blob: 1d8aadb0e29c2325add84daf5942ba8fdcda870a [file] [log] [blame]
// Copyright lowRISC contributors.
// Licensed under the Apache License, Version 2.0, see LICENSE for details.
// SPDX-License-Identifier: Apache-2.0
{
name: "rv_dm"
// TODO: remove the common testplans if not applicable
import_testplans: ["hw/dv/tools/dvsim/testplans/csr_testplan.hjson",
"hw/dv/tools/dvsim/testplans/mem_testplan.hjson",
"hw/dv/tools/dvsim/testplans/alert_test_testplan.hjson",
"hw/dv/tools/dvsim/testplans/stress_all_with_reset_testplan.hjson",
"hw/dv/tools/dvsim/testplans/tl_device_access_types_testplan.hjson",
"rv_dm_sec_cm_testplan.hjson"]
testpoints: [
// Note that the CSR tests in the imported csr_testplan.hjson will cover CSRs attached to both,
// the main RV_DM device interface as well as the debug ROM interface.
{
name: smoke
desc: '''
A basic smoke test.
. Read the DTM register `idcode` and verify that it reflects the correct value.
- Enable debug by setting lc_hw_debug_en to true.
- Write to the DMI register field dmcontrol[dmactive] via JTAG and verify that the
`dmactive` output pin reflects the same value.
- Write to the DMI register field dmcontrol[haltreq] via JTAG and verify that the
`debug_req` output pin reflects the same value.
- Write to the DMI register field dmcontrol[ndmreset] via JTAG and verify that the
`ndmreset` output pin reflects the same value.
- Wiggle the `unavailable` input and read the DTM register field dmstatus[allunavail]
to verify that it reflects the same value as the input signal.
'''
stage: V1
tests: ["rv_dm_smoke"]
}
{
name: jtag_dtm_csr_hw_reset
desc: '''
Verify the reset values of JTAG DTM CSRs as indicated in the RAL specification.
See hw/dv/tools/dvsim/testplans/csr_testplan.hjson for more description, This follows
the same approach, but applies to the JTAG DTM regisers.
In these set of tests, the lc_hw_debug_en is set to true, scanmode & scan_rst_n inputs
to false.
'''
stage: V1
tests: ["rv_dm_jtag_dtm_csr_hw_reset"]
}
{
name: jtag_dtm_csr_rw
desc: '''
Verify accessibility of JTAG DTM CSRs as indicated in the RAL specification.
See hw/dv/tools/dvsim/testplans/csr_testplan.hjson for more description, This follows
the same approach, but applies to the JTAG DTM regisers.
'''
stage: V1
tests: ["rv_dm_jtag_dtm_csr_rw"]
}
{
name: jtag_dtm_csr_bit_bash
desc: '''
Verify no aliasing within individual bits of JTAG DTM CSR.
See hw/dv/tools/dvsim/testplans/csr_testplan.hjson for more description, This follows
the same approach, but applies to the JTAG DTM regisers.
'''
stage: V1
tests: ["rv_dm_jtag_dtm_csr_bit_bash"]
}
{
name: jtag_dtm_csr_aliasing
desc: '''
Verify no aliasing within the JTAG DTM CSR address space.
See hw/dv/tools/dvsim/testplans/csr_testplan.hjson for more description, This follows
the same approach, but applies to the JTAG DTM regisers.
'''
stage: V1
tests: ["rv_dm_jtag_dtm_csr_aliasing"]
}
{
name: jtag_dmi_csr_hw_reset
desc: '''
Verify the reset values of JTAG DMI CSRs as indicated in the RAL specification.
See hw/dv/tools/dvsim/testplans/csr_testplan.hjson for more description, This follows
the same approach, but applies to the JTAG DMI regisers.
In these set of tests, the lc_hw_debug_en is set to true, scanmode & scan_rst_n inputs
to false.
Also, the dmcontrol[dmactive] field is set to 1 at the start, to ensure CSR accesses to
all other registers go through.
'''
stage: V1
tests: ["rv_dm_jtag_dmi_csr_hw_reset"]
}
{
name: jtag_dmi_csr_rw
desc: '''
Verify accessibility of JTAG DMI CSRs as indicated in the RAL specification.
See hw/dv/tools/dvsim/testplans/csr_testplan.hjson for more description, This follows
the same approach, but applies to the JTAG DMI regisers.
'''
stage: V1
tests: ["rv_dm_jtag_dmi_csr_rw"]
}
{
name: jtag_dmi_csr_bit_bash
desc: '''
Verify no aliasing within individual bits of JTAG DMI CSR.
See hw/dv/tools/dvsim/testplans/csr_testplan.hjson for more description, This follows
the same approach, but applies to the JTAG DMI regisers.
'''
stage: V1
tests: ["rv_dm_jtag_dmi_csr_bit_bash"]
}
{
name: jtag_dmi_csr_aliasing
desc: '''
Verify no aliasing within the JTAG DMI CSR address space.
See hw/dv/tools/dvsim/testplans/csr_testplan.hjson for more description, This follows
the same approach, but applies to the JTAG DMI regisers.
'''
stage: V1
tests: ["rv_dm_jtag_dmi_csr_aliasing"]
}
{
name: idcode
desc: '''
Verify that the JTAG IDCODE reads the correct value.
- Set a different JTAG ID code an rv_dm design parameter.
- Read the IDCODE register in JTAG DTM register space, via JTAG.
- Verify it reads back what was set.
'''
stage: V2
tests: ["rv_dm_smoke"]
}
{
name: jtag_dtm_hard_reset
desc: '''
Verify that the debugger can camcel an on-going DMI transaction with a hard reset.
- Perform a random legal DMI write to a chosen DMI register and immediately write to
dtmcs[dmihardreset] bit.
- Read the target DMI register to verify the write did not succeed.
'''
stage: V2
tests: [] // TODO(#15670)
}
{
name: jtag_dtm_idle_hint
desc: '''
Verify that the JTAG debugger does not need to stay any longer than the advertized idle
time indicated in dtmcs register.
- Read the dtmcs[idle] value and configure the JTAG DMI register adapter to insert that
many delay between transactions.
- Issue random legal DMI accesses back to back and ensure that all of them complete
successfully, without dmistat reflecting an error.
'''
stage: V2
tests: [] // TODO(#17033)
}
{
name: jtag_dmi_failed_op
desc: '''
Verify that a failed DMI op is reflected properly in dtmcs register.
- Issue a random legal DMI write to a chosen DMI register.
- Before that access completes, issue another random legal DMI access.
- Read the dtmcs[dmistat] register to verify busy error.
- Clear it by writing to dtmcs[dmireset] register.
- Poll the DMI access for completion and verify that the first write completed
successfully by doing a read-check.
- TBO - unclear how to generate other types of failed DMI transactions.
'''
stage: V2
tests: [] // TODO(#17034)
}
{
name: jtag_dmi_dm_inactive
desc: '''
Verify that writes to DMI registers other than dmcontrol[dmactive] and ignored and they
all retain the reset values on reads.
- Perform random writes to DMI registers while dmcontrol[dmactive] is 0 (exclude it).
- Read all DMI registers back and verify they reflect POR values.
'''
stage: V2
tests: [] // TODO(#17035)
}
{
name: sba
desc: '''
Verify all types of accesses from JTAG to SBA.
- Enable debug by setting lc_hw_debug_en to true and activate the dm
- Write to SBA registers to inject randomized 8/16/32bit writes and reads.
- Randomize readonaddr and readondata settings and ensure those have the intended
effect.
- Generate sbbusy = 1 scenario by picking a very large response delay, since JTAG
accesses are much slower (SBA TL accesses tend to complete faster than JTAG can
read the SBCS register).
'''
stage: V2
tests: ["rv_dm_sba_tl_access", "rv_dm_delayed_resp_sba_tl_access"]
}
{
name: bad_sba
desc: '''
Verify attempts to make bad SBA accesses results in the error sticky bits getting set.
- Enable debug by setting lc_hw_debug_en to true and activate the dm.
- Build on the previous `sba` test and randomly inject errors in the following
ways:
- Inject a response error on the TL response channel (d_error = 1) and verify that
the sberror bit is set to 2.
- Inject a randomized SBA access that is not aligned to the size of the transfer and
verify that the sberror bit is set to 3.
- Inject a randomized SBA access that is greater that the supported transfer size and
verify that the sberror bit is set to 4.
- Inject an integrity error on the TL response channel and verify that the sberror
bit is set to 7. Verify that an alert is seen. Reset the DUT.
- Inject a new SBA traffic before the previous one completes - verify that the
sbbusyerror asserts. This is achieved by setting a large TL response delay (TODO).
- Have more than one of these types of errors trigger at the same time.
Note: The following error scenarios are not supported by the design:
- pulp-platform/riscv-dbg#128: response timeout (sberror = 1) is not implemented.
'''
stage: V2
tests: ["rv_dm_bad_sba_tl_access"]
}
{
name: sba_autoincrement
desc: '''
Verify the address autoincrement functionality of SBA.
- Enable debug by setting lc_hw_debug_en to true and activate the dm.
- Write to the SBCS register to inject randomized 8/16/32bit writes. Set the
autoincrement bit.
- Pick a random address and write to sbaddress0 register.
- Write a random value to sbdata0, repeating a randomized number of times.
- Each write should trigger a new SBA TL write access with the address incremented with
the transfer size. Verify that the SBA TL access shows up.
- Repeat the same procedure for reads. For reads, set the readondata register and read
the sbdata0 a randomized number of times - each read should trigger a new SBA TL read
access.
- Intermittently also generate busy and error conditions.
'''
stage: V2
tests: ["rv_dm_autoincr_sba_tl_access"]
}
{
name: jtag_dmi_debug_disabled
desc: '''
Verify that the JTAG DMI register space cannot be accessed if pinmux_hw_debug_en is a non
strict true value.
- Set pinmux_hw_debug_en to true and activate the dm.
- Write a known value to a randomly picked DMI CSR.
- Set pinmux_hw_debug_en to non-true value.
- Write a different value to the same DMI CSR.
- Attempt to read that DMI CSR - it should read all 0s.
- Note that the above steps are rendered moot because the JTAG DTM itself will not
receive any incoming JTAG transactions.
- Set pinmux_hw_debug_en to true and again read the DMI CSR - it should reflect the
originally written value.
'''
stage: V2
tests: [] // TODO(#15667)
}
{
name: sba_debug_disabled
desc: '''
Verify that access to SBA interface is disabled if lc_hw_debug_en is set to not strict
true value.
- Set lc_hw_debug_en to true and activate the dm.
- Attempt to inject a legal randomized SBA access - verify that it comes through.
- Set lc_hw_debug_en to non-true value and activate the dm.
- Attempt to inject a legal randomized SBA access - verify that no SBA TL accesses
appear on the TL interface.
- Reapeat, a random number of times.
- Verify via assertion checks, no transactions were seen on the SBA TL interface.
'''
stage: V2
tests: [] // TODO(#15668)
}
{
name: ndmreset_req
desc: '''
Verify that the debugger can issue a non-debug reset to the rest of the system.
- Set lc_hw_debug_en / pinmux_hw_debug_en to true value and activate the dm.
- Pick a random set of write/readable CSRs in all 3 RALs (JTAG DMI, regs RAL and debug
mem RAL). Write known values to them.
- Write the dmcontrol register to assert ndmreset - verify that the ndmreset output
stays asserted.
- Mimic the CPU going into reset by asserting unavailable input, asserting rst_ni
and setting lc_hw_debug_en to false. Keep pinmux_hw_debug_en set to true to keep
the JTAG side open while the ndmreset is in progress.
- Read the dmstatus register to verify allunavail is asserted.
- De-assert the ndmreset by writing 0 to the dmcontrol register field, verify the
ndmreset output deasserted as well.
- Mimic the CPU going out of reset by de-asserting unavailable input and rst_ni
after some delay. Set lc_hw_debug_en to true again as well.
- Read the previously written registers back and verify that they reflect the previously
written value, proving that ndmreset assertion had no effect on them.
'''
stage: V2
tests: [] // TODO(#15666)
}
{
name: hart_unavail
desc: '''
Verify that the debugger can read the status of unavailable hart
- Set lc_hw_debug_en to true value and activate the dm.
- Randomly assert and de-assert the `unavailable` input (indicates the CPU is under
reset). This ideally happens when ndmreset is issued by the debugger.
- Periodically issue reads to dmstatus register to verify allunavail matches the
`unavailable` input value
'''
stage: V2
tests: [] // TODO(#17036)
}
{
name: tap_ctrl_transitions
desc: '''
Verify all JTAG TAP controller FSM transitions
This test should verify that the standardized JTAG TAP FSM is working correctly.
'''
stage: V2
tests: [] // TODO(#17032)
}
{
name: stress_all
desc: '''
A 'bug hunt' test that stresses the DUT to its limits.
- Combine above sequences in one test and run as many of them as possible in parallel.
Run the rest sequentially.
- Randomly inject a full device reset intermittently.
'''
stage: V2
tests: ["rv_dm_stress_all"]
}
]
covergroups: [
{
name: sba_access_cg
desc: '''Cover all possible types of accesses over SBA.
- cp: reads and write accesses
- cp: supported transfer sizes
- cp: auto-increment address with back-to-back acesses
- cp: for reads, cover readonaddr and readondata settings
- cp: sberror cases with unaligned address and unsupported size
- cp: sbbusyerror case - attempt new access before the previous one completed
- cr: cross all of the above
'''
}
]
}