From 2af76c21feb106a977b6245b6309ea868b7b7acd Mon Sep 17 00:00:00 2001 From: Flavien Solt Date: Mon, 1 Jun 2026 11:56:45 +0800 Subject: [PATCH] hpcp: gate counter enables on combinational cnt_mode_dis_pre The per-counter enables in ct_hpcp_top.v (mcycle_en, minstret_en, mhpmcnt3_en..mhpmcnt18_en, the four L2 counter enables, and the exported hpcp_xx_cnt_en) gate on the registered cnt_mode_dis. That register lags the combinational cnt_mode_dis_pre by one cycle, and cnt_mode_dis_pre already reflects the new privilege mode and the pmdm/pmds/pmdu bits on a privilege-transition cycle. So the first cycle after a transition into a disabled mode still increments the counters: every entry into a disabled mode over-counts by one event and every exit under-counts by one. Drive the 23 enables from cnt_mode_dis_pre so the per-mode disable takes effect on the transition cycle. The registered cnt_mode_dis is retained for the clock-gating term at line 1086 (cnt_mode_dis_pre ^ cnt_mode_dis), which keeps the block clocked across the transition cycle and is unchanged. The change is one operand per line on 23 lines and adds no flop. Security relevance: a deployment that uses pmdm/pmds/pmdu to keep higher-privilege events out of a counter a lower-privilege reader can sample no longer fully seals those events across a privilege boundary, leaking about one bit per transition. A Yosys SAT miter and a Verilator reproducer are available on request. --- .../gen_rtl/pmu/rtl/ct_hpcp_top.v | 48 +++++++++---------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/C910_RTL_FACTORY/gen_rtl/pmu/rtl/ct_hpcp_top.v b/C910_RTL_FACTORY/gen_rtl/pmu/rtl/ct_hpcp_top.v index 52952eb..63600c6 100644 --- a/C910_RTL_FACTORY/gen_rtl/pmu/rtl/ct_hpcp_top.v +++ b/C910_RTL_FACTORY/gen_rtl/pmu/rtl/ct_hpcp_top.v @@ -1294,25 +1294,25 @@ assign hpcp_cnt_en = (tme[1:0] == 2'b00) // enable counter -assign mcycle_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !mcntinhbt_value[0]; -assign minstret_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !mcntinhbt_value[2]; - -assign mhpmcnt3_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[3] && !mcntinhbt_value[3] && (|mhpmevt3_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt4_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[4] && !mcntinhbt_value[4] && (|mhpmevt4_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt5_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[5] && !mcntinhbt_value[5] && (|mhpmevt5_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt6_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[6] && !mcntinhbt_value[6] && (|mhpmevt6_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt7_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[7] && !mcntinhbt_value[7] && (|mhpmevt7_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt8_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[8] && !mcntinhbt_value[8] && (|mhpmevt8_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt9_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[9] && !mcntinhbt_value[9] && (|mhpmevt9_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt10_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[10] && !mcntinhbt_value[10] && (|mhpmevt10_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt11_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[11] && !mcntinhbt_value[11] && (|mhpmevt11_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt12_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[12] && !mcntinhbt_value[12] && (|mhpmevt12_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt13_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[13] && !mcntinhbt_value[13] && (|mhpmevt13_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt14_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[14] && !mcntinhbt_value[14] && (|mhpmevt14_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt15_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[15] && !mcntinhbt_value[15] && (|mhpmevt15_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt16_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[16] && !mcntinhbt_value[16] && (|mhpmevt16_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt17_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[17] && !mcntinhbt_value[17] && (|mhpmevt17_value[HPMEVT_WIDTH-1:0]); -assign mhpmcnt18_en = !rtu_yy_xx_dbgon && !cnt_mode_dis && !cnt_mask[18] && !mcntinhbt_value[18] && (|mhpmevt18_value[HPMEVT_WIDTH-1:0]); +assign mcycle_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !mcntinhbt_value[0]; +assign minstret_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !mcntinhbt_value[2]; + +assign mhpmcnt3_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[3] && !mcntinhbt_value[3] && (|mhpmevt3_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt4_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[4] && !mcntinhbt_value[4] && (|mhpmevt4_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt5_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[5] && !mcntinhbt_value[5] && (|mhpmevt5_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt6_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[6] && !mcntinhbt_value[6] && (|mhpmevt6_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt7_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[7] && !mcntinhbt_value[7] && (|mhpmevt7_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt8_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[8] && !mcntinhbt_value[8] && (|mhpmevt8_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt9_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[9] && !mcntinhbt_value[9] && (|mhpmevt9_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt10_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[10] && !mcntinhbt_value[10] && (|mhpmevt10_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt11_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[11] && !mcntinhbt_value[11] && (|mhpmevt11_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt12_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[12] && !mcntinhbt_value[12] && (|mhpmevt12_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt13_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[13] && !mcntinhbt_value[13] && (|mhpmevt13_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt14_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[14] && !mcntinhbt_value[14] && (|mhpmevt14_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt15_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[15] && !mcntinhbt_value[15] && (|mhpmevt15_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt16_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[16] && !mcntinhbt_value[16] && (|mhpmevt16_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt17_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[17] && !mcntinhbt_value[17] && (|mhpmevt17_value[HPMEVT_WIDTH-1:0]); +assign mhpmcnt18_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && !cnt_mask[18] && !mcntinhbt_value[18] && (|mhpmevt18_value[HPMEVT_WIDTH-1:0]); //============================================================================== // Counter Adders @@ -4293,10 +4293,10 @@ assign l2cnt_ra_inhbt[31:0] = mcntinhbt_value[31:0] >> cnt0_event_index[5:0]; assign l2cnt_rm_inhbt[31:0] = mcntinhbt_value[31:0] >> cnt1_event_index[5:0]; assign l2cnt_wa_inhbt[31:0] = mcntinhbt_value[31:0] >> cnt2_event_index[5:0]; assign l2cnt_wm_inhbt[31:0] = mcntinhbt_value[31:0] >> cnt3_event_index[5:0]; -assign l2cnt_ra_cnt_en = !cnt0_event_index[5] && !l2cnt_ra_inhbt[0] && !rtu_yy_xx_dbgon && !cnt_mode_dis && hpcp_cnt_en; -assign l2cnt_rm_cnt_en = !cnt1_event_index[5] && !l2cnt_rm_inhbt[0] && !rtu_yy_xx_dbgon && !cnt_mode_dis && hpcp_cnt_en; -assign l2cnt_wa_cnt_en = !cnt2_event_index[5] && !l2cnt_wa_inhbt[0] && !rtu_yy_xx_dbgon && !cnt_mode_dis && hpcp_cnt_en; -assign l2cnt_wm_cnt_en = !cnt3_event_index[5] && !l2cnt_wm_inhbt[0] && !rtu_yy_xx_dbgon && !cnt_mode_dis && hpcp_cnt_en; +assign l2cnt_ra_cnt_en = !cnt0_event_index[5] && !l2cnt_ra_inhbt[0] && !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && hpcp_cnt_en; +assign l2cnt_rm_cnt_en = !cnt1_event_index[5] && !l2cnt_rm_inhbt[0] && !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && hpcp_cnt_en; +assign l2cnt_wa_cnt_en = !cnt2_event_index[5] && !l2cnt_wa_inhbt[0] && !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && hpcp_cnt_en; +assign l2cnt_wm_cnt_en = !cnt3_event_index[5] && !l2cnt_wm_inhbt[0] && !rtu_yy_xx_dbgon && !cnt_mode_dis_pre && hpcp_cnt_en; assign l2cnt_en[3:0] = {l2cnt_wm_cnt_en,l2cnt_wa_cnt_en,l2cnt_rm_cnt_en,l2cnt_ra_cnt_en}; @@ -4342,7 +4342,7 @@ assign hpcp_cp0_data[63:0] = (l2cnt_sel && cnt_bit_mask[0]) assign hpcp_cp0_int_vld = |(cntinten_value[31:0] & cntof_int[31:0]); assign hpcp_cp0_sce = sce; -assign hpcp_xx_cnt_en = !rtu_yy_xx_dbgon && !cnt_mode_dis; +assign hpcp_xx_cnt_en = !rtu_yy_xx_dbgon && !cnt_mode_dis_pre; //========================================================== // Output to BIU