mmap.c

#include "include/common.h"
#include "include/instructions.h"
#include "include/regs.h"
#include <cheri/cheric.h>
#include <errno.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/cdefs.h>
#include <sys/mman.h>

uint32_t *get_executable_block()
{
    uint32_t *result =
        mmap(NULL, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANON | MAP_PRIVATE, -1, 0);

    if (result == MAP_FAILED)
    {
        printf("ERRNO: %d, ERROR: %s \n\n", errno, strerror(errno));
    }
    return result;
}

uint32_t *generate_purecap(uint32_t *code)
{
    uint32_t idx = 0;

    if (cheri_getlength(code) <= (9 * sizeof(uint32_t)))
    {
        error("Insufficient size");
        exit(-1);
    }

    code[idx++] =
        cincoffsetimm(csp, csp, ((-32) + (2 << 20))); // 0xFE01115B; // cincoffset csp, csp, -32
    code[idx++] = csc_128(csp, cra, 16);              // 0x00114823; // csc cra, 16(csp)
    code[idx++] = csc_128(csp, cs0, 0);               // 0x00814023; // csc cs0, 0(csp)
    code[idx++] = cincoffset(cs0, csp, 32);           // 0x0201145B; // cincoffset cs0, csp, 32
    code[idx++] = addi(a0, zero, 5);                  // 0x00500513; // addi a0, zero, 5
    code[idx++] = clc_128(cs0, csp, 0);               // 0x0001240F; // clc cs0, 0(csp)
    code[idx++] = clc_128(cra, csp, 16);              // 0x0101208F; // clc cra, 16(csp)
    code[idx++] = cincoffsetimm(csp, csp, 32);        // 0x0201115B; // cincoffset csp, csp, 32
    code[idx++] = cjalr(zero, cra);                   // 0xFEC0805B; // cret

    /*
     * Very important.
     * The flags of the pointer that is used to call a function are then transferred to the pcc
     * register. This is important when executing because:
     * https://github.com/CTSRD-CHERI/sail-cheri-riscv/blob/8253bffe30abf2a8ae1c7eba515061b141aff727/src/cheri_addr_checks.sail#L109
     * The pcc register is used to determine the mode of operation.
     * Is it in capability mode or hybrid mode.
     * When in hybrid mode the capabilities of some registers are ignored.
     * This means that the ddc (default data capability) is being used.
     * When in capability mode the capability of the corresponding capability register is used.
     * For example, if you try to access a0 that would use the capability inside of ca0
     */
    return cheri_setflags(code, 0x0001);
}

/*
 * This hybrid function works because the DDC can be set to the stack pointer and used as a
 * reference. This works because when we are in hybrid mode the DDC's address is used as a base. We
 * have the DDC set to be the stack pointer. This allows storing values on the stack though `csc
 * cra, 16(zero)`. The calculateion is done like this: `ddc.address + zero_value + 16`. Therefore
 * cnull can be used in place of the stack pointer in the case of this example.
 */
uint32_t *generate_hybrid(uint32_t *code)
{
    uint32_t idx = 0;

    if (cheri_getlength(code) <= (10 * sizeof(uint32_t)))
    {
        error("Insufficient size");
        exit(-1);
    }

    code[idx++] = cincoffsetimm(csp, csp, ((-32) + (2 << 20)));
    code[idx++] = cspecialrw(cnull, csp, 1); // cspecialw csp, ddc
    code[idx++] = csc_128(zero, cra, 16);
    code[idx++] = csc_128(zero, cs0, 0);
    code[idx++] = cincoffset(cs0, csp, 32);
    code[idx++] = addi(a0, zero, 5);
    code[idx++] = clc_128(cs0, zero, 0);
    code[idx++] = clc_128(cra, zero, 16);
    code[idx++] = cincoffsetimm(csp, csp, 32);
    code[idx++] = cjalr(zero, cra);
    return code;
}

uint32_t *generate_micro(uint32_t *code)
{
    uint32_t idx = 0;

    if (cheri_getlength(code) <= (2 * sizeof(uint32_t)))
    {
        error("Insufficient size");
        exit(-1);
    }
    code[idx++] = addi(a0, zero, 5);
    code[idx++] = cjalr(zero, cra);
    return code;
}

int main()
{
    uint32_t *code;
    code = get_executable_block();
    code = generate_purecap(code);

    pp_cap(cheri_getpcc());
    pp_cap(code);

    int (*code_function)() = (int (*)()) code;
    int result = code_function();
    printf("Result: %d\n\n", result);
    return result;
}