Code generation overwriting program memory during context save

[XavierAubert]

Code generation overwriting program memory during context save

In very rare cases, the corev-dv instruction generator is producing a code that doesn't prevent context save to be stored at program memory location, and this risk is significantly higher when those context switching events are nested (nested interrupt, ...).

Type

• corev-dv code generation issue vs asynchronous events
• Random issue
• occurence: 1 out of 10.000 tests

Steps to Reproduce

• Operating System : CentOS 7
• Simulator : Siemens Questa Sim-64 vsim 2023.2_1
• Toolchain: corev-openhw-gcc-centos7-20240530
• ISS : imperas_idv/eng.20240530.0
• core-v-verif : https://github.com/openhwgroup/core-v-verif/tree/a3a121f6424ff972214d245f5a4629e522741fe6
• CV32E40P RTL: https://github.com/openhwgroup/cv32e40p/tree/8f24b1d70dac770553bc8edfd3cef320b729f8eb

to reproduce the issue:

git clone -b cv32e40p/dev --single-branch https://github.com/openhwgroup/core-v-verif core-v-verif
cd core-v-verif
git checkout a3a121f6424ff972214d245f5a4629e522741fe6
git clone -b dev --single-branch https://github.com/openhwgroup/cv32e40p core-v-cores/cv32e40p
cd core-v-cores/cv32e40p
git checkout 8f24b1d70dac770553bc8edfd3cef320b729f8eb
cd ../../cv32e40p/sim/uvmt

make gen_corev-dv test COREV=YES TEST=corev_rand_interrupt_nested CFG_PLUSARGS=+UVM_TIMEOUT=10000000 CV_CORE=cv32e40p CFG=pulp_fpu_1cyclat TEST_CFG_FILE=floating_pt_instr_en,disable_all_trn_logs SIMULATOR=vsim USE_ISS=yes COV=YES RUN_INDEX=999891808 GEN_START_INDEX=999891808 SEED=999891808

Log example:

# 1092476.000 ns: Illegal instruction (core 0) at PC 0x0001f4d2:
# Warning (RISCV_UDEC) CPU 'refRoot/cpu' 0x0001f4d2 00000077 undef: Undecoded instruction
# 1093907.000 ns: Illegal instruction (core 0) at PC 0x0001f4d2:
# 1093910.000 ns: Illegal instruction (core 0) at PC 0x0001f4d2:
# 1093913.000 ns: Illegal instruction (core 0) at PC 0x0001f4d2:
# 1093916.000 ns: Illegal instruction (core 0) at PC 0x0001f4d2:
# 1093919.000 ns: Illegal instruction (core 0) at PC 0x0001f4d2:
# 1093922.000 ns: Illegal instruction (core 0) at PC 0x0001f4d2:
# Warning (RISCV_UDEC) CPU 'refRoot/cpu' 0x0001f4d2 00000077 undef: Undecoded instruction
# 1095314.000 ns: Illegal instruction (core 0) at PC 0x0001f4d2:
# 1095317.000 ns: Illegal instruction (core 0) at PC 0x0001f4d2:
# 1095320.000 ns: Illegal instruction (core 0) at PC 0x0001f4d2:
# Warning (RISCV_UDEC) CPU 'refRoot/cpu' 0x0001f4d2 00000077 undef: Undecoded instruction

Additional context

In the given example, the program is corrupting an instruction somewhere in the code, and just after that corrupting again an instruction in the illegal instruction handler, creating an infinite loop.
A zip file (corev_rand_interrupt_nested_999891808.zip) is given, containing the trace (trace_core.log) where all the looping code has been truncated to reduced its size. It contains as well the objdump + the assembly file, and the simulation log.