diff --git a/cfi_backward.adoc b/cfi_backward.adoc index 2cb905d..252308f 100644 --- a/cfi_backward.adoc +++ b/cfi_backward.adoc @@ -447,8 +447,8 @@ The `SSPOPCHK` and `C.SSPOPCHK` instructions require the virtual address in `ssp` to have a shadow stack attribute (see <>). Correct execution of `SSPOPCHK` and `C.SSPOPCHK` requires that `ssp` refers to idempotent memory. If the memory reference by `ssp` is not idempotent, then the instructions cause a -load access-fault exception. If the virtual address in `ssp` is not `XLEN` -aligned, then `SSPOPCHK` and `C.SSPOPCHK` instructions cause a load +store/AMO access-fault exception. If the virtual address in `ssp` is not `XLEN` +aligned, then `SSPOPCHK` and `C.SSPOPCHK` instructions cause a store/AMO access-fault exception [NOTE] @@ -493,7 +493,7 @@ endif If the value loaded from the address in `ssp` does not match the value in `rs1`, a software-check exception (cause=18) is raised with `__x__tval` set to "shadow stack fault (code=3)". The software-check exception caused by `SSPOPCHK`/ -`C.SSPOPCHK` is lower in priority than a load access-fault exception. +`C.SSPOPCHK` is lower in priority than a load/store/AMO access-fault exception. The `ssp` is incremented by `SSPOPCHK` and `C.SSPOPCHK` only if the load from the shadow stack completes successfully and no software-check exception is