PMP (Physical Memory Protection) on LicheePi4A

[fabian-thomas]

[Not sure if this is the correct place to post something like this. Please redirect me if this is not the right place.]

Hey,

I'm currently working on a research project on RISC-V where I try to protect memory regions from either OpenSBI or the kernel. Unfortunately I can't get PMP to work on the LicheePi4a (also not on the BeagleV Ahead, related post: https://forum.beagleboard.org/t/pmp-physical-memory-protection-on-beaglev-ahead/37928/1).

Every time I boot up the system, the OpenSBI PMP detection prints:

Boot HART PMP Count       : 0
Boot HART PMP Granularity : 0
Boot HART PMP Address Bits: 0

This detection simply checks if the PMP CSRs are writable, so I'm pretty confident that it should print 8 or 16 if the chip behaves correctly (The official C910 documentation states that there are options with either 8 or 16 PMP registers, so I assume my machine has at least 8).

My current guess is that either PMP is broken on the C910 (TH1520) or that some software I currently have no control of already sets the PMP registers and sets them locked so that I can't change them later. What stands against this guess is that reading from the pmp registers returns 0, which I would not assume even in the locked case.

I already tried to patch the two projects I'm currently aware of that could setup PMP related functionality:

• U-Boot (used https://github.com/chainsx/thead-u-boot); I even ripped out any occurence of pmpcfg and pmpaddr in the entire repo to be sure that it does not set up PMP
• OpenSBI (also tried upstream which failed with init_coldboot: timer init failed (error -3))

Here are my main questions:

1. Has someone found PMP working on the C910 (TH1520)?
2. I found that the Linux kernel sets up PMP in early boot when it is compiled with M_MODE. Is PMP required to be setup to do memory writes? I assumed when PMP is not setup it just performs no checks.
3. Is there some other software involved in setting up PMP before U-Boot or in between the jump from U-Boot to OpenSBI?

[RevySR]

OpenSBI (also tried upstream which failed with init_coldboot: timer init failed (error -3))

You might try this branch
https://github.com/revyos/opensbi/tree/th1520-v1.4

[RevySR]

It seems to refer to the following code

https://github.com/revyos/thead-u-boot/blob/e0247b8a622a08256bb876fe706eedd3d5d645f7/board/thead/light-c910/spl.c#L83

https://github.com/revyos/thead-u-boot/blob/e0247b8a622a08256bb876fe706eedd3d5d645f7/board/thead/ice-c910/spl.c#L20

[fabian-thomas]

OpenSBI (also tried upstream which failed with init_coldboot: timer init failed (error -3))

You might try this branch https://github.com/revyos/opensbi/tree/th1520-v1.4

Thanks for posting this. This SBI version works, but still doesn't recognize any PMP registers.

It seems to refer to the following code

https://github.com/revyos/thead-u-boot/blob/e0247b8a622a08256bb876fe706eedd3d5d645f7/board/thead/light-c910/spl.c#L83

https://github.com/revyos/thead-u-boot/blob/e0247b8a622a08256bb876fe706eedd3d5d645f7/board/thead/ice-c910/spl.c#L20

I haven't tried that exact u-boot repo, but I tried at least 3 different repositories with different versions. I previously also removed these lines and tried with that but with no luck yet.

Do you know what the lines in the first link you sent do? (e.g., writel(0x0 >> 12, (void *)(PMP_BASE_ADDR + 0x104));)
What is this PMP_BASE_ADDR? Is that something that the hardware queries for a PMP configuration? I can't find it in any other repository.

[fabian-thomas]

Found something here. I understand this as, PMP_BASE_ADDR=ffdc020000 is mapped to the pmp registers.

I tried writing pmp configuration to this memory range, but I still can't get PMP to work. It seems like RISC-Vs WILR mechanics keep dropping the interesting bits from the values I write into pmpcfg0 (first 8 bytes at PMP_BASE_ADDR). Every time I write and then read, the bits PMP_A=0x18 are cleared.

If anyone is able to write meaningful configurations there please keep me updated. Looking at this again I got another question:
Where do the initial values in this range come from?

[RevySR]

The th1520's pmp is a non-standard implementation, so you're assuming it can't be enabled