Repository navigation
mmu: page fault on non-canonical VAs without walking the page table - #1928
Merged
rosethompson merged 4 commits intoOct 15, 2026
Merged
rosethompson merged 4 commits into
rosethompson merged 4 commits into
Conversation
A TLB miss on a non-canonical address walked the truncated VA, so a PTE read access fault was reported instead of the required page fault. Fault in tlbcontrol before any walk and drop the walker's leaf check. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: David Harris <David_Harris@hmc.edu>
Extend the test so that the non-canonical page fault is checked beyond Sv39 loads, stores, AMOs and fetches: - Sv48 and Sv57, where the canonical range follows satp.MODE: 0x80C0000000 is non-canonical in Sv39 but must be walked in Sv48 - M mode with mstatus.MPRV=1 and MPP=S - cbo.zero and cbo.clean, which take store/AMO page faults - a misaligned load and store from 0x3FFFFFFFFC spilling into 0x4000000000, with mtval holding the address of the faulting portion Each new non-canonical check fails on main with an access fault; the canonical controls pass on both. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: David Harris <David_Harris@hmc.edu>
testbench/tests.vh was removed by openhwfoundation#1895; noncanonical now runs from tests/coverage. Signed-off-by: David Harris <David_Harris@hmc.edu>
rosethompson
approved these changes
Oct 15, 2026
davidharrishmc
added a commit
to davidharrishmc/cvw
that referenced
this pull request
Oct 15, 2026
Conflicts were main's logic changes in lines this branch re-indented or re-commented; each keeps main's code with this branch's formatting: - fdivsqrtfsm.sv, div.sv: FlushE & ~StallM (openhwfoundation#1925) and its comment; the fdivsqrtfsm DONE-state exclusion tag stays removed - controller.sv: sfence.inval.ir refetch (openhwfoundation#1929) - tlbcamline.sv: TLBWrite/WritePTE_G/WritePTE_NAPOT ports (openhwfoundation#1927) - tlbcontrol.sv: ~UpperBitsUnequal in TLBMiss (openhwfoundation#1928), new BadNAPOT comment - csrc.sv: time/timeh read only with Zicntr (openhwfoundation#1951) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: David Harris <David_Harris@hmc.edu>
This was referenced Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A non-canonical virtual address must page fault before any page-table access, but on a TLB miss Wally walked the truncated address, so a PTE read in nonexistent or PMP-denied memory reported an access fault (1/5/7) instead of the page fault (12/13/15). tlbcontrol now never reports a miss for a non-canonical address and raises the page fault whether or not the TLB hits; the walker's leaf-level check is unreachable and is removed. Adds the
noncanonicaltest. It covers Sv39 loads, stores, AMOs and fetches (including a spilled fetch), and also Sv48 and Sv57, where the canonical range follows satp.MODE, M mode with MPRV=1, cbo.zero and cbo.clean, and misaligned loads and stores that spill into the non-canonical page. This conflicts with #1916 in hptw.sv; the resolution is to dropUpperBitsUnequalDfrom #1916'sOtherPageFault. Part of #1921.🤖 Generated with Claude Code