A bug found once and fixed is a cost; the same bug found twice is a process failure. Regression hooks are how a map team converts the first kind into immunity: every decoded failure becomes a named, permanent test that runs on every change to the map, the decode or the wiring. This lesson takes four of the planted bugs, states the catching test for each, and closes the section with the sign-off criteria for the map as a whole.
Bug 1, the 8 KB decode window, let a write to SBR CTRL also write DMA KEY because the DMA slot select covered two slots. Its catch is a cross-talk test: write a known pattern to every register of each APB slot that has no side effect, then read back every register of every other slot and assert nothing moved. Writes with side effects are excluded by a list marked in the register table: the reset controller's SWRST (it resets the chip) and PWR_CTRL (it requests power-down), CLK_EN (clearing a bit gates a block and the next access to it hangs), DMA CTRL GO and SBR CTRL START (they start jobs). Bug 4, the byte-versus-word wiring, connected the DMA's paddr to apb_paddr bits 9 down to 2, so only offset zero survived and a COUNT read returned STATUS with no error. Its catches are the offset walk, one front-door access per implemented offset, and the bit-level connectivity rule that paddr bit i is driven by apb_paddr bit i. Bug 7, the bridge resetting as non-secure, made copies out of SRAM1 fail on the first beat while CPU reads passed; its catch is one transfer per master per region class in the access-control matrix, with the bridge present in both of its states.
Bug | Symptom signature | Catching test | Hook |
|---|---|---|---|
1: 8 KB window | SBR writes corrupt DMA KEY (offset 0x0C collision) | Cross-talk: write slot N, read back all other slots | Runs on every decoder change |
4: paddr from [9:2] | Only DMA CTRL answers; the rest PSLVERR | Offset walk plus bit-i-from-bit-i connectivity | Runs on every wiring change |
7: SBR NS reset | SRAM1 copies ERR at beat one; CPU reads fine | Master-by-region matrix, bridge in both states | Runs on every map change |
9: contract traps | Stale KEY, stuck interrupt, disarmed IRQ_EN | The three driver-rule tests of the errata list | Runs on every driver release |
Bug 9 is the odd one out and deliberately so: the hardware behaves as specified, and the regression lives in the driver rules. Its three tests are the errata entries written as code: reprogram without polling BUSY and observe the stale configuration, finish a failed then a good job and observe the stuck interrupt until STATUS is written with 0x6, and start with CTRL written as 0x1 and observe the missing completion interrupt until the rule of writing 0x3 is applied. Each test fails without its rule and passes with it, which is what keeps a workaround honest across releases. Together the four hooks cover the four layers of the section: decode, wiring, security and contract, one named test per layer per bug.
A hook is a test plus a trigger: the condition under which it must run. The triggers above are the discipline, because a test that runs only when somebody remembers protects nothing. The map sign-off then reduces to a checklist the review can actually audit: the map checker clean on the current table, the register-specification checker clean, sweeps and reset readback passing in simulation, alias count exact with connectivity clean, the access-control matrix complete and passing, and the four regression hooks green on the final generated artifacts, all quoted against one map version. Anything failing is either fixed or becomes an erratum with a workaround, which is the errata lesson's process doing its job.
Each planted bug has a named regression test and a stated trigger; the test fails when the bug is reintroduced, which is itself tested by mutation.
Sign-off quotes one map version across all artifacts, with checker and sweep outputs archived, not summarised.
New bugs found after sign-off enter the same pipeline: erratum first, regression test second, fix third.
Mutation-check the hooks once: reintroduce each bug in a scratch build (widen the select, rewire paddr, set the bridge state, break a driver rule) and confirm exactly its test fails while the others pass. A hook that fails for every mutation is too coarse to localise; a hook that fails for none is decoration. Keep the mutation results with the sign-off pack, so the reviewer inherits evidence rather than assurances.
It becomes an erratum entry with symptom, cause, revisions and a driver-facing rule if one exists; a new alias-count or cross-talk regression hook is added with the wiring-change trigger; only then does the fix land, verified by the new hook failing on the old artifacts and passing on the new.