[rv_core_ibex] Re-venor Ibex

hw/ip/rv_core_ibex/lint/rv_core_ibex.waiver

@@ -120,6 +120,9 @@ waive -rules RESET_MUX            -location {ibex_lockstep.sv} -regexp {Asynchro
       -comment "The test enable input used to control the bypass can be considered static"
 waive -rules RESET_USE            -location {ibex_lockstep.sv} -regexp {'rst_shadow_set_q' is used for some other purpose, and as asynchronous reset 'rst_ni' at}
       -comment "A synchronous counter is needed to release the shadow core reset with a delay of LockstepOffset clock cycles and start the comparison logic one clock cycle later"
+waive -rules {CLOCK_USE RESET_USE} -location {ibex_register_file_ff.sv} \
+      -regexp {'(clk_i|rst_ni)' is connected to '(prim_onehot_mux)' port} \
+      -comment {The module is fully combinatorial, clk/rst are only used for assertions.}
 
 # Highlighting my main concerns here, documenting areas to review in next dive
 #

hw/ip/rv_core_ibex/rtl/rv_core_ibex.sv

@@ -923,6 +923,12 @@ module rv_core_ibex
   `ASSERT_PRIM_REG_WE_ONEHOT_ERROR_TRIGGER_ALERT(RegWeOnehotCheck_A, u_reg_cfg, alert_tx_o[2])
   `ASSERT_PRIM_ONEHOT_ERROR_TRIGGER_ALERT(RvCoreRegWeOnehotCheck_A,
       u_core.gen_regfile_ff.register_file_i.gen_wren_check.u_prim_onehot_check, alert_tx_o[2])
+  `ASSERT_PRIM_ONEHOT_ERROR_TRIGGER_ALERT(RvCoreRegWeOnehotCheckRAddrA_A,
+        u_core.gen_regfile_ff.register_file_i.gen_rdata_mux_check.u_prim_onehot_check_raddr_a,
+        alert_tx_o[2])
+  `ASSERT_PRIM_ONEHOT_ERROR_TRIGGER_ALERT(RvCoreRegWeOnehotCheckRAddrB_A,
+        u_core.gen_regfile_ff.register_file_i.gen_rdata_mux_check.u_prim_onehot_check_raddr_b,
+        alert_tx_o[2])
 
 `ifdef INC_ASSERT
   if (ICache && ICacheScramble) begin : gen_icache_scramble_asserts

hw/vendor/lowrisc_ibex.lock.hjson

@@ -9,6 +9,6 @@
   upstream:
   {
     url: https://github.com/lowRISC/ibex.git
-    rev: 1120e8ddbfe39cfedabe7dda16945e7e809c8389
+    rev: 56413ecf103342fb7d53c31f182ac930209267df
   }
 }

hw/vendor/lowrisc_ibex/doc/03_reference/cosim.rst

@@ -22,7 +22,7 @@ These extended signals have the prefix ``rvfi_ext``
 Setup and Usage
 ---------------
 
-Clone the `lowRISC fork of Spike <https://github.com/lowRISC/riscv-isa-sim>`_ and check out the ``ibex-cosim-v0.3`` tag.
+Clone the `lowRISC fork of Spike <https://github.com/lowRISC/riscv-isa-sim>`_ and check out the ``ibex-cosim-v0.5`` tag.
 Other, later, versions called ``ibex-cosim-v*`` may also work but there's no guarantee of backwards compatibility.
 Follow the Spike build instructions to build and install Spike.
 The ``--enable-commitlog`` and ``--enable-misaligned`` options must be passed to ``configure``.

hw/vendor/lowrisc_ibex/doc/03_reference/cs_registers.rst

@@ -113,7 +113,7 @@ Machine Status (mstatus)
 
 CSR Address: ``0x300``
 
-Reset Value: ``0x0000_1800``
+Reset Value: ``0x0000_0080``
 
 +-------+-----+---------------------------------------------------------------------------------+
 | Bit#  | R/W | Description                                                                     |

hw/vendor/lowrisc_ibex/doc/03_reference/security.rst

@@ -90,6 +90,15 @@ When Ibex is configured with the SecureIbex parameter, the write enable signal i
 This can be useful to detect fault injection attacks.
 No attempt is made to correct detected errors, but an internal major alert is signaled for the system to take action.
 
+Register file read addresses glitch detection
+-------------------------------------------
+
+When Ibex is configured with the SecureIbex parameter, the read addresses provided to the register file are converted to one-hot encoded signals, and a one-hot encoded MUX is used to select the register to read from.
+By using one-hot encoding checkers, glitches in the one-hot encoded signals are detected.
+Bit-flips inside the plain read addresses before the one-hot conversion happens are detected by the dual core lockstep.
+This can be useful to detect fault injection attacks.
+No attempt is made to correct detected errors, but an internal major alert is signaled for the system to take action.
+
 ICache ECC
 ----------
 

hw/vendor/lowrisc_ibex/doc/03_reference/verification.rst

@@ -111,8 +111,7 @@ In order to run the co-simulation flow, you'll need:
   + Some custom CSRs
   + Custom NMI behavior
 
-  Ibex verification should work with the Spike version that is tagged as ``ibex-cosim-v0.3``.
-  Other, later, versions called ``ibex-cosim-v*`` may also work but there's no guarantee of backwards compatibility.
+  Ibex verification should work with the Spike version that is tagged as ``ibex-cosim-v0.5``.
 
   Spike must be built with the ``--enable-commitlog`` and ``--enable-misaligned`` options.
   ``--enable-commitlog`` is needed to produce log output to track the instructions that were executed.

hw/vendor/lowrisc_ibex/dv/uvm/common_project_cfg.hjson

@@ -5,6 +5,7 @@
   project:          ibex
 
   // These keys are expected by dvsim.py, so we have to set them to something.
+  book:              bogus.book.domain
   doc_server:        bogus.doc.server
   results_server:    bogus.results.server
   results_html_name: report.html
@@ -14,6 +15,10 @@
   scratch_path:       "{scratch_base_path}/{branch}"
   tool_srcs_dir:      "{scratch_path}/{tool}"
 
+  // Common DVSIM data structures
+  build_pass_patterns: []
+  build_fail_patterns: []
+
   // The current design level
   design_level:  "ip"
 }

hw/vendor/lowrisc_ibex/dv/uvm/core_ibex/common/ibex_cosim_agent/ibex_cosim_scoreboard.sv

@@ -6,7 +6,6 @@
 `include "cosim_dpi.svh"
 
 class ibex_cosim_scoreboard extends uvm_scoreboard;
-  import ibex_pkg::*;
   chandle cosim_handle;
 
   core_ibex_cosim_cfg cfg;
@@ -151,8 +150,10 @@ class ibex_cosim_scoreboard extends uvm_scoreboard;
 
       // Set performance counters through a pseudo-backdoor write
       for (int i=0; i < 10; i++) begin
-        riscv_cosim_set_csr(cosim_handle, CSR_MHPMCOUNTER3 + i, rvfi_instr.mhpmcounters[i]);
-        riscv_cosim_set_csr(cosim_handle, CSR_MHPMCOUNTER3H + i, rvfi_instr.mhpmcountersh[i]);
+        riscv_cosim_set_csr(cosim_handle,
+                            ibex_pkg::CSR_MHPMCOUNTER3 + i, rvfi_instr.mhpmcounters[i]);
+        riscv_cosim_set_csr(cosim_handle,
+                            ibex_pkg::CSR_MHPMCOUNTER3H + i, rvfi_instr.mhpmcountersh[i]);
       end
 
       riscv_cosim_set_ic_scr_key_valid(cosim_handle, rvfi_instr.ic_scr_key_valid);

hw/vendor/lowrisc_ibex/dv/uvm/core_ibex/common/ibex_mem_intf_agent/ibex_mem_intf_agent_pkg.sv

@@ -22,4 +22,8 @@ package ibex_mem_intf_agent_pkg;
   `include "ibex_mem_intf_request_driver.sv"
   `include "ibex_mem_intf_request_agent.sv"
 
+  // Re-export parameters from ibex_mem_intf_pkg so that other packages can access them through this
+  // package.
+  export ibex_mem_intf_pkg::*;
+
 endpackage

hw/vendor/lowrisc_ibex/dv/uvm/core_ibex/common/prim/prim_and2.sv

@@ -0,0 +1,27 @@
+// Copyright lowRISC contributors.
+// Licensed under the Apache License, Version 2.0, see LICENSE for details.
+// SPDX-License-Identifier: Apache-2.0
+
+// Abstract primitives wrapper.
+//
+// This file is a stop-gap until the DV file list is generated by FuseSoC.
+// Its contents are taken from the file which would be generated by FuseSoC.
+// https://github.com/lowRISC/ibex/issues/893
+
+module prim_and2 #(
+  parameter int Width = 1
+) (
+  input        [Width-1:0] in0_i,
+  input        [Width-1:0] in1_i,
+  output logic [Width-1:0] out_o
+);
+
+if (1) begin : gen_generic
+  prim_generic_and2 #(
+    .Width(Width)
+  ) u_impl_generic (
+    .*
+  );
+end
+
+endmodule

hw/vendor/lowrisc_ibex/dv/uvm/core_ibex/directed_tests/README.md

@@ -5,7 +5,7 @@ This directory contains the custom directed tests as well as scripts and headers
 Currently following open source test suites are vendored:
 - [riscv-tests](https://github.com/riscv-software-src/riscv-tests)
 - [riscv-arch-tests](https://github.com/riscv-non-isa/riscv-arch-test)
-- epmp-tests ([fork](https://github.com/Saad525/riscv-isa-sim) from an opensource [repo](https://github.com/joxie/riscv-isa-sim))
+- epmp-tests ([fork](https://github.com/lowRISC/riscv-isa-sim/tree/mseccfg_tests) from an opensource [repo](https://github.com/joxie/riscv-isa-sim))
 
 ## Generating test list
 

hw/vendor/lowrisc_ibex/dv/uvm/core_ibex/directed_tests/custom_macros.h

@@ -53,11 +53,13 @@
   li t1, pmp_cfg;                        \
   sll t1, t1, t0;                        \
   csrw pmpcfg1, t1;                      \
+  j 4f;                                  \
   2 : li t2, 11;                         \
   bgt t1, t2, 3f;                        \
   li t1, pmp_cfg;                        \
   sll t1, t1, t0;                        \
   csrw pmpcfg2, t1;                      \
+  j 4f;                                  \
   3 : li t2, 15;                         \
   bgt t1, t2, 4f;                        \
   li t1, pmp_cfg;                        \
@@ -111,6 +113,10 @@
   lw s1, 0(s2);                               \
   sw s1, 0(s2);
 
+// This assumes a PMP access failure on the read and write where the handler
+// jumps back to the failing access in M mode. If the access succeeds it remains
+// in U mode and the second SWITCH_TO_U_MODE will trap (due to attempting a
+// write to mstatus).
 #define RW_ACCESSES_IN_U_MODE(pmp_addr, gran) \
   la s0, pmp_addr;                            \
   SWITCH_TO_U_MODE_LABEL(1f);                 \