timing(IPrefetch): add 1 cycle to s2_finish (#3545)

Cut critical path prefetchPipe s2 -> toMSHRArbiter.valid(i) ->
toMSHR.paddr -> missUnit hit -> missUnit.req.ready -> prefetchPipe
toMSHRArbiter.

timing(IPrefetch): add 1 cycle to s2_finish (#3545)

Cut critical path prefetchPipe s2 -> toMSHRArbiter.valid(i) ->
toMSHR.paddr -> missUnit hit -> missUnit.req.ready -> prefetchPipe
toMSHRArbiter.ready ***-> s2_finish ->*** s2_ready -> s1_ready ->
toFtq.ready
for timing.

This can be thought of as adding 1 cycle to the prefetchPipe s2_finish,
but only a minor performance change is expected, since the timing of
issuing the first miss request is unchanged, and the additional waiting
delay for subsequent miss requests can be hidden by the l2 cache access
delay.

show more ...

fix(ICache): block waylookup if there is a pending gpf (#3719)

In the existing design, ICache assumes that once a gpf occurs, it works
on the wrong path until a flush (redirect) arrives, so it can

fix(ICache): block waylookup if there is a pending gpf (#3719)

In the existing design, ICache assumes that once a gpf occurs, it works
on the wrong path until a flush (redirect) arrives, so it can discard
redundant gpf/gpaddr data to reduce power/area.

As shown below, the 2nd(orange) and 3rd(blue) gpaddr write to wayLookup
is discarded.


This assumption is mostly true, except:
1. Consider a 34B fetch block in which the first 32B have no exceptions
and consist entirely of RVC instructions, and the last 2B cross a page
boundary and a gpf occurs.
2. The IFU sends at most 16 instructions to the ibuffer, and therefore
discards the last 2B. This way, none of the instructions received by the
backend have exceptions and no flush (redirect) is generated.
3. The next fetch block again has a gpf, which ICache (wayLookup)
considers redundant and discards the gpaddr data.
4. When the instruction with gpf is sent to the backend, the backend
does not get the correct gpaddr and caused an error.

Fix: block writes when there is gpf/gpaddr data in wayLookup that is not
read by mainPipe (i.e. is pending).

As shown below, the 1st(yellow) gpaddr write is bypassed to read port,
the 2nd is stored in gpf entry, and the 3rd is stalled until the 2nd is
read. So all 3 gpaddr data are sent to backend(gpaMem).


show more ...

feat(trap): support m/htinst for specific G-stage translation (#3604)

According to RISC-V priv spec, mtinst/htinst could be always written
zero on trap into M/HS-mode, except for Guest-Page-Fault t

feat(trap): support m/htinst for specific G-stage translation (#3604)

According to RISC-V priv spec, mtinst/htinst could be always written
zero on trap into M/HS-mode, except for Guest-Page-Fault traps that meet
both of the following conditions:
- the trap is caused by a G-stage translation which supports VS-stage
translation
- a nonzero value is written to mtval2/htval

"isForVSnonLeafPTE" is used only in exceptional circumstances that gpf
happens in the G-stage translation which supports VS-stage translation,
such as searching the non-leaf pte of VS-stage.

This patch adds support for writing proper value to mtinst/htinst when
specific trap occurs. And bump the nemu.

show more ...

fix(exception): check high address bits of jump target (#3003)

This commit contains high address bits checking of jump target. In
previous implementation, we simply truncated the higher bits of jump

fix(exception): check high address bits of jump target (#3003)

This commit contains high address bits checking of jump target. In
previous implementation, we simply truncated the higher bits of jump
target address, which made it impossible to raise exceptions in such
cases.

To resolve this problem, we detect the invalid jump target in
jump/branch/CSR and, this information to frontend and store the complete
invalid target in a single register in backend. The frontend will then
raise an exception to backend and backend will also use the invalid
target in the register to write xtval and mepc.

---------

Co-authored-by: Muzi <[email protected]>
Co-authored-by: ngc7331 <[email protected]>

show more ...

fix(ICache): MSHR also update meta_codes when updating waymasks (#3492)

ICache: fix metaArray ECC check (#3419)

Currently, metaArray ECC check is valid 2 cycles after request:

https://github.com/OpenXiangShan/XiangShan/blob/49162c9ab67070931573c1d4a372e2c858a72716/sr

ICache: fix metaArray ECC check (#3419)

Currently, metaArray ECC check is valid 2 cycles after request:

https://github.com/OpenXiangShan/XiangShan/blob/49162c9ab67070931573c1d4a372e2c858a72716/src/main/scala/xiangshan/frontend/icache/ICache.scala#L262

However, prefetchPipe s1 handshakes with both WayLookup and prefetchPipe
s2 assuming that all signals of the metaArray.io.readResp are valid 1
cycle after the request, resulting in the error.

Simply removing this RegEnable may lead to problems with long timing
paths (metaArray (sram) -> ECC check (xor reduction) -> prefetchPipe s1
(wire) -> wayLookup (bypass, wire) -> mainPipe s0 (wire) -> mainPipe s1
(reg)), so no.

This PR may result in case-specific errors not being checked out, which
in turn results in additional fetch requests being sent to the L2 cache,
but does not causes corrupted data being sent to the backend. See
discussion in notes:

https://github.com/OpenXiangShan/XiangShan/blob/8b87b8dcbfd5945c5bd7815eb5e569fec252ddc6/src/main/scala/xiangshan/frontend/icache/IPrefetch.scala#L279-L293

There are 2 more potential solutions described in an internal yuque
document, however, due to the complexity of implementation, area
overhead and other considerations, the current solution is considered to
be optimal.

show more ...

IPrefetch: fix s1 fsm for softPrefetch (#3433)

Do not bypass `m_enqWay` state to make sure that s1_waymasks (and maybe
other registers) is updated, whether is softPrefetch or not.

svpbmt: add simplified support (#3404)

Only the `pbmt` attribute is added and treated as MMIO when `pbmt` is NC
or IO.

---------

Co-authored-by: ngc7331 <[email protected]>

ICacheMissUnit: wait for all beats even corrupt has already occurred

See Tilelink spec section 4.4:
> The ones that are not marked corrupt still contain valid data. Every
TileLink request message

ICacheMissUnit: wait for all beats even corrupt has already occurred

See Tilelink spec section 4.4:
> The ones that are not marked corrupt still contain valid data. Every
TileLink request message requires a mandatory response message of a
mandatory size, and all beats of the message must be sent, even if every
beat is marked as corrupt.

We can't simply reset counter and send response to MainPipe when
corruption happens, but we have to wait until all beats of the message
are sent back from L2 cache even if there's a corrupt.

show more ...

Frontend: implement prefetch.i support (RVA23 Zicbop) (#3396)

IPrefetch: disable IPrefetchPipe s2 stage if CSR does not enable iprefetch (#3372)

ICache: raise af if meta/data array ECC fail

In current design, meta/data array corruption does not raise any
exception (whether or not `io.csr_parity_enable === true.B`), which may
pose two probl

ICache: raise af if meta/data array ECC fail

In current design, meta/data array corruption does not raise any
exception (whether or not `io.csr_parity_enable === true.B`), which may
pose two problems:
1. When meta corrupt, `ptag` comparison result may be invalid, and thus
cache hit may be treated as a cache miss, thereby sending (pre)fetch
request to L2 cache incorrectly;
2. When meta/data/l2 corrupt, instruction data sent to the backend may
be invalid. Although the errors are sent to beu, which sends an
interrupt via plic, the timing of the interrupt is not as controllable
as an exception. It is therefore reasonable to mark invalid data as
access fault to keep it from execution.

This PR:
1. Raise af if meta/data array ECC fail (when `io.csr_parity_enable ===
true.B`), the priority of this af is lower than iTLB & PMP exceptions
2. Cancle (pre)fetching if meta array ECC fail (by merging
`meta_corrupt` exceptions to `s2_exception`)

Note:
RISC-V Machine ISA v1.13 (draft) introduced a "hardware error"
exception, described as:
> A Hardware Error exception is a synchronous exception triggered when
corrupted or uncorrectable data is accessed explicitly or implicitly by
an instruction. In this context, "data" encompasses all types of
information used within a RISC-V hart. Upon a hardware error exception,
the xepc register is set to the address of the instruction that
attempted to access corrupted data, while the xtval register is set
either to 0 or to the virtual address of an instruction fetch, load, or
store that attempted to access corrupted data. The priority of Hardware
Error exception is implementation-defined, but any given occurrence is
generally expected to be recognized at the point in the overall priority
order at which the hardware error is discovered.

Maybe it's better to raise hardware error instead of access fault when
ECC check failed. But it's draft and XiangShan backend does not
implement this exception code yet, so we still raise af here. This may
need to be modified in the future.

show more ...

Frontend: refactor exceptions to labels (#3354)

Combine `excp_pf`/`_gpf`/`_af` into `exception` to:
1. Reduce code redundancy and improve readability and maintainability
e.g. `!itlb_excp_af && !it

Frontend: refactor exceptions to labels (#3354)

Combine `excp_pf`/`_gpf`/`_af` into `exception` to:
1. Reduce code redundancy and improve readability and maintainability
e.g. `!itlb_excp_af && !itlb_excp_pf && !itlb_excp_gpf && !pmp_excp_af
&& !pmp_excp_mmio`
-> `exception === ExcedptionType.none && !mmio`
2. Select exceptions as they are generated (e.g. from iTLB/PMP, or
data/meta array ECC check) on a priority basis (e.g. iTLB over PMP),
ensuring that there is at most one exception in the pipeline (and on the
ports of iCache -> IFU)
3. Save a little bit of pipeline/WayLookup registers (i.e. 3 bit
`excp_pf`/`_gpf`/`_af` -> 2bit `exception`)

show more ...

ICache: cancel (pre)fetch request if port1 is mmio (#3319)

ICacheMainPipe: fix s2_hit/corrupt not updating when fromMSHR.corrupt (#3292)

In original code, when `fromMSHR.bits.corrupt && fromMSHR.valid ===
true.B`:
`s2_MSHR_match` will be `false.B`
-> `s2

ICacheMainPipe: fix s2_hit/corrupt not updating when fromMSHR.corrupt (#3292)

In original code, when `fromMSHR.bits.corrupt && fromMSHR.valid ===
true.B`:
`s2_MSHR_match` will be `false.B`
-> `s2_MSHR_hits` will be `false.B`
-> `s2_hits` and `s2_corrupt` is never updated

Therefore, MainPipe will be still waiting for MissUnit response,
however, MissUnit assumes MainPipe has received data, so it will not
send again. MainPipe hangs forever, and no access fault is sent to IFU.

Fix:
`s2_MSHR_match` no longer requires `!fromMSHR.bits.corrupt`, thus
`s2_hits` and `s2_corrupt` will be updated. However, we still not update
`s2_datas` to save power.

show more ...

ICacheMainPipe: fix misuse of s0_fire (#3288)

build: purge chisel 3 and add deprecation check (#3250)

MissUnit: update replacer only when acuqire fire (#3245)

Each time `io.victim.vSetIdx.valid === true.B`, replacer will choose the
LRU way as victim and access it to MRU position.

When `acquireArb.i

MissUnit: update replacer only when acuqire fire (#3245)

Each time `io.victim.vSetIdx.valid === true.B`, replacer will choose the
LRU way as victim and access it to MRU position.

When `acquireArb.io.out.valid === true.B && acquireArb.io.out.ready ===
false.B`, replacer will be mistakenly updated, thus violates PLRU
policy.

We want to update replacer only once per acquire request, so
`io.victim.vSetIdx.valid := acquireArb.io.out.fire`.

show more ...

IPrefetch: fix s2_miss(1) typo (#3239)

Explained: (**NOT** has exception **AND NOT** hit) === miss === needs fetch

Performance change is expected, as prefetch is actually doing more work.

IPrefetch: do not pass exception(1) to WayLookup if !s1_doubleline (#3215)

Fixes bug mentioned:
https://github.com/OpenXiangShan/XiangShan/pull/3139#discussion_r1679178024

Analysis:
1. (expecte

IPrefetch: do not pass exception(1) to WayLookup if !s1_doubleline (#3215)

Fixes bug mentioned:
https://github.com/OpenXiangShan/XiangShan/pull/3139#discussion_r1679178024

Analysis:
1. (expected) In a doubleline request, port0 AND port1 finds guest page
fault(`io_itlb_x_resp_bits_excp_0_gpf_instr`), it is stored in
`itlbExcpGPF` register, enters WayLookup and is bypassed to
ICacheMainPipe (WayLookup is `empty` and `io_write` fires with `io_read`
fire). Finally it goes to backend
2. (expected) Backend send a redirect request and flushes
IPrefetch/WayLookup/ICacheMainPipe
3. (WRONG) After flush, this is a singleline request, so port1 does not
send request to itlb(`io_itlb_1_req_valid`) and thus not updated,
`io_itlb_x_resp_bits_excp_0_gpf_instr` remains `true.B`
4. (WRONG) This false-positive gpf enters WayLookup and is bypassed to
ICacheMainPipe
5. (expected) However, ICacheMainPipe finds `s2_doubleline` is
`fasle.B`, so it drops results from port1, so no gpf goes to backend.
6. (expected) After so many requests, circular pointer in WayLookup
overflows and returns to the location where the gpf was written to, so
it reads gpd again
7. (expected) This time, `s2_doubleline` is `true.B`, so gpf goes to
backend and finally causes error.

Solution:
1. Flush tlb results when `io_flush === true.B`. This might require
modifications to both the IPrefetch and TLB, we may address it later.
2. **Drop port1 results before it enqueues into WayLookup, instead of
when it is sent to IFU (after dequeues from WayLookup)**

show more ...

Frontend: cut waylookup gpaddr (#3139)

Currently, `gpaddr` is used only when guest page fault occurs, so it
should be possible to not store every `gpaddr` in WayLookup (as well as
in GPAMem).

C

Frontend: cut waylookup gpaddr (#3139)

Currently, `gpaddr` is used only when guest page fault occurs, so it
should be possible to not store every `gpaddr` in WayLookup (as well as
in GPAMem).

Considering that every guest page fault should issue a redirect, and
thus flush WayLookup/MainPipe/IPrefetch, we should be able to store only
the first guest page fault and its `gpaddr` in WayLookup.

By doing this, we can save `2×nWayLookupSize - 1 = 63` registers that
are used to store `gpaddr`.

This PR also includes some style changes for WayLookup to satisfy
linter.

show more ...

IPrefetch: MSHR should update IPrefetch s1 waymask (#3122)

Fixes MC-Linux CI fail:
https://github.com/OpenXiangShan/XiangShan/actions/runs/9709320741/job/26802800197.

In IPrefetch:
1. s0 send r

IPrefetch: MSHR should update IPrefetch s1 waymask (#3122)

Fixes MC-Linux CI fail:
https://github.com/OpenXiangShan/XiangShan/actions/runs/9709320741/job/26802800197.

In IPrefetch:
1. s0 send read request to MetaArray
2. s1:
- receive response from MetaArray (therefore `s1_SRAM_valid === true.B`)
- and receive update request from MSHR(`fromMSHR.valid &&
!fromMSHR.bits.corrupt === true.B`)
- and `s1_fire === true.B`
3. waymasks directly from SRAM(which might be outdated) enters s2 stage,
and update request from MSHR is actually discarded.

If it is a miss(`waymask === 0.U`), IPrefetch will send miss request to
MSHR. In this case, multiple refills of the same cache block may occur,
which in turn causes a bug with multiple hits in the MetaArray.

As a fix, we should use information from MSHR to update
`s1_SRAM_waymasks` too.

Local MC-Linux test passed with seed=1244.

show more ...

ICache: implement new ICache (#3051)

Co-authored-by: xu_zh <[email protected]>

L1CacheErrorInfo: code refactor for correct and convenient clockgate (#3044)

ICache: do not pass HartId to XSPerf

Since we can get hartid from the hierarchy printed by XSPerf, using HartId
here is redundant and makes the XSTile fail to dedup.

Signed-off-by: Yangyu Chen <cyy

ICache: do not pass HartId to XSPerf

Since we can get hartid from the hierarchy printed by XSPerf, using HartId
here is redundant and makes the XSTile fail to dedup.

Signed-off-by: Yangyu Chen <[email protected]>

show more ...