Instruction access fault on user mode

I develop for HiFive1 Rev.B.

I try to use user mode.
Following simple code

jump_to_user:
la a0, user_entry
csrw mepc, a0 // user_entry
li a0, 0x00000080
csrw mstatus, a0
mret
.align 2
user_entry:
ret <-- Instruction access fault

I run J-link + ozone debugger.

When single step running, ret instruction is success.
But, when execute RUN, exception occured.
mcause is Instruction access fault.
mepc/mtval is located on ret-instruction.

I try to disable PMP, but same.

How to run on user mode program?

Try looking at
https://github.com/sifive/example-user-mode

What are you expecting your “ret” to return to? What value is in x1/ ra ? You don’t show that.

You can’t use a “ret” to go from user mode to machine mode. Only a trap can do that. Of course, “ret” can cause a trap if the address in ra doesn’t point to legal machine code, or if it points to an address that doesn’t exist, or if it points to somewhere protected from User mode by PMP. Which seems to be happening.

Sorry,
ra is caller function address.
and jump_to_user function not modifiy ra register.

How to disable PMP ?
I try set all-zero to pmpcfg registers, but exception occured yet.