From 25c0333213452dedf3224ed13d1ea9f91b40445e Mon Sep 17 00:00:00 2001 From: Jonathan Behrens Date: Tue, 28 May 2019 18:29:36 -0400 Subject: [PATCH] target/riscv: Do not allow sfence.vma from user mode The 'sfence.vma' instruction is privileged, and should only ever be allowed when executing in supervisor mode or higher. Backports commit b86f4167630802128d94f3c89043d97d2f4c2546 from qemu --- qemu/target/riscv/op_helper.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/qemu/target/riscv/op_helper.c b/qemu/target/riscv/op_helper.c index 05466adf..568d36d6 100644 --- a/qemu/target/riscv/op_helper.c +++ b/qemu/target/riscv/op_helper.c @@ -144,9 +144,10 @@ void helper_tlb_flush(CPURISCVState *env) { RISCVCPU *cpu = riscv_env_get_cpu(env); CPUState *cs = CPU(cpu); - if (env->priv == PRV_S && - env->priv_ver >= PRIV_VERSION_1_10_0 && - get_field(env->mstatus, MSTATUS_TVM)) { + if (!(env->priv >= PRV_S) || + (env->priv == PRV_S && + env->priv_ver >= PRIV_VERSION_1_10_0 && + get_field(env->mstatus, MSTATUS_TVM))) { riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC()); } else { tlb_flush(cs);