openhwgroup
Illegal hardware performance-monitoring counter accesses in non-machine modes
Is there an existing CVA6 bug for this?
- [X] I have searched the existing bug issues
Bug Description
Illegal counter access while the hart is running in less privilege mode than machine one.
RISC-V Specification
Unprivileged ISA: 20191213 | Privileged Architecture: 20211203 | External Debug Support: 0.13.02
The counter-enable register mcounteren is a 32-bit register that controls the availability of the hardware performance-monitoring counters to the next-lowest privileged mode.
The settings in this register only control accessibility. The act of reading or writing this register does not affect the underlying counters, which continue to increment even when not accessible.
When the CY, TM, IR, or HPMn bit in the mcounteren register is clear, attempts to read the cycle, time, instret, or hpmcountern register while executing in S-mode or U-mode will cause an illegal instruction exception. When one of these bits is set, access to the corresponding register is permitted in the next implemented privilege mode (S-mode if implemented, otherwise U-mode).
The counter-enable register scounteren is a 32-bit register that controls the availability of the hardware performance monitoring counters to U-mode.
When the CY, TM, IR, or HPMn bit in the scounteren register is clear, attempts to read the cycle, time, instret, or hpmcountern register while executing in U-mode will cause an illegal instruction exception. When one of these bits is set, access to the corresponding register is permitted.
Example Scenario
As shown below, the following sequence of instructions happens:
CSRRSI x0, hpmcounter3h, 0
The instruction CSRRSI x0, hpmcounter3h, 0 is decoded at t_id and executed in user mode resulting in normal instruction execution and updating the architecture state at t_arch_update. As a result, minstret counter is incremented and the core doesn't throw illegal instruction exception for accessing a counter where it's not permitted, i.e., mcounteren.HPM[3] in this case is unset.
Steps to Reproduce
Git Hash: de2e254c | TARGET_CFG: cv32a6_imac_sv0 | VCD: issue_5.zip
Component
Component:RTL
Product: Questa OneSpin Solutions App: Questa Processor App Tool's version: 2024.1_1
