Overview

In the provided evidence, a cache is a processor microarchitectural target for verification. The cache-related structures discussed include instruction-cache tag and data arrays, cache entries, valid bits, L1 cache ways and banks, and cache-subsystem FIFO/arbiter logic that handles memory requests from the instruction cache.

Cache structures targeted by Logic Fuzzer

Logic Fuzzer can target cache state through [[table mutator|table mutators]]. In one RISC-V verification setup, the instruction-cache tag and data arrays are replaced with table mutators. The instruction-cache logic continues to read and write those tables through DPI, while the fuzzer can program the tables to provide a random instruction stream when a branch-target-buffer address with a specific tag is observed.

Table mutators are also described as a general mechanism for mutating RTL memories. The evidence gives cache-specific examples: randomly invalidating cache entries and fuzzing values in entries that are already invalid.

Steering cache way and bank utilization

The evidence uses CVA6's L1 cache as an example. While running more than 50 random tests generated with Google's riscv-dv, the baseline run without table mutation showed CVA6's way-selection logic preferring way 0 for the requested memory locations. To stress under-utilized ways traditionally, an engineer might need to regenerate binaries or configure the random instruction generator to produce memory requests in a specific way, which can be time-consuming and may require understanding cache replacement-policy details.

With tag-array mutation, the verification flow can instead mutate tag arrays and valid bits to steer cache accesses toward the bank of interest. The described implementation required editing five RTL lines to replace tag arrays with wrappers that access table mutators through DPI, plus a twelve-line method in the table-mutator class to mutate entries for stressing the selected cache bank.

Cache-subsystem bug exposure

The evidence also reports a CVA6 bug exposed by Logic Fuzzer in the cache subsystem. Artificial backpressure was created at a FIFO full signal; that FIFO queues memory requests coming from the instruction cache. The injected condition led to a complete system hang, summarized in the bug table as CVA6 Bug ID B6: an arbiter lock with gnt 0, found with Dromajo plus Logic Fuzzer.