[PATCH] target/riscv: enforce SSE precedence for ssp CSR access

[wangyang <wangyang25@otcaix.iscas.ac.cn>]

When menvcfg.SSE is clear, ssp access below M mode raises an
illegal-instruction exception before virtual-instruction classification.
Apply the henvcfg/senvcfg checks for VS/VU and preserve the user-only
path.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4226
Signed-off-by: wangyang <wangyang25@otcaix.iscas.ac.cn>
---
 target/riscv/tcg/csr.c | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
index 061bc9d..98dcb0e 100644
--- a/target/riscv/tcg/csr.c
+++ b/target/riscv/tcg/csr.c
@@ -204,15 +204,34 @@ static RISCVException cfi_ss(CPURISCVState *env, int csrno)
         return RISCV_EXCP_NONE;
     }
 
-    /* if bcfi not active for current env, access to csr is illegal */
-    if (!cpu_get_bcfien(env)) {
 #if !defined(CONFIG_USER_ONLY)
-        if (env->debugger) {
-            return RISCV_EXCP_NONE;
-        } else if (env->virt_enabled) {
+    if (env->debugger) {
+        return RISCV_EXCP_NONE;
+    }
+
+    /* priv < M and menvcfg.SSE = 0 must raise illegal-instruction */
+    if (!(env->menvcfg & MENVCFG_SSE)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    if (env->virt_enabled) {
+        if (env->priv == PRV_S) {
+            if (env->henvcfg & HENVCFG_SSE) {
+                return RISCV_EXCP_NONE;
+            }
+            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+        }
+        if (env->priv == PRV_U) {
+            if ((env->henvcfg & HENVCFG_SSE) &&
+                (env->senvcfg & SENVCFG_SSE)) {
+                return RISCV_EXCP_NONE;
+            }
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
+    }
 #endif
+
+    if (!cpu_get_bcfien(env)) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
-- 
2.43.0