[cheriot,rtl] Debug Mode: bounds override results, silent SR fault, forwarded suppressed write

Aperta
  • Qualcosa non va?
#2,567 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Ambito
operating-systems

Direzione di ricerca

Start with the Debug Mode section in debug.rst and the cited RTL locations: ibex_cheriot_ex.sv:774-775, ibex_cheriot_ex.sv:858, ibex_controller.sv:239-241, and ibex_wb_stage.sv:191. Trace the bounds, SR fault, and writeback forwarding behavior against the provided SymbiYosys observations. Done means the intended RTL or documentation changes are decided and the suppressed-value forwarding case is addressed.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

The "Debug Mode in CHERIoT" section that #2555 added to debug.rst does not cover three details yet. Two are questions on whether the RTL or the text should change. The third looks like a defect. All three predate #2555.

The bounds override changes instruction results, not only the load and store checks. In Debug Mode, the bounds check never reports a violation (ibex_cheriot_ex.sv:774-775). So CTestSubset can return 1 when the second capability's bounds extend outside the first. CSeal and CUnseal can keep a tag that their Sail bounds test would clear. Dropping the override would change only these three results, because the load and store fault has its own Debug Mode term (ibex_cheriot_ex.sv:858). Should the override go, or should the list in debug.rst mention these results?

The SR check on CSpecialRW also differs from the one on CSR accesses. In Debug Mode, when PCC lacks SR, a CSpecialRW of an implemented SCR writes neither its destination register nor the SCR, and raises no exception. An access to an SR-protected CSR such as dpc still traps in that state (ibex_controller.sv:239-241). PCC can lose SR in Debug Mode through a CJALR to a tagged, executable capability without SR. Should the SR fault also trap in Debug Mode, as a CSR access does, or should debug.rst say that the SCR access is suppressed?

The next instruction can still see the suppressed value. With the writeback stage present, forwarding follows rf_write_wb_o (ibex_wb_stage.sv:191). That signal still includes the decoder's write enable. The fault clears the CHERIoT write enable, not the decoder's. The register write on line 184 uses the CHERIoT one, so in this sequence c11 keeps its old value. The CMove can still copy mscratchc into c10:

cspecialrw c11, mscratchc, c6   # PCC lacks SR
cmove      c10, c11

A CJALR whose fault is masked forwards its link capability the same way. This looks worth fixing whichever way the SR question goes.

I checked these with SymbiYosys on ibex_core at master d513671d. The parameters are based on opentitan, with CHERIoT on and the register file included. Each run starts from reset and has no data-memory transactions. In Debug Mode each case is reachable in a few instructions from the reset capabilities. Outside Debug Mode the proof shows that, for well-formed operands, CTestSubset returns 1 and CSeal or CUnseal keep the tag only when the bounds condition holds. On a local tree where the SR fault traps, and with other masked faults excluded, no following instruction completes with the suppressed value. I did not simulate these, because no upstream bench enables CHERIoT.

Lingua principale
SystemVerilog
Stelle
2.2k
Fork
836
Merge medio
5g 8h
PR unite (30g)
22

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di lowRISC/ibex

Tutte le issue di lowRISC/ibex

Issue simili

Altre issue su Operating Systems

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.