Page table fault when accessing virtual address xxx.

[zhaorui233]

Do I have to use FS mode if I want to append a device ?
Does there any way to append a device without using Linux ?

I would like to append a new device using SE mode, so I create a new device named 'PKCC' inhert from 'BasicPioDevice' in '/src/dev'.
I recompile the gem5 base RISCV32 ISA, and generate the build/RISCV/gem5.debug sucessfully.
Then I add the new PKCC device in the config file like this:

import m5
from m5.objects import *
from gem5.components.memory import *

system = System()
system.clk_domain = SrcClockDomain()
system.clk_domain.clock = '1GHz'
system.clk_domain.voltage_domain = VoltageDomain()
system.mem_mode = 'timing'

system.mem_ranges = [AddrRange('512MB'),
                     AddrRange(start=0xF0000000, size=0x2000)]

system.cpu = TimingSimpleCPU()
system.membus = SystemXBar()

system.cpu.icache_port = system.membus.cpu_side_ports
system.cpu.dcache_port = system.membus.cpu_side_ports
system.cpu.createInterruptController()

system.system_port = system.membus.cpu_side_ports
system.mem_ctrl = MemCtrl()
system.mem_ctrl.dram = DDR3_1600_8x8(device_size="32MB")
system.mem_ctrl.dram.range = system.mem_ranges[0]
system.mem_ctrl.port = system.membus.mem_side_ports

system.pkcc = PKCC(
    pio_addr=0xF0000000,
    pio_latency="10ns",
    # pio_size=0x1004,
)

system._off_chip_devices = [system.pkcc]

for device in system._off_chip_devices:
    device.pio = system.membus.mem_side_ports

binary = 'tests/test-progs/paixu/bin/riscv/lowrisc/paixu.elf'

# for gem5 V21 and beyond
system.workload = SEWorkload.init_compatible(binary)

process = Process()
process.cmd = [binary]

system.workload.wait_for_remote_gdb = False

system.cpu.workload = process
system.cpu.createThreads()

root = Root(full_system = False, system = system)
m5.instantiate()

print("Beginning simulation!")
exit_event = m5.simulate()

print('Exiting @ tick {} because {}'
      .format(m5.curTick(), exit_event.getCause()))

the C program 'paixu.elf' will access the address '0xF0000000',

# include <stdio.h>

#define PKCC_RAM_START_ADDR (int *)0xF0000000
int main(void)
{
    
    int a[] = {900, 2, 3, -58, 34, 76, 32, 43, 56, -70, 35, -234, 532, 543, 2500};
    // some code...
    for (i=0; i<n; ++i)
    {
        printf("%d\x20", a[i]);
    }
    printf("\n");

    *PKCC_RAM_START_ADDR = 0x12345678;
    n = *PKCC_RAM_START_ADDR;

    // printf("%x\n", n);

    return 0;
}

But the access to address 0xF0000000 failed with the follwing fatal:

gem5 Simulator System.  https://www.gem5.org
gem5 is copyrighted software; use the --copyright option for details.

gem5 version 23.0.1.0
gem5 compiled Sep  4 2023 08:36:55
gem5 started Sep  4 2023 11:14:21
gem5 executing on dell-workstation, pid 15557
command line: build/RISCV/gem5.debug configs/tutorial/RISCV/tarim.py

Global frequency set at 1000000000000 ticks per second
src/arch/riscv/linux/se_workload.cc:60: warn: Unknown operating system; assuming Linux.
src/base/statistics.hh:279: warn: One of the stats is a legacy stat. Legacy stat is a stat that does not belong to any statistics::Group. Legacy stat is deprecated.
system.remote_gdb: Listening for connections on port 7000
Beginning simulation!
src/sim/simulate.cc:194: info: Entering event queue @ 0.  Starting simulation...
2500 900 543 532 76 56 43 35 34 32 3 2 -58 -70 -234 
src/sim/faults.cc:102: panic: panic condition !handled && !tc->getSystemPtr()->trapToGdb(GDBSignal::SEGV, tc->contextId()) occurred: Page table fault when accessing virtual address 0xf0000000
Memory Usage: 662724 KBytes
Program aborted at tick 1170463000
--- BEGIN LIBC BACKTRACE ---
build/RISCV/gem5.debug(+0x2cc457)[0x564f51748457]
build/RISCV/gem5.debug(+0x2f52b5)[0x564f517712b5]
/lib/x86_64-linux-gnu/libc.so.6(+0x42520)[0x7f6530a42520]
/lib/x86_64-linux-gnu/libc.so.6(pthread_kill+0x12c)[0x7f6530a96a7c]
/lib/x86_64-linux-gnu/libc.so.6(raise+0x16)[0x7f6530a42476]
/lib/x86_64-linux-gnu/libc.so.6(abort+0xd3)[0x7f6530a287f3]
build/RISCV/gem5.debug(+0x18fbde)[0x564f5160bbde]
build/RISCV/gem5.debug(+0x36456b)[0x564f517e056b]
build/RISCV/gem5.debug(+0xbfeb5c)[0x564f5207ab5c]
build/RISCV/gem5.debug(+0xbf367b)[0x564f5206f67b]
build/RISCV/gem5.debug(+0xbf0e3b)[0x564f5206ce3b]
build/RISCV/gem5.debug(+0xbf2699)[0x564f5206e699]
build/RISCV/gem5.debug(+0xbfbf9e)[0x564f52077f9e]
build/RISCV/gem5.debug(+0x12b8f7b)[0x564f52734f7b]
build/RISCV/gem5.debug(+0x15cca89)[0x564f52a48a89]
build/RISCV/gem5.debug(+0xbf1fcd)[0x564f5206dfcd]
build/RISCV/gem5.debug(+0xc008a9)[0x564f5207c8a9]
build/RISCV/gem5.debug(+0x1595b4c)[0x564f52a11b4c]
build/RISCV/gem5.debug(+0x1592398)[0x564f52a0e398]
build/RISCV/gem5.debug(+0x158ef2b)[0x564f52a0af2b]
build/RISCV/gem5.debug(+0x1535b76)[0x564f529b1b76]
build/RISCV/gem5.debug(+0xbf404d)[0x564f5207004d]
build/RISCV/gem5.debug(+0xbf4505)[0x564f52070505]
build/RISCV/gem5.debug(+0x2e15fd)[0x564f5175d5fd]
build/RISCV/gem5.debug(+0x314e87)[0x564f51790e87]
build/RISCV/gem5.debug(+0x314923)[0x564f51790923]
build/RISCV/gem5.debug(+0x16ab042)[0x564f52b27042]
build/RISCV/gem5.debug(+0x16a94d6)[0x564f52b254d6]
build/RISCV/gem5.debug(+0x16a53b9)[0x564f52b213b9]
build/RISCV/gem5.debug(+0x16a5424)[0x564f52b21424]
build/RISCV/gem5.debug(+0x1512c7)[0x564f515cd2c7]
/lib/x86_64-linux-gnu/libpython3.10.so.1.0(+0x128023)[0x7f6531d28023]
--- END LIBC BACKTRACE ---
For more info on how to address this issue, please visit https://www.gem5.org/documentation/general_docs/common-errors/ 

Aborted (core dumped)

how to solve the error? Please help.

[hnpl]

PKCC_RAM_START_ADDR is a pointer pointing to a virtual address, so gem5 translates that address. Subsequently, this results in translation fault because the emulated page table in gem5 does not have the translation for that address.

Typically, if you do FS mode, you can open an mmap to "/dev/mem" to use physical address directly.

If you want to avoid FS mode, you can modify gem5 to not trigger the address translation process for that particular address range.

[powerjg]

To follow up, in SE mode, you can use Process.map to insert virt->phys mappings into the emulated page table. See https://github.com/gem5/gem5/blob/stable/src/sim/Process.py#L39

You can also use mmap in SE mode to get the specific virtual address that you used in the map function described above.

Finally, you may also be interested in the EmulatedDriver class found here: https://github.com/gem5/gem5/blob/stable/src/sim/Process.py#L75