Overview
The Translation Buffer is an essential component in a cross-level processor verification co-simulation setup. In the described flow, a coverage-guided fuzzer generates bounded test vectors, and the Translation Buffer transforms those vectors into an endless instruction stream for execution by both the RTL core under test and a reference instruction set simulator (ISS). This supports co-simulation of the RTL core and ISS while helping decouple the setup from micro-architecture-specific optimizations such as pipelining. [Translation Buffer role]
Purpose
The Translation Buffer addresses two requirements of the fuzzing-based verification flow:
- It converts a bounded fuzzer-generated test vector into an instruction stream that can be consumed as if it were endless. [Bounded-to-endless transformation]
- It performs this conversion deterministically, because the fuzzer assumes deterministic execution; a non-deterministic transformation would reduce fuzzing performance. [Determinism requirement]
Design
The Translation Buffer is based on the concept of a ring buffer, but it is customized for the verification problem. A typical ring buffer is a circular FIFO queue that permits infinite writes by overwriting the oldest values when full, and it becomes empty after all values have been read once. The Translation Buffer inverts this usage: it needs infinite reading rather than infinite writing. [Ring-buffer basis]
For this approach, the Translation Buffer size is initialized to the number of instructions contained in the test vector, so no instruction has to be overwritten. When all instructions in the buffer have been read, the internal read pointer is reset, causing the buffer to deliver the same instruction sequence again. This provides an endless instruction stream through cyclic repetition. [Cyclic repetition behavior]
Operation in co-simulation
During co-simulation, the RTL core and the reference ISS execute the endless instruction stream delivered by the Translation Buffer. The Translation Buffer also helps ensure that the ISS and RTL core receive the same instruction stream: already fetched instructions are cached in the Translation Buffer. [Shared stream]
The evidence describes an RV32I example in which a 160-bit test vector is loaded into the Translation Buffer. Since each Translation Buffer entry has the size of a 32-bit instruction, the buffer contains five entries. The ISS starts at program counter address 0x00, and the Translation Buffer supplies the instruction at ID 0. [Example sizing]
Handling differing fetch behavior
The Translation Buffer is specifically relevant when the ISS and RTL core have different fetch behavior, such as when the RTL implementation is pipelined. In the example, the RTL core has a multistage pipeline and fetches the command at address 0x08 while trying to execute the command at 0x04. If the RTL core reaches an address that was not previously fetched by the ISS, a new value must be supplied by the Translation Buffer. If the buffer has no further unused instructions, it can deliver a previously buffered instruction again through its cyclic behavior. [Pipelined fetch behavior]
Relationship to mismatch detection
The Translation Buffer supplies the instruction stream, while mismatch detection is handled by the Execution Controller through register-value comparison. The broader verification setup compares processor behavior at synchronization points where register values change, because comparing too frequently can degrade performance and comparing at the wrong time can cause false mismatches, especially for pipelined RTL cores. [Mismatch detection context]