[PATCH] lib: sbi: expected trap must always clear MPRV

From: Deepak Gupta <debug@rivosinc.com>
To: opensbi@lists.infradead.org
Cc: Deepak Gupta <debug@rivosinc.com>
Subject: [PATCH] lib: sbi: expected trap must always clear MPRV
Date: Mon, 24 Nov 2025 14:03:39 -0800	[thread overview]
Message-ID: <20251124220339.3695940-1-debug@rivosinc.com> (raw)

Expected trap must always clear MPRV. Currently it doesn't. There is a
security issue here where if firmware was doing ld/st with MPRV=1 and
since there would be a expected trap, opensbi will continue to run as
MPRV=1. Security impact is DoS where opensbi will just keep trapping.

Signed-off-by: Deepak Gupta <debug@rivosinc.com>
---
 lib/sbi/sbi_expected_trap.S | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/sbi/sbi_expected_trap.S b/lib/sbi/sbi_expected_trap.S
index 99dede5f..8fbd2cb2 100644
--- a/lib/sbi/sbi_expected_trap.S
+++ b/lib/sbi/sbi_expected_trap.S
@@ -23,6 +23,8 @@
 	.global __sbi_expected_trap
 __sbi_expected_trap:
 	/* Without H-extension so, MTVAL2 and MTINST CSRs and GVA not available */
+	lui	a4, 0x20 /* MSTATUS_MPRV */
+	csrc	CSR_MSTATUS, a4
 	csrr	a4, CSR_MCAUSE
 	REG_S	a4, SBI_TRAP_INFO_OFFSET(cause)(a3)
 	csrr	a4, CSR_MTVAL
@@ -39,6 +41,8 @@ __sbi_expected_trap:
 	.global __sbi_expected_trap_hext
 __sbi_expected_trap_hext:
 	/* With H-extension so, MTVAL2 and MTINST CSRs and GVA available */
+	lui	a4, 0x20 /* MSTATUS_MPRV */
+	csrc	CSR_MSTATUS, a4
 	csrr	a4, CSR_MCAUSE
 	REG_S	a4, SBI_TRAP_INFO_OFFSET(cause)(a3)
 	csrr	a4, CSR_MTVAL
-- 
2.43.0


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi
