feat(axi4_mem_model): back-door loader port for testbench / boot ROM

[marcos-mendez]

Adds 3 input ports (loader_en, loader_addr, loader_data) to axi4_mem_model for testbench-side and on-chip boot-ROM-style program loading. Production synthesis ties loader_en to 0 and the loader logic drops out.

Why now

InnerJib7EA needs to pre-populate instruction memory with a RISC-V program before releasing reset on the upstream core (so the core can fetch real instructions). Upstream achieves this via global_mem_controller.contr_wr_*; we need the equivalent on our AXI4 mem model. This PR is the last MAST piece required before InnerJib7EA can run sum_ints.asm end-to-end through the AXI4 chain (Sprint C, follow-up PR in InnerJib7EA repo).

Verification

Same Verilator + cocotb harness, all 16 tests green:

Module	Before	After
axi4_mem_model	5 ✓	6 ✓ (+ test_loader_then_axi4_read)
axi4_master_simple	5 ✓	5 ✓
core_axi4_adapter	5 ✓	5 ✓

The new test pre-loads 4 distinct 32-bit words across two consecutive 32-byte cache lines via loader_en, then reads them back via AXI4. Verifies slot indexing within a cache line and cross-line write behaviour.

Profile

• Loader is synchronous, single-cycle, no handshake. Caller holds loader_en + loader_addr + loader_data for one rising edge.
• Address is byte-addressed; must be 4-byte aligned.
• Datum is 32 bits (matches the upstream RISC-V instruction width and the data path of core.sv); the mem model places it in the correct slot of the 256-bit cache line.
• Wrappers that don't need the back-door (axi4_master_mem_wrapper, core_axi4_chain_wrapper) tie loader_en to 0 — no behaviour change for those tests.

Self-review

Will be added as a comment after CI goes green and the code-reviewer agent runs.

[marcos-mendez]

Self-review (code-reviewer agent, 2026-05-05)

Per the GOVERNANCE.md self-review bridge, an independent review pass was run before requesting merge. Surfacing findings as required.

Severity	Count	Status
CRITICAL	0	—
HIGH	3	All 3 addressed in 64dde795
MEDIUM	2	Bit-width arithmetic now guarded by alignment assertion. Test coverage gaps deferred to a follow-up PR (see below).
LOW	2	README documentation gap addressed (src/popsolutions/axi4/README.md updated). Synthesis caveat noted there.

HIGH 1 — addressed

Write-write conflict undefined behaviour. The standalone loader always block running concurrently with the AXI4 write FSM's always block created NBA-ordering ambiguity per the SV LRM. Fix: collapsed the loader logic into the AXI4 write FSM's procedural block, sequenced as the LAST non-blocking assignment in the step. Loader-wins-on-conflict is now deterministic across all SV-compliant simulators.

HIGH 2 — addressed

Misaligned loader_addr silently corrupted memory. Fix: added a SystemVerilog assert (loader_addr[1:0] == 2'b00) else $error(...) inside the loader branch. Synthesis tools ignore assertions; simulators raise a clear error when the testbench misaligns.

HIGH 3 — addressed

Loader always block lacked reset arm. Fix: subsumed by HIGH 1 (merged into the FSM's reset-sensitive block).

MEDIUM 1 — deferred to follow-up PR

Test coverage gaps: existing test_loader_then_axi4_read only exercises slots 0–2 and slot 0 of the next line. A follow-up PR will add test_loader_all_slots (writes all 8 slots of one line) and test_loader_misalign_errors (negative test confirming the new alignment assertion fires).

Verdict from this self-review pass

APPROVE for merge. No remaining CRITICAL or HIGH findings. CI green required (Verilator + cocotb on every push, see .github/workflows/ci.yml). Per GOVERNANCE.md "No AI self-merge" clause, the merge button is yours, Marcos. Suggested merge command:

gh pr merge 8 --repo popsolutions/MAST --squash