ACC DV document

Goals

• DV
  • Verify the ACC processor by running dynamic simulations with a SV/UVM based testbench
  • These simulations are grouped in tests listed in the testplan below.
  • Close code and functional coverage on the IP and all of its sub-modules
• FPV
  • Verify TileLink device protocol compliance with an SVA based testbench

Current status

• Design & verification stage
  • HW development stages

Design features

ACC, the Asymmetric Cryptography Coprocessor, is a cryptographic accelerator. For detailed information on ACC design features, see the ACC HWIP technical specification.

Testbench architecture

The ACC testbench is based on the CIP testbench architecture. It builds on the dv_utils and csr_utils packages.

Block diagram

ACC testing makes use of a DPI-based model called acc_core_model. This is shown in the block diagram. The dotted interfaces in the acc block are bound in by the model to access internal signals (register file and memory contents).

Top level testbench

The top-level testbench is located at hw/ip/acc/dv/uvm/tb.sv. This instantiates the ACC DUT module hw/ip/acc/rtl/acc.sv.

ACC has the following interfaces:

• A Clock and reset interface
• A TileLink interface. ACC is a TL-UL device, which expects to communicate with a TL-UL host. In the SoC, this will be the Ibex core.
• Idle signals in each clock domain, idle_o, and idle_otp_o
• One interrupt
• An alert interface
• A life cycle escalation interface
• An OTP: for example, see egret’s OTP connection
• Two EDN connections
• A KMAC interface for message hashing
• A RAM configuration interface, which is passed through to the SRAM macros

The idle and interrupt signals are modelled with the basic pins_if interface.

As well as instantiating ACC, the testbench also instantiates an acc_core_model. This module wraps an ISS (instruction set simulator) subprocess and performs checks to make sure that ACC behaves the same as the ISS. The acc_core_model module communicates with test sequences through an acc_model_if interface, which is monitored by the acc_model_agent, described below. The module communicates with the Python subprocess as shown in the diagram below.

ACC model agent

The model agent is instantiated by the testbench to monitor the ACC model. It is a passive agent (essentially just a monitor): the inputs to the model are set in tb.sv. The monitor for the agent generates transactions when it sees a start signal or a done signal.

The start signal is important because we “cheat” and pull it out of the DUT. To make sure that the processor is starting when we expect, we check start transactions against TL writes in the scoreboard.

Reference models

The main reference model for ACC is the instruction set simulator (ISS), which is run as a subprocess by DPI code inside acc_core_model. This Python-based simulator can be found at hw/ip/acc/dv/accsim.

Stimulus strategy

When testing ACC, we are careful to distinguish between

• behavior that can be triggered by particular instruction streams
• behavior that is triggered by particular external stimuli (register writes; surprise resets etc.)

Testing lots of different instruction streams doesn’t really use the UVM machinery, so we have a “pre-DV” phase of testing that generates constrained-random instruction streams (as ELF binaries) and runs a simple block-level simulation on each to check that the RTL matches the model. The idea is that this is much quicker for designers to use to smoke-test proposed changes, and can be run with Verilator, so it doesn’t require an EDA tool licence. The Verilator environment uses a fusesoc flag to configure the ISS model and ACC dependencies. To configure the simulation environment for simulation of the vector ISA extension use --flag pqc during the build invocation. This pre-DV phase cannot drive sign-off, but it does use much of the same tooling.

Once we are running full DV tests, we re-use this work, by using the same collection of randomized instruction streams and randomly picking from them for most of the sequences. At the moment, the full DV tests create binaries on the fly by running hw/ip/acc/dv/uvm/gen-binaries.py. This results in one or more ELF files in a directory, which the simulation then picks from at random.

The pre-DV testing doesn’t address external stimuli like resets or TileLink-based register accesses. These are driven by specialized test sequences, described below.

Functional coverage

As a complicated IP block, ACC has a lot of functional coverage points defined. To avoid overwhelming this document, these are described in ACC functional coverage.

Test sequences

The test sequences can be found in hw/ip/acc/dv/uvm/env/seq_lib. The basic test sequence (acc_base_vseq) loads the instruction stream from a randomly chosen binary (see above), configures ACC and then lets it run to completion.

More specialized sequences include things like multiple runs, register accesses during operation (which should fail) and memory corruption. We also check things like the correct operation of the interrupt registers.

Self-checking strategy

Scoreboard

Much of the checking for these tests is actually performed in acc_core_model, which ensures that the RTL and ISS have the same behavior. However, the scoreboard does have some checks, to ensure that interrupt and idle signals are high at the expected times.

Assertions

Core TLUL protocol assertions are checked by binding the TL-UL protocol checker into the design.

Outputs are also checked for 'X values by assertions in the design RTL. The design RTL contains other assertions defined by the designers, which will be checked in simulation (and won’t have been checked by the pre-DV Verilator simulations).

Finally, the acc_idle_checker checks that the idle_o output correctly matches the running state that you’d expect, based on writes to the CMD register and responses that will appear in the DONE interrupt.

Building and running tests

Tests can be run with dvsim.py. The link gives details of the tool’s features and command line arguments. To run a basic smoke test, go to the top of the repository and run:

$ util/dvsim/dvsim.py hw/ip/acc/dv/uvm/acc_sim_cfg.hjson -i acc_smoke

Note that due to the AccPQCEn parameterization of ACC to support PQC algorithms that there are two simulation configs. As referenced in the example, acc_sim_cfg.hjson is for the classical ACC implementation. To run simulations on the PQC enabled ACC instead, the appropriate file is acc_pqc_sim_cfg.hjson.

Testplan

Testplan