diff --git a/sim/coverage b/sim/coverage new file mode 100755 index 000000000..038253911 --- /dev/null +++ b/sim/coverage @@ -0,0 +1,2 @@ +# recompile coverage tests and run coverage including them +pushd $WALLY/tests/coverage; make; popd; ./regression-wally -coverage diff --git a/sim/wave.do b/sim/wave.do index 587582a8e..62234f06b 100644 --- a/sim/wave.do +++ b/sim/wave.do @@ -65,14 +65,20 @@ add wave -noupdate -group {Execution Stage} /testbench/dut/core/ifu/PCE add wave -noupdate -group {Execution Stage} /testbench/dut/core/ifu/InstrE add wave -noupdate -group {Execution Stage} /testbench/InstrEName add wave -noupdate -group {Execution Stage} /testbench/dut/core/ieu/c/InstrValidE +add wave -noupdate -group {Execution Stage} /testbench/dut/core/ieu/dp/SrcAE +add wave -noupdate -group {Execution Stage} /testbench/dut/core/ieu/dp/SrcBE +add wave -noupdate -group {Execution Stage} /testbench/dut/core/ieu/dp/ALUResultE add wave -noupdate -expand -group {Memory Stage} /testbench/FunctionName/FunctionName/FunctionName add wave -noupdate -expand -group {Memory Stage} /testbench/dut/core/InstrValidM add wave -noupdate -expand -group {Memory Stage} /testbench/dut/core/PCM add wave -noupdate -expand -group {Memory Stage} /testbench/dut/core/InstrM add wave -noupdate -expand -group {Memory Stage} /testbench/InstrMName add wave -noupdate -expand -group {Memory Stage} /testbench/dut/core/lsu/IEUAdrM +add wave -noupdate -expand -group lsu /testbench/dut/core/lsu/ReadDataM +add wave -noupdate -expand -group lsu /testbench/dut/core/lsu/WriteDataM add wave -noupdate -group {WriteBack stage} /testbench/InstrW add wave -noupdate -group {WriteBack stage} /testbench/InstrWName +add wave -noupdate -group {Execution Stage} /testbench/dut/core/ieu/dp/ResultW add wave -noupdate -group CSRs /testbench/dut/core/priv/priv/csr/csrm/MCAUSE_REGW add wave -noupdate -group CSRs /testbench/dut/core/priv/priv/csr/MCOUNTEREN_REGW add wave -noupdate -group CSRs /testbench/dut/core/priv/priv/csr/MCOUNTINHIBIT_REGW diff --git a/src/cache/cachefsm.sv b/src/cache/cachefsm.sv index 124b92678..099077cf4 100644 --- a/src/cache/cachefsm.sv +++ b/src/cache/cachefsm.sv @@ -106,8 +106,7 @@ module cachefsm import cvw::*; #(parameter cvw_t P, assign FlushFlag = FlushAdrFlag & FlushWayFlag; // outputs for the performance counters. - assign CacheAccess = (|CacheRW) & ((CurrState == STATE_READY & ~Stall & ~FlushStage) | - (CurrState == STATE_READ_HOLD & ~Stall & ~FlushStage)); // exclusion-tag: icache CacheW + assign CacheAccess = (|CacheRW) & ((CurrState == STATE_READY & ~Stall & ~FlushStage) | (CurrState == STATE_READ_HOLD & ~Stall & ~FlushStage)); // exclusion-tag: icache CacheW assign CacheMiss = CacheAccess & ~CacheHit; // special case on reset. When the fsm first exists reset the @@ -172,9 +171,9 @@ module cachefsm import cvw::*; #(parameter cvw_t P, assign ClearValid = P.ZICBOM_SUPPORTED & ((CurrState == STATE_READY & CMOp[0] & CacheHit) | (CurrState == STATE_CMO_WRITEBACK & CMOp[2] & CacheBusAck)); // coverage off -item e 1 -fecexprrow 8 - assign LRUWriteEn = (CurrState == STATE_READY & (AnyHit | CMOZeroNoEviction)) | + assign LRUWriteEn = ((CurrState == STATE_READY & (AnyHit | CMOZeroNoEviction)) | (P.ZICBOZ_SUPPORTED & CurrState == STATE_WRITEBACK & CMOp[3] & CacheBusAck) | - (CurrState == STATE_WRITE_LINE) & ~FlushStage; + (CurrState == STATE_WRITE_LINE)) & ~FlushStage; // exclusion-tag-start: icache flushdirtycontrols assign SetDirty = (CurrState == STATE_READY & (AnyUpdateHit | CMOZeroNoEviction)) | // exclusion-tag: icache SetDirty (CurrState == STATE_WRITE_LINE & (CacheRW[0])) | diff --git a/src/ieu/controller.sv b/src/ieu/controller.sv index e923f1e3f..32fdba23e 100644 --- a/src/ieu/controller.sv +++ b/src/ieu/controller.sv @@ -182,7 +182,6 @@ module controller import cvw::*; #(parameter cvw_t P) ( ((P.ZICBOZ_SUPPORTED & InstrD[31:20] == 12'd4 & ENVCFG_CBE[3]) | (P.ZICBOM_SUPPORTED & ((InstrD[31:20] == 12'd0 & (ENVCFG_CBE[1:0] != 2'b00))) | (InstrD[31:20] == 12'd1 | InstrD[31:20] == 12'd2) & ENVCFG_CBE[2])); - // *** need to get with enable bits such as MENVCFG_CBZE assign AFunctD = (Funct3D == 3'b010) | (P.XLEN == 64 & Funct3D == 3'b011); assign AMOFunctD = (InstrD[31:27] == 5'b00001) | (InstrD[31:27] == 5'b00000) | diff --git a/src/mmu/pmachecker.sv b/src/mmu/pmachecker.sv index ce129af51..119e88d8c 100644 --- a/src/mmu/pmachecker.sv +++ b/src/mmu/pmachecker.sv @@ -57,13 +57,13 @@ module pmachecker import cvw::*; #(parameter cvw_t P) ( adrdecs #(P) adrdecs(PhysicalAddress, AccessRW, AccessRX, AccessRWX, Size, SelRegions); // Only non-core RAM/ROM memory regions are cacheable. PBMT can override cachable; NC and IO are uncachable - assign CacheableRegion = SelRegions[8] | SelRegions[7] | SelRegions[6]; - assign Cacheable = (PBMemoryType == 2'b00) ? CacheableRegion : 0; // exclusion-tag: unused-cachable + assign CacheableRegion = SelRegions[8] | SelRegions[7] | SelRegions[6]; // exclusion-tag: unused-cachable + assign Cacheable = (PBMemoryType == 2'b00) ? CacheableRegion : 0; // Nonidemdempotent means access could have side effect and must not be done speculatively or redundantly // I/O is nonidempotent. PBMT can override PMA; NC is idempotent and IO is non-idempotent - assign IdempotentRegion = SelRegions[10] | SelRegions[9] | SelRegions[8] | SelRegions[7] | SelRegions[6]; - assign Idempotent = (PBMemoryType == 2'b00) ? IdempotentRegion : (PBMemoryType == 2'b01); // exclusion-tag: unused-idempotent + assign IdempotentRegion = SelRegions[10] | SelRegions[9] | SelRegions[8] | SelRegions[7] | SelRegions[6]; // exclusion-tag: unused-idempotent + assign Idempotent = (PBMemoryType == 2'b00) ? IdempotentRegion : (PBMemoryType == 2'b01); // Atomic operations are only allowed on RAM assign AtomicAllowed = SelRegions[10] | SelRegions[8] | SelRegions[6]; // exclusion-tag: unused-atomic diff --git a/src/mmu/tlb/tlb.sv b/src/mmu/tlb/tlb.sv index 8910f7d53..9619c958d 100644 --- a/src/mmu/tlb/tlb.sv +++ b/src/mmu/tlb/tlb.sv @@ -110,7 +110,7 @@ module tlb import cvw::*; #(parameter cvw_t P, .TLBMiss, .TLBHit, .TLBPageFault, .UpdateDA, .SV39Mode, .Translate, .PTE_N, .PBMemoryType); - tlblru #(TLB_ENTRIES) lru(.clk, .reset, .TLBWrite, .TLBFlush, .Matches, .CAMHit, .WriteEnables); + tlblru #(TLB_ENTRIES) lru(.clk, .reset, .TLBWrite, .TLBFlush, .Matches, .TLBHit, .WriteEnables); tlbcam #(P, TLB_ENTRIES, P.VPN_BITS + P.ASID_BITS, P.VPN_SEGMENT_BITS) tlbcam(.clk, .reset, .VPN, .PageTypeWriteVal, .SV39Mode, .TLBFlush, .WriteEnables, .PTE_Gs, .PTE_NAPOTs, .SATP_ASID, .Matches, .HitPageType, .CAMHit); diff --git a/src/mmu/tlb/tlblru.sv b/src/mmu/tlb/tlblru.sv index 4cabb33ab..18014155a 100644 --- a/src/mmu/tlb/tlblru.sv +++ b/src/mmu/tlb/tlblru.sv @@ -32,7 +32,7 @@ module tlblru #(parameter TLB_ENTRIES = 8) ( input logic TLBWrite, input logic TLBFlush, input logic [TLB_ENTRIES-1:0] Matches, - input logic CAMHit, + input logic TLBHit, output logic [TLB_ENTRIES-1:0] WriteEnables ); @@ -50,5 +50,5 @@ module tlblru #(parameter TLB_ENTRIES = 8) ( assign RUBitsAccessed = AccessLines | RUBits; assign AllUsed = &RUBitsAccessed; // if all recently used, then clear to none assign RUBitsNext = AllUsed ? 0 : RUBitsAccessed; - flopenr #(TLB_ENTRIES) lrustate(clk, reset, (CAMHit | TLBWrite), RUBitsNext, RUBits); + flopenr #(TLB_ENTRIES) lrustate(clk, reset, (TLBHit | TLBWrite), RUBitsNext, RUBits); endmodule diff --git a/synthDC/Makefile b/synthDC/Makefile index 881abd406..57b478795 100755 --- a/synthDC/Makefile +++ b/synthDC/Makefile @@ -3,7 +3,6 @@ # Shreya Sanghai (ssanghai@hmc.edu) 2/28/2022 # Madeleine Masser-Frye (mmasserfrye@hmc.edu) 1/27/2023 NAME := synth - # defaults export DESIGN ?= wallypipelinedcore export FREQ ?= 10000 @@ -18,9 +17,12 @@ export TECH ?= sky90 export MAXCORES ?= 1 # MAXOPT turns on flattening, boundary optimization, and retiming # The output netlist is hard to interpret, but significantly better PPA +# WRAPPER turns on wrapper generation export MAXOPT ?= 0 export DRIVE ?= FLOP export USESRAM ?= 0 +export WRAPPER ?= 0 + time := $(shell date +%F-%H-%M) hash := $(shell git rev-parse --short HEAD) @@ -120,7 +122,9 @@ endif mkwrapper: +ifeq ($(WRAPPER),1) python3 $(WALLY)/synthDC/scripts/wrapperGen.py $(DESIGN) +endif mkdirecs: @echo "DC Synthesis" @mkdir -p $(OUTPUTDIR) @@ -150,4 +154,4 @@ clean: rm -f power.saif rm -f Synopsys_stack_trace_*.txt rm -f crte_*.txt - rm $(WALLY)/synthDC/wrappers/* + rm $(WALLY)/synthDC/wrappers/* \ No newline at end of file diff --git a/synthDC/scripts/synth.tcl b/synthDC/scripts/synth.tcl index bcf07902f..075bb5db9 100755 --- a/synthDC/scripts/synth.tcl +++ b/synthDC/scripts/synth.tcl @@ -16,6 +16,7 @@ suppress_message {VER-173} # Enable Multicore set_host_options -max_cores $::env(MAXCORES) + # get outputDir and configDir from environment (Makefile) set outputDir $::env(OUTPUTDIR) set cfg $::env(CONFIGDIR) @@ -23,13 +24,17 @@ set hdl_src "../src" set saifpower $::env(SAIFPOWER) set maxopt $::env(MAXOPT) set drive $::env(DRIVE) +set wrapper $::env(WRAPPER) eval file copy -force [glob ${cfg}/*.vh] {$outputDir/hdl/} eval file copy -force [glob ${hdl_src}/cvw.sv] {$outputDir/hdl/} #eval file copy -force [glob ${hdl_src}/../fpga/src/wallypipelinedsocwrapper.sv] {$outputDir/hdl/} eval file copy -force [glob ${hdl_src}/*/*.sv] {$outputDir/hdl/} eval file copy -force [glob ${hdl_src}/*/*/*.sv] {$outputDir/hdl/} -eval file copy -force [glob ${hdl_src}/../synthDC/wrappers/$::env(DESIGN)wrapper.sv] {$outputDir/hdl/} +if {$wrapper ==1 } { + eval file copy -force [glob ${hdl_src}/../synthDC/wrappers/$::env(DESIGN)wrapper.sv] {$outputDir/hdl/} +} + # Only for FMA class project; comment out when done # eval file copy -force [glob ${hdl_src}/fma/fma16.v] {hdl/} @@ -43,7 +48,11 @@ if { $saifpower == 1 } { set my_verilog_files [glob $outputDir/hdl/cvw.sv $outputDir/hdl/*.sv] # Set toplevel -set my_toplevel $::env(DESIGN)wrapper +if { $wrapper == 1 } { + set my_toplevel $::env(DESIGN)wrapper +} else { + set my_toplevel $::env(DESIGN) +} # Set number of significant digits set report_default_significant_digits 6 @@ -404,4 +413,4 @@ set t2 [clock seconds] set t [expr $t2 - $t1] echo [expr $t/60] -quit +quit \ No newline at end of file diff --git a/synthDC/scripts/wrapperGen.py b/synthDC/scripts/wrapperGen.py index d406dd6d3..aacdb0634 100755 --- a/synthDC/scripts/wrapperGen.py +++ b/synthDC/scripts/wrapperGen.py @@ -63,7 +63,7 @@ buf += f"\t{moduleName} #(P) dut(.*);\nendmodule" wrapperPath = f"{os.getenv('WALLY')}/synthDC/wrappers/{moduleName}wrapper.sv" # clear wrappers directory -os.system(f"rm {os.getenv('WALLY')}/src/wrappers/*") +os.system(f"rm {os.getenv('WALLY')}/synthDC/wrappers/*") fout = open(wrapperPath, "w") diff --git a/synthDC/wrappers/wallypipelinedcorewrapper.sv b/synthDC/wrappers/wallypipelinedcorewrapper.sv deleted file mode 100644 index 9b44d7377..000000000 --- a/synthDC/wrappers/wallypipelinedcorewrapper.sv +++ /dev/null @@ -1,24 +0,0 @@ -import cvw::*; -`include "config.vh" -`include "parameter-defs.vh" -module wallypipelinedcorewrapper ( - input logic clk, reset, - // Privileged - input logic MTimerInt, MExtInt, SExtInt, MSwInt, - input logic [63:0] MTIME_CLINT, - // Bus Interface - input logic [P.AHBW-1:0] HRDATA, - input logic HREADY, HRESP, - output logic HCLK, HRESETn, - output logic [P.PA_BITS-1:0] HADDR, - output logic [P.AHBW-1:0] HWDATA, - output logic [P.XLEN/8-1:0] HWSTRB, - output logic HWRITE, - output logic [2:0] HSIZE, - output logic [2:0] HBURST, - output logic [3:0] HPROT, - output logic [1:0] HTRANS, - output logic HMASTLOCK -); - wallypipelinedcore #(P) dut(.*); -endmodule \ No newline at end of file diff --git a/testbench/tests.vh b/testbench/tests.vh index 3229a6de7..8ba4ce8d1 100644 --- a/testbench/tests.vh +++ b/testbench/tests.vh @@ -44,6 +44,7 @@ string tvpaths[] = '{ string coverage64gc[] = '{ `COVERAGE, + "tlbNAPOT", "priv", "ieu", "ebu", diff --git a/tests/coverage/Makefile b/tests/coverage/Makefile index b2a2544d3..2f6002efc 100644 --- a/tests/coverage/Makefile +++ b/tests/coverage/Makefile @@ -17,7 +17,7 @@ all: $(OBJECTS) # Change many things if bit width isn't 64 %.elf: $(SRCDIR)/%.$(SEXT) WALLY-init-lib.h Makefile - riscv64-unknown-elf-gcc -g -o $@ -march=rv64gqc_zba_zbb_zbc_zbs_zfh -mabi=lp64 -mcmodel=medany \ + riscv64-unknown-elf-gcc -g -o $@ -march=rv64gqc_zba_zbb_zbc_zbs_zfh_zicboz_zicbop_zicbom -mabi=lp64 -mcmodel=medany \ -nostartfiles -T../../examples/link/link.ld $< riscv64-unknown-elf-objdump -S $@ > $@.objdump riscv64-unknown-elf-elf2hex --bit-width 64 --input $@ --output $@.memfile diff --git a/tests/coverage/WALLY-init-lib.h b/tests/coverage/WALLY-init-lib.h index b0f5a9654..55bfcf4e5 100644 --- a/tests/coverage/WALLY-init-lib.h +++ b/tests/coverage/WALLY-init-lib.h @@ -92,7 +92,10 @@ changeprivilege: trap_return: # return from trap handler csrr t0, mepc # get address of instruction that caused exception + li t1, 0x20000 + csrs mstatus, t1 # set mprv bit to fetch instruction with permission of code that trapped lh t0, 0(t0) # get instruction that caused exception + csrc mstatus, t1 # clear mprv bit to restore normal operation li t1, 3 and t0, t0, t1 # mask off upper bits beq t0, t1, instr32 # if lower 2 bits are 11, instruction is uncompresssed diff --git a/tests/coverage/ieu.S b/tests/coverage/ieu.S index cb0dae877..1e32a24ab 100644 --- a/tests/coverage/ieu.S +++ b/tests/coverage/ieu.S @@ -47,6 +47,13 @@ main: sc.w t0, a1, 0(a0) addi t0, t0, 1 + # test prefetch Hints (ori with destination x0) + ori x0, x0, 0 + ori x0, x0, 1 + ori x0, x0, 2 + ori x0, x0, 3 + + # Test illegal instructions are detected .word 0x80000033 // illegal R-type instruction .word 0x00007003 // illegal Load instruction @@ -66,6 +73,34 @@ main: .word 0x60F0101B // Illegal BMU similar to count word .word 0x6080101B // Illegal BMU similar to count word .word 0x6030101B // Illegal BMU similar to count word + .word 0x0000202F // Illegal similar to LR + .word 0x1010202F // Illegal similar to LR + .word 0x00402003 // illegal similar to CMO + .word 0x00202003 // illegal similar to CMO + .word 0xFF00302F // illegal Atomic instruction + .word 0xFF00402F // illegal Atomic instruction + .word 0x00000873 // illegal CSR instruction + + # Illegal CMO instructions because envcfg is 0 and system is in user Mode + li a0, 0 + ecall # switch to user mode + cbo.inval (x1) + cbo.clean (x1) + cbo.flush (x1) + cbo.zero (x1) + + li a0, 3 + ecall # switch back to machine mode + li x1, 0x50 + csrw menvcfg, x1 + csrw senvcfg, x1 + li a0, 0 + ecall # swtich to user mode + cbo.inval (x2) + cbo.clean (x3) + cbo.flush (x1) + + j done diff --git a/tests/coverage/tlbNAPOT.S b/tests/coverage/tlbNAPOT.S new file mode 100644 index 000000000..09dc2abcd --- /dev/null +++ b/tests/coverage/tlbNAPOT.S @@ -0,0 +1,393 @@ +/////////////////////////////////////////// +// tlbNAPOT.S +// +// Written: mmendozamanriquez@hmc.edu 4 April 2023 +// nlimpert@hmc.edu +// Adapted David_Harris@hmc.edu 8/29/23 to exercise NAPOT huge pages +// +// Purpose: Test coverage for LSU NAPOT +// +// A component of the CORE-V-WALLY configurable RISC-V project. +// +// Copyright (C) 2021-23 Harvey Mudd College & Oklahoma State University +// +// SPDX-License-Identifier: Apache-2.0 WITH SHL-2.1 +// +// Licensed under the Solderpad Hardware License v 2.1 (the “License”); you may not use this file +// except in compliance with the License, or, at your option, the Apache License version 2.0. You +// may obtain a copy of the License at +// +// https://solderpad.org/licenses/SHL-2.1/ +// +// Unless required by applicable law or agreed to in writing, any work distributed under the +// License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, +// either express or implied. See the License for the specific language governing permissions +// and limitations under the License. +//////////////////////////////////////////////////////////////////////////////////////////////// + +// load code to initalize stack, handle interrupts, terminate + +#include "WALLY-init-lib.h" + +# run-elf.bash find this in project description +main: + li t5, 0x1 + slli t5, t5, 62 + csrs menvcfg, t5 + # Page table root address at 0x80010000; SV48 + li t5, 0x9000000000080010 + csrw satp, t5 + + # sfence.vma x0, x0 + + # switch to supervisor mode + li a0, 1 + ecall + + li t4, 0x200000 # address step size + li a2, 0x80215240 # Test NAPOT pages + jal a1, looptest + li a2, 0xC0215240 # Test ill-formed NAPOT pages + jal a1, looptest + li a2, 0x40215240 # Test properly formed pages with 1 in PPN[3] that are not NAPOT + jal a1, looptest +# li t4, 0x1000 # address step size +# li a2, 0x80216000 # Test NAPOT pages +# jal a1, looptest + j done + +looptest: + mv t0, a2 # base address + li t2, 0 # i = 0 + li t3, 35 # Max amount of Loops = 34 + li t5, 0x8082 # return instruction opcode + +loop: bge t2, t3, looptesti # exit loop if i >= loops + sw t5, 0(t0) # store a return at this address to exercise DTLB + lw t1, 0(t0) # read it back + fence.i # synchronize with I$ + jalr ra, t0 # jump to the return statement to exercise the ITLB + add t0, t0, t4 + addi t2, t2, 1 + j loop + +looptesti: + mv t0, a2 # base address + li t2, 0 # i = 0 + fence.i # synchronize with I$ + +# Exercise itlb by jumping to each of the return statements +loopi: bge t2, t3, finished # exit loop if i >= loops + jalr ra, t0 # jump to the return statement to exercise the ITLB + add t0, t0, t4 + addi t2, t2, 1 + j loopi + +finished: + jr a1 + +.data + +.align 16 +# root Page table situated at 0x80010000 +pagetable: + .8byte 0x200044C1 // old page table was 200040 which just pointed to itself! wrong + +# next page table at 0x80011000 +.align 12 + .8byte 0x0000000000000000 # gigapage at 0x00000000 + .8byte 0x00000000200058C1 # gigapage at 0x40000000 used for non-NAPOT with PPN bit 3 set + .8byte 0x00000000200048C1 # gigapage at 0x80000000 used for testing NAPOT huge pages + .8byte 0x00000000200050C1 # gigapage at 0xC0000000 mapped to ill-formed NAPOT with wrong PPN + + +# Next page table at 0x80012000 for gigapage at 0x80000000 +.align 12 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + +# Leaf page table at 0x80013000 with NAPOT pages +.align 12 + #80000000 + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + + .8byte 0x800000002000E0CF + .8byte 0x800000002000E0CF + .8byte 0x800000002000E0CF + .8byte 0x800000002000E0CF + + .8byte 0x800000002000E0CF + .8byte 0x800000002000E0CF + +# Next page table at 0x80014000: mega-sized, pointing to malformed NAPOT for gigapage at 0xC9000000 +.align 12 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + .8byte 0x00000000200054C1 + +# Leaf page table at 0x80015000 with malformed NAPOT pages (wrong PPN) starting at 0xC0000000 +.align 12 + #80000000 + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + .8byte 0x80000000200000CF + + +# Next page table at 0x80016000: mega-sized, pointing to properly formed PTE with 1 in PPN bit 3 for gigapage at 0x40000000 +.align 12 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + .8byte 0x0000000020005CC1 + +# Leaf page table at 0x80017000 with properly formed PTE with bit 4 of PPN set but no NAPOT +.align 12 + #80000000 + .8byte 0x00000000200020CF + .8byte 0x00000000200060CF + .8byte 0x000000002000A0CF + .8byte 0x000000002000E0CF + + .8byte 0x00000000200020CF + .8byte 0x00000000200060CF + .8byte 0x000000002000A0CF + .8byte 0x000000002000E0CF + + .8byte 0x00000000200020CF + .8byte 0x00000000200060CF + .8byte 0x000000002000A0CF + .8byte 0x000000002000E0CF + + .8byte 0x00000000200020CF + .8byte 0x00000000200060CF + .8byte 0x000000002000A0CF + .8byte 0x000000002000E0CF + + .8byte 0x00000000200020CF + .8byte 0x00000000200060CF + .8byte 0x000000002000A0CF + .8byte 0x000000002000E0CF + + .8byte 0x00000000200020CF + .8byte 0x00000000200060CF + .8byte 0x000000002000A0CF + .8byte 0x000000002000E0CF + + .8byte 0x00000000200020CF + .8byte 0x00000000200060CF + .8byte 0x000000002000A0CF + .8byte 0x000000002000E0CF + + .8byte 0x00000000200020CF + .8byte 0x00000000200060CF + .8byte 0x000000002000A0CF + .8byte 0x000000002000E0CF + + .8byte 0x00000000200020CF + .8byte 0x00000000200060CF + .8byte 0x000000002000A0CF + .8byte 0x000000002000E0CF +