Changes to isa-manual files for https://github.com/riscv/riscv-cheri/commit/3673a10dbbeed6bd4acfdc34dfc1119c291d9189

riscv-cheri.diff

diff --git a/src/.asciidoctorconfig.adoc b/src/.asciidoctorconfig.adoc
new file mode 100644
index 00000000..9a5b643c
--- /dev/null
+++ b/src/.asciidoctorconfig.adoc
@@ -0,0 +1,2 @@
+:cheri_v9_annotations: 1
+include::{asciidoctorconfigdir}/cheri/attributes-standalone.adoc[]
diff --git a/src/a-st-ext.adoc b/src/a-st-ext.adoc
index 100f004d..0b9d6711 100644
--- a/src/a-st-ext.adoc
+++ b/src/a-st-ext.adoc
@@ -359,6 +359,17 @@ guarantee is sufficient to implement the C11 and C++11 languages, and is
 substantially easier to provide in some microarchitectural styles.
 ====
 
+[#zalrsc_cheri]
+=== "Zalrsc" for {cheri_base_ext_name}
+
+If the base architecture is {cheri_base_ext_name}, then additional LR/SC encodings (<<LOAD_RES_CAP>>  and <<STORE_COND_CAP>>) are available in <<rvy_zalrsc_insn_table,Zalrsc>> to access capability types in memory.
+
+Additionally smaller datatype LR/SC encodings are available in the {lr_sc_bh_ext_name} extension, see <<abhlrsc_ext>>.
+If {cheri_base_ext_name} and Zalrsc are implemented, then {lr_sc_bh_ext_name} must also be implemented.
+
+include::cheri/insns/load_res_cap_32bit.adoc[]
+include::cheri/insns/store_cond_cap_32bit.adoc[]
+
 [[sec:amo]]
 === "Zaamo" Extension for Atomic Memory Operations
 
@@ -483,3 +494,20 @@ load may impose ordering constraints that are unnecessary for this use case.
 Specific compilation conventions may require both the _aq_ and _rl_
 bits to be set in either or both the LR and AMOSWAP instructions.
 ====
+
+[#zaamo_cheri]
+=== "Zaamo" for {cheri_base_ext_name}
+
+If the base architecture is {cheri_base_ext_name}, then Zaamo provides an additional AMOSWAP encoding (<<AMOSWAP_CAP>>) to access capability types in memory.
+
+All atomic operations follow the rules in xref:section_cheri_int_load_store_insns[xrefstyle=short],
+where the atomic operation is considered to be a load followed by a store for the
+capability rules.
+
+Therefore, _all_ atomic operations are _reserved_ if `{cs1}={creg}0`.
+
+NOTE: Other atomic operation types are not yet available as they require capability
+arithmetic to be performed.
+ For example, AMOADD would need <<CADD>> functionality.
+
+include::cheri/insns/amoswap_32bit_cap.adoc[]
diff --git a/src/b-st-ext.adoc b/src/b-st-ext.adoc
index 99f332fb..b8c735fd 100644
--- a/src/b-st-ext.adoc
+++ b/src/b-st-ext.adoc
@@ -501,6 +501,14 @@ The following instructions comprise the Zba extension:
 
 |===
 
+[#zba_cheri,reftext="Address generation instructions ({cheri_base_ext_name})]
+==== Zba: Address generation ({cheri_base_ext_name})
+
+If the base architecture is {cheri_base_ext_name}, then new shift-and-add instructions to update capability types are available.
+Additionally, when XLEN=64, a new {sh4add_cheri} instruction and the corresponding `.uw` instructions are available.
+
+NOTE: There is no {cheri_base_ext_name} equivalent for `add.uw` as only having the integer version is sufficient.
+
 [#zbb,reftext="Basic bit-manipulation"]
 ==== Zbb: Basic bit-manipulation
 
@@ -3319,6 +3327,11 @@ Included in::
 |Ratified
 |===
 
+<<<
+include::cheri/insns/sh1234add_32bit.adoc[]
+<<<
+include::cheri/insns/sh1234add_uw_32bit.adoc[]
+
 <<<
 [#insns-slli_uw,reftext="Shift-left unsigned word (Immediate)"]
 ==== slli.uw
diff --git a/src/c-st-ext.adoc b/src/c-st-ext.adoc
index 5fd72c1c..744d0b53 100644
--- a/src/c-st-ext.adoc
+++ b/src/c-st-ext.adoc
@@ -293,6 +293,9 @@ pointer, `x2`, as the base address and can target any data register. The
 other can reference one of 8 base address registers and one of 8 data
 registers.
 
+If the base architecture is {cheri_base_ext_name}, then the address operand
+always refers to the YLEN-bit capability version of the register.
+
 ==== Stack-Pointer-Based Loads and Stores
 
 include::images/wavedrom/c-sp-load-store.edn[]
@@ -325,6 +328,13 @@ register _rd_. It computes its effective address by adding the
 _zero_-extended offset, scaled by 8, to the stack pointer, `x2`. It
 expands to `fld rd, offset(x2)`.
 
+<<C_LOAD_CAP_SP>> is an {cheri_base_ext_name}-only instruction that loads a
+capability from memory into capability
+register _{cd}_. It computes its effective address by adding the
+_zero_-extended offset, scaled by 8 (for {cheri_base32_ext_name}),
+or 16 (for {cheri_base64_ext_name}) to the capability stack pointer, `{creg}2`. It
+expands to `{load_cap_name_lc} {creg_ref}d, offset({creg}2)`.
+
 include::images/wavedrom/c-sp-load-store-css.edn[]
 [[c-sp-load-store-css]]
 //.Stack-Pointer-Based Loads and Stores--these instructions use the CSS format.
@@ -352,6 +362,13 @@ to memory. It computes an effective address by adding the
 _zero_-extended offset, scaled by 8, to the stack pointer, `x2`. It
 expands to `fsd rs2, offset(x2)`.
 
+<<C_STORE_CAP_SP>> is an {cheri_base_ext_name}-only instruction that stores a
+capability in capability register _{cs2}_
+to memory. It computes an effective address by adding the
+_zero_-extended offset, scaled by 8 (for {cheri_base32_ext_name}),
+or 16 (for {cheri_base64_ext_name}), to the stack pointer, `{creg}2`. It
+expands to `{store_cap_name_lc} {cs2}, offset({creg}2)`.
+
 [NOTE]
 ====
 Register save/restore code at function entry/exit represents a
@@ -426,6 +443,14 @@ _zero_-extended offset, scaled by 8, to the base address in register
 `_rs1′_`. It expands to
 `fld rd′, offset(rs1′)`.
 
+<<C_LOAD_CAP>> is an {cheri_base_ext_name} only instruction that loads a
+capability from memory into register `_{cd}′_`
+It computes an effective address by adding the
+_zero_-extended offset, scaled by 8 ({cheri_base32_ext_name})
+or 16 ({cheri_base64_ext_name}),
+to the base address in register `_{cs1}′_`. It expands to
+`{c_load_cap_lc} {cd}′, offset({cs1}′)`.
+
 [[c-cs-format-ls]]
 include::images/wavedrom/c-cs-format-ls.edn[]
 //.Compressed, CS format load and store--these instructions use the CS format.
@@ -458,6 +483,31 @@ adding the _zero_-extended offset, scaled by 8, to the base address in
 register `_rs1′_`. It expands to
 `fsd rs2′, offset(rs1′)`.
 
+<<C_STORE_CAP>> is an {cheri_base_ext_name} only instruction that stores a
+capability in register `_{cs2}′_` to memory.
+It computes an effective address by adding the
+_zero_-extended offset, scaled by 8 ({cheri_base32_ext_name})
+or 16 ({cheri_base64_ext_name}),
+to the base address in register `_{cs1}′_`. It expands to
+`{c_store_cap_lc} {cs2}′, offset({cs1}′)`
+
+==== Compressed Load and Store summary
+
+<<insn_remapping_16bit_rv32_a>> and <<insn_remapping_16bit_rv32_b>> summarize
+load/store encoding mappings for RV32 architectures.
+
+==== RV32I / {cheri_base32_ext_name}
+
+include::cheri/rv32c_mapping_table.adoc[]
+
+<<<
+==== RV64I / {cheri_base64_ext_name}
+
+<<insn_remapping_16bit_rv64_a>> and <<insn_remapping_16bit_rv64_b>> summarize
+load/store encoding mappings for RV64 architectures.
+
+include::cheri/rv64c_mapping_table.adoc[]
+
 === Control Transfer Instructions
 
 RVC provides unconditional jump instructions and conditional branch
@@ -489,14 +539,15 @@ include::images/wavedrom/c-cr-format-ls.edn[]
 These instructions use the CR format.
 
 C.JR (jump register) performs an unconditional control transfer to the
-address in register _rs1_. C.JR expands to `jalr x0, 0(rs1)`. C.JR is
-valid only when _rs1_≠`x0`; the code
+address in register _rs1_. C.JR expands to `jalr x0, 0(rs1)`.
+C.JR is valid only when _rs1_≠`x0`; the code
 point with _rs1_=`x0` is reserved.
 
 C.JALR (jump and link register) performs the same operation as C.JR, but
 additionally writes the address of the instruction following the jump
-(`pc`+2) to the link register, `x1`. C.JALR expands to
-`jalr x1, 0(rs1)`. C.JALR is valid only when
+(`pc`+2) to the link register, `x1/{creg}1`. C.JALR expands to
+`jalr x1, 0(rs1)`.
+C.JALR is valid only when
 _rs1_≠`x0`; the code point with
 _rs1_=`x0` corresponds to the C.EBREAK
 instruction.
@@ -591,6 +642,9 @@ adjust the stack pointer in procedure prologues and epilogues. It
 expands into `addi x2, x2, nzimm[9:4]`. C.ADDI16SP is valid only when
 _nzimm_≠0; the code point with _nzimm_=0 is reserved.
 
+For {cheri_base_ext_name}, <<C_ADDI16SP_CAP>> adds the scaled immediate to `{creg}2`
+(the capability stack pointer), and the expansion is `<<CADDI,{caddi_lc}>>, {creg}2, {creg}2, nzim[9:4]`.
+
 [NOTE]
 ====
 In the standard RISC-V calling convention, the stack pointer `sp` is
@@ -610,6 +664,9 @@ pointers to stack-allocated variables, and expands to
 _nzuimm_≠0; the code points with _nzuimm_=0 are
 reserved.
 
+For {cheri_base_ext_name}, <<C_ADDI4SPN_CAP>> adds the scaled immediate to `{creg}2`
+(the capability stack pointer), and the expansion is `<<CADDI,{caddi_lc}>> cd′, c2, nzuimm[9:2]`.
+
 [[c-ci]]
 include::images/wavedrom/c-ci.edn[]
 //.CI format.
@@ -620,7 +677,8 @@ the value in register _rd_ then writes the result to _rd_. The shift
 amount is encoded in the _shamt_ field.
 C.SLLI expands into `slli rd, rd, shamt[5:0]`.
 
-The C.SLLI code points with _shamt_=0 or with _rd_=`x0` are HINTs.
+The C.SLLI code points with _shamt_=0 or with _rd_=`x0` are HINTs if the
+base architecture is _not_ {cheri_base_ext_name}.
 
 For RV32C, _shamt[5]_ must be zero; the code points with _shamt[5]_=1
 are designated for custom extensions.
@@ -636,8 +694,6 @@ the value in register _rd′_ then writes the result to
 _rd′_. The shift amount is encoded in the _shamt_ field.
 C.SRLI expands into `srli rd′, rd′, shamt`.
 
-The C.SRLI code points with _shamt_=0 are HINTs.
-
 For RV32C, _shamt[5]_ must be zero; the code points with _shamt[5]_=1
 are designated for custom extensions.
 
@@ -645,6 +701,9 @@ C.SRAI is defined analogously to C.SRLI, but instead performs an
 arithmetic right shift. C.SRAI expands to
 `srai rd′, rd′, shamt`.
 
+The C.SRLI and C.SRAI code points with _shamt_=0 are HINTs if the
+base architecture is _not_ {cheri_base_ext_name}.
+
 [NOTE]
 ====
 Left shifts are usually more frequent than right shifts, as left shifts
@@ -683,6 +742,9 @@ convenient to expand C.MV to MV instead of ADD, at slight additional
 hardware cost._
 ====
 
+For {cheri_base_ext_name} <<C_MV_CAP>> copies a whole capability register.
+The expansion is `<<CMV,{cmv_lc}>> {cd}, {cs2}`.
+
 C.ADD adds the values in registers _rd_ and _rs2_ and writes the result
 to register _rd_. C.ADD expands into `add rd, rd, rs2`. C.ADD is only
 valid when _rs2_≠`x0`; the code points with _rs2_=`x0` correspond to the C.JALR
diff --git a/src/cmo.adoc b/src/cmo.adoc
index 01c692f8..e3f6e2e7 100644
--- a/src/cmo.adoc
+++ b/src/cmo.adoc
@@ -1124,3 +1124,29 @@ _An implementation may opt to cache a copy of the cache block in a cache
 accessed by a data write in order to improve memory access latency, but this
 behavior is not required._
 ====
+
+=== CMOs with {cheri_base_ext_name}
+
+When the base architecture is {cheri_base_ext_name}, all CBO and prefetch instructions are authorized by the capability in `{cs1}`.
+
+In common with load, stores and prefetches, the encodings are _reserved_ if `{cs1}={creg}0`.
+
+For CBO instructions, the entire cache block must in bounds for the access to be authorized.
+
+For prefetches, at least one byte of the cache block must be in bounds for the prefetch to be actioned.
+
+When CBO.ZERO clears the cache block, it must also clear the associated {ctag}s.
+
+include::cheri/insns/cbo.clean.adoc[]
+include::cheri/insns/cbo.flush.adoc[]
+include::cheri/insns/cbo.inval.adoc[]
+
+<<<
+
+include::cheri/insns/cbo.zero.adoc[]
+
+<<<
+
+include::cheri/insns/prefetch.i.adoc[]
+include::cheri/insns/prefetch.r.adoc[]
+include::cheri/insns/prefetch.w.adoc[]
diff --git a/src/hypervisor.adoc b/src/hypervisor.adoc
index 4cc73013..fdfaf1f6 100644
--- a/src/hypervisor.adoc
+++ b/src/hypervisor.adoc
@@ -1138,6 +1138,7 @@ When bit 2 of `hideleg` is zero, `vsip`.SSIP and `vsie`.SSIE are
 read-only zeros. Else, `vsip`.SSIP and `vsie`.SSIE are aliases of
 `hip`.VSSIP and `hie`.VSSIE.
 
+[#vstvec,reftext="vstvec"]
 ==== Virtual Supervisor Trap Vector Base Address (`vstvec`) Register
 
 The `vstvec` register is a VSXLEN-bit read/write register that is
@@ -1151,6 +1152,7 @@ affect the behavior of the machine.
 .Virtual supervisor trap vector base address register `vstvec`.
 include::images/bytefield/vstvecreg.edn[]
 
+[#vsscratch,reftext="vsscratch"]
 ==== Virtual Supervisor Scratch (`vsscratch`) Register
 
 The `vsscratch` register is a VSXLEN-bit read/write register that is
@@ -1164,6 +1166,7 @@ of `vsscratch` never directly affect the behavior of the machine.
 .Virtual supervisor scratch register `vsscratch`.
 include::images/bytefield/vsscratchreg.edn[]
 
+[#vsepc,reftext="vsepc"]
 ==== Virtual Supervisor Exception Program Counter (`vsepc`) Register
 
 The `vsepc` register is a VSXLEN-bit read/write register that is
@@ -1959,6 +1962,11 @@ _Designated for platform use_
 0 +
 0 +
 0 +
+0 +
+0 +
+0 +
+0 +
+0 +
 |0 +
 1 +
 2 +
@@ -1984,7 +1992,12 @@ _Designated for platform use_
 22 +
 23 +
 24-31 +
-32-47 +
+{cheri_excep_cause_pc} +
+{cheri_excep_cause_ld} +
+{cheri_excep_cause_st} +
+{cheri_excep_cause_pte_ld} +
+{cheri_excep_cause_pte_st} +
+37-47 +
 48-63 +
 &#8805;64
 |Instruction address misaligned +
@@ -2012,6 +2025,11 @@ Load guest-page fault +
 Virtual instruction +
 Store/AMO guest-page fault +
 _Designated for custom use_ +
+{cheri_excep_name_pc} +
+{cheri_excep_name_ld} +
+{cheri_excep_name_st} +
+{cheri_excep_name_pte_ld} +
+{cheri_excep_name_pte_st} +
 _Reserved_ +
 _Designated for custom use_ +
 _Reserved_
@@ -2597,3 +2615,10 @@ SIE=SPIE, and SPIE=1, and lastly sets `pc`=`vsepc`.
 If the Ssdbltrp extension is implemented, when `SRET` is executed in HS-mode,
 if the new privilege mode is VU, the `SRET` instruction sets `vsstatus.SDT`
 to 0. When executed in VS-mode, `vsstatus.SDT` is set to 0.
+
+=== "H" Extension for {cheri_base_ext_name}
+
+An {cheri_base_ext_name} core which supports the "H" extension also support the <<HLV_CAP>>
+and <<HSV_CAP>> instructions in {rvy_h_ext_name}.
+
+While HLVX.* only requires execute permission in the PTE, the authorizing CHERI capability must grant <<r_perm>>.
diff --git a/src/machine.adoc b/src/machine.adoc
index 0181c148..57478b50 100644
--- a/src/machine.adoc
+++ b/src/machine.adoc
@@ -15,7 +15,7 @@ other details of the hardware implementation.
 In addition to the machine-level CSRs described in this section,
 [#norm:ext:Sm:access_all_lower_priv_CSRs]#M-mode code can access all CSRs at lower privilege levels.#
 
-[[misa]]
+[#misa, reftext="misa"]
 ==== Machine ISA (`misa`) Register
 
 [#norm:csr:misa:sw_rw]#The `misa` CSR is a *WARL* read-write register# reporting the ISA supported by the hart.
@@ -188,12 +188,17 @@ User mode implemented +
 Vector extension +
 _Reserved_ +
 Non-standard extensions present +
-_Reserved_ +
+{cheri_base_ext_name} +
 _Reserved_
 |===
 
 [#norm:csrfld:misa:x:set]#The "X" bit will be set if there are any non-standard extensions.#
 
+[#norm:csrfld:misa:y:set]#The "Y" bit will be set if the base architecture is {cheri_base_ext_name}.
+In this case "I" or "E" will also be set showing the number of X registers available.#
+
+NOTE: The {cheri_default_ext_name} extension makes the "Y" bit writable.
+
 [#norm:csrfld:misa:b:set]#When the "B" bit is 1, the implementation supports the instructions provided by the
 Zba, Zbb, and Zbs extensions.# When the "B" bit is 0, it indicates that the
 implementation might not support one or more of the Zba, Zbb, or Zbs extensions.
@@ -374,6 +379,7 @@ For efficiency, system implementers should aim to reduce the magnitude
 of the largest hart ID used in a system.
 ====
 
+[#mstatus,reftext="mstatus"]
 ==== Machine Status (`mstatus` and `mstatush`) Registers
 
 [#norm:csr:mstatus:sz_rw]#The `mstatus` register is an MXLEN-bit read/write register formatted as
@@ -665,6 +671,7 @@ The MXR and SUM mechanisms only affect the interpretation of permissions
 encoded in page-table entries. In particular, they have no impact on
 whether access-fault exceptions are raised due to PMAs or PMP.
 
+[[endianness-control]]
 ===== Endianness Control in `mstatus` and `mstatush` Registers
 
 The MBE, SBE, and UBE bits in `mstatus` and `mstatush` are *WARL* fields that
@@ -1177,6 +1184,7 @@ The Zicfilp extension adds the `SPELP` and `MPELP` fields that hold the previous
 * 0 - `NO_LP_EXPECTED` - no landing pad instruction expected.
 * 1 - `LP_EXPECTED` - a landing pad instruction is expected.
 
+[#mtvec,reftext="mtvec"]
 ==== Machine Trap-Vector Base-Address (`mtvec`) Register
 
 The `mtvec` register is an MXLEN-bit *WARL* read/write register that holds
@@ -1315,6 +1323,7 @@ will not be taken when executing in M-mode. By contrast, if `mideleg`[5]
 is clear, STIs can be taken in any mode and regardless of current mode
 will transfer control to M-mode.
 
+[#medeleg,reftext="medeleg"]
 .Machine Exception Delegation (`medeleg`) register.
 include::images/bytefield/medeleg.edn[]
 
@@ -1328,6 +1337,7 @@ When XLEN=32, `medelegh` is a 32-bit read/write register
 that aliases bits 63:32 of `medeleg`.
 The `medelegh` register does not exist when XLEN=64.
 
+[#mideleg,reftext="mideleg"]
 .Machine Interrupt Delegation (`mideleg`) Register.
 include::images/bytefield/mideleg.edn[]
 
@@ -1354,9 +1364,11 @@ bits 16 and above are designated for platform use.
 NOTE: Interrupts designated for platform use may be designated for custom use
 at the platform's discretion.
 
+[#mip,reftext="mip"]
 .Machine Interrupt-Pending (`mip`) register.
 include::images/bytefield/mideleg.edn[]
 
+[#mie,reftext="mie"]
 .Machine Interrupt-Enable (`mie`) register
 include::images/bytefield/mideleg.edn[]
 
@@ -1646,6 +1658,7 @@ Because the `mtime` counter can be shared between multiple cores, it
 cannot be inhibited with the `mcountinhibit` mechanism.
 ====
 
+[#mscratch,reftext="mscratch"]
 ==== Machine Scratch (`mscratch`) Register
 
 The `mscratch` register is an MXLEN-bit read/write register dedicated
@@ -1673,6 +1686,7 @@ design, the OS can rely on holding a value in the `mscratch` register
 while the user context is running.
 ====
 
+[#mepc,reftext="mepc"]
 ==== Machine Exception Program Counter (`mepc`) Register
 
 `mepc` is an MXLEN-bit read/write register formatted as shown in
@@ -1709,7 +1723,7 @@ though it may be explicitly written by software.
 .Machine exception program counter register.
 include::images/bytefield/mepcreg.edn[]
 
-[[mcause]]
+[#mcause,reftext="mcause"]
 ==== Machine Cause (`mcause`) Register
 
 The `mcause` register is an MXLEN-bit read-write register formatted as
@@ -1834,6 +1848,11 @@ _Designated for platform use_
 0 +
 0 +
 0 +
+0 +
+0 +
+0 +
+0 +
+0 +
 0
 |0 +
 1 +
@@ -1857,7 +1876,12 @@ _Designated for platform use_
 19 +
 20-23 +
 24-31 +
-32-47 +
+{cheri_excep_cause_pc} +
+{cheri_excep_cause_ld} +
+{cheri_excep_cause_st} +
+{cheri_excep_cause_pte_ld} +
+{cheri_excep_cause_pte_st} +
+37-47 +
 48-63 +
 &#8805;64
 |Instruction address misaligned +
@@ -1882,9 +1906,14 @@ Software check +
 Hardware error +
 _Reserved_ +
 _Designated for custom use_ +
+{cheri_excep_name_pc} +
+{cheri_excep_name_ld} +
+{cheri_excep_name_st} +
+{cheri_excep_name_pte_ld} +
+{cheri_excep_name_pte_st} +
 _Reserved_ +
 _Designated for custom use_ +
-_Reserved_
+_Reserved_ +
 |===
 
 <<<
@@ -1978,6 +2007,7 @@ occurrence is generally expected to be recognized at the point in the overall
 priority order at which the hardware error is discovered.
 ====
 
+[#mtval,reftext="mtval"]
 ==== Machine Trap Value (`mtval`) Register
 
 The `mtval` register is an MXLEN-bit read-write register formatted as
@@ -2124,6 +2154,7 @@ M-mode software towards the beginning of the boot process.
 [[sec:menvcfg]]
 ====  Machine Environment Configuration (`menvcfg`) Register
 
+[[menvcfg,menvcfg]]
 The `menvcfg` CSR is a 64-bit read/write register, formatted
 as shown in <<menvcfgreg>>, that controls
 certain characteristics of the execution environment for modes less
@@ -2213,6 +2244,8 @@ The definition of the CBZE field is furnished by the Zicboz extension.
 
 The definitions of the CBCFE and CBIE fields are furnished by the Zicbom extension.
 
+If the base architecture is {cheri_base_ext_name} then the {CRE} field is read-only 1, otherwise it's read-only 0. The <<section_cheri_disable,{cheri_priv_m_reg_enable_ext}>> extension makes it writable.
+
 The definition of the PMM field is furnished by the Smnpm extension.
 
 The Zicfilp extension adds the `LPE` field in `menvcfg`. When the `LPE` field is
@@ -2249,12 +2282,13 @@ The `menvcfgh` register does not exist when XLEN=64.
 If U-mode is not supported, then registers `menvcfg` and `menvcfgh` do
 not exist.
 
+[#mseccfg,reftext="mseccfg"]
 ==== Machine Security Configuration (`mseccfg`) Register
 
 `mseccfg` is an optional 64-bit read/write register, formatted as
 shown in <<mseccfg>>, that controls security features.
 
-[[mseccfg]]
+[[mseccfgreg]]
 .Machine security configuration (`mseccfg`) register.
 include::images/wavedrom/mseccfg.edn[]
 
@@ -2755,7 +2789,7 @@ and writes of that width. Main memory and I/O regions may only support a
 subset or none of the processor-supported atomic operations.
 
 .Classes of AMOs supported by I/O regions.
-[i%autowidth,float="center",align="center",cols="<,<",options="header"]
+[%autowidth,float="center",align="center",cols="<,<",options="header"]
 |===
 |AMO Class |Supported Operations
 |AMONone +
diff --git a/src/priv-csrs.adoc b/src/priv-csrs.adoc
index 3fe8daf5..99b13da6 100644
--- a/src/priv-csrs.adoc
+++ b/src/priv-csrs.adoc
@@ -260,6 +260,25 @@ Upper 32 bits of `hpmcounter3`, RV32 only. +
 Upper 32 bits of `hpmcounter4`, RV32 only. +
 &#160; +
 Upper 32 bits of `hpmcounter31`, RV32 only.
+
+4+^|#Unprivileged {cheri_default_ext_name} YLEN CSRs#
+|`0x416` +
+|URW +
+|`ddc` +
+|#Default Data Capability (<<asr_perm>> not required).# +
+
+4+^|#Unprivileged {cheri_base_ext_name} YLEN CSRs#
+|`0x480` +
+|URW +
+|`utidc` +
+|#User thread ID capability (<<asr_perm>> required for writes, not reads).# +
+
+4+^|#Unprivileged {cheri_base_ext_name} XLEN CSRs#
+|#To be allocated# +
+|URO +
+|`uycfg` +
+|#CHERI Capability Encoding CSR# +
+
 |===
 
 <<<
@@ -408,6 +427,18 @@ Upper 32 bits of `stimecmp`, RV32 only.
  Supervisor Control Transfer Records Status Register. +
  Supervisor Control Transfer Records Depth Register.
 
+4+^|#Supervisor {cheri_base_ext_name} YLEN CSRs#
+|`0x580` +
+|SRW +
+|`stidc` +
+|#Supervisor thread ID capability (<<asr_perm>> required for writes, not reads).# +
+
+4+^|#Supervisor {cheri_base_ext_name} XLEN CSRs#
+|#To be allocated# +
+|SRW +
+|`sycfg` +
+|#CHERI Capability Encoding CSR# +
+
 |===
 
 <<<
@@ -622,6 +653,18 @@ Upper 32 bits of `vstimecmp`, RV32 only.
 |`vsctrctl`
 |Virtual Supervisor Control Transfer Records Control Register.
 
+4+^|#Virtual Supervisor {cheri_base_ext_name} YLEN CSRs#
+|`0xA80` +
+|HRW +
+|`vstidc` +
+|#Virtual supervisor thread ID capability (<<asr_perm>> required for writes, not reads).# +
+
+4+^|#Virtual supervisor {cheri_base_ext_name} XLEN CSRs#
+|#To be allocated# +
+|HRW +
+|`vsycfg` +
+|#CHERI Capability Encoding CSR# +
+
 |===
 
 <<<
@@ -998,6 +1041,18 @@ Upper 32 bits of `mhpmevent31`, RV32 only.
 |`mctrctl`
 |Machine Control Transfer Records Control Register.
 
+4+^|#Machine {cheri_base_ext_name} YLEN CSRs#
+|`0x780` +
+|MRW +
+|`mtidc` +
+|#Machine thread ID capability (<<asr_perm>> required for writes, not reads).# +
+
+4+^|#Machine {cheri_base_ext_name} XLEN CSRs#
+|#To be allocated# +
+|MRW +
+|`mycfg` +
+|#CHERI Capability Encoding CSR# +
+
 4+^|Debug/Trace Registers (shared with Debug Mode)
 
 |`0x7A0` +
@@ -1039,7 +1094,26 @@ DRW +
 |Debug control and status register. +
 Debug program counter. +
 Debug scratch register 0. +
-Debug scratch register 1.
+Debug scratch register 1. +
+
+4+^|#Debug Mode {cheri_base_ext_name} added XLEN CSRs#
+|`0x7BA`
+|DRW
+|`drootcsel`
+|#Debug Root Capability Multiplexing Selector.# +
+
+4+^|#Debug Mode {cheri_base_ext_name} added YLEN CSRs#
+|`0x7BD`
+|DRW
+|`drootc`
+|#Debug Root Capability.# +
+
+4+^|#Debug Mode {cheri_default_ext_name} added YLEN CSRs#
+|`0x7BC`
+|DRW
+|`dddc`
+|#Debug Default Data Capability.# +
+
 |===
 
 [[indcsrs-m]]
diff --git a/src/riscv-cheri-standalone.adoc b/src/riscv-cheri-standalone.adoc
new file mode 100644
index 00000000..65b4ba8b
--- /dev/null
+++ b/src/riscv-cheri-standalone.adoc
@@ -0,0 +1 @@
+include::cheri/riscv-cheri.adoc[]
diff --git a/src/riscv-privileged.adoc b/src/riscv-privileged.adoc
index 78bdedfa..56140a01 100644
--- a/src/riscv-privileged.adoc
+++ b/src/riscv-privileged.adoc
@@ -72,6 +72,7 @@ privileged specification version 1.9.1 released under following license: ©2010-
 Avižienis,
 David Patterson, Krste Asanović. Creative Commons Attribution 4.0 International License._
 
+include::cheri/attributes.adoc[]
 include::priv-preface.adoc[]
 include::priv-intro.adoc[]
 include::priv-csrs.adoc[]
@@ -85,12 +86,18 @@ include::smcdeleg.adoc[]
 include::smdbltrp.adoc[]
 include::smctr.adoc[]
 include::supervisor.adoc[]
+include::cheri/riscv-priv-integration.adoc[]
+include::cheri/cheri-pte-ext.adoc[]
 include::sstc.adoc[]
 include::sscofpmf.adoc[]
 include::hypervisor.adoc[]
+include::cheri/hypervisor-integration.adoc[]
 include::priv-cfi.adoc[]
 include::ssdbltrp.adoc[]
 include::zpm.adoc[]
+include::cheri/ptrmask-integration.adoc[]
+include::cheri/debug-integration.adoc[]
+include::cheri/trigger-integration.adoc[]
 include::priv-insns.adoc[]
 include::priv-history.adoc[]
 include::bibliography.adoc[]
diff --git a/src/riscv-unprivileged.adoc b/src/riscv-unprivileged.adoc
index 8047aedd..92920cb0 100644
--- a/src/riscv-unprivileged.adoc
+++ b/src/riscv-unprivileged.adoc
@@ -152,6 +152,7 @@ Please cite as: “The RISC-V Instruction Set Manual, Volume I: User-Level ISA,
 Version 20191214-draft”, Editors Andrew Waterman and Krste Asanović, RISC-V Foundation,
 December 2019._
 
+include::cheri/attributes.adoc[]
 //the colophon allows for a section after the preamble that is part of the frontmatter and therefore not assigned a page number.
 include::colophon.adoc[]
 
@@ -161,19 +162,28 @@ include::rv32e.adoc[]
 include::rv64.adoc[]
 include::zifencei.adoc[]
 include::zicsr.adoc[]
+include::cheri/riscv-unpriv-integration.adoc[]
+include::cheri/zylevels1.adoc[]
+// Reduce the build time to only include the base spec+CHERI changes
+ifndef::minimal_cheri_changes_doc[]
 include::counters.adoc[]
 include::zihintntl.adoc[]
 include::zihintpause.adoc[]
 include::zimop.adoc[]
 include::zicond.adoc[]
 include::m-st-ext.adoc[]
+endif::[]
 include::a-st-ext.adoc[]
 include::zawrs.adoc[]
 include::zacas.adoc[]
 include::zabha.adoc[]
+include::cheri/zabhlrsc.adoc[]
+ifndef::minimal_cheri_changes_doc[]
 include::rvwmo.adoc[]
 include::ztso-st-ext.adoc[]
+endif::[]
 include::cmo.adoc[]
+ifndef::minimal_cheri_changes_doc[]
 include::f-st-ext.adoc[]
 include::d-st-ext.adoc[]
 include::q-st-ext.adoc[]
@@ -181,7 +191,9 @@ include::zfh.adoc[]
 include::bfloat16.adoc[]
 include::zfa.adoc[]
 include::zfinx.adoc[]
+endif::[]
 include::c-st-ext.adoc[]
+ifndef::minimal_cheri_changes_doc[]
 include::zc.adoc[]
 include::b-st-ext.adoc[]
 include::v-st-ext.adoc[]
@@ -189,6 +201,9 @@ include::scalar-crypto.adoc[]
 include::vector-crypto.adoc[]
 include::unpriv-cfi.adoc[]
 include::zilsd.adoc[]
+endif::[]
+include::cheri/riscv-hybrid-integration.adoc[]
+ifndef::minimal_cheri_changes_doc[]
 include::rv-32-64g.adoc[]
 include::naming.adoc[]
 include::mm-eplan.adoc[]
@@ -199,7 +214,12 @@ include::vector-examples.adoc[]
 include::calling-convention.adoc[]
 //include::fraclmul.adoc[]
 //End of Vector appendices
+endif::[]
 
+// CHERI appendices
+include::cheri/app-cap-description.adoc[]
+include::cheri/app-cheri-instructions.adoc[]
+// End of CHERI appendices
 include::index.adoc[]
 // this is generated generated from index markers.
 include::bibliography.adoc[]
diff --git a/src/rv32.adoc b/src/rv32.adoc
index 022195e3..57f92050 100644
--- a/src/rv32.adoc
+++ b/src/rv32.adoc
@@ -418,6 +418,7 @@ register-register ADD or logical/shift operations require additional
 hardware.
 ====
 
+[[ct-insns]]
 === Control Transfer Instructions
 RV32I provides two types of control transfer instructions: unconditional
 jumps and conditional branches.
diff --git a/src/smstateen.adoc b/src/smstateen.adoc
index 81a503df..ff413b18 100644
--- a/src/smstateen.adoc
+++ b/src/smstateen.adoc
@@ -181,7 +181,8 @@ read-only).
 {bits: 1, name: 'C'},
 {bits: 1, name: 'FCSR'},
 {bits: 1, name: 'JVT'},
-{bits: 51, name: 'WPRI'},
+{bits: 1, name: 'TIDC'},
+{bits: 50, name: 'WPRI'},
 {bits: 1, name: 'CTR'},
 {bits: 1, name: 'SRMCFG'},
 {bits: 1, name: 'P1P13'},
@@ -202,7 +203,8 @@ read-only).
 {bits: 1, name: 'C'},
 {bits: 1, name: 'FCSR'},
 {bits: 1, name: 'JVT'},
-{bits: 51, name: 'WPRI'},
+{bits: 1, name: 'TIDC'},
+{bits: 50, name: 'WPRI'},
 {bits: 1, name: 'CTR'},
 {bits: 2, name: 'WPRI'},
 {bits: 1, name: 'CONTEXT'},
@@ -222,7 +224,8 @@ read-only).
 {bits: 1, name: 'C'},
 {bits: 1, name: 'FCSR'},
 {bits: 1, name: 'JVT'},
-{bits: 29, name: 'WPRI'}
+{bits: 1, name: 'TIDC'},
+{bits: 28, name: 'WPRI'}
 ], config:{bits: 32, lanes: 2, hspace:1024}}
 ....
 
@@ -252,6 +255,8 @@ whether they really do.
 
 The JVT bit controls access to the `jvt` CSR provided by the Zcmt extension.
 
+The TID bit controls access to the TIDC registers.
+
 The SE0 bit in `mstateen0` controls access to the `hstateen0`, `hstateen0h`,
 and the `sstateen0` CSRs. The SE0 bit in `hstateen0` controls access to the
 `sstateen0` CSR.
diff --git a/src/supervisor.adoc b/src/supervisor.adoc
index 5e1a4986..4727cd45 100644
--- a/src/supervisor.adoc
+++ b/src/supervisor.adoc
@@ -297,7 +297,8 @@ Additionally, the implementation of an SSE protocol can be considered as an
 optional measure to aid in the recovery from such critical errors.
 ====
 
-==== Supervisor Trap Vector Base Address (`stvec`)  Register
+[#stvec,reftext="stvec"]
+==== Supervisor Trap Vector Base Address (`stvec`) Register
 
 The `stvec` register is an SXLEN-bit read/write register that holds trap
 vector configuration, consisting of a vector base address (BASE) and a
@@ -488,6 +489,7 @@ access a counter if the corresponding bits in `scounteren` and
 `mcounteren` are both set.
 ====
 
+[#sscratch, reftext="sscratch"]
 ==== Supervisor Scratch (`sscratch`) Register
 
 The `sscratch` CSR is an SXLEN-bit read/write register, dedicated
@@ -501,6 +503,7 @@ initial working register.
 .Supervisor Scratch Register
 include::images/bytefield/sscratch.edn[]
 
+[#sepc,reftext="sepc"]
 ==== Supervisor Exception Program Counter (`sepc`) Register
 
 `sepc` is an SXLEN-bit read/write CSR formatted as shown in
@@ -527,7 +530,7 @@ though it may be explicitly written by software.
 .Supervisor exception program counter register.
 include::images/bytefield/epcreg.edn[]
 
-[[scause]]
+[#scause,reftext="scause"]
 ==== Supervisor Cause (`scause`) Register
 
 The `scause` CSR is an SXLEN-bit read-write register formatted as
@@ -549,7 +552,7 @@ guaranteed to hold supported exception codes.
 include::images/bytefield/scausereg.edn[]
 
 [[scauses]]
-.Supervisor cause (`scause`) register values after trap. Synchronous exception priorities are given by <<exception-priority>>.
+.Supervisor cause (`scause`) register values after trap. Synchronous exception priorities are given by <<exception-priority>>. #Causes added in {cheri_base_ext_name} are in *bold*#
 [%autowidth,float="center",align="center",cols=">,>,3",options="header"]
 |===
 |Interrupt |Exception Code |Description
@@ -606,6 +609,11 @@ _Designated for platform use_
 0 +
 0 +
 0 +
+0 +
+0 +
+0 +
+0 +
+0 +
 0
 |0 +
 1 +
@@ -627,7 +635,12 @@ _Designated for platform use_
 19 +
 20-23 +
 24-31 +
-32-47 +
+{cheri_excep_cause_pc} +
+{cheri_excep_cause_ld} +
+{cheri_excep_cause_st} +
+{cheri_excep_cause_pte_ld} +
+{cheri_excep_cause_pte_st} +
+37-47 +
 48-63 +
 &#8805;64
 |Instruction address misaligned +
@@ -650,11 +663,17 @@ Software check +
 Hardware error +
 _Reserved_ +
 _Designated for custom use_ +
+{cheri_excep_name_pc} +
+{cheri_excep_name_ld} +
+{cheri_excep_name_st} +
+{cheri_excep_name_pte_ld} +
+{cheri_excep_name_pte_st} +
 _Reserved_ +
 _Designated for custom use_ +
-_Reserved_
+_Reserved_ +
 |===
 
+[#stval,reftext="stval"]
 ==== Supervisor Trap Value (`stval`) Register
 
 The `stval` CSR is an SXLEN-bit read-write register formatted as
@@ -724,16 +743,16 @@ instruction bits is implemented, `stval` must also be able to hold all
 values less than latexmath:[$2^N$], where latexmath:[$N$] is the smaller
 of SXLEN and ILEN.
 
-[[sec:senvcfg]]
-==== Supervisor Environment Configuration (`senvcfg`) Register
+[#senvcfg,reftext="senvcfg"]
+==== [[sec:senvcfg]] Supervisor Environment Configuration (`senvcfg`) Register
 
 The `senvcfg` CSR is an SXLEN-bit read/write register, formatted as
 shown in <<senvcfg>>, that controls certain
 characteristics of the U-mode execution environment.
 
-[[senvcfg]]
+[[senvcfgreg]]
 .Supervisor environment configuration register (`senvcfg`) for RV64.
-[wavedrom, ,svg]
+[wavedrom, ,svg,subs=attributes+]
 ....
 {reg: [
   {bits:  1, name: 'FIOM'},
@@ -743,14 +762,16 @@ characteristics of the U-mode execution environment.
   {bits:  2, name: 'CBIE'},
   {bits:  1, name: 'CBCFE'},
   {bits:  1, name: 'CBZE'},
-  {bits: 24, name: 'WPRI'},
+  {bits: 20, name: 'WPRI'},
+  {bits:  1, name: '{CRE}'},
+  {bits:  3, name: 'WPRI'},
   {bits:  2, name: 'PMM'},
   {bits: 30, name: 'WPRI'},
 ], config:{lanes: 4, hspace:1024}}
 ....
 
 .Supervisor environment configuration register (`senvcfg`) for RV32.
-[wavedrom, ,svg]
+[wavedrom, ,svg,subs=attributes+]
 ....
 {reg: [
   {bits:  1, name: 'FIOM'},
@@ -760,7 +781,9 @@ characteristics of the U-mode execution environment.
   {bits:  2, name: 'CBIE'},
   {bits:  1, name: 'CBCFE'},
   {bits:  1, name: 'CBZE'},
-  {bits: 24, name: 'WPRI'},
+  {bits: 20, name: 'WPRI'},
+  {bits:  1, name: '{CRE}'},
+  {bits:  3, name: 'WPRI'},
 ], config:{lanes: 2, hspace:1024}}
 ....
 
@@ -834,6 +857,8 @@ The definition of the CBZE field is furnished by the Zicboz extension.
 The definitions of the CBCFE and CBIE fields are furnished by the Zicbom
 extension.
 
+If the base architecture is {cheri_base_ext_name} then the {CRE} field is read-only 1, otherwise it's read-only 0. The <<section_cheri_disable,{cheri_priv_m_reg_enable_ext}>> extension makes it writable.
+
 The definition of the PMM field is furnished by the Ssnpm extension.
 
 The Zicfilp extension adds the `LPE` field in `senvcfg`. When the `LPE` field is
@@ -1751,11 +1776,15 @@ forward compatibility, or else a page-fault exception is raised. Bits
 62-61 are reserved for use by the Svpbmt extension in
 <<svpbmt>>. If Svpbmt is not implemented, bits 62-61 remain
 reserved and must be zeroed by software for forward compatibility, or
-else a page-fault exception is raised. Bits 60-54 are reserved for
+else a page-fault exception is raised.
+#The CRW bit is reserved for {cheri_priv_vmem_ext}.#
+#If {cheri_priv_vmem_ext} is not implemented, the CRW bit remains reserved and must be zeroed by software for forward compatibility, or else a page-fault exception is raised.#
+Bits #59-54# are reserved for
 future standard use and, until their use is defined by some standard
 extension, must be zeroed by software for forward compatibility. If any
 of these bits are set, a page-fault exception is raised.
 
+
 [NOTE]
 ====
 We reserved several PTE bits for a possible extension that improves
diff --git a/src/v-st-ext.adoc b/src/v-st-ext.adoc
index d5312b44..afa8e2ea 100644
--- a/src/v-st-ext.adoc
+++ b/src/v-st-ext.adoc
@@ -5321,6 +5321,8 @@ element-level masking, or might define the concept of a _mask element group_
 (which might, e.g., update the destination element group if any mask bit in
 the mask element group is set).
 
+include::cheri/vector-integration.adoc[]
+
 === Vector Instruction Listing
 
 include::images/wavedrom/v-inst-table.edn[]
diff --git a/src/zabha.adoc b/src/zabha.adoc
index a8029089..406b8952 100644
--- a/src/zabha.adoc
+++ b/src/zabha.adoc
@@ -64,5 +64,5 @@ and `rl` bits, to help implement multiprocessor synchronization.
 
 [NOTE]
 ====
-Zabha omits _byte_ and _halfword_ support for `LR` and `SC` due to low utility.
+_Byte_ and _halfword_ support for `LR` and `SC` is added by Zabhlrsc.
 ====
diff --git a/src/zc.adoc b/src/zc.adoc
index ccf30e52..af3261fd 100644
--- a/src/zc.adoc
+++ b/src/zc.adoc
@@ -2336,6 +2336,7 @@ Table jump allows the linker to replace the following instruction sequences with
 
 If a return address stack is implemented, then as _cm.jalt_ is equivalent to _jal ra_, it pushes to the stack.
 
+[#jvt,reftext="jvt"]
 ==== jvt
 
 The base of the table is in the jvt CSR (see <<csrs-jvt>>), each table entry is XLEN bits.