lowRISC / lowRISC/opentitan

Increase Simulation Accuracy of Unknown Stack Memory

Open
#2,263 9 comments 0 reactions 0 assignees View on GitHub
Component:DV Component:Software Earlgrey-PROD Triaged Hotlist:Software
Dominant language
SystemVerilog
Stars
3.6k
Forks
1.1k
Avg merge
2d 22h
Merged PRs (30d)
141

Description

The DV Simulation environment currently initialises all memory with Xs when starting simulation, and will halt simulation if memory is read that contains Xs (so memory must be written before it is read).

This has turned up a bug in the Tock image already (#2241), though during investigating this issue I realised that the erroring instruction is not the first read of memory that was actually reading semantically uninitialised memory - because this was a stack access, some of the accesses before the erroring one were also reading memory the program should have considered "uninitalised", but weren't because a previous function had used the same part of the stack.

Given:
- we know the ABI/calling convention on RISC-V (`sp` (aka `x2`) points to the limit of the stack, quoting the psABI: "Procedures must not rely upon the persistence of stack-allocated data whose addresses lie below the stack pointer."), and
- we have a fixed stack area (as known from the linker scripts),
Is there a possibility of marking stack memory as uninitialised when the stack pointer is increased (ie points to a higher address)?

One thing that that will cut out false positives is to only do this where the old and new values are within the extents of the declared stack space, rather than any changes of `sp`.

This would catch reading any stack addresses that have not been initialised before they are read, in a more accurate way than we currently do, which will help catch software bugs.

A few changes that would help this on the software side are:
- [ ] turn off zeroing the stack in `flash_crt.S` and maybe `rom_crt.S` too (only in simulation environments, it's useful to keep it turned on for production code).
- [ ] ensure that the linker scripts for both Tock and C export the same symbols which point to the extents of the stack, so simulators can more easily understand where the stack actually is.

Contributor guide

Open the contributing guide

Research direction

Start by tracing DV simulation memory initialization and stack-pointer handling, then inspect flash_crt.S, rom_crt.S, and the linker scripts for Tock and C. Determine how the declared stack bounds can be shared with the simulator. Done means simulation marks stack memory uninitialized when sp increases within those bounds and catches reads before initialization without affecting production stack behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
embedded-iot, operating-systems, testing-qa
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.