A trap is triggered when the pmpcfg register is read by csrr

[Bill94l]

Hi Charles,

Now I have RISCV-DV integrated with NaxRiscv. This allows me to do fuzzing by generating random programs and start lockstep execution with RVLS via SocSim.

After running a program generated by riscv-dv for rv64imafdc, I see that reading the pmpcfg0 register through csrr triggers a trap in the DUT but not in spike. Here is the execution result :

[info] DUT did trap at tval: 0x3b0027f3 pc: 80004372 code 2
[info] DUT did trap at tval: 0x3a0025f3 pc: 80004376 code 2
[info] DUT did trap on 80004376
[info] Code 2
[info] commit error
[info] - std::exception

Spike log:

core   0: 3 0x000000008000484e (0x000f0db3) x27 0x0000000080034cf8
core   0: 0x0000000080004852 (0x340f1f73) csrrw   t5, mscratch, t5
core   0: 3 0x0000000080004852 (0x340f1f73) x30 0x0000000080034c00 c832_mscratch 0x0000000080034cf8
core   0: 0x0000000080004856 (0x30200073) mret
core   0: 3 0x0000000080004856 (0x30200073) c768_mstatus 0x0000000a00040080
core   0: 0x0000000080004376 (0x3a0025f3) csrr    a1, pmpcfg0
core   0: 3 0x0000000080004376 (0x3a0025f3) x11 0x000000000000001f

Tracer log:

rv rf w 0 0 32 0000000080034cf8
rv commit 0 000000008000484e
rv rf w 0 0 32 0000000080034c00
rv rf r 0 4 832 0000000080034c00
rv rf w 0 4 832 0000000080034cf8
rv commit 0 0000000080004852
rv commit 0 0000000080004856
rv load flu 0
rv load flu 0
rv trap 0 0 2 973088243

Everything you need to debug or reproduce the execution is in the attached file :
debug_riscv-dv.zip

[Dolu1990]

Hi,

The PMP isn't implemented in Naxriscv (at all)
I guess on legal implementation would be to hardwire all the PMP relater CSR to zero, right ?

[Bill94l]

I use SocSim+RVLS which normally takes into account that the pmp is not implemented in the DUT and spike
https://github.com/SpinalHDL/rvls/blob/520b40dc9bc4d15348dd2225a7c4fd30ebf900de/src/hart.cpp#L130

Why don't we get the same behaviour when the DUT and Spike are running? Why does spike not trigger a trap? It is configured not to support PMP.

[Bill94l]

After updating my RISC-V-DV locally, this problem no longer occurs. This is because it takes into account that the PMP is not implemented.

[Dolu1990]

Ahhhh ok ^^
So, overall, you use the python of RISC-V-DV to generate a instruction stream right ?
How painfull is it to use / setup ?

[Bill94l]

In fact, you would need questa-sim licence to use UVM to generate random programs. I spent a lot of time setting up the environment. If I find any bugs, I will let you know.

Do you have a problem with the use of non-open source tools? (when Verilator supports UVM, it can replace Questasim)
I have seen that you are interested in the use of a fuzzing tool for VexiiRiscv. Let me know if you are interested in incorporating RISC V-DV into NaxRiscv to have a solid verification environment?

[Dolu1990]

In fact, you would need questa-sim licence to use UVM to generate random programs. I spent a lot of time setting up the environment

Very sad that open-source project are locked behind paywals like this :(
Wasn't there some python generation for random program aswell ? or that one is not great ?

Do you have a problem with the use of non-open source tools?

Yes :

• It keep individuals out / cost
• Shit when it is about CI
• Each instance cost you one license => not great for testing large batches

Let me know if you are interested in incorporating RISC V-DV into NaxRiscv to have a solid verification environment?

As long as verilator doesn't support it, i would say i can't use it, or maybe we could generate batches of instruction stream into files and upload them somewere ? But that may generate too much data to get proper coverage XD

[Bill94l]

Wasn't there some python generation for random program aswell ? or that one is not great ?

Riscv-dv is a SV/UVM based instruction generator, so in order to generate random programs, the riscv-dv Python script needs a simulator that supports UVM. I think it's possible to use a simulator called pyflow, but I haven't tried it yet

maybe we could generate batches of instruction stream into files and upload them somewere ? But that may generate too much data to get proper coverage XD

This could be an alternative solution, I will have to see how to guarantee the coverage and the amount of data that will be generated

[Dolu1990]

Riscv-dv is a SV/UVM based instruction generator, so in order to generate random programs, the riscv-dv Python script needs a simulator that supports UVM.

Ahhhhh saaaaaad

I think it's possible to use a simulator called pyflow, but I haven't tried it yet

Never heard of it :)