tree b29680c2d9fe1032ef90c62f611e2b9a85308b99
parent 7ef24d911e4c2af34054edcef2d4588f0d5c98e5
author David Chisnall <github@theravensnest.org> 1716307558 +0100
committer David Chisnall <davidchisnall@users.noreply.github.com> 1716471059 +0100

Remove the exciting jump instruction from boot.S

This cjalr cra is in some code that is first hit after a cjal and so the
cjalr cra returns.  The caller then discards the value written back to
cra as the link operation in the jump-and-link instruction.  It is then
used as a call, with cra initialised to a jump address.

This was done as a code-size optimisation, but there's actually no need
to zero the registers at the start.  The code that runs with the
(possibly uninitialised) values in registers (most implementations will
zero in boot ROM or hardware anyway) all runs with access to the
primordial capabilities and so there is no way that this can possibly
leak information.

The first untrusted code runs after the *second* pass through this
block.

Simply removing this should shave 10 bytes off the loader without
affecting security.  More importantly, this is the *only* place where we
abuse cjalr in this way.  This abuse is incompatible with separating
sentries into forward and backward control-flow arcs (see
Microsoft/CHERIoT-Sail#54), which has a much bigger impact on security.