A method and system for dynamically generating RISC-V emulation resources

Abstract

The present application belongs to the technical field of integrated circuit simulation verification, and particularly relates to a RISC-V simulation resource dynamic generation method and system, which solves the problems of instruction consistency and variable-length instruction truncation through a metadata double-table structure and a cross-border instruction splicing mechanism, and realizes virtualized two-level translation support and exception injection through a recursive multiple hit detection and dynamic attribute bit modification mechanism. The present application replaces complete storage with lightweight metadata, significantly reduces memory occupation, solves the problem of linear growth of memory occupation over time, improves simulation efficiency and consistency, and is suitable for full-system verification of high-performance RISC-V processors.

Description

Technical Field

[0001] This invention belongs to the field of integrated circuit simulation and verification technology, specifically relating to a method and system for dynamically generating RISC-V simulation resources. Background Technology

[0002] In the simulation and verification of high-performance RISC-V processors that support virtualization expansion, traditional static reference models suffer from the following technical bottlenecks:

[0003] 1. Memory usage increases linearly with simulation time: Static models need to cache all instructions and page table structures. As the length of the instruction stream and the number of page table entries increase, memory usage will expand rapidly, and simulation efficiency will decrease significantly.

[0004] 2. Lack of instruction consistency: Static models cannot simulate the invalidation mechanism of the instruction L1 cache. When a privilege level mode switch or instruction synchronization barrier is executed, the remnants of old instructions will cause the simulation behavior to be inconsistent with the actual hardware behavior, reducing the verification coverage.

[0005] 3. Truncation problem of 32-bit instructions across cache line boundaries: RISC-V supports compressed instruction sets, and 32-bit instructions may cross cache line boundaries. Traditional dynamic generation methods lack cross-line state maintenance mechanisms, which can lead to instruction splicing errors, resulting in illegal instructions or instruction stream disorder.

[0006] 4. Low efficiency of page table multiple hit detection: When randomly generating mixed page sizes (such as 4K, 64K, 2M, 1G, 512G), the traditional traversal collision detection algorithm has high time complexity and is difficult to meet the requirements of real-time simulation.

[0007] 5. Complexity of two-level virtualization translation: After introducing hardware virtualization mode, it is necessary to support nested first-level address translation and second-level address translation. The process of manually constructing complex exceptions (such as first-level page table translation errors in virtual mode and second-level page table translation errors in virtual mode) is cumbersome, prone to human error, and difficult to cover complex and boundary scenarios. Summary of the Invention

[0008] To address the problems in the background technology, this invention provides a method and system for dynamically generating RISC-V simulation resources.

[0009] The technical solution of the present invention is as follows:

[0010] This invention provides a method for dynamically generating RISC-V simulation resources, including dynamic generation of instructions and dynamic generation of page table information;

[0011] The instructions are generated dynamically, and the operation is as follows:

[0012] (1) After obtaining the instruction type from the external instruction type parameter passing and branch prediction unit, the alignment detection operation between the program counter address and the cache line boundary is performed. If the alignment is not performed, the random instruction generation mechanism or simulation abnormality is triggered; if the alignment is performed, the instruction type is retrieved, the bit width attribute is determined according to the instruction type, and the program counter address is updated.

[0013] (2) Based on the obtained instruction type, dynamically call the corresponding generation function to construct hexadecimal encoding, generate cache line data, and integrity status signal;

[0014] (3) When a 32-bit instruction is detected to cross the cache line boundary, the high 16 bits of the instruction are extracted and stored in the half-instruction cache array; when the next cache line request is triggered, the half-instruction cache array is queried and the instruction is concatenated; if no matching fragment is found, a random instruction is generated and filled into the current cache line.

[0015] The page table information is generated dynamically, as follows:

[0016] (1) Query the historical page table data corresponding to the virtual page number. If a match is found, the page table entry is returned directly. If no match is found, the page table size range is determined according to the current privilege mode and register configuration, and the page table size is randomly generated.

[0017] (2) Based on the virtual page number and page table size, query the flag bit that conflicts with the page table size; if there is a conflicting size, downgrade the page table size level by level until a page table size without conflict is found, and use it as the target page table size;

[0018] (3) Configure physical memory protection and page table entry permission bits according to the exception type passed in by external parameters, and generate a complete page table; update the flag bit with the virtual page number as the index and the target page table size.

[0019] Furthermore, when a 32-bit instruction is detected crossing a cache line boundary, the high 16 bits of the instruction are extracted and stored in the half-instruction cache array, specifically as follows:

[0020] When it is detected that the last 16 bits of the current cache line need to accommodate a 32-bit complete instruction, the high 16 bits of the instruction are extracted, named the half-instruction cache, and the valid flag is set; the half-instruction cache data and the corresponding program counter address are written together into the half-instruction cache array.

[0021] Furthermore, when the next cache line request is triggered, the half-instruction cache array is queried and instructions are concatenated; if no matching fragment is found, a random instruction is generated and filled into the current cache line, specifically:

[0022] When the next cache line request is triggered, a matching query is performed in the half-instruction cache array based on the program counter address aligned with the current cache line. If the query result is found, the matching half-instruction cache data is filled into the lower 16 bits of the current cache line. If no high-order segment matching the current program counter address is found in the half-instruction cache array, a random instruction is generated and filled into the current cache line.

[0023] Furthermore, if misalignment occurs, a random instruction generation mechanism or simulation anomaly is triggered; if alignment occurs, the instruction type is retrieved, the bit width attribute is determined based on the instruction type, and the program counter address is updated, specifically as follows:

[0024] If the detection result is misalignment, the system will enter the preset error handling path, triggering a random instruction generation mechanism or causing a simulation anomaly.

[0025] If the detection result is aligned, then an instruction type query operation is performed to retrieve the corresponding instruction type based on the current program counter address; the bit width attribute is determined according to the instruction type. If it is a complete instruction, the program counter address is incremented by the first preset byte; if it is a compressed instruction, the program counter address is incremented by the second preset byte.

[0026] Furthermore, if a page table miss occurs, the page table size range is determined based on the current privilege mode and register configuration, and a page table size is randomly generated, specifically as follows:

[0027] When no historical page table data corresponding to the virtual page number is found, if the privileged mode is machine mode, the page table size will be random within the range of 4K to 512G.

[0028] If the privileged mode is supervisor mode or user mode, and the register is configured in SV39 mode, then the maximum page table size is 1G;

[0029] If the privileged mode is virtual mode and any associated register is configured in SV39 mode, the maximum page table size is 1G.

[0030] Furthermore, the instruction types include uncompressed instructions and compressed instructions;

[0031] The uncompressed instructions include a first conditional branch instruction, a first unconditional jump instruction, a first register indirect jump instruction, a first direct jump instruction, a function call instruction, a function return instruction, a call instruction with a return value, and an undecompilable idle instruction.

[0032] The compression instructions include a second conditional branch instruction, a second unconditional jump instruction, a second register indirect jump instruction, a second direct jump instruction, and a branch instruction.

[0033] The present invention also provides a RISC-V simulation resource dynamic generation system, including an instruction dynamic generation module and a page table information dynamic generation module;

[0034] The instruction dynamic generation module includes:

[0035] Instruction type acquisition module: After obtaining the instruction type from the external instruction type parameter passing and branch prediction unit, it performs an alignment detection operation between the program counter address and the cache line boundary. If the alignment is not achieved, it triggers a random instruction generation mechanism or a simulation exception; if the alignment is achieved, it retrieves the instruction type, determines the bit width attribute based on the instruction type, and updates the program counter address.

[0036] Instruction content generation module: It is used to dynamically call the corresponding generation function according to the acquired instruction type, construct hexadecimal encoding, generate cache line data, and integrity status signals;

[0037] Cross-cache line boundary processing module: When a 32-bit instruction is detected crossing a cache line boundary, the high 16 bits of the instruction are extracted and stored in the half-instruction cache array; when the next cache line request is triggered, the half-instruction cache array is queried and the instruction is concatenated; if no matching fragment is found, a random instruction is generated and filled into the current cache line.

[0038] The page table information dynamic generation module includes:

[0039] Historical page table query module: used to query the historical page table data corresponding to the virtual page number. If a match is found, the page table entry is returned directly; if no match is found, the page table size range is determined based on the current privilege mode and register configuration, and a page table size is randomly generated.

[0040] Multiple hit detection module: Based on the virtual page number and page table size, query the flag bit that conflicts with the page table size; if a conflicting size exists, the page table size is downgraded level by level until a conflict-free page table size is found and used as the target page table size;

[0041] Page table storage module: Based on the exception type passed in by external parameters, configure physical memory protection and permission bits for page table entries, and generate a complete page table; use the virtual page number as an index and update the flag bit in combination with the target page table size.

[0042] Furthermore, when the cross-cache line boundary processing module detects a 32-bit instruction crossing a cache line boundary, it extracts the high 16 bits of the instruction and stores them in the half-instruction cache array, specifically as follows:

[0043] When it is detected that the last 16 bits of the current cache line need to accommodate a 32-bit complete instruction, the high 16 bits of the instruction are extracted, named the half-instruction cache, and the valid flag is set; the half-instruction cache data and the corresponding program counter address are written together into the half-instruction cache array.

[0044] Furthermore, the cross-cache line boundary processing module, when the next cache line request is triggered, queries the semi-instruction cache array and concatenates the instructions; if no matching fragment is found, it generates a random instruction and fills the current cache line, specifically:

[0045] When the next cache line request is triggered, a matching query is performed in the half-instruction cache array based on the program counter address aligned with the current cache line. If the query result is found, the matching half-instruction cache data is filled into the lower 16 bits of the current cache line. If no high-order segment matching the current program counter address is found in the half-instruction cache array, a random instruction is generated and filled into the current cache line.

[0046] Furthermore, if the historical page table query module does not find a match, it determines the page table size range based on the current privileged mode and register configuration, and randomly generates a page table size, specifically as follows:

[0047] When no historical page table data corresponding to the virtual page number is found, if the privileged mode is machine mode, the page table size will be random within the range of 4K to 512G.

[0048] If the privileged mode is supervisor mode or user mode, and the register is configured in SV39 mode, then the maximum page table size is 1G;

[0049] If the privileged mode is virtual mode and any associated register is configured in SV39 mode, the maximum page table size is 1G.

[0050] Beneficial effects

[0051] This invention solves the problems of instruction consistency and variable-length instruction truncation by using a dual-table metadata structure and a cross-boundary instruction concatenation mechanism. It also achieves two-level virtualization translation support and anomaly injection through recursive multi-hit detection and dynamic attribute bit modification mechanisms. By replacing full storage with lightweight metadata, this invention significantly reduces memory usage, solves the problem of linear memory usage growth over time, improves simulation efficiency and consistency, and is suitable for full-system verification of high-performance RISC-V processors. Detailed Implementation

[0052] The following examples are intended to illustrate the present invention, and not to further limit the invention.

[0053] Example 1

[0054] This embodiment provides a method for dynamically generating RISC-V simulation resources, including dynamic generation of instructions and dynamic generation of page table information;

[0055] The instructions are generated dynamically, and the operation is as follows:

[0056] (1) After obtaining the instruction type from the external instruction type parameter passing and branch prediction unit, the alignment detection operation between the program counter address and the cache line boundary is performed. If the alignment is not performed, the random instruction generation mechanism or simulation abnormality is triggered; if the alignment is performed, the instruction type is retrieved, the bit width attribute is determined according to the instruction type, and the program counter address is updated.

[0057] (2) Based on the obtained instruction type, dynamically call the corresponding generation function to construct hexadecimal encoding, generate cache line data, and integrity status signal;

[0058] (3) When a 32-bit instruction is detected to cross the cache line boundary, the high 16 bits of the instruction are extracted and stored in the half-instruction cache array; when the next cache line request is triggered, the half-instruction cache array is queried and the instruction is concatenated; if no matching fragment is found, a random instruction is generated and filled into the current cache line.

[0059] During the instruction dynamic generation stage, the instruction types mentioned in step (1) include uncompressed instructions and compressed instructions;

[0060] The uncompressed instructions include a first conditional branch instruction, a first unconditional jump instruction, a first register indirect jump instruction, a first direct jump instruction, a function call instruction, a function return instruction, a call instruction with a return value, and an undecompilable idle instruction.

[0061] The compression instructions include a second conditional branch instruction, a second unconditional jump instruction, a second register indirect jump instruction, a second direct jump instruction, and a branch instruction.

[0062] Furthermore, if misalignment occurs, a random instruction generation mechanism or simulation anomaly is triggered; if alignment occurs, the instruction type is retrieved, the bit width attribute is determined based on the instruction type, and the program counter address is updated, specifically as follows:

[0063] If the detection result is misalignment, the system will enter the preset error handling path, triggering a random instruction generation mechanism or causing a simulation anomaly.

[0064] If the detection result is aligned, then an instruction type query operation is performed to retrieve the corresponding instruction type based on the current program counter address; the bit width attribute is determined according to the instruction type. If it is a complete instruction, the program counter address is incremented by the first preset byte; if it is a compressed instruction, the program counter address is incremented by the second preset byte.

[0065] Step (3) involves detecting a 32-bit instruction crossing a cache line boundary, extracting the high 16 bits of the instruction, and storing them in the half-instruction cache array. Specifically:

[0066] When it is detected that the last 16 bits of the current cache line need to accommodate a 32-bit complete instruction, the high 16 bits of the instruction are extracted, named the half-instruction cache, and the valid flag is set; the half-instruction cache data and the corresponding program counter address are written together into the half-instruction cache array.

[0067] Furthermore, when the next cache line request is triggered, the half-instruction cache array is queried and instructions are concatenated; if no matching fragment is found, a random instruction is generated and filled into the current cache line, specifically:

[0068] When the next cache line request is triggered, a matching query is performed in the half-instruction cache array based on the program counter address aligned with the current cache line. If the query result is found, the matching half-instruction cache data is filled into the lower 16 bits of the current cache line. If no high-order segment matching the current program counter address is found in the half-instruction cache array, a random instruction is generated and filled into the current cache line.

[0069] In the specific implementation process, during the dynamic generation stage of instructions, this invention first designed a dual-table metadata structure and a cross-boundary instruction splicing mechanism.

[0070] ① Metadata dual-table structure

[0071] Instruction type table (inst_type_table): Indexed by the program counter (PC) address, it stores instruction type enumeration values ​​and compression flags.

[0072] Half-inst array: Used to store high-order instruction fragments truncated by cache line boundaries, supporting cross-line concatenation.

[0073] ② Cross-boundary instruction concatenation mechanism refers to the process where, when the starting address of a 32-bit instruction is located within the last 16 bits of the current cache line, the lower 16 bits are written to the current line, and the higher 16 bits and the validity flag (half_inst_vld) are stored in the half-instruction cache array. During the next sequential instruction fetch request, the higher-order bits are retrieved from this array first to complete the instruction concatenation.

[0074] When an instruction fetch request is missing in the instruction type table, it is determined to be a non-sequential prefetch or an incorrect path execution. A valid random instruction will be automatically generated based on the random seed and returned, thereby improving the robustness and coverage of the corresponding model.

[0075] The specific operating procedure is as follows:

[0076] (1) Obtaining instruction type

[0077] The instruction type is obtained from the external instruction type parameter passing of two parallel paths and the output port of the branch prediction unit, and is finally input to the instruction encoding generation module (gen_inst). The external instruction type parameter passing function (get_inst_type_cfg) receives parameters of the instruction type from external sources. The supported instruction type set includes both uncompressed and compressed instructions.

[0078] The uncompressed instructions include the first conditional branch instruction br, the first unconditional jump instruction jal, the first register indirect jump instruction jalr, the first direct jump instruction jump, the function call instruction call, the function return instruction ret, the call instruction with return ret_call, and the idle instruction idle that ifu cannot translate.

[0079] The compression instructions include the second conditional branch instruction c_br, the second unconditional jump instruction c_jal, the second register indirect jump instruction c_jalr, the second direct jump instruction c_jump, and the branch instruction c_branch.

[0080] The above instruction type sequence is output in ascending order of program counter (PC) address, serving as the type basis for subsequent instruction encoding and ensuring the continuity of instruction flow in spatial layout.

[0081] The instruction type verification function (get_inst_type_bpu_gen) receives the program counter address-to-instruction type mapping table output from the branch prediction unit (BPU) as its input data source. First, it performs a program counter alignment check to determine if the current program counter address is aligned with the cache line boundary.

[0082] If the detection result is misalignment, the system will enter the preset error handling path, triggering a random instruction generation mechanism or causing a simulation exception to ensure the boundary integrity of the instruction flow.

[0083] If the detection result is aligned, the subsequent instruction type query operation continues. During the query phase, the corresponding instruction type is retrieved from the instruction type table input by the BPU based on the current program counter address; then, its bit width attribute is determined according to the instruction type.

[0084] If it is a full instruction (32-bit), the program counter address is incremented by 4 bytes; if it is a compressed instruction (16-bit), the program counter address is incremented by 2 bytes, and the current program counter register value is updated synchronously.

[0085] After completing the type output, the queried instruction type data is output, and the entry is cleared from the instruction type table to avoid reuse or state conflicts.

[0086] (2) Instruction content generation

[0087] First, based on the type of the received instruction, the bit width type is determined, and then the random distribution weights are adjusted according to the instruction semantic category, specifically as follows:

[0088] Based on the received instruction type, it is determined whether the instruction to be generated is a compressed instruction or a complete instruction: if it is a compressed instruction, the 16-bit instruction generation logic is invoked according to the encoding rules of the RISC-V C extended instruction set; if it is a complete instruction, the 32-bit instruction generation logic is invoked according to the RISC-V standard instruction format specification, thereby constructing a hexadecimal instruction code that conforms to the semantics of the instruction set architecture. In this encoding construction process, this invention does not employ a uniform random strategy, but rather dynamically adjusts the generation distribution of key fields according to the semantic category represented by the opcode.

[0089] Specifically, in the generation of the immediate number segment, if the current instruction is an arithmetic immediate instruction (such as ADDI, SLTI, or LUI), the weight of boundary values ​​such as 0, -1, 0x7FF, and 0x800 in the random candidate set is increased to increase the probability of triggering carry, overflow, or sign extension exceptions; if it is a logic immediate instruction (such as ANDI, ORI, or XORI), the immediate value is preferentially selected from the preset set such as all 0s, all 1s, single bit set to 1, or alternating bit mode, so that the arithmetic logic unit can fully cover the bit operation critical path in register transfer level simulation.

[0090] During the register operand allocation phase, this invention determines the data dependency strength mode by reading external configuration parameters and allocates the source operand register and destination operand register accordingly. When configured in tight dependency mode, the destination register of the current instruction is directly designated as a source operand register of the next instruction, thereby forming a continuous data dependency chain and activating the processor's data forwarding path at high frequency. When configured in long latency dependency mode, the source operand register of the current instruction is pointed to the destination register of a high-latency instruction (such as DIV or REM) issued several cycles ago, and irrelevant instructions are inserted between the two to lengthen the dependency distance. This verifies the functional correctness and timing robustness of the pipeline scoring board in out-of-order issuance, result wake-up, and resource conflict arbitration.

[0091] Meanwhile, while ensuring that the main opcode is within a valid definition domain, this invention performs controlled perturbation operations (verification of anomaly handling) on ​​the FUNC3 and FUNC7 fields and reserved bits in the instruction encoding. This perturbation is achieved through a boundary walk algorithm, which involves stepwise random offsets within the neighborhood of valid sub-encodings to explore undefined encoding combinations. Simultaneously, illegal but format-compliant sub-encodings are written into the instruction field according to a preset ratio (e.g., injecting 1-3 instructions per 100 instructions). This allows the decoding stage to accurately trigger illegal instruction anomalies, thereby verifying the decoder's accuracy in recognizing and isolating abnormal instructions, and preventing functional confusion or security vulnerabilities caused by fuzzy matching.

[0092] Finally, all generated instructions are sequentially filled into a 512-bit cache line buffer in ascending order of program counter address. The filling process does not force instruction alignment with cache line boundaries or half-word boundaries, allowing 16-bit compressed instructions and 32-bit complete instructions to be arbitrarily interleaved within the cache line. Specifically, when the buffer has only 16 bits remaining and the next instruction to be filled is 32 bits, this invention only writes the lower 16 bits to the end of the current cache line (e.g., the 62nd to 63rd byte position), while temporarily storing the higher 16 bits in a half-instruction cache array, thereby proactively constructing a cross-cache line fetch scenario.

[0093] After the filling is complete, two auxiliary control signals are generated simultaneously: one is an integrity status signal, which indicates whether the current cache line ends with a complete instruction. If the end is exactly at the boundary of an instruction, the signal is set to valid; otherwise, it is set to invalid. The second is a valid byte mask signal, which uses a 64-bit wide bitmap to identify the position of the valid instruction byte in the 512-bit data of the cache line. These two signals serve as the key control basis for line buffer splicing, unaligned instruction parsing, and cross-line reassembly, ensuring that the processor front end can still correctly maintain the continuity and semantic integrity of the instruction stream under arbitrary mixed instruction arrangements and boundary truncation situations.

[0094] (3) Cross-cache line boundary processing

[0095] It receives the integrity status signal output from the instruction encoding generation module (gen_inst) and the instruction content at the end of the current cache line as input conditions for its boundary processing logic. First, it performs truncation detection and high-bit caching operations: when it detects that the last 16 bits of the current cache line need to accommodate a 32-bit complete instruction, it extracts the high 16 bits of the instruction [31:16], names it as half-instruction cache, sets the valid flag (half_inst_vld = 1), and then writes the half-instruction cache data and its corresponding program counter address together into the half-instruction cache array for instruction concatenation when subsequent cache lines are requested.

[0096] When the next cache line request is triggered, the concatenation mechanism is executed: based on the program counter address aligned to the current cache line, an exact match query is performed in the half-instruction cache array to determine whether there is a high-order instruction fragment to be concatenated.

[0097] If the query result is found, the matched half-instruction cache data is filled into the lower 16 bits of the current cache line, thereby completing the cross-boundary reorganization of the complete instruction; at the same time, the corresponding entry in the half-instruction cache array is immediately cleared.

[0098] If no high-order segment matching the current program counter address is found in the half-instruction cache array, the scenario is determined to be an unexpected cross-boundary situation. At this time, the exception handling process is initiated: a set of legal random instructions conforming to the instruction format specification is generated to fill the current cache line in order to maintain the continuity of the simulation environment. If there is no cross-cache line situation, no operation will be performed.

[0099] On the one hand, this invention constructs a dual-table structure for metadata, which stores opcode attributes in an "instruction type table" and cross-line fragments in a "semi-instruction cache array," so that the simulation memory usage no longer increases linearly with the instruction stream length, thus achieving lightweight storage space. At the same time, by generating instructions through real-time querying of metadata, it ensures that it can respond to changes in the instruction stream immediately after privilege level switching or execution of the fence.i instruction, avoiding consistency errors caused by old instruction remnants.

[0100] On the other hand, this invention designs a cross-boundary instruction splicing mechanism to address the unique 16-bit / 32-bit variable-length instruction mixing characteristics of the RISC-V architecture. This effectively solves the problem of erroneous truncation of 32-bit instructions when they cross cache line boundaries, ensuring the semantic integrity of instruction fetch operations at physical boundaries, avoiding illegal instruction exceptions caused by instruction fragmentation, and significantly improving the stability of verification.

[0101] The page table information is generated dynamically, as follows:

[0102] (1) Query the historical page table data corresponding to the virtual page number. If a match is found, the page table entry is returned directly. If no match is found, the page table size range is determined according to the current privilege mode and register configuration, and the page table size is randomly generated.

[0103] (2) Based on the virtual page number and page table size, query the flag bit that conflicts with the page table size; if there is a conflicting size, downgrade the page table size level by level until a page table size without conflict is found, and use it as the target page table size;

[0104] (3) Configure physical memory protection and page table entry permission bits according to the exception type passed in by external parameters, and generate a complete page table; update the flag bit with the virtual page number as the index and the target page table size.

[0105] During the dynamic generation phase of page table information, if a page table miss occurs as described in step (1), the page table size range is determined based on the current privileged mode and register configuration, and the page table size is randomly generated, specifically as follows:

[0106] When no historical page table data corresponding to the virtual page number is found, if the privileged mode is machine mode, the page table size will be random within the range of 4K to 512G.

[0107] If the privileged mode is supervisor mode or user mode, and the register is configured in SV39 mode, then the maximum page table size is 1G;

[0108] If the privileged mode is virtual mode and any associated register is configured in SV39 mode, the maximum page table size is 1G.

[0109] In the specific implementation process, during the dynamic generation stage of page table information, this invention first designed a multi-strategy address mapping and memory mechanism, a recursive multi-hit self-checking mechanism, and virtualization awareness and non-intrusive anomaly injection.

[0110] ① Multi-strategy address mapping and memory mechanism

[0111] Mapping strategies supported include: direct mapping (physical address and virtual address are the same), bitwise inversion mapping (physical address is the bitwise inversion of virtual address), and many-to-one mapping (multiple virtual addresses are mapped to the same physical address).

[0112] Short-term memory mechanism: Maintain a page table cache table (page_info_mem) to cache the generated page table data, ensuring the determinism of the address translation result before operations that require clearing storage, such as mode switching, fence.i, or page table invalidation, occur.

[0113] ② Recursive multi-hit self-checking mechanism

[0114] Lightweight flags: For each virtual page number VPN, maintain a set of size flags (flg_512G, flg_1G, flg_2M, flg_64K) to mark the occupied page size. For example, flg_512G=1 means that the VPN cannot generate a 512G page table.

[0115] Degradation logic: Before generating the page table, check the page table size flag corresponding to the VPN. If a conflicting size already exists (Flag=1), automatically recursively downgrade (e.g., 1G→2M→64K) until a safe size is found. If the final size is reduced to 4K, since 4K is the smallest granularity of the page table, it must be a safe size.

[0116] ③ Virtualized perception and non-intrusive anomaly injection

[0117] Two-level translation support: Independent generation of first-level and second-level page tables in virtual mode. When the privileged mode is user mode in virtual mode, two-level address translation can be selected. If not specified, it will be randomized in two cases, and the address translation mode will be set by dynamically modifying the value of the two-level address translation valid bit in the page table information (1: perform two-level address translation, 0: do not perform).

[0118] Attribute bit modification mechanism: Based on the value of the exception type and combined with the current privilege mode type, the permission bits of the page table entry are directly flipped during the generation process, such as readable (pte_r), writable (pte_w), executable (pte_x), and page table in user mode (pte_u), or the permission bits of physical memory protection (pmp) are modified to simulate memory access faults and page faults without modifying physical memory data.

[0119] The specific operating procedure is as follows:

[0120] (1) Historical page table query

[0121] If the current VPN is queried in the historical page table, and this VPN exists in a page table that has been returned before, then the previously generated page table entry is directly returned from the page table cache table (page_info_mem), and the subsequent generation process is skipped;

[0122] If the VPN does not find a page table in the page_info_mem check, it first determines whether the current privileged mode is machine mode (m-mode):

[0123] If so, the page table size can be randomized within the range of 4k to 512G. If it is not machine mode, the next step is to determine whether it is in supervisory mode (s-mode) or user mode (u-mode):

[0124] If so, then the value of the Supervisory Address Translation and Protection Register (SATP) needs to be checked. If it is in sv39 mode (SATP=8), then the maximum page table size can be 1G when only three-level page table translation is possible.

[0125] If the current privileged mode is virtual mode, then it is necessary to determine the values ​​of the Supervisory Address Translation and Protection Register (SATP), the Virtual Supervisory Address Translation and Protection Register (VSAP), and the Hypervisor Client Address Translation and Protection Register (HGATP) separately:

[0126] If one of the registers is set to sv39 mode, the maximum size of the page table is 1G when the page table size is randomized. Otherwise, the maximum page table size can be set to 512G. Then, the page table size is randomized to obtain a specific value (page_size), and the physical page number (ppn) is obtained through the address mapping strategy passed in by external parameters.

[0127] (2) Multiple hit detection

[0128] S1: The VPN and page_size query page table multi-hit check table (mem_for_page_check) obtained from the historical page table query phase. This structure maintains a set of page size conflict flags for each VPN, including 512G:1 / 0, 1G:1 / 0, 2M:1 / 0, and 64K:1 / 0, which are used to determine whether there is a conflict in the target page table size within the current virtual address range.

[0129] S2: During multiple hit detection, query the VPN and the value of its page_size flag (e.g., page_size=1G and flg_1G=1), automatically start the recursive degradation mechanism, downgrade the page table size to the next level (1G→2M), and repeat the above conflict detection until a conflict-free page table size is found.

[0130] (3) Page table storage

[0131] S1: Based on the exception type passed in from external parameters, after configuring the remaining page table information such as PMP (Physical Memory Protection) and PTE (Page Table Entry), a complete page table is generated by combining the VPN, PPN, and page_size information obtained in the previous two stages, and output to the instruction fast table (ITLB). Then, using the virtual page number VPN as an index, it is stored in the page table cache table (page_info_mem).

[0132] S2: Using VPN as an index, and combining it with the page table size, pull up the corresponding flag bits (for example, if the page table size is 4K, then flg_64K, flg_2M, flg_1G, flg_512G corresponding to the VPN need to be pulled up) and store them in the page table multi-hit check table (mem_for_page_check);

[0133] S3: When a cache clear signal is received, clear page_info_mem and mem_for_page_check to complete the state refresh after the simulation environment is reset or the privileged mode is switched.

[0134] This invention solves the alignment and conflict problems of page tables of different sizes in two-level translation of virtualization through recursive multi-hit detection, eliminating the need for pre-planning complex physical memory layouts. It achieves non-intrusive exception injection by dynamically modifying the permission bits of generated page table entries rather than physical memory data through a dynamic attribute bit modification mechanism. This allows the verification environment to continuously and frequently simulate various page faults and access errors without resetting memory, significantly improving verification coverage and robustness. Furthermore, this invention replaces full storage with lightweight metadata, significantly reducing memory footprint and solving the problem of linear memory usage growth over time, improving simulation efficiency and consistency, and making it suitable for full-system verification of high-performance RISC-V processors.

[0135] Example 2

[0136] Based on Embodiment 1, this embodiment provides a RISC-V simulation resource dynamic generation system, including an instruction dynamic generation module and a page table information dynamic generation module;

[0137] The instruction dynamic generation module, serving as a reference model for the L2 cache, responds to processor instruction fetch requests, monitors processor privilege level switching and instruction barrier events (fence.i), and automatically clears instruction type metadata in response to these events, achieving real-time consistency updates of the simulation environment. This module does not store the complete instruction stream; instead, it maintains a lightweight metadata structure to achieve on-demand instruction generation and consistency guarantees. It includes:

[0138] Instruction type acquisition module: After obtaining the instruction type from the external instruction type parameter passing and branch prediction unit, it performs an alignment detection operation between the program counter address and the cache line boundary. If the alignment is not achieved, it triggers a random instruction generation mechanism or a simulation exception; if the alignment is achieved, it retrieves the instruction type, determines the bit width attribute based on the instruction type, and updates the program counter address.

[0139] Instruction content generation module: It is used to dynamically call the corresponding generation function according to the acquired instruction type, construct hexadecimal encoding, generate cache line data, and integrity status signals;

[0140] Cross-cache line boundary processing module: When a 32-bit instruction is detected crossing a cache line boundary, the high 16 bits of the instruction are extracted and stored in the half-instruction cache array; when the next cache line request is triggered, the half-instruction cache array is queried and the instruction is concatenated; if no matching fragment is found, a random instruction is generated and filled into the current cache line.

[0141] Preferably, when the cross-cache line boundary processing module detects a 32-bit instruction crossing a cache line boundary, it extracts the high 16 bits of the instruction and stores them in the half-instruction cache array, specifically as follows:

[0142] When it is detected that the last 16 bits of the current cache line need to accommodate a 32-bit complete instruction, the high 16 bits of the instruction are extracted, named the half-instruction cache, and the valid flag is set; the half-instruction cache data and the corresponding program counter address are written together into the half-instruction cache array.

[0143] Furthermore, the cross-cache line boundary processing module, when the next cache line request is triggered, queries the semi-instruction cache array and concatenates the instructions; if no matching fragment is found, it generates a random instruction and fills the current cache line, specifically:

[0144] When the next cache line request is triggered, a matching query is performed in the half-instruction cache array based on the program counter address aligned with the current cache line. If the query result is found, the matching half-instruction cache data is filled into the lower 16 bits of the current cache line. If no high-order segment matching the current program counter address is found in the half-instruction cache array, a random instruction is generated and filled into the current cache line.

[0145] The page table information dynamic generation module, serving as a reference model for the Memory Management Unit (MMU), supports different address translation modes (such as SV39 / SV48 / BARE) and virtualization extensions, enabling dynamic generation of page tables, conflict avoidance, and exception injection. It employs flag-based recursive detection logic to check for conflict-level flags within the target address range before generating the page table, and supports automatic downgrading of the page table size until the conflict is resolved. This includes:

[0146] Historical page table query module: used to query the historical page table data corresponding to the virtual page number. If a match is found, the page table entry is returned directly; if no match is found, the page table size range is determined based on the current privilege mode and register configuration, and a page table size is randomly generated.

[0147] Multiple hit detection module: Based on the virtual page number and page table size, query the flag bit that conflicts with the page table size; if a conflicting size exists, the page table size is downgraded level by level until a conflict-free page table size is found and used as the target page table size;

[0148] Page table storage module: Based on the exception type passed in by external parameters, configure physical memory protection and permission bits for page table entries, and generate a complete page table; use the virtual page number as an index and update the flag bit in combination with the target page table size.

[0149] Specifically, if the historical page table query module fails to find a match, it determines the page table size range based on the current privileged mode and register configuration, and then randomly generates a page table size.

[0150] When no historical page table data corresponding to the virtual page number is found, if the privileged mode is machine mode, the page table size will be random within the range of 4K to 512G.

[0151] If the privileged mode is supervisor mode or user mode, and the register is configured in SV39 mode, then the maximum page table size is 1G;

[0152] If the privileged mode is virtual mode and any associated register is configured in SV39 mode, the maximum page table size is 1G.

[0153] The page table information dynamic generation module of this invention supports independent control of the page table attributes for first-level and second-level address translation. By dynamically modifying the permission bits or validity bits of page table entries, it achieves the injection of various page faults without modifying the physical memory data. It also supports diverse physical address generation strategies, including inverted mapping, and uses page_info_mem to cache the generated page table entry information to ensure translation consistency within a short period of time.

[0154] Example 3

[0155] Based on Embodiment 2, this embodiment provides an operational flow for cross-boundary instruction consistency processing, as follows:

[0156] Running state: The processor requests address 0x1000 (cache line A), and the instruction dynamic generation module generates the lower 16 bits of the 32-bit instruction at the end.

[0157] Truncation processing: The high 16 bits of the last 32-bit instruction are stored in the half-inst array, with the index set to 0x1040.

[0158] Instruction concatenation: Replace the first 16 bits of the next cache line fetched sequentially with the data stored in half_inst_array.

[0159] Example 4

[0160] Based on Example 2, this example provides an operational flow for anomaly injection and conflict avoidance in the virtualization second-level address translation state, as follows:

[0161] Input: VPN 0x2000 translation request, configuration requires generating 1GB large pages.

[0162] Conflict detection: The inspection found that a 4K flag was marked in the 0x2000 range (indicating that 4K pages already existed).

[0163] Automatic downgrade: The system automatically downgrades a 1G request to 2M and continues to detect until the multi-hit flag is no longer present.

[0164] Virtual mode page fault (vs_page_fault) exception injection: Based on the external exception injection interface, force the highest bit of the virtual mode flag of the generated page table entry to be set to 1, and set the lowest two bits to 10 (this area is writable but not readable).

[0165] Output: Returns a page table that would cause the hardware to trigger vs_page_fault.

[0166] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for dynamically generating RISC-V simulation resources, characterized in that, This includes dynamic generation of instructions and dynamic generation of page table information; The instructions are generated dynamically, and the operation is as follows: (1) After obtaining the instruction type from the external instruction type parameter passing and branch prediction unit, the alignment detection operation between the program counter address and the cache line boundary is performed. If the alignment is not performed, the random instruction generation mechanism or simulation abnormality is triggered. During alignment, the instruction type is retrieved, the bit width attribute is determined based on the instruction type, and the program counter address is updated accordingly. (2) Based on the obtained instruction type, dynamically call the corresponding generation function to construct hexadecimal encoding, generate cache line data, and integrity status signal; (3) When a 32-bit instruction is detected to cross the cache line boundary, the high 16 bits of the instruction are extracted and stored in the half-instruction cache array; when the next cache line request is triggered, the half-instruction cache array is queried and the instruction is concatenated; if no matching fragment is found, a random instruction is generated and filled into the current cache line. The page table information is generated dynamically, as follows: (1) Query the historical page table data corresponding to the virtual page number. If a match is found, the page table entry is returned directly. If no match is found, the page table size range is determined according to the current privilege mode and register configuration, and the page table size is randomly generated. (2) Based on the virtual page number and page table size, query the flag bit that conflicts with the page table size; if there is a conflicting size, downgrade the page table size level by level until a page table size without conflict is found, and use it as the target page table size; (3) Configure physical memory protection and page table entry permission bits according to the exception type passed in by external parameters, and generate a complete page table; update the flag bit with the virtual page number as the index and the target page table size.

2. The method for dynamically generating RISC-V simulation resources according to claim 1, characterized in that, When a 32-bit instruction is detected crossing a cache line boundary, the high 16 bits of the instruction are extracted and stored in the half-instruction cache array, specifically: When it is detected that the last 16 bits of the current cache line need to accommodate a 32-bit complete instruction, the high 16 bits of the instruction are extracted, named the half-instruction cache, and the valid flag is set; the half-instruction cache data and the corresponding program counter address are written together into the half-instruction cache array.

3. The method for dynamically generating RISC-V simulation resources according to claim 1, characterized in that, When the next cache line request is triggered, the half-instruction cache array is queried and instructions are concatenated; if no matching fragment is found, a random instruction is generated and filled into the current cache line, specifically: When the next cache line request is triggered, a matching query is performed in the half-instruction cache array based on the program counter address aligned with the current cache line. If the query result is found, the matching half-instruction cache data is filled into the lower 16 bits of the current cache line. If no high-order segment matching the current program counter address is found in the half-instruction cache array, a random instruction is generated and filled into the current cache line.

4. The method for dynamically generating RISC-V simulation resources according to claim 1, characterized in that, When misalignment occurs, a random instruction generation mechanism or simulation anomaly is triggered; when alignment occurs, the instruction type is retrieved, the bit width attribute is determined based on the instruction type, and the program counter address is updated, specifically as follows: If the detection result is misalignment, the system will enter the preset error handling path, triggering a random instruction generation mechanism or causing a simulation anomaly. If the detection result is aligned, then an instruction type query operation is performed to retrieve the corresponding instruction type based on the current program counter address; the bit width attribute is determined according to the instruction type. If it is a complete instruction, the program counter address is incremented by the first preset byte; if it is a compressed instruction, the program counter address is incremented by the second preset byte.

5. The method for dynamically generating RISC-V simulation resources according to claim 1, characterized in that, If a page table miss occurs, the page table size range is determined based on the current privileged mode and register configuration, and a page table size is randomly generated. Specifically: When no historical page table data corresponding to the virtual page number is found, if the privileged mode is machine mode, the page table size will be random within the range of 4K to 512G. If the privileged mode is supervisor mode or user mode, and the register is configured in SV39 mode, then the maximum page table size is 1G; If the privileged mode is virtual mode and any associated register is configured in SV39 mode, the maximum page table size is 1G.

6. The method for dynamically generating RISC-V simulation resources according to claim 1, characterized in that, The instruction types include uncompressed instructions and compressed instructions; The uncompressed instructions include a first conditional branch instruction, a first unconditional jump instruction, a first register indirect jump instruction, a first direct jump instruction, a function call instruction, a function return instruction, a call instruction with a return value, and an undecompilable idle instruction. The compression instructions include a second conditional branch instruction, a second unconditional jump instruction, a second register indirect jump instruction, a second direct jump instruction, and a branch instruction.

7. A RISC-V simulation resource dynamic generation system, characterized in that, This includes a dynamic instruction generation module and a dynamic page table information generation module; The instruction dynamic generation module includes: Instruction type acquisition module: After obtaining the instruction type from the external instruction type parameter passing and branch prediction unit, it performs an alignment detection operation between the program counter address and the cache line boundary. If the alignment is not achieved, it triggers a random instruction generation mechanism or a simulation exception; if the alignment is achieved, it retrieves the instruction type, determines the bit width attribute based on the instruction type, and updates the program counter address. Instruction content generation module: It is used to dynamically call the corresponding generation function according to the acquired instruction type, construct hexadecimal encoding, generate cache line data, and integrity status signals; Cross-cache line boundary processing module: When a 32-bit instruction is detected crossing a cache line boundary, the high 16 bits of the instruction are extracted and stored in the half-instruction cache array; when the next cache line request is triggered, the half-instruction cache array is queried and the instruction is concatenated; if no matching fragment is found, a random instruction is generated and filled into the current cache line. The page table information dynamic generation module includes: Historical page table query module: used to query the historical page table data corresponding to the virtual page number. If a match is found, the page table entry is returned directly; if no match is found, the page table size range is determined based on the current privilege mode and register configuration, and a page table size is randomly generated. Multiple hit detection module: Based on the virtual page number and page table size, query the flag bit that conflicts with the page table size; if a conflicting size exists, the page table size is downgraded level by level until a conflict-free page table size is found and used as the target page table size; Page table storage module: Based on the exception type passed in by external parameters, configure physical memory protection and permission bits for page table entries, and generate a complete page table; use the virtual page number as an index and update the flag bit in combination with the target page table size.

8. The RISC-V simulation resource dynamic generation system according to claim 7, characterized in that, When the cross-cache line boundary processing module detects a 32-bit instruction crossing a cache line boundary, it extracts the high 16 bits of the instruction and stores them in the half-instruction cache array. Specifically: When it is detected that the last 16 bits of the current cache line need to accommodate a 32-bit complete instruction, the high 16 bits of the instruction are extracted, named the half-instruction cache, and the valid flag is set; the half-instruction cache data and the corresponding program counter address are written together into the half-instruction cache array.

9. The RISC-V simulation resource dynamic generation system according to claim 7, characterized in that, The cross-cache line boundary processing module, when the next cache line request is triggered, queries the half-instruction cache array and concatenates the instructions; if no matching fragment is found, it generates a random instruction and fills the current cache line, specifically as follows: When the next cache line request is triggered, a matching query is performed in the half-instruction cache array based on the program counter address aligned with the current cache line. If the query result is found, the matching half-instruction cache data is filled into the lower 16 bits of the current cache line. If no high-order segment matching the current program counter address is found in the half-instruction cache array, a random instruction is generated and filled into the current cache line.

10. The RISC-V simulation resource dynamic generation system according to claim 7, characterized in that, If the historical page table query module does not find a match, it determines the page table size range based on the current privileged mode and register configuration, and randomly generates a page table size, specifically as follows: When no historical page table data corresponding to the virtual page number is found, if the privileged mode is machine mode, the page table size will be random within the range of 4K to 512G. If the privileged mode is supervisor mode or user mode, and the register is configured in SV39 mode, then the maximum page table size is 1G; If the privileged mode is virtual mode and any associated register is configured in SV39 mode, the maximum page table size is 1G.