A resource isolation verification method and system

Abstract

The application discloses a resource isolation verification method and system, which is applied to an RTL simulation verification platform and a unified bus interconnection protocol and comprises the following steps: a control unit constructs a resource ownership table of shared resources; a test unit creates a device instance comprising an instance unique identifier; the control unit saves the association between the instance unique identifier and resource information identifier, so as to continuously update the resource ownership table; when the device instance issues a resource access transaction, the control unit acquires the corresponding instance unique identifier in the current resource ownership table and records the instance unique identifier; after the resource access transaction is executed, the control unit compares the acquired instance unique identifier with the recorded instance unique identifier, and judges that there is a resource isolation exception when the comparison result is inconsistent. The application compares the two instance unique identifiers to judge whether the resources are isolated abnormally, and improves the detection capability of resource reuse transition period isolation defects.

Description

Technical Field

[0001] This invention relates to the field of integrated circuit simulation and verification, and in particular to a resource isolation verification method and system. Background Technology

[0002] In the hardware design of unified bus virtual devices, multiple virtual device instances share physical resources such as queues, doorbells, direct memory access address windows, interrupt vectors, and routing contexts. Resource isolation is crucial to ensuring that instances do not interfere with each other. During the RTL (Register Transfer Level) simulation verification phase, the verification platform typically checks whether the direct memory access address range exceeds the authorized limits using the input / output memory management unit, or associates transactions on the bus based on device identifiers and resource numbers to determine the legality of virtual device instance access to resources. During verification, test cases drive virtual device instances through lifecycle operations such as creation, configuration, operation, and destruction. Monitoring components collect transactions on the device interface and bus, comparing the actual response of the tested design with the expected results to identify isolation issues such as unauthorized resource access or address conflicts. When a virtual device instance is destroyed, its occupied hardware resources are reclaimed and can be redistributed to subsequently created instances. This resource reclamation and reuse mechanism frequently occurs in scenarios involving long-running operations and the alternating creation of multiple instances.

[0003] However, device identifiers and resource numbers are reused after instance destruction, and the same queue number or interrupt vector may belong to different virtual device instances at different times. Direct memory access transactions issued by virtual device instances during runtime undergo address translation, bus transmission, and target execution before returning a completion response, resulting in a delay of multiple clock cycles between transaction issuance and completion. When an instance is destroyed before a transaction returns, its occupied resources are reclaimed and redistributed to newly created instances. Old transactions still in transit, upon completion, arrive at the queue or interrupt already belonging to the new instance using the same resource number. Existing verification methods rely solely on device identifiers and resource numbers to determine transaction ownership, making it difficult to identify whether the completion actually originates from a no-longer-existing old instance. If the verification platform mistakenly identifies a late-arriving completion from an old instance as a legitimate transaction from a new instance, or confuses a legitimate access from a new instance with a residual transaction from an old instance, it cannot detect isolation defects in the design under test during the resource reuse transition period. This leads to cross-lifecycle resource ownership conflicts being missed in the chip after tape-out, affecting system stability. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention discloses a resource isolation verification method applied to an RTL simulation verification platform comprising multiple units under test (UTDs). The resource isolation verification method is applied to a unified bus transmission protocol. It includes setting up a test unit and a control unit. The resource isolation verification method comprises: the control unit constructing a corresponding resource ownership table based on all shared resources stored in each UTD; the test unit creating corresponding device instances in each UTD, each device instance having a unique instance identifier; and the control unit continuously acquiring configuration update information from each UTD to continuously update the resource ownership table, the configuration update information including the instance unique identifier of the corresponding device instance. The resource information identifier of the shared resource and the configuration are stored in the resource ownership table along with the corresponding instance unique identifier. When the device instance issues a resource access transaction, the control unit obtains and records the instance unique identifier corresponding to the current resource ownership table based on the resource information identifier carried in the resource access transaction. After the resource access transaction is completed, the control unit obtains the instance unique identifier corresponding to the current resource ownership table based on the corresponding resource information identifier, compares the currently obtained instance unique identifier with the corresponding recorded instance unique identifier, and judges it as a resource isolation anomaly when the comparison result is inconsistent.

[0005] Preferably, the instance unique identifier includes the unit unique identifier of the unit under test corresponding to the device instance and the generation identifier of the device instance; the device instance is allowed to be created repeatedly in each unit under test, and when the device instance is created, the generation identifier of the device instance is set incrementally according to the creation order in the corresponding unit under test.

[0006] Preferably, after creating the device instance, the test unit issues lifecycle instructions to the device instance; the lifecycle instructions include resource configuration instructions and resource access instructions; upon receiving the resource configuration instructions, the device instance executes the resource configuration instructions based on preset configuration logic, and uses the execution result as the configuration update information for the control unit to obtain; upon receiving the resource access instructions, the device instance constructs and issues the resource access transaction based on the resource access instructions; the resource ownership table stores the ownership record of each shared resource; after updating the resource ownership table, the control unit verifies the configuration update information based on preset resource configuration rules, and if the verification fails, queries the corresponding ownership record in the resource ownership table based on the corresponding resource information identifier and the instance unique identifier to backtrack the device instance; when the resource access transaction is completed and it is determined to be a resource isolation anomaly, the control unit queries the corresponding ownership record in the resource ownership table based on the corresponding resource information identifier and the instance unique identifier to backtrack the device instance.

[0007] Preferably, a monitoring unit is also provided, which continuously monitors the device instance to obtain the resource access instruction; after the testing unit sends the resource access instruction to the device instance, the device instance verifies the legality of the resource access instruction to determine whether to construct the resource access transaction; after the device instance receives the resource access instruction, the control unit obtains the corresponding resource access instruction from the monitoring unit, obtains the corresponding instance unique identifier from the current resource ownership table based on the resource information identifier carried in the resource access instruction, and predicts whether the corresponding device instance will construct the resource access transaction based on the instance unique identifier; the control unit transmits the actual status of whether the device instance constructs the resource access transaction. The actual result is compared with the predicted result of the control unit: if they are inconsistent, it is judged as a resource isolation anomaly; if both the actual result and the predicted result are to construct the resource access transaction, the corresponding instance unique identifier is recorded. After the resource access transaction is completed, the instance unique identifier obtained from the current resource ownership table is compared with the instance unique identifier recorded in the corresponding record, and if the comparison result is inconsistent, it is judged as a resource isolation anomaly; if both the actual result and the predicted result are to refuse to construct the resource access transaction, the resource change status of the shared resource involved in the resource access transaction is obtained, and if the resource change status indicates that the device instance is still accessing the shared resource, it is judged as a resource isolation anomaly.

[0008] Preferably, when the device instance issues a resource access transaction, the control unit obtains the instance unique identifier corresponding to the current resource ownership table based on the resource information identifier carried in the resource access transaction, and associates and saves the corresponding resource information identifier and the corresponding instance unique identifier in the transaction ledger; when receiving the configuration update information, the control unit queries the transaction ledger after associating the instance unique identifier and the resource information identifier carried in the configuration update information, and determines that the resource isolation is abnormal when the corresponding resource access transaction is saved in the transaction ledger.

[0009] This invention discloses a resource isolation verification system applied to an RTL simulation verification platform comprising multiple units under test (UTS). The resource isolation verification method is applied to a unified bus interconnect protocol. The resource isolation verification system includes a test unit and a control unit. The test unit creates corresponding device instances in each UTS, each device instance having a unique instance identifier. The control unit includes: a construction module for constructing a corresponding resource ownership table based on all shared resources stored in each UTS; and an update module connected to the construction module for continuously acquiring configuration update information from each UTS to continuously update the resource ownership table. The configuration update information includes the unique instance identifier and configured information of the corresponding device instance. The resource information identifier of the shared resource is associated with the resource ownership table, which stores the resource information identifier and the corresponding instance unique identifier. A recording module, connected to the update module, is used to obtain and record the current instance unique identifier in the resource ownership table based on the resource information identifier carried in the resource access transaction when the device instance issues a resource access transaction. A first judgment module, connected to the recording module, is used to obtain the current instance unique identifier in the resource ownership table based on the corresponding resource information identifier after the resource access transaction is completed, compare the currently obtained instance unique identifier with the corresponding recorded instance unique identifier, and determine a resource isolation anomaly if the comparison result is inconsistent.

[0010] Preferably, the testing unit includes: an instruction issuing module, used to issue lifecycle instructions to the device instance after the device instance is created; the lifecycle instructions include resource configuration instructions and resource access instructions; the device instance includes: a first execution module, used to execute the resource configuration instructions based on preset configuration logic when receiving the resource configuration instructions, and use the execution result as the configuration update information for the control unit to obtain; a second execution module, used to construct and issue the resource access transaction based on the resource access instructions when receiving the resource access instructions; the resource ownership table stores the ownership record of each shared resource; the control unit includes: a first backtracking module, used to verify the configuration update information based on preset resource configuration rules after updating the resource ownership table, and query the corresponding ownership record in the resource ownership table based on the corresponding resource information identifier and the instance unique identifier when the verification fails, so as to backtrack the device instance; a second backtracking module, used to query the corresponding ownership record in the resource ownership table based on the corresponding resource information identifier and the instance unique identifier when the resource access transaction is completed and it is determined that the resource isolation is abnormal, so as to backtrack the device instance.

[0011] Preferably, it further includes: a monitoring unit, connected to the device instance and the control unit respectively, for continuously monitoring the device instance to obtain the resource access instruction; the device instance includes: a determination module, for verifying the legality of the resource access instruction after the test unit issues the resource access instruction to the device instance, to determine whether to construct the resource access transaction; the control unit includes: a prediction module, for obtaining the corresponding resource access instruction from the monitoring unit after the device instance receives the resource access instruction, obtaining the corresponding instance unique identifier from the current resource ownership table based on the resource information identifier carried in the resource access instruction, and predicting whether the corresponding device instance will construct the resource access transaction based on the instance unique identifier; a comparison module, connected to the prediction module, for using... The actual result of whether the device instance constructs the resource access transaction is compared with the prediction result of the prediction module: if they are inconsistent, it is judged as a resource isolation anomaly; if both the actual result and the prediction result indicate that the resource access transaction is constructed, the corresponding unique identifier of the instance is recorded. After the resource access transaction is completed, the unique identifier of the instance obtained from the current resource ownership table is compared with the unique identifier of the instance recorded in the corresponding record, and if the comparison result indicates that they are inconsistent, it is judged as a resource isolation anomaly; if both the actual result and the prediction result indicate that the resource access transaction is rejected, the resource change status of the shared resources involved in the resource access transaction is obtained, and if the resource change status indicates that the device instance is still accessing the shared resources, it is judged as a resource isolation anomaly.

[0012] Preferably, the control unit includes: a storage module, configured to, when the device instance issues a resource access transaction, obtain the instance unique identifier corresponding to the current resource ownership table based on the resource information identifier carried in the resource access transaction, and associate and store the resource information identifier and the instance unique identifier in the transaction ledger; and a second judgment module, connected to the storage module, configured to, when receiving the configuration update information, query the transaction ledger after associating the instance unique identifier and the resource information identifier carried in the configuration update information, and determine that the resource isolation is abnormal when the corresponding resource access transaction is stored in the transaction ledger.

[0013] The present invention can achieve the following beneficial effects: by comparing and verifying the unique instance identifier stored in the resource ownership table with the unique instance identifier obtained from the resource ownership table after the resource access transaction is completed, the problem of indistinguishable ownership between the completed items of the old instance's in-transit transactions and the new instance's resources after the resources are redistributed among device instances is solved, and the detection capability of isolation defects during the resource reuse transition period is improved. Attached Figure Description

[0014] Figure 1 This is a flowchart illustrating the resource isolation verification method in this invention; Figure 2 This is a schematic diagram of the process of tracing back the device instance in this invention; Figure 3 This is a schematic diagram illustrating the process of predicting resource access instructions received by a device instance in this invention. Figure 4 This is a schematic diagram of the process for querying the transaction ledger in this invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0017] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, but this is not intended to limit the scope of the invention.

[0018] This invention discloses a resource isolation verification method, applied to an RTL simulation verification platform including multiple units under test, and simultaneously applied to a unified bus interconnection protocol, setting up test units and control units; such as Figure 1 As shown, the resource isolation verification method includes: the control unit constructs a corresponding resource ownership table based on all shared resources stored in each unit under test; the test unit creates corresponding device instances in each unit under test, each device instance having a corresponding unique instance identifier; the control unit continuously obtains configuration update information from each unit under test to continuously update the resource ownership table, the configuration update information including the unique instance identifier of the corresponding device instance and the resource information identifier of the configured shared resource, the resource ownership table storing the resource information identifier and the corresponding unique instance identifier; when a device instance issues a resource access transaction, the control unit obtains the corresponding unique instance identifier in the current resource ownership table based on the resource information identifier carried in the resource access transaction and records it; after the resource access transaction is completed, the control unit obtains the corresponding unique instance identifier in the current resource ownership table based on the corresponding resource information identifier, compares the currently obtained unique instance identifier with the corresponding recorded unique instance identifier, and judges it as a resource isolation anomaly when the comparison result is inconsistent.

[0019] Specifically, the RTL simulation verification platform includes a DUT (Design Under Test), which comprises multiple units under test. Each unit under test is a virtual device functional unit defined within the DUT, and each unit has a unique identifier. Internally, each unit contains functional modules such as queue and doorbell interfaces, direct memory access interfaces, address translation and permission checking modules, unified bus interconnect and routing modules, interrupt control modules, and completion queues. Shared resources are stored in each unit under test, including memory-mapped input / output windows, queues, doorbells, direct memory access address windows, address translation contexts, interrupt vectors, routing contexts, and credits or bandwidth limits. Test units are pre-configured test cases, management drivers, and other stimulus initiation components within the RTL simulation verification platform. Control units include reference models, implemented using hardware description languages ​​or high-level programming languages, and deployed within the RTL simulation verification platform. The RTL simulation verification platform also includes multiple monitoring units, such as lifecycle monitoring unit, configuration monitoring unit, device interface monitoring unit, UMMU (Unified Memory Management Unit) or address translation monitoring unit, UB (Unified Bus) transaction monitoring unit, and target resource monitoring unit.

[0020] Furthermore, the control unit constructs a resource ownership table based on the shared resources stored in each unit under test. Each ownership record in the resource ownership table includes at least a resource information identifier, a unique instance identifier, a lifecycle status, an effective date, a reclamation status, a reuse status, and access permissions. The resource information identifier includes the resource type and resource number, used to uniquely identify a shared resource. The lifecycle status includes unallocated, active, being reclaimed, being isolated, and reusable. When the resource ownership table is initially constructed, the lifecycle status of all shared resources is unallocated, meaning there are no associated device instances.

[0021] The test unit creates one or more device instances in each unit under test (DUT), each with a unique instance identifier. After creation, the test unit issues resource configuration commands through the DUT's management interface to allocate and bind resources to the device instances. Once a device instance accepts the configuration and returns an activation confirmation, the configuration update information is obtained by the control unit. This update information includes the device instance's unique identifier and the resource information identifier of the configured shared resource. The control unit updates the resource ownership table based on the configuration update information, associates the resource information identifier with the instance's unique identifier, and updates the shared resource's lifecycle status to active. Configurations issued by the test unit but rejected by the DUT or not yet activated are not considered actual ownership and are not updated in the resource ownership table. The ownership record also records the configuration version and activation sequence number to track the order of configurations.

[0022] Furthermore, during device instance operation, the test unit drives the device instance to issue resource access transactions, performing direct memory access read / write, doorbell write, queue operations, etc., on shared resources. Each resource access transaction carries resource information identifiers, such as queue numbers, doorbell numbers, or interrupt vectors. When a device instance issues a resource access transaction, the control unit queries the current resource ownership table based on the resource information identifier carried in the transaction to obtain the unique identifier of the instance currently owning the shared resource, and associates this unique identifier with the resource access transaction record.

[0023] After a resource access transaction is initiated, it undergoes address translation and unified bus transmission to reach the target memory or target device for execution. Upon completion, a completion response is returned. After the resource access transaction is completed, the control unit queries the current resource ownership table again based on the same resource information identifier to obtain the unique identifier of the instance to which the shared resource currently belongs. The control unit compares the obtained unique identifier with the previously recorded unique identifier. If they match, it indicates that the ownership of the shared resource has not changed from the time the transaction was initiated to its completion, and resource access is normal. If they do not match, it indicates that the shared resource was reallocated to another device instance during the transaction execution, and the completed transaction is a residual transaction of the old device instance. The control unit determines this as a resource isolation anomaly.

[0024] Specifically, resource isolation anomalies caused by residual transactions are time isolation anomalies, which are cross-generational ownership conflicts caused by in-transit transactions belonging to old device instances being completed after resource reuse.

[0025] In a preferred embodiment of the present invention, the instance unique identifier includes the unit unique identifier of the unit under test corresponding to the device instance and the generation identifier of the device instance; the device instance is allowed to be created repeatedly in each unit under test, and when the device instance is created, the generation identifier of the device instance is set incrementally according to the creation order in the corresponding unit under test.

[0026] Specifically, the unit unique identifier is used to distinguish different virtual device functional units, and duplicate device instances are allowed to be created within the same unit under test. The generation identifier is used to distinguish device instances created by the same unit under test at different times. When creating a device instance, the generation identifier is incremented according to the creation order within the corresponding unit under test. For example, if the generation identifier is 10 when a device instance is first created in the same unit under test, and 20 when it is recreated after being destroyed, the two created device instances have the same unit unique identifier but different generation identifiers, which the control unit uses to distinguish them as different device instances. Even if there are still pending resource access transactions for a device instance of an older generation, it will not be merged into a new generation simply because the unit unique identifier is the same. If creation fails or configuration is rolled back, the corresponding generation identifier enters an aborted state, and its ineffective resource configuration is revoked.

[0027] In a preferred embodiment of the present invention, such as Figure 2 As shown, after creating a device instance, the test unit issues lifecycle instructions to the device instance. These lifecycle instructions include resource configuration instructions and resource access instructions. Upon receiving a resource configuration instruction, the device instance executes the instruction based on preset configuration logic, using the execution result as configuration update information for the control unit to obtain. Upon receiving a resource access instruction, the device instance constructs and issues a resource access transaction based on the instruction. The resource ownership table stores the ownership record for each shared resource. After updating the resource ownership table, the control unit verifies the configuration update information based on preset resource configuration rules. If the verification fails, the control unit queries the corresponding ownership record in the resource ownership table based on the corresponding resource information identifier and instance unique identifier to backtrack the device instance. When the resource access transaction is completed and a resource isolation anomaly is determined, the control unit queries the corresponding ownership record in the resource ownership table based on the corresponding resource information identifier and instance unique identifier to backtrack the device instance.

[0028] Specifically, after creating a device instance, the test unit issues lifecycle instructions to the device instance. Lifecycle instructions include resource configuration instructions and resource access instructions. Resource configuration instructions are used to perform configuration operations such as allocation, binding, reclamation, and reset of shared resources, while resource access instructions are used to drive the device instance to perform data read and write access to shared resources.

[0029] After receiving a resource configuration command, the device instance executes the command based on preset configuration logic. This configuration logic comprises the hardware state machine and resource management logic within the unit under test (DUT), used to determine whether to accept the configuration based on the current lifecycle state and resource occupancy. The device instance returns the execution result of the configuration command as configuration update information to the control unit. This result includes whether the configuration was accepted, whether the configuration took effect, and the resource information identifier and instance unique identifier of the corresponding shared resource when the configuration took effect. Upon receiving a resource access command, the device instance constructs a resource access transaction based on the command and issues it via the unified bus.

[0030] Furthermore, the resource ownership table stores the ownership record for each shared resource. After updating the resource ownership table, the control unit verifies the configuration update information based on preset resource configuration rules. The resource configuration rules specify the allowed configuration operations for each type of shared resource in each lifecycle state, as well as the allocation constraints of shared resources among different device instances. The verification includes whether the configuration should be accepted or rejected, whether the configuration is complete and effective, and whether the configuration is consistent across units under test. For example, if a queue belongs to one device instance but the corresponding interrupt vector belongs to another device instance, this constitutes a cross-module configuration inconsistency. If the verification fails, the control unit queries the corresponding ownership record in the resource ownership table based on the resource information identifier and the instance unique identifier, tracing back along the sending of the configuration command, the confirmation of the device instance, and the actual written values ​​of the registers of each unit under test to locate the first point where a discrepancy occurs.

[0031] Specifically, resource isolation exceptions caused by configuration verification failures are configuration isolation exceptions, meaning that resource configurations violate resource configuration rules or have inconsistent ownership across modules.

[0032] Furthermore, when a resource access transaction is completed and is determined to be in a resource isolation anomaly, the control unit queries the ownership record based on the resource information identifier and the instance unique identifier, and performs backtracking by combining the transaction ledger, address translation record, unified bus transaction record, queue operation record, and completion path record, tracing back along the complete execution path of the resource access transaction to locate the first link where the actual result is inconsistent with the expected result.

[0033] In a preferred embodiment of the present invention, a monitoring unit is further provided, such as... Figure 3As shown, the monitoring unit continuously monitors the device instance to obtain resource access commands. After the testing unit issues a resource access command to the device instance, the device instance verifies the legality of the resource access command to determine whether to construct a resource access transaction. After the device instance receives the resource access command, the control unit obtains the corresponding resource access command from the monitoring unit, retrieves the corresponding instance unique identifier from the current resource ownership table based on the resource information identifier carried in the resource access command, and predicts whether the corresponding device instance will construct a resource access transaction based on the instance unique identifier. The control unit compares the actual result of whether the device instance constructs a resource access transaction with the prediction result of the control unit: if they are inconsistent, it is judged as a resource isolation anomaly; if both the actual result and the prediction result are that a resource access transaction is constructed, the corresponding instance unique identifier is recorded. After the resource access transaction is completed, the instance unique identifier obtained from the current resource ownership table is compared with the corresponding recorded instance unique identifier, and if the comparison result is inconsistent, it is judged as a resource isolation anomaly; if both the actual result and the prediction result are that the resource access transaction is rejected, the resource changes of the shared resources involved in the resource access transaction are obtained, and if the resource changes indicate that the device instance is still accessing the shared resources, it is judged as a resource isolation anomaly.

[0034] Specifically, the monitoring unit is set at the management command interface, configuration register, device interface, address translation interface, and unified bus interface of the unit under test, and continuously monitors the device instance to obtain resource access instructions and signals and statuses of resource access transactions at each stage.

[0035] After the test unit issues a resource access command to the device instance, the device instance verifies the legality of the command to determine whether to construct a resource access transaction. The legality verification is performed by the permission check logic within the unit under test, including checking whether the device instance issuing the command has the right to access the target shared resource, whether the current lifecycle state allows the access, whether the address range is valid, and whether the credit limit is sufficient. If the verification passes, the device instance constructs and issues the resource access transaction; if the verification fails, the device instance refuses to construct the transaction and returns an error response.

[0036] After a device instance receives a resource access command but before it returns a processing result, the control unit obtains the command from the monitoring unit. Based on the resource information identifier carried in the command, it retrieves the corresponding unique instance identifier from the current resource ownership table. Then, based on this unique instance identifier and resource configuration rules, it predicts whether the device instance should establish a resource access transaction. This prediction is performed independently by the control unit and does not depend on the actual result returned by the device instance.

[0037] The reference model in the control unit compares the actual result of whether a device instance constructs a resource access transaction with the predicted result, and divides it into three cases. When the actual result is inconsistent with the predicted result (e.g., the prediction should be rejected but the device instance actually constructs the transaction, or the prediction should be constructed but the device instance actually rejects), the control unit determines it as a resource isolation anomaly. When both the actual result and the predicted result are that a resource access transaction is constructed, the control unit records the corresponding instance unique identifier. After the resource access transaction is completed, it compares the instance unique identifier obtained from the current resource ownership table with the recorded instance unique identifier. If they are inconsistent, it is determined as a resource isolation anomaly. When both the actual result and the predicted result are that the resource access transaction is rejected, the control unit obtains the resource changes of the shared resources involved in the resource access transaction. The resource changes are obtained by the monitoring unit reading the actual state of the target shared resources in the unit under test before and after the resource access command is issued. The comparison content includes the target memory content, queue production pointers and consumption pointers, interrupt count, and completion queue content. If the resource changes indicate that the device instance has still written to or modified the shared resources, such as the interface returning a rejection but the queue pointer has been advanced or the interrupt count has been increased, it means that the device instance has produced unauthorized side effects while denying access, and the control unit judges it as a resource isolation anomaly.

[0038] Specifically, resource isolation anomalies caused by discrepancies between predicted and actual results fall under the category of permission isolation anomalies, meaning the permission check logic of the device instance does not match expectations. If both the actual result reported by the device instance and the expected result predicted by the control unit indicate a rejection but a change in resource status, this is a side-effect isolation anomaly, meaning the interface returns a rejection even though the target resource has been actually modified.

[0039] In a preferred embodiment of the present invention, such as Figure 4 As shown, when a device instance issues a resource access transaction, the control unit obtains the unique instance identifier corresponding to the current resource ownership table based on the resource information identifier carried in the resource access transaction, and associates and saves the corresponding resource information identifier and the corresponding unique instance identifier in the transaction ledger; when receiving configuration update information, the control unit queries the transaction ledger after associating the unique instance identifier and the resource information identifier carried in the configuration update information, and judges that the resource isolation is abnormal when the corresponding resource access transaction is saved in the transaction ledger.

[0040] Specifically, when a device instance issues a resource access transaction, the control unit, in addition to recording the instance's unique identifier, also associates and stores the resource information identifier with the instance's unique identifier in the transaction ledger. The transaction ledger records each resource access transaction according to its transaction identifier, parent-child transaction relationship, queue, address range, and completion status. The completion status includes pending, committed, aborted, and late completion. The transaction ledger is used to track transactions that a device instance has issued but not yet completed that are in transit.

[0041] When a device instance enters the silent, drain, reset, or destruction phase, the monitoring unit checks whether the device instance has stopped receiving new doorbell and direct memory access requests, and adds accepted but incomplete resource access transactions to the transaction ledger for continuous tracking. After the device instance returns to destruction, the shared resources enter a reclamation state and cannot be reallocated until all reuse barrier conditions are met.

[0042] When receiving configuration update information, such as when a shared resource is reclaimed from one device instance and reassigned to another, the control unit associates the instance unique identifier and resource information identifier carried in the configuration update information and then queries the transaction ledger. If the transaction ledger still contains incomplete resource access transactions corresponding to the resource information identifier, it indicates that the device instance returned the confirmation of the reassignment before the in-transit transactions for the shared resource were cleared, the reuse barrier was not correctly implemented, and the control unit judges it as a resource isolation anomaly.

[0043] The reuse barrier conditions include clearing in-transit transactions, emptying the queue, interrupt delivery completion, address translation cache invalidation confirmation, routing context invalidation, and reset completion. The control unit confirms clearing in-transit transactions through the transaction ledger, confirms the queue is empty by checking if the queue production and consumption pointers are equal through the monitoring unit, confirms no pending interrupts through the interrupt controller status, confirms the old cache mapping has been cleared through the address translation cache invalidation completion confirmation signal returned by the unit under test, confirms the routing context has been invalidated through the routing table entry status, and confirms the reset has ended through the reset completion confirmation signal returned by the unit under test. Before all conditions are met, the shared resource remains in a state of reclamation or isolation. After all conditions are met, the shared resource enters a reusable state. At this point, when the control unit receives the reallocated configuration update information, there are no corresponding incomplete transactions in the transaction ledger, and no exception is triggered.

[0044] Furthermore, for late completions or late interruptions that arrive after the reuse barrier conditions have been met, the control unit determines, based on the transaction ledger, whether they should be discarded, sent to the isolation queue of the destroyed device instance, or converted to faulty completion. Delivery to a new device instance is not permitted solely because the queue number or interrupt vector has already been assigned to that instance. For residual doorbells, descriptors, cached translations, and credit statuses, the control unit checks whether the initialization values ​​of the new generation device instance are consistent with the values ​​specified in the resource configuration rules.

[0045] In one embodiment, the verification platform further includes a coverage component and a scenario generation component. The coverage component statistically analyzes the cross-coverage of lifecycle states, resource types, access types, instance unique identifiers, drain states, cache invalidation states, reuse states, and inspection results. When there are valid but uncovered state combinations, the scenario generation component generates boundary scenarios based on the lifecycle state machine and resource dependencies, such as creation / destruction contention, partial configuration failure, drain delay, late completion, interruption delay, error doorbell, cross-address context direct memory access, and fast resource reuse, and incorporates them into regression testing.

[0046] In one embodiment, when a resource isolation anomaly occurs, the control unit starts from the incorrectly modified shared resource, incorrect completion, or delayed interruption, and sequentially traces back the instance unique identifier, lifecycle state, configuration acknowledgments, address translation, unified bus transactions, queue operations, target commits, and completion paths to identify the discrepancy between the first actual result and the expected result. The output verification package includes lifecycle events, resource ownership table, configuration version, instance unique identifier, transaction ledger, address translation cache invalidation and reset acknowledgment records, queue and interruption records, reuse barrier status, random seed, waveform window, and expected result.

[0047] This invention discloses a resource isolation verification system applied to an RTL simulation verification platform comprising multiple units under test (UTDs). The system employs the aforementioned resource isolation verification method and is applied to a unified bus interconnect protocol. The resource isolation verification system includes a test unit and a control unit. The test unit creates corresponding device instances in each UTD, each device instance having a unique instance identifier. The control unit includes: a construction module for constructing a corresponding resource ownership table based on all shared resources stored in each UTD; and an update module connected to the construction module for continuously acquiring configuration update information from each UTD to continuously update the resource ownership table. The configuration update information includes the unique instance identifier of the corresponding device instance. The system identifies and configures shared resources by storing resource information identifiers and corresponding instance unique identifiers in a resource ownership table. A recording module, connected to the update module, is used to obtain and record the corresponding instance unique identifier in the current resource ownership table based on the resource information identifier carried in the resource access transaction when a device instance issues a resource access transaction. A first judgment module, connected to the recording module, is used to obtain the corresponding instance unique identifier in the current resource ownership table based on the corresponding resource information identifier after the resource access transaction is completed, compare the currently obtained instance unique identifier with the corresponding recorded instance unique identifier, and determine a resource isolation anomaly if the comparison result is inconsistent.

[0048] In a preferred embodiment of the present invention, the test unit includes: an instruction issuing module, used to issue lifecycle instructions to the device instance after the device instance is created; the lifecycle instructions include resource configuration instructions and resource access instructions; the device instance includes: a first execution module, used to execute the resource configuration instructions based on preset configuration logic when receiving the resource configuration instructions, and use the execution result as configuration update information for the control unit to obtain; a second execution module, used to construct and issue a resource access transaction based on the resource access instructions when receiving the resource access instructions; the resource ownership table stores the ownership record of each shared resource; the control unit includes: a first backtracking module, used to verify the configuration update information based on preset resource configuration rules after updating the resource ownership table, and query the corresponding ownership record in the resource ownership table based on the corresponding resource information identifier and instance unique identifier when the verification fails, so as to backtrack the device instance; a second backtracking module, used to query the corresponding ownership record in the resource ownership table based on the corresponding resource information identifier and instance unique identifier when the resource access transaction is completed and it is determined that the resource isolation is abnormal, so as to backtrack the device instance.

[0049] In a preferred embodiment of the present invention, the system further includes: a monitoring unit, connected to both the device instance and the control unit, for continuously monitoring the device instance to obtain resource access instructions; the device instance includes: a determination module, for verifying the legality of the resource access instructions after the testing unit issues them to the device instance, to determine whether to construct a resource access transaction; the control unit includes: a prediction module, for obtaining the corresponding resource access instructions from the monitoring unit after the device instance receives them, obtaining the corresponding instance unique identifier from the current resource ownership table based on the resource information identifier carried in the resource access instructions, and predicting whether the corresponding device instance will construct a resource access transaction based on the instance unique identifier; and a comparison module, connected to the prediction module. This is used to compare the actual result of whether a device instance constructs a resource access transaction with the prediction result of the prediction module: if they are inconsistent, it is judged as a resource isolation anomaly; if both the actual result and the prediction result are to construct a resource access transaction, the corresponding instance unique identifier is recorded. After the resource access transaction is completed, the instance unique identifier obtained from the current resource ownership table is compared with the instance unique identifier of the corresponding record, and if the comparison result is inconsistent, it is judged as a resource isolation anomaly; if both the actual result and the prediction result are to refuse to construct a resource access transaction, the resource changes of the shared resources involved in the resource access transaction are obtained, and if the resource changes indicate that the device instance is still accessing the shared resources, it is judged as a resource isolation anomaly.

[0050] In a preferred embodiment of the present invention, the control unit includes: a storage module, configured to, when a device instance issues a resource access transaction, obtain the instance unique identifier corresponding to the current resource ownership table based on the resource information identifier carried in the resource access transaction, and associate and store the resource information identifier and the instance unique identifier in the transaction ledger; and a second judgment module, connected to the storage module, configured to, when receiving configuration update information, query the transaction ledger after associating the instance unique identifier and the resource information identifier carried in the configuration update information, and judge that the resource isolation is abnormal when the corresponding resource access transaction is stored in the transaction ledger.

[0051] A preferred embodiment is provided to help those skilled in the art better understand the method by which the present invention determines resource isolation anomalies: The unit under test divides a physical device interface into two device instances, referred to as the first device instance and the second device instance, respectively. The first device instance has two queues, a doorbell, a direct memory access window, and an interrupt vector, while the second device instance has two more queues, a doorbell, a direct memory access window, and an interrupt vector.

[0052] The control unit establishes a resource ownership table, recording the ownership relationship between each shared resource and the unique instance identifiers of the two device instances. The test unit submits legitimate tasks to the doorbells of the two device instances respectively, and the monitoring unit records queue operations, address translation, unified bus transactions, target memory, and interrupt information. Subsequently, the test unit drives the first device instance to attempt to access the direct memory access window of the second device instance and write to the doorbell of the second device instance. Based on the unique instance identifier currently belonging to the window and doorbell in the resource ownership table, the control unit predicts that the device instance should refuse to construct the resource access transaction, combined with resource configuration rules. If the device instance actually constructs the transaction, or if the interface returns an error but the window data, queue pointer, interrupt count, and completion queue of the second device instance have changed, the control unit determines that a resource isolation anomaly has occurred and backtracks to locate the defect in interrupt ownership or incorrect completion routing. The coverage component records the combined coverage of device pairs, resource types, access directions, and post-rejection side effects.

[0053] The above description is merely a preferred embodiment of the present invention and does not limit the implementation and protection scope of the present invention. Those skilled in the art should realize that any equivalent substitutions and obvious changes made based on the description and illustrations of the present invention should be included within the protection scope of the present invention.

Claims

1. A resource isolation verification method, applied to an RTL simulation verification platform including multiple units under test, characterized in that, The resource isolation verification method is applied to the unified bus interconnection protocol; The test unit and control unit are set up. The resource isolation verification method includes: the control unit constructs a corresponding resource ownership table based on all shared resources stored in each unit under test; the test unit creates a corresponding device instance in each unit under test, and each device instance has a corresponding unique instance identifier; the control unit continuously obtains the configuration update information of each unit under test to continuously update the resource ownership table, the configuration update information includes the unique instance identifier of the corresponding device instance and the resource information identifier of the configured shared resource, and the resource ownership table stores the resource information identifier and the corresponding unique instance identifier; when the device instance issues a resource access transaction, the control unit obtains the corresponding unique instance identifier in the current resource ownership table based on the resource information identifier carried in the resource access transaction and records it; after the resource access transaction is completed, the control unit obtains the corresponding unique instance identifier in the current resource ownership table based on the corresponding resource information identifier, compares the currently obtained unique instance identifier with the corresponding recorded unique instance identifier, and judges it as a resource isolation anomaly when the comparison result is inconsistent.

2. The resource isolation verification method according to claim 1, characterized in that, The instance unique identifier includes the unit unique identifier of the unit under test corresponding to the device instance and the generation identifier of the device instance; the device instance is allowed to be created repeatedly in each unit under test, and when the device instance is created, the generation identifier of the device instance is set to increment according to the creation order in the corresponding unit under test.

3. The resource isolation verification method according to claim 1, characterized in that, After creating the device instance, the test unit issues lifecycle instructions to the device instance. These lifecycle instructions include resource configuration instructions and resource access instructions. Upon receiving the resource configuration instruction, the device instance executes the instruction based on preset configuration logic, and uses the execution result as configuration update information for the control unit to obtain. Upon receiving the resource access instruction, the device instance constructs and issues a resource access transaction based on the instruction. The resource ownership table stores the ownership record for each shared resource. After updating the resource ownership table, the control unit verifies the configuration update information based on preset resource configuration rules. If the verification fails, the control unit queries the corresponding ownership record in the resource ownership table based on the corresponding resource information identifier and the instance unique identifier to backtrack the device instance. When the resource access transaction is completed and a resource isolation anomaly is determined, the control unit queries the corresponding ownership record in the resource ownership table based on the corresponding resource information identifier and the instance unique identifier to backtrack the device instance.

4. The resource isolation verification method according to claim 3, characterized in that, A monitoring unit is also provided, which continuously monitors the device instance to obtain the resource access command; after the testing unit sends the resource access command to the device instance, the device instance verifies the legality of the resource access command to determine whether to construct the resource access transaction; After the device instance receives the resource access instruction, the control unit obtains the corresponding resource access instruction from the monitoring unit, obtains the corresponding instance unique identifier from the current resource ownership table based on the resource information identifier carried in the resource access instruction, and predicts whether the corresponding device instance should construct the resource access transaction based on the instance unique identifier. The control unit compares the actual result of whether the device instance constructs the resource access transaction with the prediction result of the control unit: if they are inconsistent, it is determined that the resource isolation is abnormal. If both the actual result and the predicted result are to construct the resource access transaction, then the corresponding instance unique identifier is recorded. After the resource access transaction is completed, the instance unique identifier obtained from the current resource ownership table is compared with the instance unique identifier of the corresponding record, and if the comparison result is inconsistent, it is judged as a resource isolation anomaly. If both the actual result and the predicted result are to refuse to construct the resource access transaction, then the resource changes of the shared resource involved in the resource access transaction are obtained, and if the resource changes indicate that the device instance is still accessing the shared resource, it is determined that the resource isolation is abnormal.

5. The resource isolation verification method according to claim 1, characterized in that, When the device instance issues a resource access transaction, the control unit obtains the instance unique identifier corresponding to the current resource ownership table based on the resource information identifier carried in the resource access transaction, and associates and saves the corresponding resource information identifier and the corresponding instance unique identifier in the transaction ledger; when receiving the configuration update information, the control unit queries the transaction ledger after associating the instance unique identifier and the resource information identifier carried in the configuration update information, and determines that the resource isolation is abnormal when the corresponding resource access transaction is saved in the transaction ledger.

6. A resource isolation verification system, applied to an RTL simulation verification platform including multiple units under test, characterized in that, The resource isolation verification method described in any one of claims 1-5 is applied to the Unified Bus Interconnect Protocol; the resource isolation verification system includes a test unit and a control unit; the test unit is used to create corresponding device instances in each of the units under test, and each device instance has a corresponding unique instance identifier; The control unit includes: a construction module, used to construct a corresponding resource ownership table based on all shared resources stored in each of the units under test; An update module, connected to the construction module, is used to continuously acquire configuration update information of each unit under test to continuously update the resource ownership table. The configuration update information includes the instance unique identifier of the corresponding device instance and the resource information identifier of the configured shared resource. The resource ownership table stores the resource information identifier and the corresponding instance unique identifier in association. A record module, connected to the update module, is used to obtain and record the instance unique identifier corresponding to the current resource ownership table based on the resource information identifier carried in the resource access transaction when the device instance issues a resource access transaction. A first judgment module, connected to the record module, is used to obtain the instance unique identifier corresponding to the current resource ownership table based on the corresponding resource information identifier after the resource access transaction is completed, compare the currently obtained instance unique identifier with the corresponding recorded instance unique identifier, and judge that the resource isolation is abnormal when the comparison result is inconsistent.

7. The resource isolation verification system according to claim 6, characterized in that, The testing unit includes: an instruction issuing module, used to issue lifecycle instructions to the device instance after the device instance is created; the lifecycle instructions include resource configuration instructions and resource access instructions; the device instance includes: a first execution module, used to execute the resource configuration instructions based on preset configuration logic when receiving the resource configuration instructions, and use the execution result as the configuration update information for the control unit to obtain; a second execution module, used to construct and issue the resource access transaction based on the resource access instructions when receiving the resource access instructions; the resource ownership table stores the ownership record of each shared resource; the control unit includes: a first backtracking module, used to verify the configuration update information based on preset resource configuration rules after updating the resource ownership table, and query the corresponding ownership record in the resource ownership table based on the corresponding resource information identifier and the instance unique identifier when the verification fails, so as to backtrack the device instance; a second backtracking module, used to query the corresponding ownership record in the resource ownership table based on the corresponding resource information identifier and the instance unique identifier when the resource access transaction is completed and it is determined that the resource isolation is abnormal, so as to backtrack the device instance.

8. The resource isolation verification system according to claim 7, characterized in that, Also includes: A monitoring unit, connected to the device instance and the control unit respectively, is used to continuously monitor the device instance to obtain the resource access command; The device instance includes: a determination module, configured to verify the legality of the resource access instruction after the test unit issues the resource access instruction to the device instance, in order to determine whether to construct the resource access transaction; the control unit includes: a prediction module, configured to obtain the corresponding resource access instruction from the monitoring unit after the device instance receives the resource access instruction, obtain the corresponding instance unique identifier from the current resource ownership table based on the resource information identifier carried in the resource access instruction, and predict whether the corresponding device instance will construct the resource access transaction based on the instance unique identifier; and a comparison module, connected to the prediction module, configured to compare the actual result of whether the device instance constructs the resource access transaction with the... The prediction results of the prediction module are compared: if they are inconsistent, it is judged as a resource isolation anomaly; if both the actual result and the prediction result indicate that the resource access transaction should be constructed, the corresponding instance unique identifier is recorded. After the resource access transaction is completed, the instance unique identifier obtained from the current resource ownership table is compared with the instance unique identifier recorded in the corresponding record, and if the comparison result indicates that they are inconsistent, it is judged as a resource isolation anomaly; if both the actual result and the prediction result indicate that the resource access transaction should be rejected, the resource change status of the shared resources involved in the resource access transaction is obtained, and if the resource change status indicates that the device instance is still accessing the shared resources, it is judged as a resource isolation anomaly.

9. The resource isolation verification system according to claim 6, characterized in that, The control unit includes: a storage module, configured to, when the device instance issues a resource access transaction, obtain the instance unique identifier corresponding to the current resource ownership table based on the resource information identifier carried in the resource access transaction, and associate and store the resource information identifier and the instance unique identifier in the transaction ledger; and a second judgment module, connected to the storage module, configured to, when receiving the configuration update information, query the transaction ledger after associating the instance unique identifier and the resource information identifier carried in the configuration update information, and determine that the resource isolation is abnormal if the corresponding resource access transaction is stored in the transaction ledger.

Images