feat(build): add RISC-V ZCMP post-link workaround check

Validate linked RISC-V executables when
CONFIG_COMPILER_ENABLE_RISCV_ZCMP is enabled on affected chips.
Disassemble each function and reject mstatus.MIE clears that lack an
earlier mintthresh write of 0xff.

Handle csrrci, csrrw, and register-mask csrrc patterns while ignoring
csrrs. Add build-only coverage for valid and invalid sequences with
CMake v1 and v2.

Stop the hardware stack guard before switching stacks during restart,
and keep ZCMP disabled for TEE test apps that still require the
workaround.

components/esp_hal_security/test_apps/tee/main/CMakeLists.txt

@@ -7,11 +7,3 @@ idf_component_register(SRCS "${srcs}"
                        INCLUDE_DIRS ""
                        PRIV_REQUIRES pms_and_cpu_intr esp_psram esp_hal_security
                        WHOLE_ARCHIVE)
-
-# TODO: IDF-14145
-if(CONFIG_IDF_TARGET_ESP32C5 OR CONFIG_IDF_TARGET_ESP32C61)
-    # Disable zcmp extension to avoid hardware issue with interrupts (DIG-661)
-    set(march_option "-march=rv32imac_zicsr_zifencei_zaamo_zalrsc")
-    idf_build_set_property(COMPILE_OPTIONS "${march_option}" APPEND)
-    idf_build_set_property(LINK_OPTIONS "${march_option}" APPEND)
-endif()

components/esp_hal_security/test_apps/tee/sdkconfig.defaults.esp32c5

@@ -5,3 +5,6 @@ CONFIG_ESP_SYSTEM_ALLOW_RTC_FAST_MEM_AS_HEAP=n
 
 # Enable SPIRAM
 CONFIG_SPIRAM=y
+
+# TODO: IDF-14145
+CONFIG_COMPILER_ENABLE_RISCV_ZCMP=n

components/esp_hal_security/test_apps/tee/sdkconfig.defaults.esp32c61

@@ -1,2 +1,5 @@
 # Enable SPIRAM
 CONFIG_SPIRAM=y
+
+# TODO: IDF-14145
+CONFIG_COMPILER_ENABLE_RISCV_ZCMP=n