pulp-platform / carfield

A mixed-criticality platform built around Cheshire, with a number of safety/security and predictability features. Ready-to-use FPGA flow on multiple boards is available.

Carfield

Carfield is an open-research heterogeneous platform for safety, resilient and time-predictable systems. Originally conceived as automotive-oriented SoC, the high configurability of the platform makes it tunable to target a broader class of mixed-criticality applications' domains, such as automotive, space or industry.

Carfield is developed as part of the PULP project, a joint effort between ETH Zurich and the University of Bologna.

Motivation

The rapid evolution of AI algorithms and the massive amount of sensed data across application-domains such as Automotive, Space and Cyber-Physical embedded systems (CPSs), call for a paradigm shift in the design of next generation of mixed-criticality systems (MCSs), from simple micro-controllers towards powerful and heterogeneous edge computers.

These must not only deliver outstanding performance and energy efficiency but also ensure steadfast safety, resilience, and security.

The Carfield platform aims to tackle these architectural challenges establishing itself as a pre-competitive heterogeneous platform for MCSs, underpinned by fully open-source Intellectual Properties (IPs).

Carfield showcases pioneering hardware solutions, addressing challenges related to time-predictable on/off-chip communication, robust fault recovery mechanisms, secure boot processes, cryptographic acceleration services, hardware-assisted virtualization, and accelerated computation for both floating-point and integer workloads.

Quick Start

• To learn how to build and use Carfield, see Getting Started.
• To learn about available simulation, FPGA, and ASIC targets, see Targets.
• For detailed information on Carfield's inner workings, consult the User Manual.

If you are impatient and have all needed dependencies, type:

make car-all

and then run a simulation with Questasim by typing:

make car-vsim-sim-build
make car-vsim-sim-run CHS_BINARY=./sw/tests/bare-metal/hostd/helloworld.car.l2.elf

---

To display the main Make build targets and their usage, from the root repository type:

make help

The Make files are autodocumented.

License

Unless specified otherwise in the respective file headers, all code checked into this repository is made available under a permissive license. All hardware sources and tool scripts are licensed under the Solderpad Hardware License 0.51 (see LICENSE) with the exception of generated register file code (e.g. hw/regs/*.sv), which is generated by a fork of lowRISC's regtool and licensed under Apache 2.0. All software sources are licensed under Apache 2.0.

carfield's Issues

Watchdog timer reset

• Careful when routing the watchdog timer reset as it is a vital signal
• Better to keep the watchdog disabled by default and then enable it

Propagate bootmode for safety Island

Propagate this to the top:

https://github.com/pulp-platform/carfield/blob/main/hw/carfield.sv#L1073

Synchronize input signals for carfield's islands

-> Interrupts
-> AXI isolate
-> (If any) fetch_enable etc

Status

• Safety island -> PR#23
• Security island
• Integer cluster
• Floating point cluster
• Cheshire (if any)

Missing hyper ram sdf

Simulation leaves you with these errors

# ** Error: (vsim-7) Failed to open SDF file "./tb/hyp_vip/s27ks0641_verilog.sdf" in read mode.
# No such file or directory. (errno = ENOENT)
# ** Error: (vsim-SDF-3445) Failed to parse SDF file "./tb/hyp_vip/s27ks0641_verilog.sdf".
#    Time: 0 ps  Iteration: 0  Region: /tb_carfield_soc/fix/car_vip/sdf_annotation[0]/sdf_annotation[0]
# Mem (          0,          0)
# ** Error: (vsim-7) Failed to open SDF file "./tb/hyp_vip/s27ks0641_verilog.sdf" in read mode.
# No such file or directory. (errno = ENOENT)
# ** Error: (vsim-SDF-3445) Failed to parse SDF file "./tb/hyp_vip/s27ks0641_verilog.sdf".
#    Time: 0 ps  Iteration: 0  Region: /tb_carfield_soc/fix/car_vip/sdf_annotation[0]/sdf_annotation[0]
# Mem (          0,          1)
# ** Error: (vsim-7) Failed to open SDF file "./tb/hyp_vip/s27ks0641_verilog.sdf" in read mode.
# No such file or directory. (errno = ENOENT)
# ** Error: (vsim-SDF-3445) Failed to parse SDF file "./tb/hyp_vip/s27ks0641_verilog.sdf".
#    Time: 0 ps  Iteration: 0  Region: /tb_carfield_soc/fix/car_vip/sdf_annotation[0]/sdf_annotation[0]
# Mem (          1,          0)
# ** Error: (vsim-7) Failed to open SDF file "./tb/hyp_vip/s27ks0641_verilog.sdf" in read mode.
# No such file or directory. (errno = ENOENT)
# ** Error: (vsim-SDF-3445) Failed to parse SDF file "./tb/hyp_vip/s27ks0641_verilog.sdf".
#    Time: 0 ps  Iteration: 0  Region: /tb_carfield_soc/fix/car_vip/sdf_annotation[0]/sdf_annotation[0]

make car-init fails

From the README.md:
"make car-init" should download carfield.
I get this:
bender -d Carfield/test01 checkout
Checkout safety_island ([email protected]:carfield/safety-island.git)
warning: Please ensure the commits are available on the remote or run bender update
error: Failed to checkout given commit in Bender.lock.
Git command (Command { std: cd "Carfield/test01/.bender/git/db/safety_island-faba656b56b385a7" && "git" "tag" "bender-tmp-d0771928a2b850272c7a3d1b2a4a767bfb7c30a9" "d0771928a2b850272c7a3d1b2a4a767bfb7c30a9" "--force", kill_on_drop: false }) in directory "Carfield/test01/.bender/git/db/safety_island-faba656b56b385a7" failed with exit code 128:

fatal: cannot update ref 'refs/tags/bender-tmp-d0771928a2b850272c7a3d1b2a4a767bfb7c30a9': trying to write ref 'refs/tags/bender-tmp-d0771928a2b850272c7a3d1b2a4a767bfb7c30a9' with nonexistent object d0771928a2b850272c7a3d1b2a4a767bfb7c30a9

Synopsys does not like new lines in Macro arguments

5488280#diff-f35fdc4f85c5da80dc8c037b48fb5c825ebae91b44bdb39320222c2ed658f8feL193

To be checked

Improve naming for Carfield's cores traces

This issue is a drawback of our systems developed to exist standalone.

The tracer of each of carfield's cores should follow the hart id of the core.

Not on the critical path, but eases debugging

Some warm resets fail

I don't know the cause yet but the reset sequence fails somewhere during isolation

• Fix PULP warm reset
  * [ ] Fix Periph warm reset -> can be done, but no use case for peripheral domain reset
• Fix Security island warm reset
• Fix L2 warm reset

Analyze AXI to AXILite conversion

• Use https://github.com/pulp-platform/axi/tree/axi_lite_dw_converter/src, wait until it is merged into main in axi

Move IPs hosted under AlSaqr-platform to pulp-platform

IPs under AlSaqr-platform are not readily available. It also makes sense to have all IPs which are used in Carfield to be hosted on pulp-platform (you don't have want random remote locations to suddenly disappear)

Currently the following IPs are affected

• [email protected]:AlSaqr-platform/can_bus.git -> the IP has been made publicly accessible, but still in the AlSaqr platform
• https://github.com/alsaqr-platform/opentitan.git

Documentation: describe how to enable/disable domains

After #245 , the documentaiton will be missing some information.

@yvantor I will do it ASAP, maybe next week. Opening this issue to make the misalignment evident to everybody

Connect L2 margin configuration signals

Use dedicated `target/sim` folder for simulations

Right now they are run in the root of the repo. Fix this.

Check `atomics`: `axi_riscv_atomics_structs` before the L2 SPM

Atomics support is needed towards every memory inside carfield. Cheshire already instantiates axi_riscv_atomics_structs before the main memory, the debug module and the idma slave port. We need it before the L2SPM.

Add missing registers to control isolate signals in `soc_ctrl_regs`

@yvantor

Add test for L2 ECC manager

We integrated an ECC manager in L2, we need a basic test to test functionality (register access, operation)

Align HARTIDs

Carfield includes several cores, we should align hartids at system level. Current proposal:

cva6 -> 0,1
Safey -> 8-10
HMR cluster -> 32-43
Spatz cluster -> 64-...

@micprog @yvantor we shall discuss about this

Speed up simulation

Add a make debug or similar target to simulate the design with full visibility (+acc and logging all the waves). To be tirggered when only full debug is required

@bluewww

Align Bender IPs

Align Bender IPs and point to stable versions. Some IPs that need attention for alignment:

• FPU (cva6, safety_island, spatz)
• iDMA (Cheshire, spatz) -> @yvantor
• CLIC (Cheshire, safety_island) -> @alex96295

@micprog are you on board to keep track of this with me?

Move `slink_read_reg` to `cheshire_vip`

Currently introduced in the main carfield tb, it will be moved to where it belongs

@yvantor

SYNTHESIS ERROR

Line 294 and 295 of carfield_pkg generate synthesis errors:

Error: /home/agarofalo/2023_prj/CARFIELD/CarfieldPD_Intel16/.bender/git/checkouts/carfield-98c7188642667437/hw/carfield_pkg.sv:294: The construct 'string' is not supported in synthesis.
Error: /home/agarofalo/2023_prj/CARFIELD/CarfieldPD_Intel16/.bender/git/checkouts/carfield-98c7188642667437/hw/carfield_pkg.sv:295: The construct 'string' is not supported in synthesis.

System-level printf from PULP cluster

Probably PULP does not print due to wrong driver usage. Need to adapt the UART driver in pulp-runtime (uDMA UART) to use the APB UART currently used in Cheshire.

Spurious latches

To fix:

• hw/ip/debug_mode/rtl/debug_mode_preload.sv:60: Netlist for always_comb block contains a latch. @maicolciani
• src/per2axi_res_channel.sv:89: Netlist for always_ff block contains a latch. @yvantor
• src/hyperbus_axi.sv:257: Netlist for always_comb block contains a latch. @luca-valente
• core/cva6_clic_controller.sv:43: Netlist for always_comb block contains a latch. @bluewww @alex96295 @niwis

Discuss `clk_en` and `isolate` default values for carfield islands

Fix isolate in carfield.sv

Change Cheshire's SPI/I2C/UART clock domain in Carfield

• SPI, I2C, UART are in the same clock domain of the cva6 host in default cheshire
• An alternative is to disable them and route them in the peripheral domain

Fix timer interrupt Xs in carfield

Unaligned read to Safety Island SPM fails

A unaligned read from CVA6 to any address should result in an load exception.

Currently, a double word load to CAR_SAFETY_ISLAND_SPM_BASE_ADDR + 1 causes the core to lock up.

Clip minimum number of external AXI masters to 1 due to PULP cluster limitations.

There is an issue with this piece of logic. Since the PULP cluster has a separate CDC destination FIFO due to its different AXI ID widths respect to the rest of the SoC, if one wants to use a very basic Carfield configuration where Cfg.AxiExtNumMst becomes 0, that for has an iterative spanning from 0 to 0-1, and the code does not compile. To mitigate this, as a temporary solution we prevent Cfg.AxiExtNumMst from being zero with this workaround. The "final solution" would be to unify all the AXI IDs so that the PULP cluster does not need a dedicated port and the iterative of that for can freely span from 0 to Cfg.AxiExtNumMst, with a consequent increase in the area of the AXI crossbar that should be investigated.

Documentation: describe OpenMP flow

@CyrilKoe you can refer to this issue when opening the PR addressing this part of the documentation

Test secure boot

[EDIT] @alex96295

Test is added in #137 and the secure boot pin becomes meaningful after #108 is merged

Track AXI4 crossbar scaling

⚠️ Keep track of AXI crossbar scaling when using only one xbar in Cheshire

@anga93 this is important to keep on top of our heads