Zicfiss clarifications: CBO and PM (#1657)

src/priv-cfi.adoc

@@ -214,8 +214,10 @@ instruction will result in a store/AMO access-fault exception.
 
 Memory mapped as an SS page cannot be written to by instructions other than
 `SSAMOSWAP.W/D`, `SSPUSH`, and `C.SSPUSH`. Attempts will raise a store/AMO
-access-fault exception. Implicit accesses, including instruction fetches to an SS
-page, are not permitted. Such accesses will raise an access-fault exception
+access-fault exception. Access to a SS page using _cache-block operation_
+(`CBO.*`) instructions is not permitted. Such accesses will raise a store/AMO
+access-fault exception. Implicit accesses, including instruction fetches to an
+SS page, are not permitted. Such accesses will raise an access-fault exception
 appropriate to the access type. However, the shadow stack is readable by all
 instructions that only load from memory.
 

src/zpm.adoc

@@ -131,6 +131,7 @@ Pointer masking applies to all explicit memory accesses. Currently, in the Base
 * **Hypervisor Extension**: HLV.\*, HSV.* (in some cases; see <<_ssnpm>>).
 * **Cache Management Operations**: All instructions in Zicbom, Zicbop and Zicboz.
 * **Vector Extension**: All vector load and store instructions in the ratified RVV 1.0 spec.
+* **Zicfiss Extension**: SSPUSH, C.SSPUSH, SSPOPCHK, C.SSPOPCHK, SSAMOSWAP.W/D.
 * **Assorted**: FENCE, FENCE.I (if the currently unused address fields become enabled in the future).
 
 [NOTE]