-// CHECK-CHERI: warning: __CHERI__ defined
 void* __capability y = 0;
 #else
 #pragma message("__CHERI__ not defined")
+// CHECK-CHERI: warning: __CHERI__ not defined
 // CHECK-MIPS: warning: __CHERI__ not defined
 #endif
 
+#if defined(__CHERI_HYBRID__)
+#pragma message("__CHERI_HYBRID__ defined")
+// CHECK-CHERI: warning: __CHERI_HYBRID__ defined
+void* __capability y = 0;
+#else
+#pragma message("__CHERI_HYBRID__ not defined")
+// CHECK-MIPS: warning: __CHERI_HYBRID__ not defined
+#endif
+
 int main() {
 	return 0;
 }
diff --git a/clang/test/Preprocessor/cheri-riscv-feature-flags.c b/clang/test/Preprocessor/cheri-riscv-feature-flags.c
@@ -18,7 +18,7 @@
 // CHECK: #define __CHERI_CAP_PERMISSION_PERMIT_STORE_LOCAL__ 64
 // CHECK: #define __CHERI_CAP_PERMISSION_PERMIT_STORE__ 8
 // CHECK: #define __CHERI_CAP_PERMISSION_PERMIT_UNSEAL__ 512
-// CHECK: #define __CHERI__ 1
+// CHECK: #define __CHERI_HYBRID__ 1
 // CHECK32: #define __SIZEOF_CHERI_CAPABILITY__ 8
 // CHECK64: #define __SIZEOF_CHERI_CAPABILITY__ 16
 // __VERSION__ and __clang_version__ could contain CHERI due to the Git URL.

diff --git a/clang/test/Preprocessor/init.c b/clang/test/Preprocessor/init.c
@@ -355,7 +355,7 @@
 // CHERI-COMMON-NEXT: #define __CHERI_CAP_PERMISSION_PERMIT_STORE_LOCAL__ 64
 // CHERI-COMMON-NEXT: #define __CHERI_CAP_PERMISSION_PERMIT_STORE__ 8
 // CHERI-COMMON-NEXT: #define __CHERI_CAP_PERMISSION_PERMIT_UNSEAL__ 512
-// CHERI-COMMON-NEXT: #define __CHERI__ 1
+// CHERI-COMMON-NEXT: #define __CHERI_HYBRID__ 1
 // CHERI64:           #define __POINTER_WIDTH__ 32
 // CHERI128:          #define __POINTER_WIDTH__ 64
 // CHERI-COMMON-NEXT: #define __PRAGMA_REDEFINE_EXTNAME 1
@@ -407,6 +407,7 @@
 // CHERI128-PURECAP: #define _MIPS_FPSET 32
 // CHERI128-PURECAP: #define __CHERI_PURE_CAPABILITY__ 2
 // CHERI128-PURECAP: #define __CHERI_SANDBOX__ 4
+// CHERI128-PURECAP: #define __CHERI__ 1
 // CHERI128-PURECAP: #define __INTPTR_FMTd__ "Pd"
 // CHERI128-PURECAP: #define __INTPTR_FMTi__ "Pi"
 // CHERI128-PURECAP: #define __INTPTR_MAX__ 9223372036854775807L

diff --git a/clang/test/SemaCXX/cheri/cheri-pointer-cast.cpp b/clang/test/SemaCXX/cheri/cheri-pointer-cast.cpp
@@ -9,7 +9,7 @@ typedef unsigned long ulong;
 
 int foo;
 
-#ifdef __CHERI__
+#if __has_feature(cheri)
 #define CAP __capability
 #else
 #define CAP
@@ -68,7 +68,7 @@ int main() {
 }
 
 // Check that we don't warn on dependent types
-#ifdef __CHERI__
+#if __has_feature(cheri)
 template <typename T>
 long offset_get(T x) {
   return __builtin_cheri_offset_get(reinterpret_cast<void * __capability>(x));

diff --git a/clang/test/SemaCXX/cheri/dependent-cast-crash.cpp b/clang/test/SemaCXX/cheri/dependent-cast-crash.cpp
@@ -1,7 +1,7 @@
 // RUN: %clang_cc1 -fsyntax-only %s -verify
 // RUN: %cheri_cc1 -fsyntax-only %s -verify
 // RUN: %cheri_purecap_cc1 -fsyntax-only %s -verify
-#if !__has_feature(capabilities)
+#if !__has_feature(cheri)
 #define __capability
 #endif
 

diff --git a/clang/test/SemaCXX/cheri/implicit-cap-conversion-return-value.cpp b/clang/test/SemaCXX/cheri/implicit-cap-conversion-return-value.cpp
@@ -7,7 +7,7 @@
 // RUN: %cheri_cc1 -Wall -Wcheri-pointer-conversion -verify=c,expected,hybrid,hybrid-c -x c -fsyntax-only %s
 // RUN: %cheri_purecap_cc1 -Wall -Wcheri-pointer-conversion -verify=c,expected,purecap,purecap-c -x c -fsyntax-only %s
 
-#if __has_feature(capabilities)
+#if __has_feature(cheri)
 typedef unsigned __intcap uintcap_t;
 #else
 typedef unsigned long uintcap_t;

diff --git a/clang/test/SemaCXX/cheri/overloaded-function-template-arg.cpp b/clang/test/SemaCXX/cheri/overloaded-function-template-arg.cpp
@@ -32,7 +32,7 @@ void instantiate() {
   c<void(char), a>::function(1);         // expected-error{{address of overloaded function 'a' does not match required type 'void (char)'}}
 }
 
-#if __has_feature(capabilities)
+#if __has_feature(cheri)
 template <class T, T *__capability Func>
 // hybrid-note@-1 3 {{template parameter is declared here}}
 struct c_cap {

diff --git a/libcxx/include/limits b/libcxx/include/limits
@@ -447,7 +447,7 @@ protected:
     static _LIBCPP_CONSTEXPR const float_round_style round_style = round_to_nearest;
 };
 
-#ifdef __CHERI__
+#if __has_feature(capabilities)
 template<>
 class __libcpp_numeric_limits<__intcap_t, true>
   : public __libcpp_numeric_limits<long, true> { };

diff --git a/libcxx/test/std/utilities/function.objects/unord.hash/integral.pass.cpp b/libcxx/test/std/utilities/function.objects/unord.hash/integral.pass.cpp
@@ -115,9 +115,9 @@ int main(int, char**)
     test<__uint128_t>();
 #endif
 
-#if defined(__CHERI__) && !defined(__CHERI_PURE_CAPABILITY__)
-  test<__intcap_t>();
-  test<__uintcap_t>();
+#ifdef __CHERI_HYBRID__
+    test<__intcap_t>();
+    test<__uintcap_t>();
 #endif
 
   return 0;

diff --git a/libcxx/test/support/charconv_test_helpers.h b/libcxx/test/support/charconv_test_helpers.h
@@ -303,7 +303,7 @@ auto all_signed = type_list<
     ,
     __int128_t
 #endif
-#if __has_feature(capabilities)
+#if __has_feature(cheri)
     , __intcap
 #endif
     >();
@@ -317,7 +317,7 @@ auto all_unsigned = type_list<
     ,
     __uint128_t
 #endif
-#if __has_feature(capabilities)
+#if __has_feature(cheri)
     , unsigned __intcap
 #endif
     >();

diff --git a/libunwind/src/AddressSpace.hpp b/libunwind/src/AddressSpace.hpp
@@ -174,7 +174,7 @@ class _LIBUNWIND_HIDDEN LocalAddressSpace {
 public:
   typedef uintptr_t pint_t;
   typedef intptr_t  sint_t;
-#ifndef __CHERI__
+#if !__has_feature(capabilities)
   typedef libunwind::fake_capability_t capability_t;
 #else
   typedef ::uintcap_t capability_t;
@@ -342,7 +342,7 @@ class _LIBUNWIND_HIDDEN LocalAddressSpace {
   static pint_t to_pint_t(capability_t cap) {
 #ifdef __CHERI_PURE_CAPABILITY__
     return (uintcap_t)cap;
-#elif defined(__CHERI__)
+#elif __has_feature(capabilities)
     return (__cheri_addr pint_t)cap;
 #else
     pint_t result;
@@ -351,7 +351,7 @@ class _LIBUNWIND_HIDDEN LocalAddressSpace {
 #endif
   }
   static capability_t to_capability_t(pint_t pint) {
-#ifdef __CHERI__
+#if __has_feature(capabilities)
     return (uintcap_t)pint;
 #else
     capability_t result;

diff --git a/libunwind/src/DwarfInstructions.hpp b/libunwind/src/DwarfInstructions.hpp
@@ -460,7 +460,7 @@ DwarfInstructions<A, R>::evaluateExpression(pint_t expression, A &addressSpace,
 // XXXAR: I am not entirely sure these operations should work on a uintcap_t
 // but if it's an untagged integer value it is fine
 #pragma clang diagnostic push
-#ifdef __CHERI__
+#if __has_feature(capabilities)
 #pragma clang diagnostic ignored "-Wcheri-bitwise-operations"
 #endif
   const bool log = true;

diff --git a/libunwind/src/Registers.hpp b/libunwind/src/Registers.hpp
@@ -24,7 +24,7 @@ namespace libunwind {
 // For emulating 128-bit registers
 struct v128 { uint32_t vec[4]; };
 // For emulating CHERI capability
-#ifndef __CHERI__
+#if !_has_feature(capabilities)
 struct __attribute__((aligned(16))) fake_capability {
   char bytes[16];
 };
@@ -3291,7 +3291,7 @@ class _LIBUNWIND_HIDDEN Registers_mips_newabi {
   Registers_mips_newabi();
   Registers_mips_newabi(const void *registers);
   CAPABILITIES_NOT_SUPPORTED
-#ifdef __CHERI__
+#if __has_feature(capabilities)
 #pragma message("Should also handle capability registers here.")
 #endif