[cheriot,rtl] Debug Mode: bounds override results, silent SR fault, forwarded suppressed write

Abierto
  • ¿Algo no está bien?
#2,567 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Área
operating-systems

Línea de trabajo

Start with the Debug Mode section in debug.rst and the cited RTL locations: ibex_cheriot_ex.sv:774-775, ibex_cheriot_ex.sv:858, ibex_controller.sv:239-241, and ibex_wb_stage.sv:191. Trace the bounds, SR fault, and writeback forwarding behavior against the provided SymbiYosys observations. Done means the intended RTL or documentation changes are decided and the suppressed-value forwarding case is addressed.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

The "Debug Mode in CHERIoT" section that #2555 added to debug.rst does not cover three details yet. Two are questions on whether the RTL or the text should change. The third looks like a defect. All three predate #2555.

The bounds override changes instruction results, not only the load and store checks. In Debug Mode, the bounds check never reports a violation (ibex_cheriot_ex.sv:774-775). So CTestSubset can return 1 when the second capability's bounds extend outside the first. CSeal and CUnseal can keep a tag that their Sail bounds test would clear. Dropping the override would change only these three results, because the load and store fault has its own Debug Mode term (ibex_cheriot_ex.sv:858). Should the override go, or should the list in debug.rst mention these results?

The SR check on CSpecialRW also differs from the one on CSR accesses. In Debug Mode, when PCC lacks SR, a CSpecialRW of an implemented SCR writes neither its destination register nor the SCR, and raises no exception. An access to an SR-protected CSR such as dpc still traps in that state (ibex_controller.sv:239-241). PCC can lose SR in Debug Mode through a CJALR to a tagged, executable capability without SR. Should the SR fault also trap in Debug Mode, as a CSR access does, or should debug.rst say that the SCR access is suppressed?

The next instruction can still see the suppressed value. With the writeback stage present, forwarding follows rf_write_wb_o (ibex_wb_stage.sv:191). That signal still includes the decoder's write enable. The fault clears the CHERIoT write enable, not the decoder's. The register write on line 184 uses the CHERIoT one, so in this sequence c11 keeps its old value. The CMove can still copy mscratchc into c10:

cspecialrw c11, mscratchc, c6   # PCC lacks SR
cmove      c10, c11

A CJALR whose fault is masked forwards its link capability the same way. This looks worth fixing whichever way the SR question goes.

I checked these with SymbiYosys on ibex_core at master d513671d. The parameters are based on opentitan, with CHERIoT on and the register file included. Each run starts from reset and has no data-memory transactions. In Debug Mode each case is reachable in a few instructions from the reset capabilities. Outside Debug Mode the proof shows that, for well-formed operands, CTestSubset returns 1 and CSeal or CUnseal keep the tag only when the bounds condition holds. On a local tree where the SR fault traps, and with other masked faults excluded, no following instruction completes with the suppressed value. I did not simulate these, because no upstream bench enables CHERIoT.

Lenguaje dominante
SystemVerilog
Estrellas
2.2k
Forks
836
Merge medio
5 d 8 h
PR fusionados (30 d)
22

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de lowRISC/ibex

Todos los issues de lowRISC/ibex

Issues similares

Más issues de Operating Systems

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.