Update lowrisc_ibex to lowRISC/ibex@75ef275c

Update code from upstream repository
https://github.com/lowRISC/ibex.git to revision
75ef275cb34b7cae55325a1d64d8672a0cd72269

* [rtl] Lint fixes for recent Zc code (Andreas Kurth)
* [doc] Clarify usage of data independent timing & branch prediction
  (Pascal Nasahl)
* [doc] PMP instruction fetch check clarified (Marno van der Maas)

Signed-off-by: Pascal Nasahl <nasahlpa@lowrisc.org>

Author: nasahlpa

hw/vendor/lowrisc_ibex.lock.hjson

@@ -9,6 +9,6 @@
   upstream:
   {
     url: https://github.com/lowRISC/ibex.git
-    rev: 0c233f54361d769f370889223acc456f2ac19d46
+    rev: 75ef275cb34b7cae55325a1d64d8672a0cd72269
   }
 }

hw/vendor/lowrisc_ibex/doc/03_reference/instruction_fetch.rst

@@ -26,6 +26,8 @@ The interfaces of the icache module are the same as the prefetch buffer with two
 Firstly, a signal to enable the cache which is driven from a custom CSR.
 Secondly a signal to the flush the cache which is set every time a ``fence.i`` instruction is executed.
 
+.. _branch-prediction:
+
 Branch Prediction
 -----------------
 

hw/vendor/lowrisc_ibex/doc/03_reference/pmp.rst

@@ -21,7 +21,13 @@ When PMPEnable is zero, the PMP module is not instantiated and all PMP registers
 PMP Integration
 ---------------
 
-Addresses from the instruction fetch unit and load-store unit are passed to the PMP module for checking, and the output of the PMP check is used to gate the external request.
+Addresses from the instruction fetch unit and load-store unit are passed to the PMP module for checking.
+The output of PMP check is used to gate the external request of the load-store unit.
+This is because both writes and reads can have side-effects on MMIO devices connected to the data memory bus.
+The request coming from the instruction fetch unit are not gated by the PMP check, so integrators must choose carefully what to connect to the instruction fetch bus.
+Specifically, no devices that experience side-effects due to reading should be available on this bus.
+In general, connecting memories to the instruction fetch bus should be safe.
+
 To maintain consistency with external errors, the instruction fetch unit and load-store unit progress with their request as if it was granted externally.
 The PMP error is registered and consumed by the core when the data would have been consumed.
 

hw/vendor/lowrisc_ibex/doc/03_reference/security.rst

@@ -36,6 +36,8 @@ Software that has need of data independent timing may wish to disable the instru
 The instruction cache is controlled by the **icache_enable** bit in the **cpuctrl** register.
 Precise details of fetch timing will depend upon the memory system Ibex is connected to.
 
+If data independent timing is needed for branches, turn off the branch prediction feature as it is :ref:`experimental<branch-prediction>`.
+
 Dummy Instruction Insertion
 ---------------------------
 

hw/vendor/lowrisc_ibex/rtl/ibex_compressed_decoder.sv

@@ -57,9 +57,9 @@ module ibex_compressed_decoder #(
   function automatic logic [4:0] cm_stack_adj_word(input logic [3:0] rlist,
                                                    input logic [1:0] spimm);
     logic [6:0] tmp;
-    logic [1:0] _unused;
+    logic [1:0] unused_tmp;
     tmp = cm_stack_adj(.rlist(rlist), .spimm(spimm));
-    _unused = tmp[1:0];
+    unused_tmp = tmp[1:0];
     return tmp[6:2];
   endfunction
 
@@ -79,8 +79,12 @@ module ibex_compressed_decoder #(
   function automatic logic [31:0] cm_push_store_reg(input logic [4:0] rlist,
                                                     input logic [4:0] sp_offset);
     logic [11:0] neg_offset;
+    logic signed [11:0] neg_offset_signed;
     logic [31:0] instr;
-    neg_offset = ~{5'b00000, sp_offset, 2'b00} + 12'd1;
+    // Compute two's complement on signed variable, then cast back to unsigned
+    // for the part select operations below.
+    neg_offset_signed = -signed'({5'b00000, sp_offset, 2'b00});
+    neg_offset = unsigned'(neg_offset_signed);
     instr[ 6: 0] /* opcode       */ = OPCODE_STORE;
     instr[11: 7] /* offset[4:0]  */ = neg_offset[4:0];
     instr[14:12] /* width        */ = 3'b010; // 32 bit
@@ -105,15 +109,18 @@ module ibex_compressed_decoder #(
                                              input logic [1:0] spimm,
                                              input logic decr = 1'b0);
     logic [11:0] imm;
+    logic signed [11:0] imm_signed;
     logic [31:0] instr;
     imm[11:7] = '0;
     imm[ 6:0] = cm_stack_adj(.rlist(rlist), .spimm(spimm));
-    if (decr) imm = ~imm + 12'd1;
+    // Compute two's complement on signed variable, but as it will be used in
+    // unsigned targets below, it will have to be cast back to unsigned then.
+    imm_signed = decr ? -signed'(imm) : signed'(imm);
     instr[ 6: 0] /* opcode    */ = OPCODE_OP_IMM;
     instr[11: 7] /* dest reg  */ = 5'd2; // x2 (sp / stack pointer)
     instr[14:12] /* funct3    */ = 3'b000; // addi
     instr[19:15] /* src reg   */ = 5'd2; // x2
-    instr[31:20] /* imm[11:0] */ = imm;
+    instr[31:20] /* imm[11:0] */ = unsigned'(imm_signed);
     return instr;
   endfunction
 

hw/vendor/lowrisc_ibex/rtl/ibex_core.sv

@@ -1932,10 +1932,13 @@ module ibex_core import ibex_pkg::*; #(
   end
 
 `else
-  logic unused_instr_new_id, unused_instr_id_done, unused_instr_done_wb;
+  logic unused_instr_new_id, unused_instr_id_done, unused_instr_done_wb,
+        unused_instr_expanded_id, unused_instr_gets_expanded_id;
   assign unused_instr_id_done = instr_id_done;
   assign unused_instr_new_id = instr_new_id;
   assign unused_instr_done_wb = instr_done_wb;
+  assign unused_instr_expanded_id = ^instr_expanded_id;
+  assign unused_instr_gets_expanded_id = ^instr_gets_expanded_id;
 `endif
 
   // Certain parameter combinations are not supported