Add CHERI support to Ibex #2

Also adds SocketPacketUtils from https://github.com/CTSRD-CHERI/SocketPacketUtils Change-Id: I2b175f8d33e2c21389a1e6780712aa38060ec09e

Change-Id: I65f8c23fed05fcacc4834e645be8886740d762f9

Change-Id: I24c5994c7b996e8238ae102ea79033cad9ed4467

The bus does not currently set the error signal when a request is out of ranges, so this commit adds a very simple error detection in the toplevel. At the moment writes are not cancelled. Change-Id: I11c269f4a01598a7497db0c0dc5674556929ee18

Change-Id: I9073533656c2b5378ff454a307f358964f0bdb17

Change-Id: I72b51851e11865b7f18c115b416cf2a8a118bef5

Change-Id: I93177e7bb0be8889e4da7f17c810c1e1f5af0ebb

Change-Id: Id97de7eb226cfff913c75c6883d7b52d68ee9c31

Change-Id: Iafa1eb7d6640e10590e3af6d64d79ed8078202c6

Change-Id: I4fbd14704ee1e2e24bd51f9ce96e825771b34d84

The SRAM block provided by the shared libraries does not handle reset, so memory is instead implemented in C++ so that it can be reset. Change-Id: Ic572f355ec5204c78425ce121791f461a43e28a0

Change-Id: I4ef24cd83617c1c808098641c82f2016ff426980

The in_count and out_count variables might have strange values when we encounter exceptions and jumps, so remove these as a factor when extracting RVFI data. Change-Id: If235e0aed99ae6ec21a76bf4d91ed43a939f9583

Previously, all our verilator "logic" happened while the clock cycle was low (apart from setting gnt_i signals which happened after it when high). Now, all our logic happens while the clock is high, then we evaluate the core so it can update, and then we set the clock low and evaluate. This commit also makes some tracing dependent on the verbosity - the next commit makes more printing and tracing dependent on verbosity. Change-Id: Id9927feec443d25c26f96eaa74560ecc533cdc31

Change-Id: I7bb76996b33d77cdd9c33b23914a2546fc45b4cd

If there is no real instruction to insert (ie we have run out of instructions, or for some reason our received, in_count or out_count variables got messed up), then insert NOPs instead. This should prevent the core from locking up if we run out of instructions, and should help in debugging. Change-Id: Ia3628b98fab8eeb248fbf497104828daf35d6ffb

When control flow changes occur in the core, the simulation environment needs to replay some instructions (since the instructions that have been inserted were flushed out of the pipeline). This commit adds that logic and also explains it. Change-Id: I9d7ff4f46a6e76edfee8cc60ffce32d10c708334

This is used to track when a MRET or DRET instruction occurs, so that the simulation environment can correctly replay instructions. Change-Id: I4f3f0b81ff8cda3e4b92fd58c393312ce2d47c2b

When an xRET or exception is encountered, the controller goes into the FLUSH state. RVFI data is read while the controller is in the FLUSH state, but the PC is only available the next cycle, so for RVFI we need to set the PC WData again once it is available. Change-Id: Ia6370d03ac15cbac15ae4c44cf3959138d04e21d

In typical uses, MTVEC can be set after the core fetches the first instruction and we can use the boot_addr_i signal to set it. However, when using TestRIG it is possible that the first instruction causes an exception, and in this case there is not enough time to set MTVEC before the exception is handled, so the exception vector will be whatever was in boot_addr_i on boot. This is incompatible with TestRIG, so MTVEC is set to 0 on boot rather than using boot_addr_i. Change-Id: I55f9d1daea9f18ab232d1d85311ed1e846767264

Change-Id: I0c2c98eb2d847ead3118dea69462f6376da1e401

With the changes so far, Ibex reports the same results in RVFI as the Sail-RISCV model modulo the caveats mentioned in the README. Change-Id: I17529b1d9ccb49b2d6f1253e21f6e8acffca2f9a

This was done using the vendor script from the OpenTitan repository. The SocketPacketUtils repository is pinned at the latest commit that successfully built; later commits seem to break compilation. Change-Id: I1f9c881c571257332c70789e8e6fd99b267bcc30

This will provide the CHERI instruction functionality. Currently there is no way to build BluespecSystemVerilog using fusesoc, so building the wrappers requires running "make verilog-wrappers" in the cheri-cap-lib directory. Change-Id: I75ffac7cd914769ddea758a56e5fd709418d467c

Change-Id: I1776e8073eaf8e9f96c2d9a06a13cf63d60e2123

Change-Id: I8521dfbc71693583a3184b7bfde6871eadcb9075

Change-Id: I384f96b0e64c7e8634ddfed81e911161bf073d02

This commit adds the CHERI ALU from the previous CHERI implementation, with several updates to fix some bugs and clean up the code. For now, the CHERI ALU is instantiated but not connected to anything; this is to check that it builds without syntax errors or warnings. Change-Id: I03c675268187b577d02a9ab265bb56eef9ba01f2

There are also a couple of TODOs left in the decoder for a couple of instructions - these will be implemented later Change-Id: I6755155ed23362b7e992ccd774189e718d9fc9a4

Change-Id: I4aa1c601cd1affb80dc8557dd158a902388f8f88

A designer may want the reset value of registers to be different from the "zero" value which is read from register 0. For example in CHERI, register 0 must contain the null capability when read, but the other registers must reset to the almighty capability. Change-Id: Ia1c0e3fcfa0b48c91243772db474f905dda4498c

This commit adds connections between the CHERI decoder opcode signals and the CHERI ALU. It also connects the CHERI ALU to the integer ALU when a CHERI instruction is executing. Change-Id: I1ea27d19fb485552ea094edc277e5aade9365f26

Several fields that were previously 32b integers have now been converted into two fields, one "int" (= integer) and one "cap" (= capability). At the moment only the integer one is used; capabilities read from the register file are converted to integers (through the getAddr instantiations), and integer results generated by the pipeline are converted into capabilities (through the nullWithAddr instantiation). Eventually the capability path will also be used. Change-Id: I6123be912dd9308aa0f8c93b8e7119c0d2aeaab8

Change-Id: I18e37aa25cac0c4fe4a265ae673b355083fd0adf

This value signals whether the write was a capability write or an integer write; a capability write should get its value from the _cap signal, and an integer write should get it from the _int signal. Change-Id: I6f51f3b47af29b6bfee560c5d431171277a22864

Change-Id: I3a5e8011f07d55775c3ea9511e25720e817317f9

With these changes, results from the CHERI ALU are written to the register file. Change-Id: I8a5e2d6b8dcc783cca19d9f856bbefd5b2832f2c

For now, just throw the exception. Later, will need to set the exception cause, save the PC, etc. Change-Id: Ice6bb26915ddac1df6f573bb9f548574459128e0

This commit adds the SCR interface and connects it between ID and the CS register file. This commit also adds an initial implementation of DDC as a SCR. It is writeable via the SCR interface. DDC is also muxed in as either operand A or operand B in certain instructions; this commit adds that muxing. Change-Id: I76b7fc2491c9a2130aa3385ccc05d8587c67737c

Change-Id: Ide36fc5aeabe08ccfe153346761bf16da9be9ec1

Baseline Ibex does not throw exceptions in ID, but with CHERI it does so need to ensure that instructions that cause exceptions do not write to the register file. Change-Id: Id4020dd5d7ca939d1ebbf9d6405569034984d618

There will probably be further changes to this, but for now just hardwire things to make progress. "setKind" expects a Bluespec Tagged Union as its input; there's no easy way to provide this in systemverilog so for now just hardwire things. cheri-cap-lib will probably have an update at some point to improve the situation here. Change-Id: I3c304671c88145b011050d7f966762a16e8974da

This commit adds signals for the PCC in several locations; at the moment this is unused. It is generated by setting the PC as the offset of an almighty capability in the IF stage, and then propagated the same way that the PC is propagated. Eventually logic will move to primarily use the PCC rather than the PC; at this point, PC will be generated by taking the offset of PCC. Change-Id: I787ed9b9925edb0ccafe1ce3727800e86585e3d4

This adds some more SCRs and implements saving MEPCC on exception at the same time as MEPC is saved. This also implements reading PCC and DDC in the decoder; this change is not yet tested. Change-Id: Ifceceaa08488062b6e6c98bbe4c4e6aafd0f1158

Change-Id: Iba24210ed1b03be494bde2ec7cf1d1728863309f

Change-Id: I6f2b623cb9f67b4b200f8c34deaf989a22fe6397

Change-Id: I5eedcd450951039fea6874c4d37c83a628a3999e

Not all paths keep the capability and integer data to be written to the register file in sync, so in some cases when writing a capability the value returned by RVFI was incorrect. Change-Id: I5844a1431451f8f0315e658feb19230395a85c0c

OType is a signed integer so sign extension is required. Change-Id: Ic2d291c2fb4285671969bc50d41f0a3273fabb9e

Change-Id: I9ff21829d7945a83496d4174d1c604cbae0097e4

Change-Id: I2cc6b656a61061a3cfe38d53e593bfbc2296e059

This commit just widens the paths; no capabilities are read or written yet. This functionality will be added in a later commit. Change-Id: Ic15a8a54385d79f744326fb82b176f8b774c7c7d

CBuildCap now unseals the capability but only if it is not a Sentry capability. Change-Id: I45dcf1f5bcee11860852497c6d7474848f8c1449

Exceptions associated with register B should only be thrown if register A is both tagged and unsealed; if A is untagged then an exception associated with register A is thrown, and if A is sealed then no exception is thrown and the conditional seal fails. Change-Id: If062ce0d79c8a1c5837d622f6c829e7073ff4ba1

There is now an explicit pcc_q signal which is used to store the PCC. This is used mostly for the metadata. The IF stage submodules (cache or prefetch buffer) keep track of the PC internally, so the IF stage continuously updates the PCC so that its offset tracks the PC that the submodules report. Change-Id: I66c0eb9a7fc16f572bd1cf09418b54b66df16911

One important thing is that previously jumps could not throw exceptions; now they can, so changes are needed in the IF and ID stages to handle this. In IF, we need to make sure we don't set the PC on jumps if it encountered an exception. In ID, we need to make sure we go to FIRST_CYCLE when a multicycle instruction gets an exception. Note: PCC's bounds are still unused Change-Id: I7c40b293dbca9f686bf0442ebeb4e13ad6ae6ede

Change-Id: If2681e1ded875ef1c3857674fa3bcc7f131755b8

This commit adds CRoundRepresentableLength (CRRL) and CRepresentableAlignmentMask (CRAM). cheri-cap-lib will need to be updated for this to work - at the moment I have changes locally that make it generate the required modules and have added those to the cheri-cap-lib verilog wrapper core file. Change-Id: Iff5d896c7dd11d6dd775f8ce3a82ada0f2f82dd0

Adding CHERI means that we need to support making double-word sized memory accesses at an ISA level (even if we do it by performing two different accesses microarchitecturally), so the RVFI memory access fields need to be widened to hold the full data and masks. Change-Id: I877162a888b7b0c492979e518ed92a343b547916

Instead of writing back an integer to the register file, CFromPtr should write back the modified capability (cs1 with its offset changed to rs2) but with the tag unset. Tag clearing is handled by the setOffset module. Change-Id: I4062ac16dd679c1790566b4950c5c04b8f05d572

When reading or writing capabilities, RVFI should get the in-memory representation of the capability that was read or written. Change-Id: If7a217f99ee478fdbce08708964ca40c58bdccb6

Capability accesses are handled similarly to misaligned accesses in the finite state machine within the load store unit. CHERI does not allow for misaligned capability-wide accesses so all capability accesses will always require 2 requests. The memory interface has been widened by 1 bit to allow transferring capability tags along with the data. At the moment nothing has been done about misaligned capability accesses so behaviour is untested in this case. Change-Id: Icf2abc0053b7fca57a0be2a41458cc53354f89c7

This commit adds a CHERI memory checker that takes a capability as an input and checks that the request going through it is allowed. Previously, all exceptions in the LSU required a memory response; this is no longer true since misaligned capability accesses do not make it out to the bus. Note: At the moment, accesses that cause CHERI exceptions (not misaligned) still go out on the bus. This will be fixed in a later commit. Change-Id: I5915a91ce5a44f72ec31a0f97169959d58320b78

Change-Id: I8d720ea0d6b667050b7316d58d3ef9c6b8d5b245

Rather than deciding whether to actually jump inside IF, make the decision inside the controller Change-Id: Ic67f02eb5bd2f806cbbe477497fb75ade44f0733

This adds PCC checks on fetch. For now, errors are treated as fetch errors, not CHERI errors. This will need to be changed in the future. Change-Id: I7e47dd74498195956023cf8c8e8afc772eebe29e

Change-Id: If4233e0b71fcd1e0cf57dbdb882a4b6d8ddd10f8

With this commit the LSU will treat CHERI memory errors in the same way as it treats bus errors. Note: stores still get put on the bus and will make it out to memory; this will need to be fixed in a later commit. Change-Id: I27520546c4c44e684a8939fbcea9c610fb8d7c88

Change-Id: Ia7ee62bb269288d641d73bde248899a2f0fee5bf

This converts CHERI-errored writes into reads. This should prevent memory from being incorrectly written, but does not solve issues if the underlying memory has stateful reads (ie a FIFO). Change-Id: I2072ee654a2f39ce381c088381adace106bf57b4

Change-Id: I349bf81fd046130035448a344bd8df4bcf372de7

The exception signal for the upper halfword of an instruction should be latched identically to how it is latched for the lower halfword. It was not, so an exception was being thrown one cycle early. Change-Id: I018fc0ce158737f3cd6ad2b341b6076a3899f270

Change-Id: If93310aca17cd6f314bd652d996fbce5ea495521

This commit adds functionality to check whether the target of baseline RISC-V jumps and branches is within the bounds of PCC. This commit is intended to work with the BranchTargetALU but has not been tested with it. The majority of the CHERI ALU has been indented by 1 level to account for the "if" statement at the top -- it looks like git doesn't render this very well. Change-Id: I0b87ab3928610f882419be317083efad06b45d0e

Change-Id: I02065a0415279284b252f4d3dfb0a75aa5353488

When reading or writing any register (except for reading PCC), CSpecialRW needs the ASR permission bit to be set in PCC. Change-Id: Iefd87c12660c5ba00dffcedfa1438830d6c62237

On jumps, if_instr_addr is stale and contains the PC that would have been fetched if there was no control flow change, rather than the new PC to be fetched. Change-Id: I85e279ef8ff3912bc5da2afce1dbf9bbd6a2f172

Capability mode is encoded in the PCC flags, and controls how certain instructions behave (such as memory instructions and AUIPC). This also cleans up the CHERI module instantiations within the ID stage. Change-Id: I98dcd762adac8f2e17f25daed47a5b93375b905f

When checking whether a jump should lead to an exception, the bottom bit should be set to 0 regardless of what the result from the branch target calculation is. Change-Id: Ic00a4e08a8a351118b8c17ce6878527007e293f0

Change-Id: I42434fd7dbe76457558e707c1efce876940b3f8b

Change-Id: I7d889408e46cf1b2260c227b594a45965752f247

And do check in non-Data (ie instruction) memchecker Change-Id: Ib2ca63f6010e343ef60fac5e92131e6cf66a14ef

Some System instructions (CSR access and MRET) require ASR permissions to execute. This commit also includes a fix to ASR exception checking; previously, exceptions on the exceptions_a or exceptions_b lines were being checked as well as checking for ASR and this is not correct. Change-Id: I4917d809c1c8adfc04345f986c0dc0c5b0f16cfb

This adds functionality to set CHERI exception information on CHERI exceptions. However, CHERI exceptions are not yet set correctly in exc_cause_o in ibex_controller. This will be implemented later. Change-Id: I8859e5e550ce0b4092c0c8cc828393eee1f57982

Always set jump_in_dec_o and overwrite_rf_waddr. jump_set_o should be set high on the first cycle when the code capability is being unsealed, and rf_we should be set in the second cycle when the data capability is being unsealed. Change-Id: I12a1c27df1bb9d668e2d3b2985bb94db0e7a53c1

Change-Id: I45c3501016944e1541bd6f63961db7d3a30ae53b

Change-Id: I96fe68bc94f1c62acb963b4ee2704f77094a30e7

CHERI loads use bit 22 to signal whether the result is signed or unsigned, not bit 14 Change-Id: I9e47bbf2999f9fc662901271f05a0c29cc4152ef

Change-Id: I841264f78b118f026580da48808129ea93af6fdc

The "upper" check needs to ensure that we can read the next 2 bytes after the "lower" check Change-Id: I1d14ba7cc999ea633282f1e99a09acf519e0903c

Change-Id: Icfe2d8575e9a65a7c59a9d15f88260317ba7a0a6

The new offset should be based on the old offset, not the bottom bits of the encoded capability... Change-Id: Ibee31e9667324b39a4b2e1a67911e18fc2180f72

Change-Id: Ie395f785fb2835db3fe18631400333785b6f25da

The implementation of CCopyType has been slightly rewritten for clarity. The logic for writing back a capability vs integer has been inverted. (An integer should be written when the type IS a reserved type, ie it IS NOT a software type). Change-Id: I465507fd64a415067419a9ad54ad6714ad184fa4

M-mode SCRs can only be read when in M-mode, otherwise they should throw an illegal instruction exception. Change-Id: I7b38fd70dec423a9ffdcc5957d5b9a8eff0ce0d7

Only check the "upper" exception signal if this was a full instruction fetch that started on a 4-byte-aligned boundary (if it was a compressed fetch then we only need the bottom half, and if it was 4-byte-unaligned then we only need the bottom half because the rest of the instruction was fetched in the previous aligned read). Note: this has not been tested with compressed instruction fetching, only with unaligned full instruction fetches. Change-Id: I38183f342fa02f71c14015b7e3b7fdcc02eb2dae

When the processor is in capability mode, JAL and JALR should follow the semantics of CJALR with an immediate. Change-Id: I2f6dd1ae94a99254ddae82404c5db8346c8167fb

With CHERI, PC is defined as being the _offset_ of PCC. However, the modules in the IF stage that handle actually fetching instructions and setting the memory interface signals work with addresses. This cleans up the variable names to more explicitly state whether the variable is an offset (equivalent to a PC) or an address. It also adds logic that correctly converts between the two. This approach requires the fewest modifications to the internal logic of the IF stage but might be wasteful - it might be possible to improve the logic if the modules use offsets rather than addresses, but this change would require additional care (for example to ensure that addresses requested on the interface are still aligned when PCC's base is not 4-byte aligned. Change-Id: If965b3d3c872ae3244307f71c9c177c44addefe7

When in capability mode, JALR becomes CJALR with an immediate. If the input capability is a Sentry, then the immediate must be 0 (otherwise we would be modifying a sealed capability which is not allowed). Change-Id: Ice882c03fc590cbec2472a683f63698bae183260

The bottom bit of the target will be set to 0 for the jump, so also set it to 0 for the bounds checks. Change-Id: I21c829cb6f3a3825a1b5d964ec48ae56f46555e1

This is so that the code is more similar to the CSR code. MRET ASR check is still done in ibex_id_stage, since this is not connected to CS registers. Change-Id: I2f2965ff942b016307a3e2a3606415ca2d760041

There is a subtle difference between how setOffset and incOffset check whether the resulting capability should be tagged. To align with the model, use the incOffset function for the CIncOffset and CIncOffsetImmediate instructions. Change-Id: Iac3f1ba17814bf62287f9591fadc9d9c683f4e42

The sealing mechanism in cheri-cap-lib has changed since the original implementation, so isSealed was giving the wrong data and there were new reserved capability types that were not being handled. This commit fixes those issues Change-Id: I664293a32ecceb1521c51dfa20d96749dea52e29

When the LSU executes a misaligned or capability-wide memory access, only save the exceptions from the first access. The checks in the first access test permissions for both accesses. Change-Id: I4d67c3bd04304886d362dd738d6624dd070badfd

The sail model allows instruction fetches that overflow the address space calculation (ie requesting the instruction at 'hFFFF_FFFE). This commit aligns ibex to that behaviour. Change-Id: Ic54bf3ba59c9cd5f10653bcbd08b4067d9d7c689

Edge cases could occur where you would fetch the upper half of a word with a capability that only allowed you to fetch the lower half. Also, with DII, the second half of a misaligned fetch is skipped, so this adds logic that checks whether the second half would have been allowed. Change-Id: I73597240c8ebe2ac4a422a1074919905c278861e

The Sail CHERI-RISC-V model does not require PCC to have the "load" permission to fetch instructions; this commit aligns Ibex to that behaviour. Change-Id: I7d70cecb8cfd92766e4433bc02ac6b05220d1a7d

There is no priority given in the CHERI ISA document for this exception, so the priority was taken from the Sail model (ie just after Length exceptions) Change-Id: I127d71cbeb42981671c28f32795c8c0081025d32

The Length check was not correctly bracketed. With the previous bracket setup, it was checking (below base | DataMem) ? (outcome1 : outcome2). Change-Id: Iaeea495b156efbfafef85a0ce389b8237529bdf9

This adds logic in the Instruction Fetch stage to track whether there is an error in the fetch FIFO, and whether the error is a CHERI error or not. When it is, the CHERI exception information is passed to the controller. Since errors will cause FIFO flushes when they reach the controller, any later bus errors (which this logic does not handle) will be flushed and will not happen, so only one error needs to be tracked at a time. A new signal is connected from the fetch FIFO to the IF stage to signal when the output of the FIFO is the same as its input -- in this case the exception information comes directly from the input to the IF stage rather than from the registered exception signals. Change-Id: I2cf40bbaf62c6fe547dc9ae71cb7744eaf8881a7

Change-Id: I3d8833595a4f8b9362a14e797b6f1b7dfd9dabc0

Change-Id: I3e8573bdb47bdca9ac3888ef10136b550228b55b

This adds the CRRL, CRAM and getBaseAlignment to the list of BSV functions exported as modules and adds the files they generate to the core file. Change-Id: I24ae065aae1e050302117e3d0deef6c663307694

This significantly improves the performance of the TestRIG setup. Previously the simulation would sleep for 100ns every time an instruction was received before receiving the next one. Oops. Change-Id: Idbde402be8022902ad0cd419d9769395ea3d87e8

Change-Id: Idc44980f00f22dcfe4d1156660507b57cd6ad574

For the second half of a two-piece store, (i.e. misaligned or capability-width) the write-enable signal should be based on the registered exception information rather than the combinational information (the bounds check is performed for the full transaction in the first cycle). Change-Id: Ibf23e30a65c859d5831719a517699a5471611d2e

This commit splits the Program Counter Capability in the Instruction Fetch stage into: - a jump PCC (which assumes a jump will be taken); and - a nojump PCC (which assumes a jump is not taken). This is also the PCC of the instruction currently being returned by the prefetcher/caches The new_pcc muxes between the jump and nojump PCCs depending on whether there has been a jump or not. The new_pcc is used to provide authority for the current instruction fetch (since it needs to account for the new bounds) and the nojump PCC is used the same way as the old pc_if_o signal, so that it can be saved to MEPC/MEPCC when required. Change-Id: I7939efde4804872dc1b50eadd451c835fc399692

This commit should not have any behavioural effects, it just cleans up the code a bit. Change-Id: I349980af0108c91f6dfc71ce9e37ffe01493f316

Change-Id: I908f913e88957507d96694200251f79ba6d0b507

Change-Id: I43733102bf35093d75716e0dbec4ae6300415393

This improves the critical path. The previous implementation used the base of the new PCC, which requires significant logic, and then added this to the new fetch offset, despite the fact that the old logic was already factoring in the new offset into the new PCC. Getting the address of the new PCC (which has the new fetch offset factored in already) requires less logic. Change-Id: Iad2b14371c3d1c7b4b7d5fbb3e94c20050f54fc3

The value calculated by the ALU uses the PC, which is an offset of the current PCC. This means that we should compare it to the length rather than the base and top. Note: the comment explains that cheri-cap-lib does not rule out the possibility of the base being above the top, and also does not explain what happens to the length in this case. Change-Id: I92fffcee60671f53addd64f0e79f17efe7f04a68

This makes the memchecker modules purely combinational, and changes the data and instruction interfaces to not issue requests on the bus that will cause a CHERI exception. On the instruction interface, requests that might cause an exception are still issued because it is not known when the request is being made whether the request is allowed or not (because we don't know whether the resulting data contains a compressed instruction or not, and we don't know until the instruction leaves the fetch FIFO which half of the 4-byte-aligned fetch it came from). The "possible" exception signals are propagated through the fetch FIFO with the data. Fetches that are guaranteed to cause a CHERI exception (ones where both halves of the fetch are disallowed) halt the prefetcher and prevent it from making any further requests. Instructions in the fetch FIFO are executed and if none of these flush the FIFO then the error will be handled, which will flush the FIFO and restart prefetching. Change-Id: I50c9c65d55c69e3131722708799eb330bada6f2b

Change-Id: I5b2bc9c118817649a095eed03e1feafd18de287a

Change-Id: Id18b8ac94551eb781ab91fa61bd9ea11563d5987

Previously DDC was special-cased with PCC when the address of rs1 was 0, since this operation was just reading DDC into the general purpose register file, and not writing DDC. This changes it to be treated as a normal SCR in all cases. Change-Id: I6c36a1995d8f70438cd9f75a2a903cd7908dfecf

Issues were encountered when synthesizing the design when an unsized X value was being passed in, so pass in a proper value. The internal implementation of the modules ignores the value. Change-Id: I21e7700c719624a714e6613a1b3fe4dad3873d88

This change always issues requests on the instruction fetch interface regardless of whether they cause a CHERI exception or not. The exception signals are then passed through the prefetch buffer and fetch fifo the same way they were passed through before (but as a struct now). This improves the critical path. (~ -3.8ns slack before to ~ -2.73ns). Change-Id: I9e68f4f47da730afb9d152805f2147fa50db6a06

This removes a long path from the CHERI alu to the controller and then to the IF stage. We can still jump because if an exception is raised it will cause the controller to switch to the FLUSH state which will discard the effects of the jump. Change-Id: Iba845bebd791b340a71d93c69ccc7b1533e98074

Previously the path of CHERI jumps would go through the ALU, perform a setAddress, then go to the IF stage, perform a getOffset, perform a setOffset and then go through the memory checking. Now, the target capability goes directly from ID to IF without going through the CHERI ALU, and the IF stage sets the new offset and unseals the capability. The same exception checking is still performed in the CHERI ALU, and the CHERI ALU still needs to set the integer ALU inputs so that the new offset can be calculated and passed to the IF stage. Change-Id: I93983494f7f47a8481693cdbdc6fa2f673dc8fa3

The setOffset function does not modify the bounds or permissions of a capability, so the authority can be provided before this operation happens, to improve the critical path. Change-Id: I2fcd1982c11a7f53a8f6717e83b5d7eb9c2b81b9

A getAddr is almost free (the address is stored un-encoded in the capabillity format, so it just consists of selecting the appropriate bits). This commit removes some muxing logic that would extract the address (ie integer value) of a capability in the ID stage for the CHERI ALU - the extraction of the value is now done inside the ALU. Change-Id: I32d9ff81bd9c47cc2bf83008bf7579fdd7dd9d26

There are lots of comparisons performed in the CHERI ALU; this commit updates it to share two comparators for the majority of these to reduce the amount of logic. Change-Id: I283038ff53b6e9cc3c213df467645b0aa508f110

Some SystemVerilog tools cannot handle signal declarations occurring later in the file than their first use, so this moves the signals to the top of the file. Change-Id: Ib2c39754499441772f0d3c1de989e3b14cb85675

Extracting the address for RVFI is done in the ibex_core.sv file Change-Id: Ie02d94ea430fec2b2aa3889912f4327d1dad2b70

Change-Id: Ie5621a449beb3e7ae8284cfa7f8142891bde6790

The changes in the IF stage for boot address and how to change the address to be fetched on compressed instructions are only needed when compiling for TestRIG, so this commit (finally) makes this a compile time parameter. The parameter is of "int" type because as far as I can tell, it's not possible to have it set to 1 if it's a bit. FuseSoC uses the verilator edalize backend, which passes the parameter as a literal integer using verilator's -G argument (https://github.com/olofk/edalize/blob/4044f2de5bf7f43e018e18f881468baebb3452c2/edalize/verilator.py#L165) without giving it a size. Verilator interprets literal integer arguments as 32bit signed integers (https://github.com/verilator/verilator/blob/038d57070b539b2da2658edd7740d41ea069fd4f/src/V3AstNodes.cpp#L311) so it sticks "32'h" before the integer when passing the argument in to a module, and then complains because it is trying to set a 1 bit value to a 32 bit value. Change-Id: If2a147f52df98f5bdedf351279a45cc96f0dfbb3

Change-Id: I27903688cda591b3a2e8b233692af1f7410ac08b

Change-Id: Iba6a44bbbed1473bec7add62cd277e6090de07b3

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add CHERI support to Ibex #2

Add CHERI support to Ibex #2

Commits on Oct 31, 2022

Add CHERI support to Ibex #2

Are you sure you want to change the base?

Add CHERI support to Ibex #2

Commits on Oct 31, 2022