russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
60 lines
1.9 KiB
ReStructuredText
60 lines
1.9 KiB
ReStructuredText
Verilator — CWE-407 Analysis
|
|
==============================
|
|
|
|
.. contents:: :local:
|
|
|
|
Overview
|
|
--------
|
|
|
|
Verilator is the fastest open-source Verilog/SystemVerilog simulator. It compiles
|
|
RTL designs to multithreaded C++. Internally it performs design analysis, data-flow
|
|
graph construction, critical-path scheduling, and SCC detection for combinational
|
|
loop identification.
|
|
|
|
**Status: CLEAN — 0 confirmed defects**
|
|
|
|
Scanner returned 3 candidates; all are false positives on hash-backed containers.
|
|
|
|
Triage
|
|
------
|
|
|
|
.. list-table::
|
|
:header-rows: 1
|
|
:widths: 35 30 20 15
|
|
|
|
* - Candidate
|
|
- Container type
|
|
- Membership cost
|
|
- Verdict
|
|
* - ``V3ExecGraph.cpp:955`` — ``schedule.contains(nextp)`` in edge loop
|
|
- ``ThreadSchedule`` (internal hash set)
|
|
- O(1)
|
|
- FALSE POSITIVE
|
|
* - ``V3Gate.cpp:722`` — ``readVscps.count(varScp)`` in out-edge loop
|
|
- ``std::unordered_set`` / ``VNumRange``
|
|
- O(1)
|
|
- FALSE POSITIVE
|
|
* - ``V3Options.h:724`` — ``m_fDfgPeepholeDisabled.count(name)``
|
|
- ``VStringSet`` (``std::set<std::string>``)
|
|
- O(log n); not in hot loop
|
|
- FALSE POSITIVE
|
|
|
|
All three candidates are O(1) or O(log n) hash/set lookups — not O(n) linear scans.
|
|
|
|
Design Assessment
|
|
-----------------
|
|
|
|
Verilator's graph algorithms use proper O(1) membership containers throughout:
|
|
|
|
- **V3Graph**: node/edge traversal with pointer-based identity, no list membership
|
|
- **V3Partition** (multithreading scheduler): ``std::unordered_set<ExecMTask*>``
|
|
for all visited-set tracking
|
|
- **SCC detection** (combinational loop finder): ``std::unordered_set`` for
|
|
on-stack and visited state — correct O(1) membership
|
|
- **V3Gate** (gate optimization): ``std::unordered_set`` for variable scope sets
|
|
|
|
References
|
|
----------
|
|
|
|
* Scanner: ``tools/scans/verilator.sh``
|
|
* Scan result: ``tools/scan-results/verilator.txt`` — 3 candidates, all false positives
|