Zalrsc (sc.w/d) checking reservation before checking pmp permission.

[sudo-apt-abdullah]

A region with no permission (XWR-000) from 0x80002000 to 0x80002040 is there and we're trying to lr.w from start of the region.

[233] [M]: 0x800004A0 (0x1007A62F) lr.w x12, (x15)
trapping from M to M to handle load-access-fault
handling exc#0x05 at priv M with tval 0x80002000
CSR mstatus (0x300) <- 0x00001800
CSR mstatush (0x310) <- 0x00000000
CSR mcause (0x342) <- 0x00000005
CSR mtval (0x343) <- 0x80002000
CSR mepc (0x341) <- 0x800004A0 

Since, there's no permission read permission, it throws access-fault and when we're trying to sc.w at the same address, with no write permission it's checking reservation first and since no load occur at that address, it simply putting 1 in rd. But it should check the pmp permission first and throw access-fault.

[345] [M]: 0x800004AC (0x18C7A62F) sc.w x12, x12, (x15)
x12 <- 0x00000001

[KotorinMinami]

To my knowledge, the lr.w instruction, upon successful execution, registers a reservation set. When sc.w is used, it checks if the target has a corresponding reservation set. If no such set exists, it will not access memory. In the scenario you described, sc.w will not access memory, and therefore will not throw an access-fault.

[Timmmm]

I believe @sudo-apt-abdullah is correct. If you check vmem_write_addr it performs address translation, then checks the reservation, and then attempts the physical memory access which checks PMPs.

However the ISA manual says:

Attempting to execute a load or load-reserved instruction which accesses a physical address within a PMP region without read permissions raises a load access-fault exception. Attempting to execute a store, store-conditional, or AMO instruction which accesses a physical address within a PMP region without write permissions raises a store access-fault exception.

This is a bit awkward with how the code is currently structured. It's also kind of similar to the CBO instructions which have to have extra calls to phys_access_check().

We should probably move the PMA/PMP checks into vmem_read/vmem_write. It will make more sense after #787 I think.

[KotorinMinami]

This is my mistake. I must have overlooked the spec.

[Timmmm]

Hmm I think we also found this in our fork and fixed it but I guess I never got around to upstreaming it, sorry!