This commit addresses the integrity part of #1759 by verifying that a
glitch on the data or tag response from the instruction cache raises a
minor alert by the core (if the data/tag returned from the cache is used
by the core).
Signed-off-by: Andreas Kurth <adk@lowrisc.org>
These functions are alternatives to `uvm_hdl_read()` when that function
is not available (e.g., when signals are otherwise optimized away such
as when not dumping waves) and the probe functions are apparently much
faster than `uvm_hdl_read()`, which seems to be implemented as foreign
function.
Signed-off-by: Andreas Kurth <adk@lowrisc.org>
This commit addresses the integrity checking part of #1756 by verifying
that a glitch on the data read from the register file raises a major
alert by the core (if the data read from the register file is used by
the core).
Signed-off-by: Andreas Kurth <adk@lowrisc.org>
These functions are alternatives to `uvm_hdl_read()` when that function
is not available (e.g., when signals are otherwise optimized away such
as when not dumping waves) and the probe functions are apparently much
faster than `uvm_hdl_read()`, which seems to be implemented as foreign
function.
Signed-off-by: Andreas Kurth <adk@lowrisc.org>
This is necessary because after the upcoming update of `lowrisc_ip`,
`prim_util_pkg` will depend on `INC_ASSERT`, which is defined in
`dv_assert.sv`.
Signed-off-by: Andreas Kurth <adk@lowrisc.org>
The `-access rw` option allows Xcelium to access signals in the design
(e.g., with `uvm_hdl_read` or `uvm_hdl_force`) without having to dump
waves (which substantially increases the run time). See [1] for the
background discussion.
[1]: https://github.com/lowRISC/ibex/pull/1879#issuecomment-1300216022
Signed-off-by: Andreas Kurth <adk@lowrisc.org>
Tidy up merge_cov.py to use metadata / pathlib
The 'imc' tool can accept a list of coverage databases as arguments on the
command line, or a '-runfile' argument can point to a file containing a list of
the databases, one entry per line.
Switch to use the file-method, as too many iterations leads to exceeding the
maximium length of arguments to the shell.
This commit addresses #1755 by verifying that a glitch on the PC of Ibex
raises an internal major alert in the core.
Signed-off-by: Andreas Kurth <adk@lowrisc.org>
This commit adds a directed instruction stream to riscv_pmp_full_random_test
To inject random writes to MSECCFG register.
Signed-off-by: Canberk Topal <ctopal@lowrisc.org>
Memory errors trigger the same exception as PMP failures. For this test
we simply need to return to the failing instructions rather than the
more complex handling from the PMP exception handler.
Previously there was a single dummy_instr_id_o signal from ibex_core
which the register file used to determine if it could write to the zero
register (which reads as zero always for real instructions). However a
write occurs in the writeback stage so this signal was not asserted
correctly.
This adds a dummy_instr_wb_o signal to control the write to zero
register. dummy_instr_id_o remains as it's still employed for register
reads for dummy instructions.
Move the handling of resets to the routine core_ibex_base_test::handle_reset,
which sequences the resets of different testbench components to ensure that
everything comes back up in the right sequence after a reset stimulus.
When DCSR is set such that ebreak will enter debug mode we were getting
cosim mismatches. This was because Ibex produces the ebreak on the RVFI
interface and spike effectively skips right over it and executes the
first instruction of the debug handler immediately. Traps have similar
but not identical behaviour so we need a special case in the step
function to handle this.
The recent change to add the fetch_enable sequence in to every regression
can very-rarely cause the 3000 cycle timeout for the irq_stimulus check to fail.
This only happens with a large randomized length of the fetch being disabled,
and long latency for memory accesses.
Increase this timeout.
Overrides some riscv-dv classes to create a custom debug_rom for this test,
which is used to setup the breakpoint registers.
I have found it difficult to get stimulus of this hardware feature without
a more directed test. Improvements or ideas are welcome here.
Test-specific timeout of 5min within which I see >90% pass rate.
Adding this behaviour to ibex_asm_program_gen allows all test to benefit
from the option of jumping directly to these label. Previously, ECALL was
used to provide a single path to this code.
Previously it was asserted when an instruction in ID would cause an
exception but an earlier instruction in WB also causes an exception
which takes priority.
This didn't cause a functional bug as the `id_exception_o` signal was
used in a single place ORed with `wb_exception_o`. However it was
confusing behaviour and could cause killed instructions to appear on the
RVFI causing false cosim mismatches.
Update code from upstream repository https://github.com/google/riscv-
dv to revision be9c75fe6911504c0e6e9b89dc2a7766e367c500
* Reserve one extra word when pushing GPRs to kernel stack (Harry
Callahan)
* Store user-stack-pointer on kernel stack when pushing/popping GPRs
(Harry Callahan)
Signed-off-by: Harry Callahan <hcallahan@lowrisc.org>
It is illegal to see an execution/read/write denied while in Machine
mode if MML is disabled. Add this combination to our illegal bin list.
Signed-off-by: Canberk Topal <ctopal@lowrisc.org>
It was triggered only on the debug wakeup actually occurring, so in
particular would never capture debug activity around entering sleep. Now
it just considers if there's something that would trigger debug wakeup.
This cross wasn't much use as many of the transitions it was crossing
with instruction types only occur when the pipeline is empty (so there's
no instruction type to check).
The remaining interesting cases are already covered by other crosses
(e.g. `debug_if_entry_instr_cross` and `pipe_flush_instr_cross`).
Also adds an assertion to check the pipe is empty when we transition to
IRQ_TAKEN (we need this condition to hold to ensure we don't need extra
coverage for instruction types on this transition).
When in the FLUSH state we cannot have `csr_pipe_flush` set as it
depends upon `instr_executing` being set (within `ibex_id_stage`) and
that is only set in the DECODE stage.
