[RTL] Register file output ports DCLS comparison

When DCLS and `lockstep_regfile_enable` is enabled, previously, a
subset of registers were directly compared. This has two drawbacks:
- Area overhead is quite large as multiple registers need to be
  compared
- No comprehensive protection as only a subset of registers were
  covered.

This commit switches from a comparison of a subset of registers to
the comparison of the read output ports of the main and the shadow
core. This:
- Saves area as only the output ports need to be compared
- Covers all registers

The detection latency is a bit higher as a fault injected into a
registes is only detected when the register is read from the RF.
However, this is fine as we are interested in detecting a fault
when we are consuming the register file value.

Signed-off-by: Pascal Nasahl <nasahlpa@lowrisc.org>

Author: nasahlpa

design/dec/el2_dec.sv

@@ -435,17 +435,8 @@ module el2_dec
 
 `ifdef RV_LOCKSTEP_REGFILE_ENABLE
       el2_regfile_if regfile_if ();
-      assign regfile.gpr.ra = regfile_if.gpr.ra;
-      assign regfile.gpr.sp = regfile_if.gpr.sp;
-      assign regfile.gpr.fp = regfile_if.gpr.fp;
-      assign regfile.gpr.a0 = regfile_if.gpr.a0;
-      assign regfile.gpr.a1 = regfile_if.gpr.a1;
-      assign regfile.gpr.a2 = regfile_if.gpr.a2;
-      assign regfile.gpr.a3 = regfile_if.gpr.a3;
-      assign regfile.gpr.a4 = regfile_if.gpr.a4;
-      assign regfile.gpr.a5 = regfile_if.gpr.a5;
-      assign regfile.gpr.a6 = regfile_if.gpr.a6;
-      assign regfile.gpr.a7 = regfile_if.gpr.a7;
+      assign regfile.gpr.rd0 = regfile_if.gpr.rd0;
+      assign regfile.gpr.rd1 = regfile_if.gpr.rd1;
 
       assign regfile.tlu.pc        = regfile_if.tlu.pc;
       assign regfile.tlu.npc       = regfile_if.tlu.npc;

design/dec/el2_dec_gpr_ctl.sv

@@ -55,17 +55,8 @@ import el2_pkg::*;
    logic [31:1] gpr_wr_en;
 
 `ifdef RV_LOCKSTEP_REGFILE_ENABLE
-   assign regfile.gpr.ra = gpr_out[1][31:0]; // x1
-   assign regfile.gpr.sp = gpr_out[2][31:0]; // x2
-   assign regfile.gpr.fp = gpr_out[8][31:0]; // x8
-   assign regfile.gpr.a0 = gpr_out[10][31:0]; // x10
-   assign regfile.gpr.a1 = gpr_out[11][31:0]; // x11
-   assign regfile.gpr.a2 = gpr_out[12][31:0]; // x12
-   assign regfile.gpr.a3 = gpr_out[13][31:0]; // x13
-   assign regfile.gpr.a4 = gpr_out[14][31:0]; // x14
-   assign regfile.gpr.a5 = gpr_out[15][31:0]; // x15
-   assign regfile.gpr.a6 = gpr_out[16][31:0]; // x16
-   assign regfile.gpr.a7 = gpr_out[17][31:0]; // x17
+   assign regfile.gpr.rd0 = rd0[31:0];
+   assign regfile.gpr.rd1 = rd1[31:0];
 `endif
 
    // GPR Write Enables

design/el2_veer_lockstep.sv

@@ -762,6 +762,7 @@ module el2_veer_lockstep
       delayed_main_core_regfile[0].tlu <= '0;
     end else begin
       delayed_main_core_regfile[0].gpr <= main_core_regfile.gpr;
+      delayed_main_core_regfile[0].gpr.rd0 <= main_core_regfile.gpr;
       delayed_main_core_regfile[0].tlu <= main_core_regfile.tlu;
     end
   end

design/lib/el2_regfile_if.sv

@@ -19,13 +19,12 @@
 interface el2_regfile_if
 import el2_pkg::*;
 ();
+  // Compare the read output ports of the register file.
+  // When a fault corrupts a register, this is detected by DCLS once
+  // the register file content is read.
   typedef struct packed {
-    // General Purpose Registers
-    logic [31:0] ra; // Return address
-    logic [31:0] sp; // Stack pointer
-    logic [31:0] fp; // Frame pointer
-    logic [31:0] a0, a1; // Function arguments 0-1 / Return values 0-1
-    logic [31:0] a2, a3, a4, a5, a6, a7; // Function arguments 2-7
+    logic [31:0] rd0; // GPR read port 0 data (raddr0 / rs1)
+    logic [31:0] rd1; // GPR read port 1 data (raddr1 / rs2)
   } el2_regfile_gpr_pkt_t;
 
   typedef struct packed {

docs/source/dual-core-lock-step.md

@@ -21,7 +21,7 @@ The diagram below outlines the architecture of the proposed solution.
 
 ![VeeR DCLS Overview](img/dcls_block_diagram.png)
 
-Outputs and the register file from the main core are delayed by `DELAY` cycles and passed to the `Equivalency Checker` for verification against the outputs and the register file of the Shadow Core.
+Outputs and the register file from the main core are delayed by `DELAY` cycles and passed to the `Equivalency Checker` for verification against the outputs and the register file outputs of the Shadow Core.
 
 ### Error Policy
 
@@ -35,27 +35,23 @@ The corruption error will be reported always when all of the following requireme
 
 ### Monitored Registers
 
-The Shadow Core can have its internal copy of the register file by setting a proper VeeR EL2 configuration flag.
+#### Register File
+
+Enabling the `lockstep_regfile_enable` VeeR EL2 configuration flag exposes the register file read ports of both cores to the `Equivalency Checker`.
 Even though every discrepancy between register files of the Main Core and Shadow Core will eventually lead to difference between IOs of these modules, it might take some time for the mismatch to manifest.
-To determine whether a discrepancy has occurred immediately, the register files from both cores will be compared taking into account a reasonable subset of the VeeR EL2 registers, as defined in the table below:
+To detect the discrepancy on a read immediately, the register file read port outputs from both cores are compared.
+
+#### Control and Status Registers
+
+The following CSRs from both cores will be compared:
 
-:::{list-table} Monitored VeeR EL2 Registers
+:::{list-table} Monitored VeeR EL2 CSRs
 :header-rows: 0
-:name: tab-dcls-monitored-veer-el2-registers
+:name: tab-dcls-monitored-veer-el2-csrs
 :align: center
 
 * - **Name**
   - **Description**
-* - x1 (ra)
-  - Return address
-* - x2 (sp)
-  - Stack pointer
-* - x8 (s0/fp)
-  - Saved register / frame pointer
-* - x10-x11 (a0-a1)
-  - Function arguments / return values
-* - x12-17 (a2-7)
-  - Function arguments
 * - pc
   - Program Counter
 * - npc
@@ -1179,7 +1175,7 @@ Entering Debug Mode with DCLS enabled will disable DCLS until the next reset.
 The DCLS feature can be enabled via `-set lockstep_enable=1` option.
 There are two configuration options:
 * `-set lockstep_delay={2, 3, 4}` - the delay applied on the Shadow Core between 2 and 4 cycles,
-* `-set lockstep_regfile_enable=1` - enable exposing the VeeR Register File so the Shadow Core will have an internal copy to compare with the Main Core Register File.
+* `-set lockstep_regfile_enable=1` - enable exposing the VeeR register file read ports so the Shadow Core's read-port outputs can be compared against the Main Core's.
 
 The configuration options are ignored and their macros are not generated if the Dual Core Lockstep feature is disabled.
 
@@ -1307,4 +1303,20 @@ The DCLS feature will be tested within:
   - `dcls_debug`
 * -
   -
+* - **Function**
+  - **Register file fault injection detection**
+* - Reference Document
+  -
+* - Check description
+  - Inject a fault into the register file or the register file output ports of the main or the shadow core.
+* - Coverage groups
+  -
+* - Assertions
+  - Detection bit is asserted upon encountered corruption. Error behavior follows the relevant error handling policy. No action is taken if no corruption was introduced.
+* - Comments
+  -
+* - Test Name
+  -
+* -
+  -
 :::