[pmp/debug]: Debug Mode data access uses `mstatus.MPRV` when `dcsr.mprven=0`

[KnightGOKU]

Observed Behavior

Ibex hardwires dcsr.mprven to zero. However, a data access executed in Debug Mode still uses mstatus.MPRV and mstatus.MPP to select the PMP privilege level.

The test enters Debug Mode with:

mstatus.MPRV = 1
mstatus.MPP  = U
dcsr.mprven   = 0

The Debug ROM then executes a load from 0x3000. The current RTL reports:

priv_lsu     = U
pmp_err      = 1
external_req = 0

The access is checked as a U-mode access and is rejected by PMP.

Expected Behavior

According to Sections 4.1 and 4.8 of the RISC-V External Debug Support Specification 0.13.2, Debug Mode must ignore mstatus.MPRV when dcsr.mprven=0.

The same load should therefore use M-mode privilege. The expected result is:

priv_lsu     = M
pmp_err      = 0
external_req = 1

Steps to Reproduce

1. Build and run the test with Verilator: run_ibex_core_debug_mprven.sh
2. The test configures an RX PMP region for the program and Debug ROM, and an X-only region covering 0x3000–0x3fff.
3. The M-mode program sets mstatus.MPRV=1 and mstatus.MPP=U.
4. The test enters Debug Mode through debug_req_i.
5. The Debug ROM executes lw t2, 0(t1) with t1=0x3000.
6. Observe the effective LSU privilege, the PMP error, and the external data request.

The current RTL produces:

debug target load: priv_lsu=0 pmp_err=1 external_req=0 mprv=1 mpp=0

The test intentionally fails when the observed result does not match the expected M-mode access.

Testbench

ibex_core_debug_mprven_tb.sv

testcases.zip

Environment

Ibex source revision: 57d37bf9008640415532d23ad59018b795c642aa.

The test uses Verilator and the real ibex_core.

[elliotb-lowrisc]

Hi @KnightGOKU, thanks for finding this! It looks to me like something we should get fixed. Hopefully @SamuelRiedel will be able to take a look soon.

[vogelpi]

Moving to M4 as P2, @SamuelRiedel please re-assign the priority as you see fit.