Gate SPR writes on SR[SM] for l.mtspr - #172
Open
lrfe wants to merge 3 commits into
Open
Conversation
spr_we and spr_bus_we_o were derived directly from spr_write_access, which a generic l.mtspr asserts regardless of privilege level. SR[SM] was only checked in the SR write path, leaving other SPRs and external SPR bus targets writable from user mode. Gate both write-enable signals with SR[SM] at their common source. Debug-unit writes remain independently authorized. Keep spr_write_access unchanged: it also drives the SPR bus strobe/ack handshake, and gating it would prevent unprivileged multi-cycle mtspr transactions from being acknowledged and stall the pipeline. Instead, an unprivileged mtspr completes as a bus no-op. Add a formal property ensuring that user-mode l.mtspr cannot assert spr_we or spr_bus_we_o.
spr_we and spr_bus_we_o were derived from spr_write_access without checking SR[SM]. The SR write path checked the bit itself, but ESR, EPCR, DMR1, DSR and DRR did not. Add spr_write_authorized and derive both write enables from it. Keep spr_write_access unchanged so the existing SPR bus strobe/ack path is not affected.
spr_we and spr_bus_we_o were derived from spr_write_access without checking SR[SM]. The SR write path checked the bit itself, but the other SPR write paths did not. Add spr_write_authorized and derive both write enables from it. Keep spr_write_access unchanged so the existing SPR bus strobe/ack path is not affected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
spr_we and spr_bus_we_o were derived directly from spr_write_access,
which a generic l.mtspr asserts regardless of privilege level. SR[SM]
was only checked in the SR write path, leaving other internal SPRs and
external SPR bus targets writable from user mode.
Introduce spr_write_authorized, gated on SR[SM] for l.mtspr and
independently on du_access for debug accesses, and derive spr_we and
spr_bus_we_o from it.
spr_write_access is left unchanged because it also drives the SPR bus
strobe/ack handshake. Gating it would prevent unprivileged multi-cycle
mtspr transactions from completing and stall the pipeline instead of
just suppressing the write.
Apply the same authorization check to cappuccino, espresso and
prontoespresso. Add a formal property to cappuccino asserting that
user-mode l.mtspr cannot assert spr_we or spr_bus_we_o.