[dv,TestFW] Cosim mismatches due to dside access misidentified as iside

[ZhongYic00]

Observed Behavior

Cosim reports a kind of mismatch saying DUT generated load at address 100084 but load at address 10009c was expected.
We found the cosim mmio_load for spike has an unsound assumption that, memory access around PC address is made by iside.

ibex/dv/cosim/spike_cosim.cc

Lines 101 to 107 in 587e9fe

	// Spike may attempt to access up to 8-bytes from the PC when fetching, so
	// only check as a dside access when it falls outside that range
	bool in_iside_range = (addr >= pc && addr < pc + 8);
	if (!in_iside_range) {
	dut_error = (check_mem_access(false, addr, len, bytes) != kCheckMemOk);
	}

In this testcase, two dside loads happens. one loads 0x100084 when PC=100084, so it's wrongly identified as iside, no memcheck performed, leaving DUT's reported dside access entry in queue.
Then another load 0x10009c correctly identified happens, the checker pops the 0x100084 entry and raises an error.

Expected Behavior

This kind of assumption on mem access and PC would not work.
As for the fix, I suppose exporting RVFI_order in DPI may help.

Steps to reproduce the issue

• Run cosim with build/lowrisc_ibex_ibex_simple_system_cosim_0/sim-verilator/Vibex_simple_system -c 10000 --meminit=ram,tmp/mepc0084.elf
• stdout as following, DUT and spike log files are in zip, testcase ELF in zip

Simulation running, end by pressing CTRL-c.
notify dside access0
TOP.ibex_simple_system.u_top.u_ibex_tracer.unnamedblk2.unnamedblk3: Writing execution trace to trace_core_00000000.log
notify dside access1048708
notify dside access1048732
FAILURE: Co-simulation mismatch at time                  310
DUT generated load at address 100084 but load at address 10009c was expected
Synchronous trap was expected at ISS PC: 100000 but the DUT didn't report one at PC 100084
[310] %Error: ibex_simple_system_cosim_checker.sv:74: Assertion failed in TOP.ibex_simple_system.u_ibex_simple_system_cosim_checker_bind: Co-simulation mismatch seen
Received stop request, shutting down simulation.

Simulation statistics
=====================
Executed cycles:  155
Wallclock time:   0.008 s
Simulation speed: 19375 cycles/s (19.375 kHz)
Co-simulation matched 123 instructions

ibex_cosim_iside.zip

My Environment

EDA tool and version:

Verilator 5.006 2023-01-22 rev (Debian 5.006-3)

Operating system:

Version of the Ibex source code:

587e9fe

[ZhongYic00]

A hacky way is to use stack unwinding

    bool is_icache_load = false;
    void *frames[10];
    int nframes = backtrace(frames, 10);
    for (int i=0; i<nframes; i++) {
      if (frames[i]>=reinterpret_cast<void*>(&mmu_t::refill_icache)
          && frames[i]<=reinterpret_cast<void*>(&mmu_t::refill_icache)+600) {
        is_icache_load = true;
        break;
      }
    }
    if (!is_icache_load) {
      dut_error = (check_mem_access(false, addr, len, bytes) != kCheckMemOk);
    }