Update lowrisc_ibex to lowRISC/ibex@aae4809a

Update code from upstream repository
https://github.com/lowRISC/ibex.git to revision
aae4809aea170fc605bdaa64a70a13efd2408829

* [dv] Check u-mode counter alias the correct m-mode counter (Samuel
  Riedel)
* [formal] Exclude u-mode counters from formal verification (Samuel
  Riedel)
* [doc] Document the newly added performance counters (Samuel Riedel)
* [dv] Add directed test for mcounteren lock signal (Samuel Riedel)
* [dv] Add `mcounteren` directed test (Samuel Riedel)
* [dv] Fix ordering in `directed_testlist.yml` (Samuel Riedel)
* [dv] Implement Ibex-specific mcounteren behavior in cosim (Samuel
  Riedel)
* [rtl] Add input to lock mcounteren (Samuel Riedel)
* [rtl] Add unpriviledged counter/timers (Samuel Riedel)
* [rtl] Add register for `mcounteren` (Samuel Riedel)
* [rtl] Fix incrementing `minstret` after setting it (Samuel Riedel)
* [rtl] Fix speculative increment of `minstret` (Samuel Riedel)
* [syn] Fix scripts for new vendored lowrisc_ip (Harry Callahan)
* [syn] Add nix devShell for example synthesis flow (Harry Callahan)
* [dv] Fixup explicit static lifetime on initializer by seperating
  decl from assign. (Harry Callahan)
* [vendor/google_riscv-dv] Add VCS -Xcflags to suppress build warnings
  (Harry Callahan)
* [vendor/google_riscv-dv] use env bash and non-absolute bash paths
  (Harry Callahan)
* [rtl] Explicitly define mapping to `prim_generic` for linter targets
  (Samuel Riedel)
* [rtl] Fix prim_generic mapping in ibex_top (Samuel Riedel)
* [rtl] Move prim_generic dependency to ibex_top (Samuel Riedel)
* [doc] Ibex Concierge updated (Marno van der Maas)

Signed-off-by: Samuel Riedel <sriedel@lowrisc.org>

Author: SamuelRiedel

hw/ip_templates/rv_core_ibex/rtl/rv_core_ibex.sv.tpl

@@ -237,6 +237,8 @@ module ${module_instance_name}
   logic [ 3:0] rvfi_mem_wmask;
   logic [31:0] rvfi_mem_rdata;
   logic [31:0] rvfi_mem_wdata;
+  logic        rvfi_ext_expanded_insn_valid;
+  logic [15:0] rvfi_ext_expanded_insn;
 `endif
 
   import tlul_pkg::tl_h2d_t;
@@ -568,18 +570,21 @@ module ${module_instance_name}
     .rvfi_mem_rdata,
     .rvfi_mem_wdata,
     // Unused ports from the RVFI interface
-    .rvfi_ext_pre_mip         (),
-    .rvfi_ext_post_mip        (),
-    .rvfi_ext_nmi             (),
-    .rvfi_ext_nmi_int         (),
-    .rvfi_ext_debug_req       (),
-    .rvfi_ext_debug_mode      (),
-    .rvfi_ext_rf_wr_suppress  (),
-    .rvfi_ext_mcycle          (),
-    .rvfi_ext_mhpmcounters    (),
-    .rvfi_ext_mhpmcountersh   (),
-    .rvfi_ext_ic_scr_key_valid(),
-    .rvfi_ext_irq_valid       (),
+    .rvfi_ext_pre_mip            (),
+    .rvfi_ext_post_mip           (),
+    .rvfi_ext_nmi                (),
+    .rvfi_ext_nmi_int            (),
+    .rvfi_ext_debug_req          (),
+    .rvfi_ext_debug_mode         (),
+    .rvfi_ext_rf_wr_suppress     (),
+    .rvfi_ext_mcycle             (),
+    .rvfi_ext_mhpmcounters       (),
+    .rvfi_ext_mhpmcountersh      (),
+    .rvfi_ext_ic_scr_key_valid   (),
+    .rvfi_ext_irq_valid          (),
+    .rvfi_ext_expanded_insn_valid(),
+    .rvfi_ext_expanded_insn      (),
+    .rvfi_ext_expanded_insn_last (),
 `endif
     // SEC_CM: FETCH.CTRL.LC_GATED
     .fetch_enable_i         (fetch_enable),
@@ -836,7 +841,9 @@ module ${module_instance_name}
     .rvfi_mem_rmask,
     .rvfi_mem_wmask,
     .rvfi_mem_rdata,
-    .rvfi_mem_wdata
+    .rvfi_mem_wdata,
+    .rvfi_ext_expanded_insn_valid,
+    .rvfi_ext_expanded_insn
   );
 `endif
 

hw/top_darjeeling/ip_autogen/rv_core_ibex/rtl/rv_core_ibex.sv

@@ -224,6 +224,8 @@ module rv_core_ibex
   logic [ 3:0] rvfi_mem_wmask;
   logic [31:0] rvfi_mem_rdata;
   logic [31:0] rvfi_mem_wdata;
+  logic        rvfi_ext_expanded_insn_valid;
+  logic [15:0] rvfi_ext_expanded_insn;
 `endif
 
   import tlul_pkg::tl_h2d_t;
@@ -555,18 +557,21 @@ module rv_core_ibex
     .rvfi_mem_rdata,
     .rvfi_mem_wdata,
     // Unused ports from the RVFI interface
-    .rvfi_ext_pre_mip         (),
-    .rvfi_ext_post_mip        (),
-    .rvfi_ext_nmi             (),
-    .rvfi_ext_nmi_int         (),
-    .rvfi_ext_debug_req       (),
-    .rvfi_ext_debug_mode      (),
-    .rvfi_ext_rf_wr_suppress  (),
-    .rvfi_ext_mcycle          (),
-    .rvfi_ext_mhpmcounters    (),
-    .rvfi_ext_mhpmcountersh   (),
-    .rvfi_ext_ic_scr_key_valid(),
-    .rvfi_ext_irq_valid       (),
+    .rvfi_ext_pre_mip            (),
+    .rvfi_ext_post_mip           (),
+    .rvfi_ext_nmi                (),
+    .rvfi_ext_nmi_int            (),
+    .rvfi_ext_debug_req          (),
+    .rvfi_ext_debug_mode         (),
+    .rvfi_ext_rf_wr_suppress     (),
+    .rvfi_ext_mcycle             (),
+    .rvfi_ext_mhpmcounters       (),
+    .rvfi_ext_mhpmcountersh      (),
+    .rvfi_ext_ic_scr_key_valid   (),
+    .rvfi_ext_irq_valid          (),
+    .rvfi_ext_expanded_insn_valid(),
+    .rvfi_ext_expanded_insn      (),
+    .rvfi_ext_expanded_insn_last (),
 `endif
     // SEC_CM: FETCH.CTRL.LC_GATED
     .fetch_enable_i         (fetch_enable),
@@ -823,7 +828,9 @@ module rv_core_ibex
     .rvfi_mem_rmask,
     .rvfi_mem_wmask,
     .rvfi_mem_rdata,
-    .rvfi_mem_wdata
+    .rvfi_mem_wdata,
+    .rvfi_ext_expanded_insn_valid,
+    .rvfi_ext_expanded_insn
   );
 `endif
 

hw/top_earlgrey/ip_autogen/rv_core_ibex/rtl/rv_core_ibex.sv

@@ -224,6 +224,8 @@ module rv_core_ibex
   logic [ 3:0] rvfi_mem_wmask;
   logic [31:0] rvfi_mem_rdata;
   logic [31:0] rvfi_mem_wdata;
+  logic        rvfi_ext_expanded_insn_valid;
+  logic [15:0] rvfi_ext_expanded_insn;
 `endif
 
   import tlul_pkg::tl_h2d_t;
@@ -555,18 +557,21 @@ module rv_core_ibex
     .rvfi_mem_rdata,
     .rvfi_mem_wdata,
     // Unused ports from the RVFI interface
-    .rvfi_ext_pre_mip         (),
-    .rvfi_ext_post_mip        (),
-    .rvfi_ext_nmi             (),
-    .rvfi_ext_nmi_int         (),
-    .rvfi_ext_debug_req       (),
-    .rvfi_ext_debug_mode      (),
-    .rvfi_ext_rf_wr_suppress  (),
-    .rvfi_ext_mcycle          (),
-    .rvfi_ext_mhpmcounters    (),
-    .rvfi_ext_mhpmcountersh   (),
-    .rvfi_ext_ic_scr_key_valid(),
-    .rvfi_ext_irq_valid       (),
+    .rvfi_ext_pre_mip            (),
+    .rvfi_ext_post_mip           (),
+    .rvfi_ext_nmi                (),
+    .rvfi_ext_nmi_int            (),
+    .rvfi_ext_debug_req          (),
+    .rvfi_ext_debug_mode         (),
+    .rvfi_ext_rf_wr_suppress     (),
+    .rvfi_ext_mcycle             (),
+    .rvfi_ext_mhpmcounters       (),
+    .rvfi_ext_mhpmcountersh      (),
+    .rvfi_ext_ic_scr_key_valid   (),
+    .rvfi_ext_irq_valid          (),
+    .rvfi_ext_expanded_insn_valid(),
+    .rvfi_ext_expanded_insn      (),
+    .rvfi_ext_expanded_insn_last (),
 `endif
     // SEC_CM: FETCH.CTRL.LC_GATED
     .fetch_enable_i         (fetch_enable),
@@ -823,7 +828,9 @@ module rv_core_ibex
     .rvfi_mem_rmask,
     .rvfi_mem_wmask,
     .rvfi_mem_rdata,
-    .rvfi_mem_wdata
+    .rvfi_mem_wdata,
+    .rvfi_ext_expanded_insn_valid,
+    .rvfi_ext_expanded_insn
   );
 `endif
 

hw/top_englishbreakfast/ip_autogen/rv_core_ibex/rtl/rv_core_ibex.sv

@@ -224,6 +224,8 @@ module rv_core_ibex
   logic [ 3:0] rvfi_mem_wmask;
   logic [31:0] rvfi_mem_rdata;
   logic [31:0] rvfi_mem_wdata;
+  logic        rvfi_ext_expanded_insn_valid;
+  logic [15:0] rvfi_ext_expanded_insn;
 `endif
 
   import tlul_pkg::tl_h2d_t;
@@ -555,18 +557,21 @@ module rv_core_ibex
     .rvfi_mem_rdata,
     .rvfi_mem_wdata,
     // Unused ports from the RVFI interface
-    .rvfi_ext_pre_mip         (),
-    .rvfi_ext_post_mip        (),
-    .rvfi_ext_nmi             (),
-    .rvfi_ext_nmi_int         (),
-    .rvfi_ext_debug_req       (),
-    .rvfi_ext_debug_mode      (),
-    .rvfi_ext_rf_wr_suppress  (),
-    .rvfi_ext_mcycle          (),
-    .rvfi_ext_mhpmcounters    (),
-    .rvfi_ext_mhpmcountersh   (),
-    .rvfi_ext_ic_scr_key_valid(),
-    .rvfi_ext_irq_valid       (),
+    .rvfi_ext_pre_mip            (),
+    .rvfi_ext_post_mip           (),
+    .rvfi_ext_nmi                (),
+    .rvfi_ext_nmi_int            (),
+    .rvfi_ext_debug_req          (),
+    .rvfi_ext_debug_mode         (),
+    .rvfi_ext_rf_wr_suppress     (),
+    .rvfi_ext_mcycle             (),
+    .rvfi_ext_mhpmcounters       (),
+    .rvfi_ext_mhpmcountersh      (),
+    .rvfi_ext_ic_scr_key_valid   (),
+    .rvfi_ext_irq_valid          (),
+    .rvfi_ext_expanded_insn_valid(),
+    .rvfi_ext_expanded_insn      (),
+    .rvfi_ext_expanded_insn_last (),
 `endif
     // SEC_CM: FETCH.CTRL.LC_GATED
     .fetch_enable_i         (fetch_enable),
@@ -823,7 +828,9 @@ module rv_core_ibex
     .rvfi_mem_rmask,
     .rvfi_mem_wmask,
     .rvfi_mem_rdata,
-    .rvfi_mem_wdata
+    .rvfi_mem_wdata,
+    .rvfi_ext_expanded_insn_valid,
+    .rvfi_ext_expanded_insn
   );
 `endif
 

hw/vendor/lowrisc_ibex.lock.hjson

@@ -9,6 +9,6 @@
   upstream:
   {
     url: https://github.com/lowRISC/ibex.git
-    rev: ac911ec101c7e9df5eeb2317ec3db664023b1c24
+    rev: aae4809aea170fc605bdaa64a70a13efd2408829
   }
 }

hw/vendor/lowrisc_ibex/doc/01_overview/compliance.rst

@@ -43,6 +43,10 @@ In addition, the following instruction set extensions are available.
      - 2.0
      - always enabled
 
+   * - **"Zicntr" and "Zihpm"**: Extensions for Counters and Hardware Performance Counters in User mode
+     - 2.0
+     - always enabled
+
    * - **Zifencei**: Instruction-Fetch Fence
      - 2.0
      - always enabled

hw/vendor/lowrisc_ibex/doc/03_reference/performance_counters.rst

@@ -3,10 +3,13 @@
 Performance Counters
 ====================
 
-Ibex implements performance counters according to the RISC-V Privileged Specification, version 1.11 (see Hardware Performance Monitor, Section 3.1.11).
+Ibex implements performance counters according to the RISC-V Privileged Specification, version 1.11 (see Hardware Performance Monitor, Section 3.1.11) and supports the **Zihpm** (Hardware Performance Counters) extension.
 The performance counters are placed inside the Control and Status Registers (CSRs) and can be accessed with the ``CSRRW(I)`` and ``CSRRS/C(I)`` instructions.
 
-Ibex implements the clock cycle counter ``mcycle(h)``, the retired instruction counter ``minstret(h)``, as well as the 29 event counters ``mhpmcounter3(h)`` - ``mhpmcounter31(h)`` and the corresponding event selector CSRs ``mhpmevent3`` - ``mhpmevent31``, and the ``mcountinhibit`` CSR to individually enable/disable the counters.
+Ibex implements the machine-mode clock cycle counter ``mcycle(h)``, the retired instruction counter ``minstret(h)``, as well as the 29 event counters ``mhpmcounter3(h)`` - ``mhpmcounter31(h)`` and the corresponding event selector CSRs ``mhpmevent3`` - ``mhpmevent31``, and the ``mcountinhibit`` CSR to individually enable/disable the counters.
+
+Additionally, Ibex implements the Zicntr and Zihpm extensions which provide User-mode (U-mode) aliases for these performance counters: ``cycle(h)``, ``instret(h)``, and ``hpmcounter3(h)`` - ``hpmcounter31(h)``. These aliases provide read-only access to the exact same underlying hardware counters configured in M-mode.
+
 ``mcycle(h)`` and ``minstret(h)`` are always available and 64 bit wide.
 The ``mhpmcounter`` performance counters are optional (unavailable by default) and parametrizable in width.
 
@@ -60,6 +63,19 @@ In particular, to enable/disable ``mcycle(h)``, bit 0 must be written. For ``min
 The lower 32 bits of all counters can be accessed through the base register, whereas the upper 32 bits are accessed through the ``h``-register.
 Reads to all these registers are non-destructive.
 
+User-Mode Counter Access (mcounteren)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Access to the U-mode counter aliases (``cycle(h)``, ``instret(h)``, and ``hpmcounterX(h)``) is controlled via the Machine Counter-Enable CSR (``mcounteren``). This register can gate access to the counters from less privileged modes to prevent benchmarking the core if desired.
+
+* **Bit 0** controls access to ``cycle(h)``.
+* **Bit 2** controls access to ``instret(h)``.
+* **Bit X** controls access to ``hpmcounterX(h)``.
+
+When a bit in ``mcounteren`` is clear (0), any attempt to read the corresponding counter alias from U-mode will trigger an illegal instruction exception.
+
+To secure this mechanism, the ``mcounteren`` register can be locked against software modifications using a MUBI input signal called ``mcounteren_writeable``. When this signal disables writes, any attempt by software to modify the contents of ``mcounteren`` is ignored.
+
 Parametrization at synthesis time
 ---------------------------------
 

hw/vendor/lowrisc_ibex/doc/04_developer/concierge.rst

@@ -8,14 +8,7 @@ The Ibex Concierge
 The Ibex Concierge is the friendly caretaker of the Ibex project.
 It's a rotating duty shared by experienced contributors to help newcomers find their way around the project, and to stay on top of the various small tasks necessary to keep the project going.
 
-The Ibex CPU project is a reasonably large open source project.
-Like all projects we experience two challenges:
-we want to lend a helping hand to new developers, answering their questions or helping them with code contributions.
-And we need to stay on top of our "caretaker" tasks, like fixing problems with our continuous integration setup, triaging issues and pull requests, etc.
-The Ibex Concierge combines these two duties in one person.
-
-Please reach out to the Ibex Concierge if you have trouble finding your way around the Ibex project.
-You can find today's Ibex Concierge in the calendar below.
+The best way to reach the Ibex Concierge team is by creating an issue on our repository.
 
 
 Who is Ibex Concierge today?
@@ -24,14 +17,11 @@ Who is Ibex Concierge today?
 The concierge duties rotate between several core developers on a weekly basis.
 You can find today's concierge on duty in a `public calendar <https://calendar.google.com/calendar/embed?src=lowrisc.org_s0pdodkddnggdp40jusjij27h4%40group.calendar.google.com>`_.
 
-Besides the concierge on duty you can also contact the following people for urgent matters:
+Besides the concierge on duty you can also contact the following people for urgent matters and for prioritisation:
 
 * Marno van der Maas (`@marnovandermaas <https://github.com/marnovandermaas>`_)
 * Rupert Swarbrick (`@rswarbrick <https://github.com/rswarbrick>`_)
 
-You can be Ibex Concierge, too.
-Please talk to any of the current concierges to discuss!
-
 .. raw:: html
 
     <iframe src="https://calendar.google.com/calendar/embed?src=lowrisc.org_s0pdodkddnggdp40jusjij27h4%40group.calendar.google.com" style="border: 0" width="100%" height="600" frameborder="0" scrolling="no"></iframe>
@@ -41,32 +31,31 @@ Ibex Concierge duties
 ---------------------
 
 The Ibex Concierge is aware of what's happening in the Ibex project, and helps to ensure that everyone feels welcome and is able to work productively.
-The list of duties includes, but isn't strictly limited to the following tasks.
+The list of duties includes, but isn't strictly limited to the following tasks:
 
 * Triage incoming issues and pull requests.
 
   * Assign labels to them.
 
-  * Give initial feedback with an indication of what the next steps are.
-
-  * Answer questions if possible.
-
   * Ask for clarifications where necessary.
 
-  * Redirect to the right developers as needed.
+  * Give initial feedback with an indication of what the next steps are, this does not mean detailed feedback.
 
-* Track progress of open issues and pull requests.
-  Ensure contributors always know what's going on, and are informed if things take longer.
+  * Where more detailed feedback is necessary redirect this to one of the core developers for prioritisation.
 
-* Welcome new contributors, and provide (hands-on) help to get them up to speed.
-  For example, help them get their commits into good shape, etc.
+* When time permits, track progress of open issues and pull requests.
 
-* Fix or coordinate fixes to necessary infrastructure, such as the continuous integration setup in a timely manner.
+  * Try to ensure that contributors know what's going on, and are informed if things take longer or are de-prioritised.
 
-* Go through the list of open pull requests: ping developers if information or action is needed, close abandoned pull requests, etc.
+  * If you find any abandoned pull requests, close them.
 
-* Assist with the review and update of open issues.
+* Check the continuous integration runs and make sure that faults are reported immediately.
+  If applicable, coordinate fixes to necessary infrastructure.
 
 * At the end of the week, hand over to the next Ibex Concierge on the rota.
+  Best thing to do is have a hand-over meeting of no more than half an hour.
 
-Note the obvious: it is not the job of the Ibex Concierge to fix all bugs, implement all incoming feature requests, or be available 24/7.
+Note the obvious:
+It is not the job of the Ibex Concierge to fix all bugs, implement all incoming feature requests, or be available 24/7.
+We expect the Ibex Concierge to spend less than half a day a week on their duties.
+Anything beyond that needs to fit into broader priorities.

hw/vendor/lowrisc_ibex/dv/cosim/spike_cosim.cc

@@ -39,7 +39,10 @@ SpikeCosim::SpikeCosim(const std::string &isa_string, uint32_t start_pc,
                        uint32_t pmp_num_regions, uint32_t pmp_granularity,
                        uint32_t mhpm_counter_num, uint32_t dm_start_addr,
                        uint32_t dm_end_addr)
-    : nmi_mode(false), pending_iside_error(false), insn_cnt(0) {
+    : nmi_mode(false),
+      pending_iside_error(false),
+      insn_cnt(0),
+      mhpm_counter_num(mhpm_counter_num) {
   FILE *log_file = nullptr;
   if (trace_log_path.length() != 0) {
     log = std::make_unique<log_file_t>(trace_log_path.c_str());
@@ -832,6 +835,19 @@ void SpikeCosim::fixup_csr(int csr_num, uint32_t csr_val) {
       processor->set_csr(csr_num, new_val);
 #else
       processor->put_csr(csr_num, new_val);
+#endif
+      break;
+    }
+    case CSR_MCOUNTEREN: {
+      // Bits 3..3+mhpm_counter_num-1 correspond to implemented HPM counters
+      reg_t hpm_mask = ((1 << mhpm_counter_num) - 1) << 3;
+      // Bit 0 and 2 are for mcycle and minstret which are always implemented
+      // Bit 1 is for time which is not implemented, hence the mask 0x5
+      reg_t new_val = csr_val & (0x5 | hpm_mask);
+#ifdef OLD_SPIKE
+      processor->set_csr(csr_num, new_val);
+#else
+      processor->put_csr(csr_num, new_val);
 #endif
       break;
     }

hw/vendor/lowrisc_ibex/dv/cosim/spike_cosim.h

@@ -98,6 +98,7 @@ class SpikeCosim : public simif_t, public Cosim {
   void misaligned_pmp_fixup();
 
   unsigned int insn_cnt;
+  uint32_t mhpm_counter_num;
 
  public:
   SpikeCosim(const std::string &isa_string, uint32_t start_pc,