[rtl] Issues with memory and instruction fetch errors with branch prediction enabled

[GregAC]

When riscv_mem_error_test is run with a config that includes a branch predictor failures are seen. These are around failures to take instruction faults and memory access faults.

It seems memory accesses next to branches can fail to produce the correct precise exception when a memory error response is seen.

For instruction faults it may be the branch prediction mechanism is failing to maintain correct error information leading to the execution of an instruction whose fetch saw an error response.

For now the branch prediction config will be removed from CI as that configuration is not a priority and these bugs will be addressed at a later date.

[menna2008]

Hi @GregAC, I'm interested in working on this issue if it's still open.

Before diving in, I had a couple of questions to make sure I can actually contribute effectively:

1. Is anyone currently working on this, or is it still up for grabs?
2. Reproducing this seems to require running riscv_mem_error_test through the UVM/riscv-dv environment with branch prediction enabled. I have access to Icarus Verilog, Verilator, and GTKWave, but not a commercial simulator (VCS/Xcelium/Questa/Riviera-PRO). Is there a way to reproduce and debug this with an open-source toolchain, or is a commercial simulator required for this particular test?
3. If a commercial simulator is required, is there any guidance on getting access (e.g. a shared CI environment, waveforms from a failing run I could start from, or similar), or would this issue not be practical without one?

Happy to dig into the if-stage/branch-predictor RTL and precise-exception logic in the meantime regardless of the tooling answer.

[elliotb-lowrisc]

Hi @menna-fouad, nobody is currently working on this, but I'm not sure if it will be relevant going forwards as Ibex will be undergoing changes (see https://lowrisc.org/news/opentitan-earl-grey-2-to-support-cheri-and-pqc/). Also, you would indeed need a UVM-capable simulator to run the co-sim environment, ideally VCS.

[menna2008]

Hi @elliotb-lowrisc, thank you for the info! I looked into the Earl Grey 2 changes, and I don't think they affect this issue. CHERIoT-Ibex (the config Earl Grey 2 uses for CHERI) is built on Ibex's simpler baseline config, which doesn't have branch prediction enabled - that's only in the maxperf configs. So the CHERI work just isn't touching this code path, not that it's incompatible with it. This bug would still matter for anyone running a branch-predictor-enabled config and for future work that could benefit from a working branch prediction feature, so I'd like to take a shot at it.

On the simulator side, I'm requesting a Siemens Questa evaluation license first, since that seems like the most accessible UVM-capable simulator as an individual. If I encounter an issue with Questa, would it be possible to have temporary access to a licence the organization already uses? Totally understand if that's not something you're able to offer, just wondering in case there's an easier path than me sorting out my own license.

[elliotb-lowrisc]

Hi @menna2008, feel free to have a go at this issue if you like, but the result will have to be easy to review. As branch prediction is an experimental feature and not used in OpenTitan, we unfortunately can't put much resource into it, such as time reviewing PRs. A clear test and a light-touch on parts of the design shared with configurations without branch prediction would help reduce the time required to review, which would increase the chance of a review happening.

I'm afraid I don't think we're able to help on the license front, but you could alternatively see if newer Verilator versions have enough UVM support for the cosim to work.

Thanks for your interest in contributing to Ibex