| Affected product/code base |
PicoRV32(https://github.com/YosysHQ/picorv32). Commit ID 87c89acc18994c8cf9a2311e871818e87d304568 |
PicoRV32(https://github.com/YosysHQ/picorv32). Commit ID 87c89acc18994c8cf9a2311e871818e87d304568 |
OR1200 processor (https://github.com/openrisc/or1200) . Commit ID 83ac6b42d73f00daa88a996a1f6738d5a639a105" |
OR1200 processor (https://github.com/openrisc/or1200) . Commit ID 83ac6b42d73f00daa88a996a1f6738d5a639a105" |
OR1200 processor (https://github.com/openrisc/or1200) . Commit ID 83ac6b42d73f00daa88a996a1f6738d5a639a105" |
| Description |
The bug resides within the processor memory interface, where the address calculation for subsequent memory operations is not accurately updated. This flaw can result in disruptions to memory access, such as incorrect instruction fetching or inadvertent data retrieval from unintended memory locations, thereby compromising the reliability and integrity of the processor's operation. |
The bug has been identified in the PicoRV32 Co-Processor Interface, where instructions meant for the co-processor are not fully fetched into the decode stage, leading to incomplete or incorrect data being forwarded to the co-processor. This bug undermines the reliability of custom instruction execution, limiting the effectiveness and compatibility of hardware acceleration through the co-processor interface. |
The bug was discovered in the front-end design of the OR1200 processor, specifically between the Load-Store Unit (LSU) and the Debug Unit. When the Debug Unit performs debugging executions, it requests a memory load operation. Upon receiving this request, the LSU retrieves the requested data from memory and makes it available to the Debug Unit during the debugging process. It was detected that an incomplete data retrieval occurred from the LSU in response to the debugging request. This leads to incorrect data being received by the Debug Unit, which results in the misinterpretation of memory states and prevents the debugging entity from diagnosing issues in the processor. |
The bug arises when the instruction 95bf022d fails to execute in the synthesized netlist, resulting in an incomplete program counter (PC) update and undefined program flow. The instruction is executed, and the program counter fields are in an undefined state. This discrepancy causes disruptions in the program executions. |
The issue lies in the inaccurate update of program counter (PC) values when the values in the Next Program Counter (NPC) stored in the Special Purpose Registers (SPRs) change. The program counter is stalled at its previous value when the NPC is updated. This introduces the vulnerability of incorrect program fetching, causing the processor to stall. |
| Additional Info |
Issue Location: https://github.com/YosysHQ/picorv32/issues/269 Trigerring Input: When mem_addr is x"00000074" and pcpi_insn is x"DD679663" Expected Output: mem_addr: 64 bit memory value PicoRV value: xxxxxxxx (unknown value) |
Issue Location: https://github.com/YosysHQ/picorv32/issues/269 Trigerring Input: When mem_addr is x"00000074" and pcpi_insn is x"DD679663" Expected Output: mem_addr: 64 bit memory value PicoRV value: xxxxxxxx (unknown value) |
Issue Location: https://github.com/openrisc/or1200/blob/master/rtl/verilog/or1200_cpu.v Trigeering Vectors: When the du_lsu_load_dat is x"7759A981" Expetcetd Outputs : any 64-bit memory value OR1200 Output: unknown value (xxxxxxxx) |
Issue Location: https://github.com/openrisc/or1200/blob/master/rtl/verilog/or1200_cpu.v Trigeering Vectors: When the ex_insn is "x"95bf022d" Expected Outputs: ex_insn:Executed Instruction, ex_pc: Program Counter Value OR1200 Output : ex_insn: unknown value (xxxxxxxx) ,ex_pc: unknown value (xxxxxxxx) |
Issue Location: https://github.com/openrisc/or1200/blob/master/rtl/verilog/or1200_genpc.v Trigeering Input: spr_dat_npc: any 64-bit PC value Expected Output: cpu_adr_o: Updated PC value when the spr_data_npc changes OR1200 Output: cpu_adr_o: Previous PC value |
