Invalid capability returned by CCopyType

[Andreas-Bur]

There seems to be an issue where the CCopyType instruction mistakenly clears the tag of the result if the capability's bounds are set to zero.
This was tested on 64bit RISCV.

PoC:

  cseal c1,cnull,cnull
  cspecialrw c2,31,cnull
  csetboundsexact c2,c2,zero
  ccopytype c3,c2,c1
  cgettag x4,c3

Expected value: x4=1
Actual value: x4=0

[jrtc27]

How are you running this? What's the full state of each register?

[Andreas-Bur]

The exact command used is qemu-system-riscv64cheri -machine spike -cpu rv64 -nographic -bios none -kernel app.elf -chardev socket,path=gdb.sock,server=on,wait=off,id=gdb0 -gdb chardev:gdb0 -d instr -D qemu.log -S

Then I attached GDB with gdb -q -ex "target remote gdb.sock" app.elf

This is the objdump of app.elf:

/<path>/app.elf:	file format elf64-littleriscv

Disassembly of section .text:

0000000080000000 <_start>:
80000000: db 00 00 16  	cseal	cra, cnull, cnull
80000004: 5b 01 f0 03  	cspecialr	csp, mepcc
80000008: 5b 01 01 12  	csetboundsexact	csp, csp, zero
8000000c: db 01 11 3c  	ccopytype	cgp, csp, cra
80000010: 5b 82 41 fe  	cgettag	tp, cgp

After stepping after 0x80000010 with gdb, the value of tp observed with info reg tp is 0.