SVD missing atomic alias registers #2830
Labels
No labels
bazel
bluetooth
board settings
boot_stage2
bug
build
c++
can't reproduce
clang
clib-interface
cmsis
code cleanliness
code size
compiler version issues
cyw43_driver
debug
discussion
documentation
duplicate
dynamic_clock
elf2uf2
enhancement
errata
filesystem
flash layout
floating point
FreeRTOS
hardware_adc
hardware_claim
hardware_clocks
hardware_dma
hardware_exception
hardware_flash
hardware_gpio
hardware_i2c
hardware_irq
hardware_pio
hardware_pwm
hardware_rcp
hardware_rtc
hardware_spi
hardware_sync
hardware_uart
hardware_vreg
hardware_watchdog
hardware_xosc
help wanted
host
IAR
installation
invalid
linker scripts
lto
lwip
mbedtls
missing API
needs reporter detail
networking
newlib
newlib-multicore
non-c
non-cmake
non-gcc
openocd
orphan PR
OS integration
pico_async_context
pico_base
pico_binary_info
pico_flash
picolibc
pico_lwip
pico_malloc
pico_multicore
pico_printf
pico_runtime
pico_stdio
pico_stdio_usb
pico_sync
pico_time
pico_util
pioasm
port
question
review
review2
rtos interop
runtime init
static library
svd
test
tinyusb
vscode
wifi integration
wontfix
No milestone
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
gh-raspberrypi/pico-sdk#2830
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Stumbled on this while reversing some RP2350 RISC-V firmware for a CTF challenge.
For example, RP2350.svd defines PADS_BANK0 at 0x40038000, but does not define its atomic alias views:
No idea if this patch is technically correct as I know nothing about SVD files:
It fixes the decompilation in IDA though:
Disassembly for reference:
Relevant section from the datasheet:
2.1.3. Atomic register access
Each peripheral register block is allocated 4 kB of address space, with registers accessed using one of 4 methods,
selected by address decode.
• Addr + 0x0000 : normal read write access
• Addr + 0x1000 : atomic XOR on write
• Addr + 0x2000 : atomic bitmask set on write
• Addr + 0x3000 : atomic bitmask clear on write
This allows software to modify individual fields of a control register without performing a read-modify-write sequence.
Instead, the peripheral itself modifies its contents in-place. Without this capability, it is difficult to safely access IO
registers when an interrupt service routine is concurrent with code running in the foreground, or when the two
processors run code in parallel.
The four atomic access aliases occupy a total of 16 kB. Native atomic writes take the same number of clock cycles as
normal writes. Most peripherals on RP2350 provide this functionality natively, but some peripherals (I2C, UART, SPI and
SSI) add this functionality using a bus interposer. The bus interposer translates upstream atomic writes into
downstream read-modify-write sequences at the boundary of the peripheral, at the cost of additional clock cycles.
Atomic writes that use a bus interposer take two additional clock cycles compared to normal writes.
The following registers do not support atomic register access:
• SIO (Section 3.1), though some individual registers (for example, GPIO) have set, clear, and XOR aliases.
• Any register accessed through the self-hosted CoreSight window, including Arm Mem-APs and the RISC-V Debug
Module.
• Standard Arm control registers on the Cortex-M33 private peripheral bus (PPB), except for Raspberry Pi-specific
registers on the EPPB.
• OTP programming registers accessed through the SBPI bridge.
Our SVD files (there's one for RP2040 and RP2350) are autogenerated using internal tooling. You can learn more about SVD at https://arm-software.github.io/CMSIS_5/SVD/html/index.html
I don't know if we'll be making your suggested change to our SVD files, as I guess we'd need to do that for all peripherals, not just
PADS_BANK0. And as you've highlighted, there are a lot of special-exceptions which would make this tricky to get right.I tried looking at the exceptions, but the datasheet is very unclear about it:
It says "for example, GPIO" but I cannot find any other examples (except maybe ACCESSCTRL?). I did some attempt myself to include the stuff actively used by the pico-sdk (which means you would encounter it while debugging):
More complete RP2350 SVD
Open to suggestions for it! I don't think finding all the aliases will be terribly difficult (especially for you internally I'm just guessing based on the spec with limited experience).
I believe that's referring to "The OUT and OE registers also have atomic SET , CLR , and XOR aliases. This allows software to update a subset of the pins in one operation. This ensures safety for concurrent GPIO access, both between the two cores and between a single core’s interrupt handler and foreground code." (in section 3.1.3. of the RP2350 datasheet).
If you look at the list of SIO registers there's explicit
GPIO_OUT_SET,GPIO_OUT_CLRandGPIO_OUT_XORetc. registers, and alsoDOORBELL_OUT_SET,DOORBELL_OUT_CLRetc.But this is reaching the limits of my knowledge, so I'll shut up now and wait for somebody more knowledgeable to comment 😉