Skip to content

Implement Svpbmt extension support (parameter, PTE, PTW, CSRs)#3288

Draft
StackedArchitect wants to merge 1 commit into
openhwgroup:masterfrom
StackedArchitect:svpbmt-full
Draft

Implement Svpbmt extension support (parameter, PTE, PTW, CSRs)#3288
StackedArchitect wants to merge 1 commit into
openhwgroup:masterfrom
StackedArchitect:svpbmt-full

Conversation

@StackedArchitect
Copy link
Copy Markdown

Description

This PR implements the RISC-V Svpbmt (Supervisor Page-Based Memory Types) extension for CVA6, as specified in the RISC-V Privileged Specification v1.12, Section 12.3.

All functionality is introduced behind a new SvpbmtEn configuration parameter. Existing configurations remain functionally unchanged (SvpbmtEn=0 by default).

This PR is submitted as a complete parameter + functionality unit, following feedback from @JeanRochCoulon on the earlier incremental PRs (#3254, #3269, #3283).


Changes

1. Parameter Declaration

  • SvpbmtEn added to cva6_user_cfg_t and cva6_cfg_t in config_pkg.sv
  • Propagated through build_config_pkg.sv
  • Added to all 19 target config packages (bit'(0) by default; bit'(1) in cv64a6_imafdc_sv39 only)

2. PTE Field Restructuring (cva6_mmu.sv)

  • Split pte_cva6_t.reserved[8:0] into pbmt[1:0] (bits [62:61]) and reserved[6:0] (bits [60:54])
  • Added pbmt field to tlb_update_cva6_t for the TLB refill path

3. CSR Control Bits (csr_regfile.sv)

  • Added menvcfg.PBMTE (bit 62): controls Svpbmt enable at M-mode
  • Added henvcfg.PBMTE (bit 62): AND-masked with menvcfg.PBMTE on write, ensuring hypervisor isolation
  • pbmte_o output accounts for virtualization mode (v_q):
    • HS-mode: menvcfg.PBMTE
    • VS/VU-mode: menvcfg.PBMTE AND henvcfg.PBMTE
  • Both reset to 0 (extension disabled at boot)

4. Signal Threading

  • pbmte threaded from CSR regfile through cva6.sv -> ex_stage.sv -> load_store_unit.sv -> cva6_mmu.sv -> cva6_ptw.sv

5. PTW Validation (cva6_ptw.sv)

  • Leaf PTEs: Fault on reserved encoding (pbmt==2'b11); fault on non-zero pbmt when PBMTE disabled
  • Non-leaf PTEs: Fault on any non-zero pbmt (spec requires pbmt==0 for pointer PTEs)
  • When SvpbmtEn=0: non-zero pbmt bits are treated as reserved fields and cause page faults

6. TLB Storage and MMU Output

  • cva6_tlb.sv: PBMT stored in TLB tag struct; lu_pbmt_o output on hit
  • cva6_shared_tlb.sv: PBMT propagated through bypass and SRAM-backed update paths
  • cva6_mmu.sv: lsu_pbmt_o output with registered pipeline (dtlb_pbmt_n/q)

Limitations (deferred to future PRs)

  • lsu_pbmt_o is not yet wired to the cache subsystem (HPDcache backend support)
  • I-cache PBMT wiring is not included
  • The PBMT value is surfaced at the MMU output but not yet consumed by downstream hardware

Testing

  • All existing tests are expected to pass since SvpbmtEn=0 for most configurations
  • cv64a6_imafdc_sv39 config with SvpbmtEn=1 exercises the gated paths via CI

Related

Implement the RISC-V Svpbmt (Page-Based Memory Types) extension for CVA6, gated behind the new SvpbmtEn configuration parameter.

Parameter declaration:

- Add SvpbmtEn to cva6_user_cfg_t and cva6_cfg_t in config_pkg.sv

- Propagate SvpbmtEn through build_config_pkg.sv

- Add SvpbmtEn to all 19 target config packages (enabled in cv64a6_imafdc_sv39 only)

PTE field restructuring:

- Split pte_cva6_t.reserved[8:0] into pbmt[1:0] (bits [62:61]) and reserved[6:0] (bits [60:54])

- Add pbmt field to tlb_update_cva6_t for TLB refill path

CSR control bits (menvcfg/henvcfg.PBMTE):

- Add pbmte_d/q and hpbmte_d/q registers in csr_regfile.sv

- henvcfg.PBMTE is AND-masked with menvcfg.PBMTE on write

- pbmte_o accounts for virtualization mode (v_q) per spec

- Thread pbmte signal from CSR through cva6.sv, ex_stage, LSU to MMU

PTW validation:

- Leaf PTE: fault on reserved encoding (pbmt==2'b11) and when PBMTE disabled

- Non-leaf PTE: fault on any non-zero pbmt

- When SvpbmtEn=0, non-zero pbmt bits treated as reserved (fault)

TLB and MMU output:

- Store pbmt in TLB tag struct, output via lu_pbmt_o on hit

- Propagate pbmt through shared TLB bypass and SRAM paths

- Add lsu_pbmt_o output with registered pipeline in MMU

All functionality is strictly gated on CVA6Cfg.SvpbmtEn. Existing configurations with SvpbmtEn=0 are functionally unchanged.

Ref: RISC-V Privileged Specification v1.12, Section 12.3
@StackedArchitect
Copy link
Copy Markdown
Author

CI Status Note

The 2 failing jobs (execute-riscv32-tests and execute-riscv64-tests) are not related to this PR's code changes.

All changes in this PR are strictly within core/ (29 files); no Makefile, CI script, or test file was modified.

The failure is caused by a pre-existing path-var vs path_var variable naming mismatch in verif/sim/Makefile (line 41 defines path-var but the recipes use $(path_var)). All directed tests exit immediately with code 2 due to empty $(path_var), before any RTL simulation begins.

This same issue appears to affect fork-based pull_request CI runs. The upstream master branch passes CI because the push event workflow may handle the variable differently.

Happy to re-run CI or address any reviewer feedback.

@JeanRochCoulon
Copy link
Copy Markdown
Contributor

As we need to wait before reviewing the PR, I set the PR as draft.

@JeanRochCoulon JeanRochCoulon marked this pull request as draft April 30, 2026 16:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants