Cover the last rv64gc coverage rows and make the coverage tests check themselves

sim/questa/coverage-exclusions-rv64gc.do

@@ -292,10 +292,12 @@ set line [GetLineNum ${SRC}/mmu/adrdec.sv "exclusion-tag: adrdecSel"]
 # The instruction side drives the MMU with ReadAccessM and WriteAccessM tied low and ExecuteAccessF tied high (see
 # the mmu instantiation in ifu.sv), so AccessRW is 0 and AccessRX/AccessRWXC are 1 there, and the fetch size is fixed.
 # Peripherals qualified by AccessRW never select: every row except AccessValid_0 needs AccessValid = 1.  AccessValid_0
-# (row 5) is reachable by fetching from the peripheral's address range, so it is counted.
-foreach dec {clintdec gpiodec uartdec plicdec spidec pwmdec} {
+# (row 5) is reachable by fetching from the peripheral's address range (tests/coverage/fetchperiph.S), so it is
+# counted, except for the UART: it only accepts byte accesses, so SizeValid is 0 for the word-sized fetch.
+foreach dec {clintdec gpiodec plicdec spidec pwmdec} {
   coverage exclude -scope /core/ifu/immu/immu/pmachecker/adrdecs/$dec -fecexprrow $line 1-4 6-8
 }
+coverage exclude -scope /core/ifu/immu/immu/pmachecker/adrdecs/uartdec -fecexprrow $line 1-8
 # DTIM and SDC are not supported and qualified by AccessRW: no row can be reached.  IROM and external memory are not
 # supported: Supported_0 (row 3) is hit and every other row needs Supported = 1.
 coverage exclude -scope /core/ifu/immu/immu/pmachecker/adrdecs/dtimdec -fecexprrow $line 1-8
@@ -436,8 +438,9 @@ set line [GetLineNum ${SRC}/mmu/tlb/tlbcontrol.sv "ReadAccess \\| WriteAccess"]
 coverage exclude -scope /core/ifu/immu/immu/tlb/tlb/tlbcontrol -fecexprrow $line 1 3-6
 set line [GetLineNum ${SRC}/mmu/tlb/tlbcontrol.sv "CAMHit & TLBAccess"]
 coverage exclude -scope /core/ifu/immu/immu/tlb/tlb/tlbcontrol -fecexprrow $line 3
+# Questa orders the TLBMiss terms CAMHit, UpperBitsUnequal, TLBAccess, Translate: row 5 is TLBAccess_0
 set line [GetLineNum ${SRC}/mmu/tlb/tlbcontrol.sv "~CAMHit & TLBAccess"]
-coverage exclude -scope /core/ifu/immu/immu/tlb/tlb/tlbcontrol -fecexprrow $line 3
+coverage exclude -scope /core/ifu/immu/immu/tlb/tlb/tlbcontrol -fecexprrow $line 5
 
 # IMMU only makes word-sized accesses (Size = 2'b10), so the byte, halfword and doubleword arms of the
 # misalignment case never run, and the fetch address bit 0 is always 0 (row 4, VAdr[0]_1, of the word arm).
@@ -485,9 +488,9 @@ coverage exclude -scope /core/ifu/immu/immu/pmp/pmpchecker -fecexprrow [GetLineN
 coverage exclude -scope /core/ifu/immu/immu/pmp/pmpchecker -fecexprrow [GetLineNum ${SRC}/mmu/pmpchecker.sv "exclusion-tag: immu-pmpcboaccess"] 2 4
 
 # No irom
-set line [GetLineNum ${SRC}/ifu/ifu.sv "~ITLBMissF & ~CacheableF & ~SelIROM"]
+set line [GetLineNum ${SRC}/ifu/ifu.sv "~ITLBMissOrUpdateRawF & ~CacheableF & ~SelIROM"]
 coverage exclude -scope /core/ifu -feccondrow $line 6
-set line [GetLineNum ${SRC}/ifu/ifu.sv "~ITLBMissF & CacheableF & ~SelIROM"]
+set line [GetLineNum ${SRC}/ifu/ifu.sv "~ITLBMissOrUpdateRawF & CacheableF & ~SelIROM"]
 coverage exclude -scope /core/ifu -feccondrow $line 4
 
 # no DTIM
@@ -618,6 +621,9 @@ coverage exclude -scope /core/hzu -fecexprrow [GetLineNum ${SRC}/hazard/hazard.s
 
 # Instruction Misaligned never asserted because compressed instructions are accepted
 coverage exclude -scope /core/priv/priv/trap -fecexprrow [GetLineNum ${SRC}/privileged/trap.sv "assign ExceptionM"] 2
+# The wait counter clears whenever M advances and M holds the same instruction while it is stalled, so the counter
+# can only reach its limit with the wfi still in M: wfiM_0 (row 1) never sees the counter's top bit set.
+coverage exclude -scope /core/priv/priv/pmd -fecexprrow [GetLineNum ${SRC}/privileged/privdec.sv "assign TWTimeoutM"] 1
 
 # Attempting to access fflags, frm, fcsr with mstatus.FS = 0 traps, so checking for (STATUS_FS != 2'b00)
 # before enabling writes to these CSRs is redundant and uncoverable

tests/coverage/cacheInval.S

@@ -24,6 +24,11 @@
 //          LRU/valid state is invalidated, and the burst is long enough to absorb timer
 //          jitter.
 //
+//          Checks: the D$ priming loads return the stored values; the timer interrupt was taken
+//          (mcause) on a fence.i inside the burst (mepc); and self-modifying code works: a function
+//          run once (so it is in the I$) is overwritten with a store, and after fence.i the next
+//          call runs the new instruction.
+//
 // A component of the CORE-V-WALLY configurable RISC-V project.
 // https://github.com/openhwfoundation/cvw
 //
@@ -44,6 +49,7 @@
 ////////////////////////////////////////////////////////////////////////////////////////////////
 
 #include "WALLY-init-lib.h"
+#include "WALLY-selfcheck.h"
 
 main:
         // Prime the instruction cache by executing code spread across several
@@ -56,12 +62,14 @@ main:
         fence.i             // back-to-back fence.i
 
         // Prime the data cache with valid lines (for context; D$ InvalidateCache is tied 0).
+        // Each line holds its own address, checked after the burst.
         li t0, 0x80108000
-        sd zero, 0(t0)
-        ld t1, 0(t0)
+        sd t0, 0(t0)
+        ld a1, 0(t0)
         li t0, 0x80109000
-        sd zero, 0(t0)
-        ld t1, 0(t0)
+        sd t0, 0(t0)
+        ld a2, 0(t0)
+        csrw mcause, zero       // the check after the burst reads the cause of the timer interrupt
 
         // ---- Arm the machine timer to fire during the fence.i burst ----
         // CLINT: MTIME @ 0x0200BFF8, MTIMECMP @ 0x02004000.  MTIE and global MIE
@@ -77,9 +85,11 @@ main:
         // Memory stage asserting InvalidateICacheM; with the timer armed to fire inside this
         // window, the trap (TrapM -> FlushW) is taken while a fence.i is in M, hitting
         // InvalidateFlushStage_1 (InvalidateCache=1 & InvalidateFlushStage=1).
+burst_start:
         .rept 256
         fence.i
         .endr
+burst_end:
 
         // The trap_handler in WALLY-init-lib.h disables the timer (mtimecmp = -1) and
         // returns into the middle of the burst, which then runs to completion.
@@ -89,6 +99,40 @@ main:
         jal primer
         fence.i
 
+        // ---- Checks, after the timing-sensitive sequence ----
+        li t5, 0x80108000
+        SC_CHECK_EQ a1, t5, 1
+        li t5, 0x80109000
+        SC_CHECK_EQ a2, t5, 2
+
+        // The machine timer interrupt was taken, on a fence.i in the burst.  The library handler returns
+        // past the interrupted instruction, so mepc is its address + 4.
+        csrr a3, mcause
+        li t5, 0x8000000000000007
+        SC_CHECK_EQ a3, t5, 3
+        csrr a3, mepc
+        addi a3, a3, -4
+        la t5, burst_start
+        bltu a3, t5, 1f
+        la t5, burst_end
+        bltu a3, t5, 2f
+1:      SC_FAIL 4
+2:
+
+        // Self-modifying code.  smc_fn returns a0 = 1.  Run it so its line is in the I$, then overwrite its
+        // first instruction with addi a0, x0, 2.  After fence.i, the next call must run the new instruction.
+        jal smc_fn
+        li t5, 1
+        SC_CHECK_EQ a0, t5, 5
+        la a3, smc_fn
+        li a4, 0x00200513       // addi a0, x0, 2
+        sw a4, 0(a3)
+        fence.i
+        jal smc_fn
+        li t5, 2
+        SC_CHECK_EQ a0, t5, 6
+
+        SC_PASS
         j done
 
 // Subroutine spread over several .align'd cache lines so executing it fills
@@ -111,3 +155,9 @@ primer2:
         nop
         nop
         jr t6
+
+// Function rewritten by the self-modifying code check, on its own cache line
+.align 6
+smc_fn:
+        .word 0x00100513        // addi a0, x0, 1 (a 32-bit encoding, so one word store replaces it)
+        ret