Privilege promotion/demotion for load/store

[Silabs-ArjanB]

Summary: A load or store executed in User mode can get its privilege promoted to Machine mode (e.g. when followed by an ECALL instruction). Similarly a (multi-cycle) load store executed in Machine mode can gets its privilege demoted to User mode half-way through its execution.

Git tag: eae1cabcdb2333e5f1037996a48504985e7813a7 (august 5 2019)

Parameters: INSTR_RDATA_WIDTH = 32, PULP_SECURE = 1, USE_PMP = 1

A load or store executed in User mode can get its privilege promoted to Machine mode (e.g. when followed by an ECALL instruction).

To replicate this issue set up the PMP to filter User mode loads or stores in a specific region, switch to User mode, and try to execute such a (supposedly forbidden) load or store (this can be achieved by replacing 'j start' in tb/core/start.S with the attached code0.S). If RI5CY changes to Machine mode while the load or store is being executed, the PMP uses the wrong (elevated) privilege level to decide if the load or store is allowed. The changing back from User to Machine mode can be because of various reasons. An example is to perform an ECALL after the User mode load/store. Another example would be to program the program the PMP to forbid an instruction fetch for the instruction after the load/store. Likely inserting an illegal instruction after the load/store will also trigger the unwanted behavior (as such an illegal instruction will also cause a switch to Machine mode)

Similarly a (multi-cycle) load store executed in Machine mode can gets its privilege demoted to User mode half-way through its execution (this can be achieved by replacing 'j start' in tb/core/start.S with the attached code1.S). This issue occurred (only) for particular wait state behavior on the data interface (which can be mimicked by the attached (artificial) modification in tb/core/mm_ram.sv).

privilege.tar.gz