refactor(MemBlock): move MemBlock.scala from backend to mem (#4221)

area(EXU): add parameter `needCopySrc` in FuConfig (#4063)

fix(decode): scala fp fu's fmt use fpuCtrl instead of vsew

area(exu): ctrl signals only pipe once in exu

area(Backend): merge pcMem and pcTargetMem

feat(CtrlUnit, DCache): support L1 DCache RAS (#4009)

# L1 DCache RAS extension support

The L1 DCache supports the part of Reliability, Availability, and
Serviceability (RAS) Extension.
* L1 DCache

feat(CtrlUnit, DCache): support L1 DCache RAS (#4009)

# L1 DCache RAS extension support

The L1 DCache supports the part of Reliability, Availability, and
Serviceability (RAS) Extension.
* L1 DCache protection with Single Error Correct Double Error Detect
(SECDED) ECC on the RAMs. This includes the L1 DChace tag and data RAMs.
Not recovery error tag or data.
* Fault Handling Interrupt (Bus Error Unit Interrupt,BEU, 65)
* Error inject

## ECC Error Detect
An error might be triggered, when access L1 DCache.
* **Error Report**:
* Tag ECC Error: As long as an ECC error occurs on a certain path, it
is judged that an ECC error has occurred.
* Data ECC Error: If an ECC error occurs in the hit line, it is
considered
that an ECC error has occurred. If it does not hit, it will not be
processed.
* If an instruction access triggers an ECC error, a Hardware error is
considered and an exception is reported.
* Whenever there is an error in starting, an error message needs to
be sent to BEU.
* When the hardware detects an error, it reports it to the BEU and
triggers the NMI external interrupt(65).

* **Load instruction**:
* Only ECC errors of tags or data will be triggered during execution,
and the errors will be reported to the BEU and a `Hardware Error`
will be reported.

* **Probe/Snoop**:
* If a tag ecc error occurs, there is no need to change the cache
status,
and a `ProbeAck` with `corrupt=1` needs to be returned to l2.
* If a data ecc error occurs, change the cache status according to
the rules. If data needs to be returned, `ProbeAckData` with `corrupt=1`
needs to be returned to l2.

* **Replace/Evict**:
* `ReleaseData` with `corrupt=1` needs to be returned to l2.

* **Store to L1 DCache**:
* If a tag ecc error occurs, the cacheline is released according to the
`Repalce/Evict` process and the data is written to L1 DCache without
reporting errors to l2.
* If a data ecc error occurs, the data is written directly without
reporting
the error to l2.

* **Atomics**:
* report `Hardware Error`, do not report errors to l2.

## Error Inject
Each core's L1 DCache is configured with a memory map
register-controlled
controller, and each hardware unit that supports ECC is configured with
a
control bank. After the Bank register configuration is completed, L1
DCache
will trigger an ecc error for the first access L1 DCache.
<div style="text-align: center;">
<img
src="https://github.com/user-attachments/assets/8c4d23c5-0324-4e52-bcf4-29b47a282d72"
alt="err_inject" width="200" />
</div>

### Address Space
Address space `0x38022000`-`0x3802207F`, a total of 128 bytes of space,
this space is the local space of each hart.
<div style="text-align: center;">
<img width="292" alt="ctl_bank"
src="https://github.com/user-attachments/assets/89f88b24-37a4-4786-a192-401759eb95cf">
</div>

### L1 DCache Control Bank
Each Control Bank contains registers: `ECCCTL`, `ECCEID`, `ECCMASK`,
each register is 8 bytes.
<img width="414" alt="eccctl"
src="https://github.com/user-attachments/assets/b22ff437-d05d-4b3c-a353-dbea1afdc156">
* ECCCTL(ECC Control): ECC injection control register.
* `ese(error signaling enable)`: Indicates that the injection is valid
and is initialized to 0. When the injection is successful and `pst==0`,
ese will be clean.
* `pst(persist)`: Continuously inject signals. When `pst==1`,
the `ECCEID`
counter decreases to 0 and after successful injection, the
injection timer will be restored to the last set `ECCEID` and
re-injected;
when `pst==0`, it will be injected only once.
* `ede(error delay enable)`: Indicates that counter is valid and
initialized to 0. If
* `ese==1` and `ede==0`, error injection is effective immediately.
* `ese==1` and `ede==1`, you need to wait until `ECCEID`
decrements to 0 before the injection is effective.
* `cmp(component)`: Injection target, initialized to 0.
* 1'b0: The injection object is tag.
* 1'b1: The injection object is data.
* `bank`: The bank valid signal is initialized to 0. When the bit in
the `bank` is set, the corresponding mask is valid.

<img width="414" alt="ecceid"
src="https://github.com/user-attachments/assets/8cea0d8d-2540-44b1-b1f9-c1ed6ec5341e">

* ECCEID(ECC Error Inject Delay): ECC injection delay controller.
* When `ese==1` and `ede==1`, it
starts to decrease until it reaches 0. Currently, the same clock as
the core frequency is used, which can also be divided. Since ECC
injection relies on L1 DCache access, the time of the `EID` and the
time when the ECC error is triggered may not be consistent.

<img width="414" alt="eccmask"
src="https://github.com/user-attachments/assets/b1be83fd-17a6-4324-8aa6-45858249c476">

* ECCMASK(ECC Mask): ECC injection mask register.
* 0 means no inversion, 1 means flip.
Tag injection only uses the bits in `ECCMASK0` corresponding to
the tag length.

### Error Inject Example
```
1 # set control bank base address
2 mv x3, $(BASEADDR)
3
4 # set eid
5 mv x5, 500 # delay 500 cycles
6 sd x5, 8(x3) # mmio store
7
8 # set mask
9 mv x5, 0x1 # flip bit 0
10 sd x5, 16(x3) # mmio store
11
12 # set ctl
13 mv x5, 0x7 # comp = 0, ede = 1, pst = 1, ese = 1
14 sd x5, 0(x3) # mmio store
```

show more ...

feat(dbltrp) : add support for critical error (#3793)

feat(rv64v): support first only fault instruction

feat(Trigger): add vector memory access Trigger logic

fix(exception): check high address bits of jump target (#3003)

This commit contains high address bits checking of jump target. In
previous implementation, we simply truncated the higher bits of jump

fix(exception): check high address bits of jump target (#3003)

This commit contains high address bits checking of jump target. In
previous implementation, we simply truncated the higher bits of jump
target address, which made it impossible to raise exceptions in such
cases.

To resolve this problem, we detect the invalid jump target in
jump/branch/CSR and, this information to frontend and store the complete
invalid target in a single register in backend. The frontend will then
raise an exception to backend and backend will also use the invalid
target in the register to write xtval and mepc.

---------

Co-authored-by: Muzi <[email protected]>
Co-authored-by: ngc7331 <[email protected]>

show more ...

timing(Backend): add OG2 stage for vector mem (#3482)

fix(Zicclsm, trigger): fix the problem of missing breakpoint exception (#3470)

+ @wissygh Refactored Trigger check code of Memblock.
+ Move Trigger address cmp from load S3 to S1. In addition, the

fix(Zicclsm, trigger): fix the problem of missing breakpoint exception (#3470)

+ @wissygh Refactored Trigger check code of Memblock.
+ Move Trigger address cmp from load S3 to S1. In addition, the
detection of trigger is moved from Memblock to LoadUnit.
- Once the breakpoint exception is detected, enter the exception Buffer
directly to handle the exception (previously, the
load instruction was executed first and then the exception was handled,
which would cause the mmio load to change the
status of the peripheral).
+ If Trigger address matches and the action is to enter debug mode, both
loadUnit and storeUnit will directly write this instruction back without
any execution (by setting this instruction as an exception).
+ Match trigger addresses for vector instructions in LoadUnit.
+ If both a misalign exception and a breakpoint occur, the breakpoint
exception will be processed first.

---------

Co-authored-by: chengguanghui <[email protected]>

show more ...

feat(riscv64): Support RISC-V Zfa extension

* Support fli.{h.s.d}, fminm.{h.s.d}, fmaxm.{h.s.d}
* Support fround.{h.s.d}, froundnx.{h.s.d}, fcvtmod.w.d
* Support fleq.{h.s.d}, fltq.{h.s.d}

RVA23: Support Zicclsm & Zama16b (Handling Unaligned Load Store by Hardware) (#3320)

This PR supports handling load store unaligned exceptions by hardware
and provides CSR-controlled switches

--

RVA23: Support Zicclsm & Zama16b (Handling Unaligned Load Store by Hardware) (#3320)

This PR supports handling load store unaligned exceptions by hardware
and provides CSR-controlled switches

---------

Co-authored-by: xiaofeibao <[email protected]>

show more ...

parameters: move CsrCfg, FenceCfg to BJU3 and set latency is UncertainLatency

Trigger: add breakpoint exception for `STORE`

*prevent `STORE` from writing sbuffer when trigger fire.

NewCSR: make XRET use redirect bundle to pass target instead of csr-rob direct connection

* TODO: remove isXRet signal from RobCSRIO.
* Add ftqIdx,ftqOffset in CSR Fu.
* XRet need not flushPipe

NewCSR: add IMSIC

rv64v: fix immType for vector instructions because use i2v module

Backend: fix Uncertain Layency Fu's clock gate (#3085)

vl: convert read vl instruction to a move instrcuction

* using vset module to move vl from vl register to int register

vset: fix old vl read for vsetvl and vsetvli instructions (#3058)

VPU: new vcompress to fit v0&vl split; fix vfredsum/min/max (#3053)

fix vfredsum/max/min:
When the vector vfredusum/max/min consists entirely of inactive elements
and vs1[0] is NaN, the result sho

VPU: new vcompress to fit v0&vl split; fix vfredsum/min/max (#3053)

fix vfredsum/max/min:
When the vector vfredusum/max/min consists entirely of inactive elements
and vs1[0] is NaN, the result should be vs1[0]
When both elements of vfredusum are inactive, the temporary result
changes from positive zero to negative zero.
nes vcompress to fit v0/vl split:
The vcompress calculation combines the ones_sum result with vs1 using a
temporary register to reduce one read operation. Additionally, other
uops, except ones_sum, reduce the basemask calculation and the right
shift basemask operation.
fix vpermtest to fit new vcompress

show more ...

FuConfig: split dataBits into destDataBits and srcDataBits for distinguish input and output data width

FuConfig: add writeV0Rf writeVlRf