target/riscv: clear mseccfg on reset for all dependent extensions
Currently, the `mseccfg` CSR is only cleared to 0 during reset if the `ext_smepmp` is enabled. However, this register is now shared by several other extensions such as `zkr`, `smmpm`, and `zicfilp`. Fix by clearing `mseccfg` if any dependent extension is present, and adjusting the relevant comments. This vulnerability was discovered and reported by SpecHunter, an AI-driven architecture specification analysis tool. Link: https://github.com/yizishun/rv-isa-sec/blob/master/output/riscv-svvptc/pr-134/qemu.txt Signed-off-by: Zishun Yi <vulab@iscas.ac.cn> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Message-ID: <20260512052240.330815-1-vulab@iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Zishun Yi committed
May 12, 2026 at 13:22 UTC
8158a74f0a0db8626d7836eb03eca7aba46c18b5
1 file changed
+7
-3
target/riscv/cpu.c
+7
-3
@@ -756,10 +756,14 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
756
757
/*
758
* Clear mseccfg and unlock all the PMP entries upon reset.
759
- * This is allowed as per the priv and smepmp specifications
760
- * and is needed to clear stale entries across reboots.
759
+ * This is required as per the priv, smepmp, and other security
760
+ * extension specifications that share this CSR, and is needed
761
+ * to clear stale entries across reboots.
762
*/
762
- if (riscv_cpu_cfg(env)->ext_smepmp) {
763
+ if (riscv_cpu_cfg(env)->ext_smepmp ||
764
+ riscv_cpu_cfg(env)->ext_zkr ||
765
+ riscv_cpu_cfg(env)->ext_smmpm ||
766
+ riscv_cpu_cfg(env)->ext_zicfilp) {
767
env->mseccfg = 0;
768
}
769