[PATCH] lib: sbi: expected trap must always clear MPRV

[Anup Patel]

On Tue, Nov 25, 2025 at 3:33 AM Deepak Gupta <debug at rivosinc.com> wrote:
>
> Expected trap must always clear MPRV. Currently it doesn't. There is a
> security issue here where if firmware was doing ld/st with MPRV=1 and
> since there would be a expected trap, opensbi will continue to run as
> MPRV=1. Security impact is DoS where opensbi will just keep trapping.
>
> Signed-off-by: Deepak Gupta <debug at rivosinc.com>
> ---
>  lib/sbi/sbi_expected_trap.S | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/lib/sbi/sbi_expected_trap.S b/lib/sbi/sbi_expected_trap.S
> index 99dede5f..8fbd2cb2 100644
> --- a/lib/sbi/sbi_expected_trap.S
> +++ b/lib/sbi/sbi_expected_trap.S
> @@ -23,6 +23,8 @@
>         .global __sbi_expected_trap
>  __sbi_expected_trap:
>         /* Without H-extension so, MTVAL2 and MTINST CSRs and GVA not available */
> +       lui     a4, 0x20 /* MSTATUS_MPRV */

This should be "li a4, MSTATUS_MPRV". I will take care
of it at the time of merging this patch.

> +       csrc    CSR_MSTATUS, a4
>         csrr    a4, CSR_MCAUSE
>         REG_S   a4, SBI_TRAP_INFO_OFFSET(cause)(a3)
>         csrr    a4, CSR_MTVAL
> @@ -39,6 +41,8 @@ __sbi_expected_trap:
>         .global __sbi_expected_trap_hext
>  __sbi_expected_trap_hext:
>         /* With H-extension so, MTVAL2 and MTINST CSRs and GVA available */
> +       lui     a4, 0x20 /* MSTATUS_MPRV */

Same comment as above.

> +       csrc    CSR_MSTATUS, a4
>         csrr    a4, CSR_MCAUSE
>         REG_S   a4, SBI_TRAP_INFO_OFFSET(cause)(a3)
>         csrr    a4, CSR_MTVAL
> --
> 2.43.0
>
>
> --
> opensbi mailing list
> opensbi at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi

Reviewed-by: Anup Patel <anup at brainfault.org>

Applied this patch to the riscv/opensbi repo.

Thanks,
Anup