From 66dce731a0e8df9112ccd353a8e142a8170db22a Mon Sep 17 00:00:00 2001 From: David Harris Date: Mon, 1 Jan 2024 18:33:47 -0800 Subject: [PATCH 1/3] Fixed wave file after signal name changes --- sim/wave.do | 53 +++++++++++++++++++++++++---------------------------- 1 file changed, 25 insertions(+), 28 deletions(-) diff --git a/sim/wave.do b/sim/wave.do index 43ff1226b..272673ae3 100644 --- a/sim/wave.do +++ b/sim/wave.do @@ -8,11 +8,11 @@ add wave -noupdate /testbench/dut/core/SATP_REGW add wave -noupdate /testbench/dut/core/InstrValidM add wave -noupdate -expand -group HDU -group hazards /testbench/dut/core/hzu/RetM add wave -noupdate -expand -group HDU -group hazards -color Pink /testbench/dut/core/hzu/TrapM -add wave -noupdate -expand -group HDU -group hazards /testbench/dut/core/hzu/LoadStallD +add wave -noupdate -expand -group HDU -group hazards /testbench/dut/core/ieu/c/LoadStallD add wave -noupdate -expand -group HDU -group hazards /testbench/dut/core/ifu/IFUStallF add wave -noupdate -expand -group HDU -group hazards /testbench/dut/core/hzu/BPWrongE add wave -noupdate -expand -group HDU -group hazards /testbench/dut/core/hzu/LSUStallM -add wave -noupdate -expand -group HDU -group hazards /testbench/dut/core/MDUStallD +add wave -noupdate -expand -group HDU -group hazards /testbench/dut/core/ieu/c/MDUStallD add wave -noupdate -expand -group HDU -group hazards /testbench/dut/core/hzu/DivBusyE add wave -noupdate -expand -group HDU -group hazards /testbench/dut/core/hzu/FDivBusyE add wave -noupdate -expand -group HDU -group traps /testbench/dut/core/priv/priv/trap/InstrMisalignedFaultM @@ -59,14 +59,13 @@ add wave -noupdate -group {PCNext Generation} /testbench/dut/core/ifu/PCSrcE add wave -noupdate -group {PCNext Generation} /testbench/dut/core/ifu/PC1NextF add wave -noupdate -group {PCNext Generation} -label {NextValidPCE (from bpred)} /testbench/dut/core/ifu/NextValidPCE add wave -noupdate -group {PCNext Generation} /testbench/dut/core/ifu/CSRWriteFenceM -add wave -noupdate -group {PCNext Generation} -expand -group pcmux3 /testbench/dut/core/priv/priv/csr/PC2NextF add wave -noupdate -group {PCNext Generation} -expand -group pcmux3 -group xepc /testbench/dut/core/priv/priv/csr/MEPC_REGW add wave -noupdate -group {PCNext Generation} -expand -group pcmux3 -group xepc /testbench/dut/core/priv/priv/csr/SEPC_REGW add wave -noupdate -group {PCNext Generation} -expand -group pcmux3 -group xepc /testbench/dut/core/priv/priv/csr/mretM -add wave -noupdate -group {PCNext Generation} -expand -group pcmux3 -group xepc /testbench/dut/core/priv/priv/csr/EPC +add wave -noupdate -group {PCNext Generation} -expand -group pcmux3 -group xepc /testbench/dut/core/priv/priv/EPCM add wave -noupdate -group {PCNext Generation} -expand -group pcmux3 /testbench/dut/core/priv/priv/csr/TrapVectorM add wave -noupdate -group {PCNext Generation} -expand -group pcmux3 /testbench/dut/core/priv/priv/csr/TrapM -add wave -noupdate -group {PCNext Generation} -expand -group pcmux3 /testbench/dut/core/priv/priv/csr/RetM +add wave -noupdate -group {PCNext Generation} -expand -group pcmux3 /testbench/dut/core/priv/priv/RetM add wave -noupdate -group {PCNext Generation} -expand -group pcmux3 /testbench/dut/core/ifu/UnalignedPCNextF add wave -noupdate -group {PCNext Generation} /testbench/dut/core/ifu/PCNextF add wave -noupdate -group {PCNext Generation} /testbench/dut/core/ifu/PCF @@ -195,9 +194,9 @@ add wave -noupdate -group {Decode Stage} /testbench/dut/core/ifu/InstrD add wave -noupdate -group {Decode Stage} /testbench/InstrDName add wave -noupdate -group {Decode Stage} /testbench/dut/core/ieu/c/InstrValidD add wave -noupdate -group {Decode Stage} /testbench/dut/core/ieu/c/RegWriteD -add wave -noupdate -group {Decode Stage} /testbench/dut/core/ieu/dp/RdD -add wave -noupdate -group {Decode Stage} /testbench/dut/core/ieu/dp/Rs1D -add wave -noupdate -group {Decode Stage} /testbench/dut/core/ieu/dp/Rs2D +add wave -noupdate -group {Decode Stage} /testbench/dut/core/ieu/c/RdD +add wave -noupdate -group {Decode Stage} /testbench/dut/core/ieu/c/Rs1D +add wave -noupdate -group {Decode Stage} /testbench/dut/core/ieu/c/Rs2D add wave -noupdate -group {Execution Stage} /testbench/dut/core/ifu/PCE add wave -noupdate -group {Execution Stage} /testbench/dut/core/ifu/InstrE add wave -noupdate -group {Execution Stage} /testbench/InstrEName @@ -251,13 +250,12 @@ add wave -noupdate -group lsu /testbench/dut/core/lsu/IEUAdrExtE add wave -noupdate -group lsu /testbench/dut/core/lsu/IEUAdrExtM add wave -noupdate -group lsu /testbench/dut/core/lsu/bus/dcache/dcache/NextSet add wave -noupdate -group lsu -expand -group dcache /testbench/dut/core/lsu/bus/dcache/dcache/CacheRW -add wave -noupdate -group lsu -expand -group dcache /testbench/dut/core/lsu/bus/dcache/dcache/CMOp +add wave -noupdate -group lsu -expand -group dcache /testbench/dut/core/lsu/bus/dcache/dcache/CMOpM add wave -noupdate -group lsu -expand -group dcache -color Gold /testbench/dut/core/lsu/bus/dcache/dcache/cachefsm/CurrState add wave -noupdate -group lsu -expand -group dcache -group SRAM-update-control /testbench/dut/core/lsu/bus/dcache/dcache/SetValid add wave -noupdate -group lsu -expand -group dcache -group SRAM-update-control /testbench/dut/core/lsu/bus/dcache/dcache/ClearValid add wave -noupdate -group lsu -expand -group dcache -group SRAM-update-control /testbench/dut/core/lsu/bus/dcache/dcache/SetDirty add wave -noupdate -group lsu -expand -group dcache -group SRAM-update-control /testbench/dut/core/lsu/bus/dcache/dcache/ClearDirty -add wave -noupdate -group lsu -expand -group dcache -group SRAM-update-control /testbench/dut/core/lsu/bus/dcache/dcache/SelFlush add wave -noupdate -group lsu -expand -group dcache -group SRAM-update-control /testbench/dut/core/lsu/bus/dcache/dcache/SelWay add wave -noupdate -group lsu -expand -group dcache -group {requesting address} /testbench/dut/core/lsu/IEUAdrE add wave -noupdate -group lsu -expand -group dcache -group {requesting address} /testbench/dut/core/lsu/bus/dcache/dcache/PAdr @@ -291,7 +289,6 @@ add wave -noupdate -group lsu -expand -group dcache -group flush /testbench/dut/ add wave -noupdate -group lsu -expand -group dcache -group flush /testbench/dut/core/lsu/bus/dcache/dcache/FlushWayCntEn add wave -noupdate -group lsu -expand -group dcache -group flush /testbench/dut/core/lsu/bus/dcache/dcache/cachefsm/FlushAdrCntEn add wave -noupdate -group lsu -expand -group dcache -group flush /testbench/dut/core/lsu/bus/dcache/dcache/FlushAdrFlag -add wave -noupdate -group lsu -expand -group dcache -group flush /testbench/dut/core/lsu/bus/dcache/dcache/cachefsm/SelFlush add wave -noupdate -group lsu -expand -group dcache -group {Cache SRAM writes} /testbench/dut/core/lsu/bus/dcache/dcache/SetValid add wave -noupdate -group lsu -expand -group dcache -group {Cache SRAM writes} /testbench/dut/core/lsu/bus/dcache/dcache/ClearValid add wave -noupdate -group lsu -expand -group dcache -group {Cache SRAM writes} /testbench/dut/core/lsu/bus/dcache/dcache/SetDirty @@ -626,24 +623,24 @@ add wave -noupdate -group alu /testbench/dut/core/ieu/dp/alu/B add wave -noupdate -group alu /testbench/dut/core/ieu/dp/alu/ALUResult add wave -noupdate -group alu /testbench/dut/core/ieu/dp/alu/BALUControl add wave -noupdate -group alu -divider internals -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/Rs1D -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/Rs2D -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/Rs1E -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/Rs2E -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/RdE -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/RdM -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/RdW -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/MemReadE -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/RegWriteM -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/RegWriteW -add wave -noupdate -group Forward -color Thistle /testbench/dut/core/ieu/fw/ForwardAE -add wave -noupdate -group Forward -color Thistle /testbench/dut/core/ieu/fw/ForwardBE -add wave -noupdate -group Forward -color Thistle /testbench/dut/core/ieu/fw/LoadStallD +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/Rs1D +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/Rs2D +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/Rs1E +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/Rs2E +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/RdE +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/RdM +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/RdW +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/MemReadE +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/RegWriteM +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/RegWriteW +add wave -noupdate -group Forward -color Thistle /testbench/dut/core/ieu/c/ForwardAE +add wave -noupdate -group Forward -color Thistle /testbench/dut/core/ieu/c/ForwardBE +add wave -noupdate -group Forward -color Thistle /testbench/dut/core/ieu/c/LoadStallD add wave -noupdate -group Forward /testbench/dut/core/ieu/dp/IFResultM -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/ForwardAE -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/Rs1E -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/RdM -add wave -noupdate -group Forward /testbench/dut/core/ieu/fw/RdW +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/ForwardAE +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/Rs1E +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/RdM +add wave -noupdate -group Forward /testbench/dut/core/ieu/c/RdW add wave -noupdate -group {alu execution stage} /testbench/dut/core/ieu/dp/ALUResultE add wave -noupdate -group {alu execution stage} /testbench/dut/core/ieu/dp/SrcAE add wave -noupdate -group {alu execution stage} /testbench/dut/core/ieu/dp/SrcBE From d229dc06ee9e84da2c835e7cf599532e7fcfea3a Mon Sep 17 00:00:00 2001 From: David Harris Date: Tue, 2 Jan 2024 00:35:17 -0800 Subject: [PATCH 2/3] Coverage improvements; remove incorrect logic checking NAPOT nonleaf PTE --- src/mmu/hptw.sv | 5 +- src/mmu/tlb/tlbcontrol.sv | 6 +- testbench/tests.vh | 3 +- tests/coverage/tlbmisc.S | 318 ++++++++++++++++++++++++++++++++++++++ 4 files changed, 325 insertions(+), 7 deletions(-) create mode 100644 tests/coverage/tlbmisc.S diff --git a/src/mmu/hptw.sv b/src/mmu/hptw.sv index 322a730dd..97e7f536e 100644 --- a/src/mmu/hptw.sv +++ b/src/mmu/hptw.sv @@ -139,7 +139,7 @@ module hptw import cvw::*; #(parameter cvw_t P) ( assign LeafPTE = Executable | Writable | Readable; assign ValidPTE = Valid & ~(Writable & ~Readable); assign ValidLeafPTE = ValidPTE & LeafPTE; - assign ValidNonLeafPTE = ValidPTE & ~LeafPTE; + assign ValidNonLeafPTE = Valid & ~LeafPTE; if(P.SVADU_SUPPORTED) begin : hptwwrites logic ReadAccess, WriteAccess; @@ -255,13 +255,14 @@ module hptw import cvw::*; #(parameter cvw_t P) ( end // Page Table Walker FSM - // there is a bug here. Each memory access needs to be potentially flushed if the PMA/P checkers + // *** there is a bug here (RT). Each memory access needs to be potentially flushed if the PMA/P checkers // generate an access fault. Specially the store on UDPATE_PTE needs to check for access violation. // I think the solution is to do 1 of the following // 1. Allow the HPTW to generate exceptions and stop walking immediately. // 2. If the store would generate an exception don't store to dcache but still write the TLB. When we go back // to LEAF then the PMA/P. Wait this does not work. The PMA/P won't be looking a the address in the table, but // rather than physical address of the translated instruction/data. So we must generate the exception. + // *** DH 1/1/24 another bug: when the NAPOT bits (PTE[62:61]) are nonzero on a nonleaf PTE, the walker should make a page fault flopenl #(.TYPE(statetype)) WalkerStateReg(clk, reset | FlushW, 1'b1, NextWalkerState, IDLE, WalkerState); always_comb case (WalkerState) diff --git a/src/mmu/tlb/tlbcontrol.sv b/src/mmu/tlb/tlbcontrol.sv index 58368c511..8c8058167 100644 --- a/src/mmu/tlb/tlbcontrol.sv +++ b/src/mmu/tlb/tlbcontrol.sv @@ -85,8 +85,7 @@ module tlbcontrol import cvw::*; #(parameter cvw_t P, ITLB = 0) ( assign PBMemoryType = PTE_PBMT & {2{Translate & TLBHit & P.SVPBMT_SUPPORTED}}; // check if reserved, N, or PBMT bits are malformed w in RV64 - assign BadPBMT = PTE_PBMT != 0 & (~(P.SVPBMT_SUPPORTED & ENVCFG_PBMTE) | - {PTE_X, PTE_W, PTE_R} == 3'b000) | PTE_PBMT == 3; // PBMT must be zero if not supported or for non-leaf PTEs; + assign BadPBMT = ((PTE_PBMT != 0) & ~(P.SVPBMT_SUPPORTED & ENVCFG_PBMTE)) | PTE_PBMT == 3; // PBMT must be zero if not supported; value of 3 is reserved assign BadNAPOT = PTE_N & (~P.SVNAPOT_SUPPORTED | ~NAPOT4); // N must be be 0 if CVNAPOT is not supported or not 64 KiB contiguous region assign BadReserved = PTE_RESERVED; // Reserved bits must be zero @@ -94,8 +93,7 @@ module tlbcontrol import cvw::*; #(parameter cvw_t P, ITLB = 0) ( if (ITLB == 1) begin:itlb // Instruction TLB fault checking // User mode may only execute user mode pages, and supervisor mode may // only execute non-user mode pages. - assign ImproperPrivilege = ((EffectivePrivilegeMode == P.U_MODE) & ~PTE_U) | - ((EffectivePrivilegeMode == P.S_MODE) & PTE_U); + assign ImproperPrivilege = ((PrivilegeModeW == P.U_MODE) & ~PTE_U) | ((PrivilegeModeW == P.S_MODE) & PTE_U); assign PreUpdateDA = ~PTE_A; assign InvalidAccess = ~PTE_X; end else begin:dtlb // Data TLB fault checking diff --git a/testbench/tests.vh b/testbench/tests.vh index 65d78d8e5..e6adb0330 100644 --- a/testbench/tests.vh +++ b/testbench/tests.vh @@ -44,8 +44,9 @@ string tvpaths[] = '{ string coverage64gc[] = '{ `COVERAGE, - "ieu", + "tlbmisc", "tlbNAPOT", + "ieu", "priv", "ebu", "csrwrites", diff --git a/tests/coverage/tlbmisc.S b/tests/coverage/tlbmisc.S new file mode 100644 index 000000000..e25615cd2 --- /dev/null +++ b/tests/coverage/tlbmisc.S @@ -0,0 +1,318 @@ +/////////////////////////////////////////// +// tlbmisc.S +// +// Written David_Harris@hmc.edu 1/1/24 +// +// Purpose: Test coverage for other TLB issues +// +// A component of the CORE-V-WALLY configurable RISC-V project. +// +// Copyright (C) 2021-23 Harvey Mudd College & Oklahoma State University +// +// SPDX-License-Identifier: Apache-2.0 WITH SHL-2.1 +// +// Licensed under the Solderpad Hardware License v 2.1 (the “License”); you may not use this file +// except in compliance with the License, or, at your option, the Apache License version 2.0. You +// may obtain a copy of the License at +// +// https://solderpad.org/licenses/SHL-2.1/ +// +// Unless required by applicable law or agreed to in writing, any work distributed under the +// License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, +// either express or implied. See the License for the specific language governing permissions +// and limitations under the License. +//////////////////////////////////////////////////////////////////////////////////////////////// + +// load code to initalize stack, handle interrupts, terminate + +#include "WALLY-init-lib.h" + +# run-elf.bash find this in project description +main: + li t5, 0x1 + slli t5, t5, 62 + ori t5, t5, 0xF0 + csrs menvcfg, t5 # menvcfg.PBMTE = 1, CBZE, CBCFE, CBIE all 1 + + # store ret instruction in case we jump to an address mapping to 80000000 + li t0, 0x80000000 + li t5, 0x8082 # return instruction opcode + sw t5, 0(t0) + fence.i + + # Page table root address at 0x80010000; SV48 + li t5, 0x9000000000080010 + csrw satp, t5 + + # sfence.vma x0, x0 + + # switch to supervisor mode + li a0, 1 + ecall + + # Instruction fetch from misaligned pages + jal changetoipfhandler # set up trap handler to return from instruction page fault if necessary + li t0, 0x8000000000 + jalr ra, t0 # jump misaligned terapage + li t0, 0x00000000 + jalr ra, t0 # jump to misaligned gigapage + li t0, 0x80200000 + jalr ra, t0 # jump to misaligned megapage + + + # exercise malformed PBMT pages + + # page has PBMT = 3 (reserved) + li t0, 0x80400000 + lw t1, 0(t0) # read from page + sw t1, 0(t0) # write to page + jalr ra, t0 # jump to page + + # Nonleaf PTE has PBMT != 0 # this should cause a page fault during page walking. However, as of issue 546 1/1/24, both ImperasDV and Wally don't detect this + li t0, 0x80600000 + lw t1, 0(t0) # read from page + sw t1, 0(t0) # write to page + jalr ra, t0 # jump to page + + + # change back to default trap handler after checking everything that might cause an instruction page fault + jal changetodefaulthandler + + # exercise CBOM instructions with various permissions + li t0, 0x80800000 + cbo.zero (t0) + cbo.clean (t0) + li t0, 0x80801000 + cbo.zero (t0) + cbo.clean (t0) + li t0, 0x80802000 + cbo.zero (t0) + cbo.clean (t0) + li t0, 0x80803000 + cbo.zero (t0) + cbo.clean (t0) + + # set mstatus.MXR + li a0, 3 + ecall + li t0, 1 + slli t0, t0, 19 + csrs mstatus, t0 # mstatus.mxr = 1 + li a0, 1 + ecall + + # exercise CBOM again now that MXR is set + li t0, 0x80800000 + cbo.zero (t0) + cbo.clean (t0) + li t0, 0x80801000 + cbo.zero (t0) + cbo.clean (t0) + li t0, 0x80802000 + cbo.zero (t0) + cbo.clean (t0) + li t0, 0x80803000 + cbo.zero (t0) + cbo.clean (t0) + + # clear mstatus.MXR + li a0, 3 + ecall + li t0, 1 + slli t0, t0, 19 + csrc mstatus, t0 # mstatus.mxr = 1 + li a0, 1 + ecall + + + # wrap up + li a0, 3 # switch back to machine mode because code at 0x80000000 may not have clean page table entry + ecall + j done + + +changetoipfhandler: + li a0, 3 + ecall # switch to machine mode + la a0, ipf_handler + csrw mtvec, a0 # point to new handler + li a0, 1 + ecall # switch back to supervisor mode + ret + +changetodefaulthandler: + li a0, 3 + ecall # switch to machine mode + la a0, trap_handler + csrw mtvec, a0 # point to new handler + li a0, 1 + ecall # switch back to supervisor mode + ret + +instructionpagefaulthandler: + csrw mepc, ra # go back to calling function + mret + +.align 4 # trap handlers must be aligned to multiple of 4 +ipf_handler: + # Load trap handler stack pointer tp + csrrw tp, mscratch, tp # swap MSCRATCH and tp + sd t0, 0(tp) # Save t0 and t1 on the stack + sd t1, -8(tp) + csrr t0, mcause # Check the cause + li t1, 8 # is it an ecall trap? + andi t0, t0, 0xFC # if CAUSE = 8, 9, or 11 + beq t0, t1, ecall # yes, take ecall + csrr t0, mcause + li t1, 12 # is it an instruction page fault + beq t0, t1, ipf # yes, return to calling function + j trap_return + +ipf: + csrw mepc, ra # return to calling function + ld t1, -8(tp) # restore t1 and t0 + ld t0, 0(tp) + csrrw tp, mscratch, tp # restore tp + mret # return from trap + +.data + +.align 16 +# root Page table situated at 0x80010000 +pagetable: + .8byte 0x200044C1 # 0x00000000-0x80_00000000: PTE at 0x80011000 C1 dirty, accessed, valid + .8byte 0x00000000000010CF # misaligned terapage at 0x80_00000000 + +# next page table at 0x80011000 +.align 12 + .8byte 0x00000000000010CF # misaligned gigapage at 0x00000000 + .8byte 0x00000000200058C1 # PTE for pages at 0x40000000 + .8byte 0x00000000200048C1 # gigapage at 0x80000000 pointing to 0x80120000 + + +# Next page table at 0x80012000 for gigapage at 0x80000000 +.align 12 + .8byte 0x0000000020004CC1 # for VA starting at 80000000 (pointer to NAPOT 64 KiB pages) + .8byte 0x0000000020014CCF # for VA starting at 80200000 (misaligned megapage) + .8byte 0x00000000200050C1 # for VA starting at 80400000 (bad PBMT pages) + .8byte 0x4000000020004CC1 # for VA starting at 80600000 (bad entry: nonleaf PTE can't have PBMT != 0) + .8byte 0x00000000200054C1 # for VA starting at 80800000 (testing rwx permissiosn with cbom/cboz) + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 + +# Leaf page table at 0x80013000 with NAPOT pages +.align 12 + #80000000 + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + .8byte 0xA0000000200020CF + + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + .8byte 0x80000000200060CF + + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + .8byte 0x800000002000A0CF + + .8byte 0x800000002000E0CF + .8byte 0x800000002000E0CF + .8byte 0x800000002000E0CF + .8byte 0x800000002000E0CF + + .8byte 0x800000002000E0CF + .8byte 0x800000002000E0CF + +# Leaf page table at 0x80014000 with PBMT pages +.align 12 + #80400000 + .8byte 0x60000000200020CF # reserved entry + +# Leaf page table at 0x80015000 with various permissions for testing CBOM and CBOZ +.align 12 + #80800000 + .8byte 0x00000000200000CF # valid rwx for VA 80800000 + .8byte 0x00000000200000CF # valid r x for VA 80801000 + .8byte 0x00000000200000CF # valid r for VA 80802000 + .8byte 0x00000000200000CF # valid x for CA 80003000 + + From 680a0148760db7a6c1e9c61c3ee0209bb170049e Mon Sep 17 00:00:00 2001 From: David Harris Date: Tue, 2 Jan 2024 10:16:20 -0800 Subject: [PATCH 3/3] Finished LSU tlbcontrol coverage tests --- src/lsu/lsu.sv | 2 +- src/mmu/hptw.sv | 2 +- tests/coverage/tlbmisc.S | 23 +++++++++++++++++++---- 3 files changed, 21 insertions(+), 6 deletions(-) diff --git a/src/lsu/lsu.sv b/src/lsu/lsu.sv index 6417bc573..6a869076e 100644 --- a/src/lsu/lsu.sv +++ b/src/lsu/lsu.sv @@ -308,7 +308,7 @@ module lsu import cvw::*; #(parameter cvw_t P) ( if(P.ZICBOZ_SUPPORTED) begin assign BusCMOZero = CMOpM[3] & ~CacheableM; - assign CacheCMOpM = CacheableM ? CMOpM : '0; + assign CacheCMOpM = (CacheableM & ~SelHPTW) ? CMOpM : '0; assign BusAtomic = AtomicM[1] & ~CacheableM; end else begin assign BusCMOZero = '0; diff --git a/src/mmu/hptw.sv b/src/mmu/hptw.sv index 97e7f536e..294a6f8f4 100644 --- a/src/mmu/hptw.sv +++ b/src/mmu/hptw.sv @@ -262,7 +262,7 @@ module hptw import cvw::*; #(parameter cvw_t P) ( // 2. If the store would generate an exception don't store to dcache but still write the TLB. When we go back // to LEAF then the PMA/P. Wait this does not work. The PMA/P won't be looking a the address in the table, but // rather than physical address of the translated instruction/data. So we must generate the exception. - // *** DH 1/1/24 another bug: when the NAPOT bits (PTE[62:61]) are nonzero on a nonleaf PTE, the walker should make a page fault + // *** DH 1/1/24 another bug: when the NAPOT bits (PTE[62:61]) are nonzero on a nonleaf PTE, the walker should make a page fault (Issue 546) flopenl #(.TYPE(statetype)) WalkerStateReg(clk, reset | FlushW, 1'b1, NextWalkerState, IDLE, WalkerState); always_comb case (WalkerState) diff --git a/tests/coverage/tlbmisc.S b/tests/coverage/tlbmisc.S index e25615cd2..8d34c1ef1 100644 --- a/tests/coverage/tlbmisc.S +++ b/tests/coverage/tlbmisc.S @@ -59,6 +59,12 @@ main: li t0, 0x80200000 jalr ra, t0 # jump to misaligned megapage + # exercise ebufsmarb + li t0, 0x80000000 + lw t1, 0(t0) # fetch from an address to warm up tlb entries + li t0, 0x80A00000 + lw t1, 0(t0) # trigger TLB miss on a non-first entry + jal backandforth # exercise malformed PBMT pages @@ -91,6 +97,9 @@ main: li t0, 0x80803000 cbo.zero (t0) cbo.clean (t0) + li t0, 0x80804000 + cbo.zero (t0) + cbo.clean (t0) # set mstatus.MXR li a0, 3 @@ -114,6 +123,9 @@ main: li t0, 0x80803000 cbo.zero (t0) cbo.clean (t0) + li t0, 0x80804000 + cbo.zero (t0) + cbo.clean (t0) # clear mstatus.MXR li a0, 3 @@ -130,6 +142,8 @@ main: ecall j done +backandforth: + ret changetoipfhandler: li a0, 3 @@ -197,7 +211,7 @@ pagetable: .8byte 0x00000000200050C1 # for VA starting at 80400000 (bad PBMT pages) .8byte 0x4000000020004CC1 # for VA starting at 80600000 (bad entry: nonleaf PTE can't have PBMT != 0) .8byte 0x00000000200054C1 # for VA starting at 80800000 (testing rwx permissiosn with cbom/cboz) - .8byte 0x0000000020004CC1 + .8byte 0x0000000020004CC1 # for VA starting at 80A00000 (pointer to NAPOT 64 KiB pages like at 80000000) .8byte 0x0000000020004CC1 .8byte 0x0000000020004CC1 .8byte 0x0000000020004CC1 @@ -311,8 +325,9 @@ pagetable: .align 12 #80800000 .8byte 0x00000000200000CF # valid rwx for VA 80800000 - .8byte 0x00000000200000CF # valid r x for VA 80801000 - .8byte 0x00000000200000CF # valid r for VA 80802000 - .8byte 0x00000000200000CF # valid x for CA 80003000 + .8byte 0x00000000200000CB # valid r x for VA 80801000 + .8byte 0x00000000200000C3 # valid r for VA 80802000 + .8byte 0x00000000200000C5 # valid x for VA 80803000 + .8byte 0x00000000200000CD # valid wx for VA 80804000 (illegal combination, but used to test tlbcontrol)