fix(StoreQueue): add nc_req_ack state to avoid duplicated request (#4625)

## Bug Discovery
The Svpbmt CI of master at
https://github.com/OpenXiangShan/XiangShan/actions/runs/14639358525/job/41077890

fix(StoreQueue): add nc_req_ack state to avoid duplicated request (#4625)

## Bug Discovery
The Svpbmt CI of master at
https://github.com/OpenXiangShan/XiangShan/actions/runs/14639358525/job/41077890352
reported the following implicit output error:

```
check_misa_h PASSED
test_pbmt_perf
TEST: read 4 Bytes 1000 times

Svpbmt IO test...
addr:0x10006d000
start: 8589, end: 59845, ticks: 51256

Svpbmt NC test...
addr:0x10006c000
start: 67656, end: 106762, ticks: 39106

Svpbmt NC OUTSTANDING test...
smblockctl = 0x3f7
addr:0x10006c000
start: 118198, end: 134513, ticks: 16315

Svpbmt PMA test...
addr:0x100000000
start: 142696, end: 144084, ticks: 1388
PASSED
test_pbmt_ldld_violate ERROR: untested exception! cause NO: 5
(mhandler, 219)
[FORK_INFO pid(1251274)] clear processes...
Core 0: HIT GOOD TRAP at pc = 0x80005d64
Core-0 instrCnt = 174,141, cycleCnt = 240,713, IPC = 0.723438
```

## Design Background
For NC (Non-Cacheable) store operations, the handshake logic between the
StoreQueue and Uncache is as follows:

1. **Without Outstanding Enabled:**
In the `nc_idle` state, when an executable `nc store` is encountered, it
transitions to the `nc_req` state. After `req.fire`, it moves to the
`nc_resp` state. Once `resp.fire` is triggered, it returns to `nc_idle`,
and both `rdataPtrExtNext` and `deqPtrExtNext` are updated to handle the
next request.

2. **With Outstanding Enabled:**
In the `nc_idle` state, upon encountering an executable `nc store`, it
transitions to the `nc_req` state. After `req.fire`, it **returns to
`nc_idle`** (Point A). Once the request is fully written into Uncache,
i.e., upon receiving `ncSlaveAck` (Point B), it updates
`rdataPtrExtNext` and `deqPtrExtNext` to handle the next request.


## Bug Description
In the above scenario, since the transition to `nc_idle` at Point A
occurs earlier (by two cycles) than Point B due to timing differences,
the `rdataPtr` at Point A still points to the location of the previous
uncache request (let’s call it NC1). The condition for sending uncache
request is still met at this moment, leading Point A to issue a
**duplicate `uncache` request** for NC1.

By the time Point B occurs, **two identical requests for NC1** have
already been sent. At Point B, `rdataPtr` is updated to proceed to the
next request. However, when the **second `ncSlaveAck`** for NC1 returns,
`rdataPtr` is updated **again**, causing it to move forward **twice**
for a single request. This eventually results in one of the following
requests never being executed.

## Bug Fix
Given that multiple cycles are required to ensure that a request is
fully written to Uncache, a new state called `nc_req_ack` is introduced.
The revised handshake logic with outstanding enabled is as follows:

In the `nc_idle` state, when an executable `ncstore` is encountered, it
transitions to the `nc_req` state. After `req.fire`, it moves to the
`nc_req_ack` state. Once the request is fully written to Uncache and
`ncSlaveAck` is received, it transitions back to `nc_idle`, and updates
`rdataPtrExtNext` and `deqPtrExtNext` to handle the next request.

show more ...

fix(csr): filter out Read-Only CSR in regOut (#4412)

fix(criticalError): Stop counting `wfi_cycles` when disable `wfiResume` (#4623)

* The precondition for `commitStuck_overflow` to trigger a critical
error is that `WFI` resumes after 1M(2^20) cycles.

build: add configuration for `CHIAddrWidth` and `enableL2Flush` (#4621)

fix(intr,difftest): add interrupt delegate (#4516)

fix: sync the signals before use for lowpower (#4610)

fix(vstopi): fix vstopi result selection

* AIA Spec:
* Ties in nominal priority are broken as usual by the default priority
* order from Table 8, unless hvictl fields VTI = 1 and IID ≠ 9
* (last ite

fix(vstopi): fix vstopi result selection

* AIA Spec:
* Ties in nominal priority are broken as usual by the default priority
* order from Table 8, unless hvictl fields VTI = 1 and IID ≠ 9
* (last item in the candidate list above), in which case
* default priority order is determined solely by hvictl.DPR.

* If bit IPRIOM (IPRIO Mode) of hvictl is zero, IPRIO in vstopi is 1;
* else, if the priority number for the highest-priority candidate
* is within the range 1 to 255, IPRIO is that value; else, IPRIO
* is set to either 0 or 255 in the manner documented for stopi
* in Section 5.4.2.

show more ...

fix(xtopi): fix m/stopi.IRPIO generation conditions

* If all bytes of the supervisor-level iprio array are read-only zeros,
* a simplified implementation of field IPRIO is allowed in which
* its val

fix(xtopi): fix m/stopi.IRPIO generation conditions

* If all bytes of the supervisor-level iprio array are read-only zeros,
* a simplified implementation of field IPRIO is allowed in which
* its value is always 1 whenever stopi is not zero.
*
* We are configurable and do not need to simplify the implementation.

show more ...

fix(AXI4Memory): fix write request enqueue DRAMSim logic for AXI4Memory (#4611)

fix(VLSU): modifying vector misalign elemidx generation (#4593)

For "unit-stride access with element granularity misaligned and emul<0",
it could be the case that:
has only once valid elements, but

fix(VLSU): modifying vector misalign elemidx generation (#4593)

For "unit-stride access with element granularity misaligned and emul<0",
it could be the case that:
has only once valid elements, but splits into two flows(misaligned),
which would result in the `elemidx` being the same, making it impossible
for the exception handling logic in the `mergebuffer` to recognise the
correct order.

Instead of adding a new variable, we have chosen to reuse `elemidx` as a
marker. But this does pollute the original semantics of `elemidx`.

show more ...

chore(Parameters): remove the incorrect parameter description (#4391)

This is a misrepresentation; currently, there is only one item in the fofbuffer.

fix(xiselect): set the minimum range for xiselect (#4594)

The miselect register implements at least enough bits to support all
implemented miselect values.
The siselect register will support the val

fix(xiselect): set the minimum range for xiselect (#4594)

The miselect register implements at least enough bits to support all
implemented miselect values.
The siselect register will support the value range 0..0xFFF at a
minimum.
The vsiselect register will support the value range 0..0xFFF at a
minimum.

show more ...

timing(LoadQueueUncache): adjust s1 enq and s2 enq valid generate logic (#4603)

fix(rename): fix Csrr format (#4605)

fix(top): enable cpuclock when debug halt req (#4583)

fix(StoreUnit): cbo violation check should check cacheline (#4592)

The cbo instruction should check for violations at the granularity of
cacheline.

Theoretically modifying the condition of this var

fix(StoreUnit): cbo violation check should check cacheline (#4592)

The cbo instruction should check for violations at the granularity of
cacheline.

Theoretically modifying the condition of this variable would allow
checking at cacheline granularity in RAW and should not introduce any
other side effects.

show more ...

fix(StoreQueue): remove `cboZeroUop` saved `sqptr` (#4591)

fix(MainPipe): fix error report valid when Atomics and SBuffer request miss (#4572)

* Sbuffer write and Atomics should not report errors, but refill from L2
should report ecc error, but requests in

fix(MainPipe): fix error report valid when Atomics and SBuffer request miss (#4572)

* Sbuffer write and Atomics should not report errors, but refill from L2
should report ecc error, but requests in MissQueue carry `isAmo` or
`isStore` and `req.miss` in a request, hence `(s2_req.isAMO ||
s2_req.isStore)` includes the refill, so the missing request of `isAmo`
or `isStore` will not report an error

show more ...

fix(MainPipe): fix `s1_way_en` logic when pseudo tag error inject (#4573)

* `s1_way_en` should use `io.pseudo_error.valid` on the same stage, not
`RegNext(io.pseudo_error.valid)`. Otherwise, `MainPi

fix(MainPipe): fix `s1_way_en` logic when pseudo tag error inject (#4573)

* `s1_way_en` should use `io.pseudo_error.valid` on the same stage, not
`RegNext(io.pseudo_error.valid)`. Otherwise, `MainPipe` may use wrong
way enable to write DCache, it will result in two identical tags.

show more ...

fix(LLPTW): dup_wait_resp should not send last_hptw_req when excp (#4596)

In the original design, the condition for `to_last_hptw_req` was:
`dup_wait_resp && entries(io.mem.resp.bits.id).req_info.s2

fix(LLPTW): dup_wait_resp should not send last_hptw_req when excp (#4596)

In the original design, the condition for `to_last_hptw_req` was:
`dup_wait_resp && entries(io.mem.resp.bits.id).req_info.s2xlate ===
allStage`. As a result, when a newly entered LLPTW request dups with an
entry currently returning from memory, and the new request is marked as
allStage, the `to_last_hptw_req` signal would be true. This causes the
state machine to transition to the `state_last_hptw_req` state and send
a request to HPTW.

However, if the page table returned from memory contains a `vsStagePf`
or `gStagePf`, it should directly go to `mem_out` or `bitmap_check`
without performing a final HPTW translation. Therefore, this commit
fixes the bug by adding a restriction to the original `to_last_hptw_req`
condition to ensure that no exceptions are present; otherwise, the state
machine will transition to either `mem_out` or `bitmap_check`.

Additionally, this PR also fixes a bug where `last_hptw_req_ppn` did not
account for the napot case.

show more ...

fix(LLPTW): dup entry should consider s2xlate in need_to_waiting_vec (#4597)

fix(TLB): explicitly specify the signal width again when truncated (#4588)

Similar to https://github.com/OpenXiangShan/XiangShan/pull/4471

fix(TLB): onlyStage1 req should use s1_paddr rather than s2_paddr (#4587)

In the previous design, `s2_paddr` was used whenever virtualization was
enabled (`s2xlate =/= noS2xlate`). This was incorrec

fix(TLB): onlyStage1 req should use s1_paddr rather than s2_paddr (#4587)

In the previous design, `s2_paddr` was used whenever virtualization was
enabled (`s2xlate =/= noS2xlate`). This was incorrect — we should use
`s2_paddr` only when `onlyStage2` or `allStage` is active, and use
`s1_paddr` when in `onlyStage1` or `noS2xlate` mode. This commit fixes
that bug.

show more ...

fix(PTW): false positive accessFault should not use af_level when resp (#4586)

In certain cases where a `pageFault` or `guestFault` occurs,
`accessFault` signal might still be true; however, it is a

fix(PTW): false positive accessFault should not use af_level when resp (#4586)

In certain cases where a `pageFault` or `guestFault` occurs,
`accessFault` signal might still be true; however, it is actually
invalid and should not be reported. We fixed this bug in commit
https://github.com/OpenXiangShan/XiangShan/pull/4540.

However, in the previous design, the level field of the PTW response was
defined as: `Mux(accessFault, af_level, Mux(guestFault, gpf_level,
level))`. As a result, although we fixed the false accessFault reporting
in https://github.com/OpenXiangShan/XiangShan/pull/4540, the level in
the PTW response was still incorrectly set to `af_level`. This commit
fixes that issue.

Additionally, this commit extracts the arguments in `ptw_resp.apply`
into separate variables to improve code readability. Previously, it was
incorrectly assumed that `pte_valid` was a required condition for
`guestFault`, using the condition: `!(pte_valid && (pageFault ||
guestFault))`. In fact, only `pageFault` needs to consider `pte_valid`;
`guestFault` does not depend on it. This bug is also fixed in this
commit.

show more ...

fix(LoadUnit): fix ldld && stld query revoke logic (#4580)

The prior design reassigns `io.lsq.ldin.bits.rep_info.need_rep` to 0
when source comes from MisalignBuffer, preventing cancellation of
rar/

fix(LoadUnit): fix ldld && stld query revoke logic (#4580)

The prior design reassigns `io.lsq.ldin.bits.rep_info.need_rep` to 0
when source comes from MisalignBuffer, preventing cancellation of
rar/raw enqueue requests during misaligned instruction reissuance.

Thus, we must use `io.misalign_ldout.bits.rep_info.need_rep` to
determine whether to revoke rar/raw enqueue requests when source is from
MisalignBuffer.

show more ...