Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@joschroeter
Copy link
Contributor

This PR introduces new DPI-Instrumentation capabilities for Verilator. Additionally to make the configuration of the instrumantion via the Verilator configuration file easier a signal dumping capability is introduced, that prints the signal hierarchy that is needed for the instrumentation into a log file.

Motivation

Verilator supports the usage of the DPI functionalities of SystemVerilog, but implementing the DPI into the design, especially for complex designs, can be cumbersome. This PR provides a pass for automating the adding of DPI calls into the provided module. (V3Instrumentation)
To make the configuration of this automation easier for the user the instrumentation an additional pass is part of the PR, which dumps signals that can be currently addressed by the DPI-Instrumentation. (V3DumpSignals)

Features

V3Instrumentation:

  • Added a Verilator execution argument that enables the usage for the instrumentation in form of --instrument.
  • Automatically inserts DPI interface calls on the Verilog design side, based on an instrumentation configuration provided in a Verilator .vlt configuration file.
  • A new configuration structure for the instrumentation is introduced for the .vlt files, following the syntax: instrument --model "<function name>" --id "<switch_case_id>" --target "<topmodule.instance.instance.variable>"
    • The keyword instrument informs Verilator that instrumentation is required for the provided signal hierarchy.
    • model specifies the DPI function to be called.
    • id defines the case, if a case depended functionality like a switch case statement is used. This can be used if depending on the provided case a different functionality should be executed by the DPI while keeping the same function name, e.g. fault injection stuck-at-1 vs. stuck-at-0 for the same signal type.
    • target provides the full hierarchical path to the signal that should be instrumented.
  • The instrumentation pass works in two steps:
    1. Collection/Finding Phase: The pass parses the provided configuration, collects the relevant information from the provided --target path, and stores it in a map. It also inserts parameters along the module hierarchy to ensure structural consistency and enable precise instrumentation. These parameters are used to enable the instrumentation for specific hierarchy paths while disabling them for hierarchy paths that should not use the instrumentation.
    2. Insertion/Instrumentation Phase: The pass modifies the AST, inserting the required nodes for the DPI call environment and ensuring that references initially occupied by the original signal node are properly reconnected to the instrumented signal nodes.

V3DumpSignals:

  • Iterates over the AST and collects all signals that can currently be instrumented (see limitations).
  • Dumps each signal’s hierarchy path, type, and bit width into a signalDump.log file inside obj_dir.
  • This functionality can be enabled with the Verilator flag --dump-signals.

Limitations

  • The top module can currently not be instrumented. Instrumenting it will be intercepted and lead to an error-message.
  • Signals above 64bit can currently not be instrumented, due to interaction with the DPI Task does not work reliable.
  • Signals that are not C++ literal types can not be instrumented, due to interaction with the DPI Task does not work reliable.
  • Signals that are provided by packages or interfaces can not be instrumented, due to interaction with the DPI Task does not work reliable.

Future Plans/To Dos

  • Extending the signal amounts that can be instrumented
  • Enable the instrumentation of the Top module (Probably some discussion would be nice if the current idea has some drawbacks)
  • Setup an regression test for failing instrumentation (not sure how to set it up properly so some help would be nice here)

Thanks a lot in advance for any feedback for my first big PR. Looking forward for the upcoming discussions, improvements and ideas!

@joschroeter joschroeter marked this pull request as draft October 1, 2025 12:35
@joschroeter joschroeter marked this pull request as ready for review October 1, 2025 12:36
@wsnyder
Copy link
Member

wsnyder commented Oct 1, 2025

Thanks I'll look through this tonight. Meanwhile please fix the tests (unless this is just a draft and mark draft if so).

Can you please indicate more about how you are using this in a real project?

Are there similar capabilities in other simulators - or said another way how do you accomplish what you need using other simulators today?

How do you accomplish what you need today in Verilator (if you do)?

@joschroeter
Copy link
Contributor Author

joschroeter commented Oct 1, 2025

Thanks for the quick reaction. I hope I addressed the issues properly and the tests run as expected.

This idea originated from a research project me and @wallento are working on, which focuses on exploring fast, design-level simulation of fault injection and hardware faults. The goal is to allow early-stage testing of hardware designs and to evaluate resilience against potential attacks, while staying as close to the provided design and its abstraction level as possible. This fault-injection simulation is the main usage in real projects for us.

I do not have a simulator in mind, which automatically adds DPI calls, which can be used for a certain functionality, for specific signals.
For now, regarding fault injection, it is typically required to either:

  • Modify the original model to insert VPI/DPI calls or additional hardware components that generate faults.
  • Edit files produced by the simulator itself to provide some kind of fault injection capability.
    Both approaches can be cumbersome and may disable performance optimizations offered by the simulator.

The approach here aims to be much faster by leveraging simulator optimizations to provide a fast simulation, which is very welcome when doing extensive Fault Injection simulation/testing.
Additionally this approach seemed suitable to us since it is providing flexible functionality and is not limited to fault injection.
Users can define other functionalities for their design, without relying on (System)Verilog, through these DPI calls.

I hope that answers your questions :)

@joschroeter joschroeter marked this pull request as draft October 1, 2025 15:09
Copy link
Member

@wsnyder wsnyder left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am concerned that this will get added and no one else will ever use it, especially as it's non-standard.

Is the downstream project open sourced/will it be?

DPI isn't too heavyweight but is still a lot more than native code. Or do you only do this on a small portion of a large design? What is the performance difference you see by doing this versus no annotation on a design you are experimenting on?

Mutation/fault coverage itself is interesting, is it more valuable to add that directly? Or is that too large/hard/whatever?

Why is a new output needed, is the .json missing something? If so please add it to the .json - probably better as a separate pre-pull.

Need to add documentation, both on the new .vlt statement and how to use this generally. This would also help me gauge the value - feel free to make it super-rough to start.

There's style cleanups needed in V3Instrument, compare it to other files and you'll see the comments look quite different. I'll add more feedback on that file when we settle on some of the above.

@joschroeter joschroeter force-pushed the add-signal-instrumentation branch 2 times, most recently from f4c8259 to c03ef34 Compare October 9, 2025 12:35
@joschroeter joschroeter force-pushed the add-signal-instrumentation branch 2 times, most recently from 8cefd55 to 021e122 Compare October 23, 2025 09:29
@joschroeter joschroeter force-pushed the add-signal-instrumentation branch from 021e122 to e449552 Compare October 23, 2025 09:31
@wsnyder
Copy link
Member

wsnyder commented Oct 24, 2025

To avoid other people getting a mails on your push please develop on another branch, and when everything is working and you are ready for more feedback, push to this branch. Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants