OVP Forums - A community of assistance, help, questions, and answers.
  FAQFAQ    SearchSearch      RegisterRegister  ProfileProfile    Log in to check your private messagesLog in to check your private messages    Log inLog in
PMP fetch exception

 
Post new topic   Reply to topic    Open Virtual Platforms Forum Index -> Ask a Question
View previous topic :: View next topic  
Author Message
JonathanJonsson



Joined: 04 Jul 2022
Posts: 5
Location: Gothenburg

PostPosted: Fri Aug 19, 2022 12:55 am    Post subject: PMP fetch exception Reply with quote

Hi!

I have come across an issue regarding PMP which I haven't been able to explain.
The issue is an instruction fetch fault which I think shouldn't happen. My PMP setup is the following. All (TOR) addresses should fulfill the requirement pmpaddr[g-1:0] == 0 set by the specification. The address I'm trying to access is 0x28f0 and this is where the "No access permission for fetch" occurs. The prior address 0x28ee works just fine.

Quote:

pmp_granularity = 1
Info pmpcfg0 0000000000000000 -> 0f0f0f0f0f0f0f0c
Info pmpaddr0 0000000000000000 -> 0000000000000a3c
Info pmpaddr1 0000000000000000 -> 000000000022eace
Info pmpaddr2 0000000000000000 -> 000000000045cb60
Info pmpaddr3 0000000000000000 -> 000000000068abf2
Info pmpaddr4 0000000000000000 -> 00000000008b8c86
Info pmpaddr5 0000000000000000 -> 0000000000ae6d18
Info pmpaddr6 0000000000000000 -> 0000000000d14daa
Info pmpaddr7 0000000000000000 -> 0000000000f42e3c


Quote:

Info 22389: 'riscvOVPsim/cpu', 0x00000000000028f0(test_done+2): User *** FETCH EXCEPTION ***
Warning (RISCV_IMA) CPU 'riscvOVPsim/cpu' 0x000028f0 00000073 ecall: No access permission for fetch (0x28f0)
Info mstatus 0000000a00040080 -> 0000000a00040000
Info mepc 00000000000002ac -> 00000000000028f0
Info mcause 0000000000000000 -> 0000000000000001
Info mtval 0000000000000000 -> 00000000000028f0


Since the fetch address is aligned and all PMP entries are TOR and have execute permissions I don't understand how this can happen. From my understanding of PMP it should be possible to perform instruction fetches all the way to pmpaddr7. I tried two things that seems to "solve" the issue, if I move pmpaddr0 forward 4-bytes the access is allowed. If I change pmp_g to 0 it also works. I haven't been able to find an explanation to this, but my guess is that an unintentional overlap happens between the access and the regions and thus no match occurs.

From my understanding of the specification this is what should happen:
I should "hit" the region set by pmpaddr0 -> pmpaddr1 since TOR matches addresses pmpaddr(i-1) <= addr < pmpaddr(i).
If I shift pmpaddr0 by two to get its full size I get:
pmpaddr0 << 2 = 0x28F0, thus we should not be in the first region set by 0 <= addr < 0x28f0. Maybe the check for the upper bound is implemented differently?

I'd be happy to supply any other information if required.
Back to top
View user's profile Send private message
JimStraus
OVP Technologist
OVP Technologist


Joined: 09 Dec 2008
Posts: 157

PostPosted: Mon Aug 22, 2022 7:00 am    Post subject: Reply with quote

Would it be possible to provide a test case in an email to support@imperas.com?

Please provide the elf file you are running, the riscvOVPsim command line you are using, and a complete log file from your run.

(You could try attaching a zip or tar file to the email, although we find these often are blocked by email servers, so a dropbox or googledrive link would be better.)

Thanks

Jim Straus
OVP support
Back to top
View user's profile Send private message
JimStraus
OVP Technologist
OVP Technologist


Joined: 09 Dec 2008
Posts: 157

PostPosted: Mon Aug 22, 2022 10:09 am    Post subject: Reply with quote

Hi Jonathan,

Thanks for sending the test files. I have recreated the problem in my environment and the following is my initial analysis of the problem, in order to make it clear to any other interested readers what the problem is precisely.

First, using the Imperas Professional Tools pmpquery command, (which reports the state of the PMP registers in human-readable format), I see you have configured the PMP registers as follows:

Code:
idebug (cpu0) > ::pmpquery
PMP Settings for 'iss/cpu0':
        pmp00cfg: 0x0000000000000000:0x00000000000028ef:   TOR priv=x-- lock=0
        pmp01cfg: 0x00000000000028f0:0x00000000008bab37:   TOR priv=xwr lock=0
        pmp02cfg: 0x00000000008bab38:0x0000000001172d7f:   TOR priv=xwr lock=0
        pmp03cfg: 0x0000000001172d80:0x0000000001a2afc7:   TOR priv=xwr lock=0
        pmp04cfg: 0x0000000001a2afc8:0x00000000022e3217:   TOR priv=xwr lock=0
        pmp05cfg: 0x00000000022e3218:0x0000000002b9b45f:   TOR priv=xwr lock=0
        pmp06cfg: 0x0000000002b9b460:0x00000000034536a7:   TOR priv=xwr lock=0
        pmp07cfg: 0x00000000034536a8:0x0000000003d0b8ef:   TOR priv=xwr lock=0


Next, using the objdump program in the riscv toolchain I see that the instructions at the location in question are:

Code:
00000000000028ee <test_done>:
    28ee:       4185                    li      gp,1
    28f0:       00000073                ecall


And the instruction trace when the problem occurs is:

Code:
Info 22386: 'iss/cpu0', 0x0000000000004092(main_j1+210): User 860a8a93 addi    s5,s5,-1952
Info   s5 000000000000308e -> 00000000000028ee
Info 22387: 'iss/cpu0', 0x0000000000004096(main_j1+214): User 000a8067 jr      s5
Info 22388: 'iss/cpu0', 0x00000000000028ee(test_done): User 4185     li      gp,1
Info   gp 3fffffffffffffff -> 0000000000000001
Info 22389: 'iss/cpu0', 0x00000000000028f0(test_done+2): User *** FETCH EXCEPTION ***
Warning (RISCV_IMA) CPU 'iss/cpu0' 0x000028f0 00000073 ecall: No access permission for fetch (0x28f0)


So the problem can be stated as:
1) The instruction at 0x28ee, which is at the end of the execute-only PMP00 region executes ok
2) The following instruction, which is at the beginning of the xwr PMP01 region throws a fetch access error

I will continue to investigate and let you know what I find.

Jim
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Open Virtual Platforms Forum Index -> Ask a Question All times are GMT - 8 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Information regarding OVP © 2008-2022 Imperas Software