[Stable-9.2.3,58/69] target/riscv: fix access permission checks for CSR_SSP

Commit Message

Michael Tokarev March 25, 2025, 6:50 a.m. UTC

From: Deepak Gupta <[e-mail]>

Commit:8205bc1 ("target/riscv: introduce ssp and enabling controls for
zicfiss") introduced CSR_SSP but it mis-interpreted the spec on access
to CSR_SSP in M-mode. Gated to CSR_SSP is not gated via `xSSE`. But
rather rules clearly specified in section "22.2.1. Shadow Stack Pointer
(ssp) CSR access contr" in the priv spec.

Fixes: 8205bc127a83 ("target/riscv: introduce ssp and enabling controls
for zicfiss". Thanks to Adam Zabrocki for bringing this to attention.

Reported-by: Adam Zabrocki <[e-mail]>
Signed-off-by: Deepak Gupta <[e-mail]>
Reviewed-by: Alistair Francis <[e-mail]>
Message-ID: <[e-mail]>
Signed-off-by: Alistair Francis <[e-mail]>
(cherry picked from commit 86c78b280607fcff787866a03374047c65037a90)
Signed-off-by: Michael Tokarev <[e-mail]>

Patch

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 9846770820..c2e39c91b6 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -190,6 +190,11 @@  static RISCVException cfi_ss(CPURISCVState *env, int csrno)
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
+    /* If ext implemented, M-mode always have access to SSP CSR */
+    if (env->priv == PRV_M) {
+        return RISCV_EXCP_NONE;
+    }
+
     /* if bcfi not active for current env, access to csr is illegal */
     if (!cpu_get_bcfien(env)) {
 #if !defined(CONFIG_USER_ONLY)