feat: support inst lifetime trace (#4007)

PerfCCT(performance counter commit trace) is a Instruction-level
granularity perfCounter like GEM5
How to use this:
1. Make with "WITH_CHISELDB=1" argument

feat: support inst lifetime trace (#4007)

PerfCCT(performance counter commit trace) is a Instruction-level
granularity perfCounter like GEM5
How to use this:
1. Make with "WITH_CHISELDB=1" argument
2. Run with "--dump-db --dump-select-db lifetime", then get the database
3. Instruction lifetime visualize run "python3 scripts/perfcct.py
"the-db-file-path" -p 1 -v | less"
4. Analysis script now is in XS-GEM5 repo, see
https://github.com/OpenXiangShan/GEM5/blob/xs-dev/util/ClockAnalysis.py

How it works:
1. Allocate one unique tag "seqNum" like GEM5 for each instruction at
fetch stage
2. Passing the "seqNum" in each pipeline
3. Recording perf data through the DPIC interface

show more ...

chore(dispatch): remove useless code and files (#4288)

fix(LSU): fix cbo instr exceptions and implementation (#4262)

1. typo.
2. `cbo` instr not produce misaligned exception.
3. `cbo zero` instr need flush `sbuffer`.
4. `cbo zero` sets mask correctly

fix(LSU): fix cbo instr exceptions and implementation (#4262)

1. typo.
2. `cbo` instr not produce misaligned exception.
3. `cbo zero` instr need flush `sbuffer`.
4. `cbo zero` sets mask correctly
5. Adding RAW checks to `cbo zero`.
6. Adding trigger(Debug Mode) checks to `cbo zero`.
7. Fixed several issues with the CBO instruction in NEMU.
----

In order not to create ambiguity with `io.mmioStout`, a new port of
`StoreQueue` is introduced for writeback `cbo zero` after flush sbuffer.
arbitration is performed in `MemBlock`, and currently, `cbo zero` has
higher priority by default.
`cbo zero` should not be writteback at the same time as `mmio`.

---
A check on `CacheLine` has been added to `RAWQueue` to ensure memory
consistency when executing `cbo zero`.
See this issues:https://github.com/OpenXiangShan/XiangShan/issues/4240
for specific issues.

---
The `cbo` instruction requires a trigger check.

---------

Co-authored-by: zhanglinjuan <[email protected]>

show more ...

feat(Zawrs): support Zawrs extension (#4211)

This commit implements a basic nop-based Zawrs extension.

- `wrs.sto` in this commit acts as a nop instruction.
- `wrs.nto` in this commit acts as a nop

feat(Zawrs): support Zawrs extension (#4211)

This commit implements a basic nop-based Zawrs extension.

- `wrs.sto` in this commit acts as a nop instruction.
- `wrs.nto` in this commit acts as a nop instruction, except it:
- raises illegal instruction exception when !isModeM && mstatus.TW=1, or
- raises virtual instruction exception when privState.V && mstatus.TW=0
&& hstatus.VTW=1

Seems that completely raises no exception is also a valid
implementation,
but raises an exception can help OS to do scheduling during waiting.

Also, like WFI, interrupts cannot take on wrs instructions.

show more ...

feat(CtrlUnit, DCache): support L1 DCache RAS (#4009)

# L1 DCache RAS extension support

The L1 DCache supports the part of Reliability, Availability, and
Serviceability (RAS) Extension.
* L1 DCache

feat(CtrlUnit, DCache): support L1 DCache RAS (#4009)

# L1 DCache RAS extension support

The L1 DCache supports the part of Reliability, Availability, and
Serviceability (RAS) Extension.
* L1 DCache protection with Single Error Correct Double Error Detect
(SECDED) ECC on the RAMs. This includes the L1 DChace tag and data RAMs.
Not recovery error tag or data.
* Fault Handling Interrupt (Bus Error Unit Interrupt,BEU, 65)
* Error inject

## ECC Error Detect
An error might be triggered, when access L1 DCache.
* **Error Report**:
* Tag ECC Error: As long as an ECC error occurs on a certain path, it
is judged that an ECC error has occurred.
* Data ECC Error: If an ECC error occurs in the hit line, it is
considered
that an ECC error has occurred. If it does not hit, it will not be
processed.
* If an instruction access triggers an ECC error, a Hardware error is
considered and an exception is reported.
* Whenever there is an error in starting, an error message needs to
be sent to BEU.
* When the hardware detects an error, it reports it to the BEU and
triggers the NMI external interrupt(65).

* **Load instruction**:
* Only ECC errors of tags or data will be triggered during execution,
and the errors will be reported to the BEU and a `Hardware Error`
will be reported.

* **Probe/Snoop**:
* If a tag ecc error occurs, there is no need to change the cache
status,
and a `ProbeAck` with `corrupt=1` needs to be returned to l2.
* If a data ecc error occurs, change the cache status according to
the rules. If data needs to be returned, `ProbeAckData` with `corrupt=1`
needs to be returned to l2.

* **Replace/Evict**:
* `ReleaseData` with `corrupt=1` needs to be returned to l2.

* **Store to L1 DCache**:
* If a tag ecc error occurs, the cacheline is released according to the
`Repalce/Evict` process and the data is written to L1 DCache without
reporting errors to l2.
* If a data ecc error occurs, the data is written directly without
reporting
the error to l2.

* **Atomics**:
* report `Hardware Error`, do not report errors to l2.

## Error Inject
Each core's L1 DCache is configured with a memory map
register-controlled
controller, and each hardware unit that supports ECC is configured with
a
control bank. After the Bank register configuration is completed, L1
DCache
will trigger an ecc error for the first access L1 DCache.
<div style="text-align: center;">
<img
src="https://github.com/user-attachments/assets/8c4d23c5-0324-4e52-bcf4-29b47a282d72"
alt="err_inject" width="200" />
</div>

### Address Space
Address space `0x38022000`-`0x3802207F`, a total of 128 bytes of space,
this space is the local space of each hart.
<div style="text-align: center;">
<img width="292" alt="ctl_bank"
src="https://github.com/user-attachments/assets/89f88b24-37a4-4786-a192-401759eb95cf">
</div>

### L1 DCache Control Bank
Each Control Bank contains registers: `ECCCTL`, `ECCEID`, `ECCMASK`,
each register is 8 bytes.
<img width="414" alt="eccctl"
src="https://github.com/user-attachments/assets/b22ff437-d05d-4b3c-a353-dbea1afdc156">
* ECCCTL(ECC Control): ECC injection control register.
* `ese(error signaling enable)`: Indicates that the injection is valid
and is initialized to 0. When the injection is successful and `pst==0`,
ese will be clean.
* `pst(persist)`: Continuously inject signals. When `pst==1`,
the `ECCEID`
counter decreases to 0 and after successful injection, the
injection timer will be restored to the last set `ECCEID` and
re-injected;
when `pst==0`, it will be injected only once.
* `ede(error delay enable)`: Indicates that counter is valid and
initialized to 0. If
* `ese==1` and `ede==0`, error injection is effective immediately.
* `ese==1` and `ede==1`, you need to wait until `ECCEID`
decrements to 0 before the injection is effective.
* `cmp(component)`: Injection target, initialized to 0.
* 1'b0: The injection object is tag.
* 1'b1: The injection object is data.
* `bank`: The bank valid signal is initialized to 0. When the bit in
the `bank` is set, the corresponding mask is valid.

<img width="414" alt="ecceid"
src="https://github.com/user-attachments/assets/8cea0d8d-2540-44b1-b1f9-c1ed6ec5341e">

* ECCEID(ECC Error Inject Delay): ECC injection delay controller.
* When `ese==1` and `ede==1`, it
starts to decrease until it reaches 0. Currently, the same clock as
the core frequency is used, which can also be divided. Since ECC
injection relies on L1 DCache access, the time of the `EID` and the
time when the ECC error is triggered may not be consistent.

<img width="414" alt="eccmask"
src="https://github.com/user-attachments/assets/b1be83fd-17a6-4324-8aa6-45858249c476">

* ECCMASK(ECC Mask): ECC injection mask register.
* 0 means no inversion, 1 means flip.
Tag injection only uses the bits in `ECCMASK0` corresponding to
the tag length.

### Error Inject Example
```
1 # set control bank base address
2 mv x3, $(BASEADDR)
3
4 # set eid
5 mv x5, 500 # delay 500 cycles
6 sd x5, 8(x3) # mmio store
7
8 # set mask
9 mv x5, 0x1 # flip bit 0
10 sd x5, 16(x3) # mmio store
11
12 # set ctl
13 mv x5, 0x7 # comp = 0, ede = 1, pst = 1, ese = 1
14 sd x5, 0(x3) # mmio store
```

show more ...

fix(uopsplit): set vector instructions never use simple split type (#4024)

* when use simple split type, instruction cannot send to complex decoder
and not do the exception check
* vs dirty is set

fix(uopsplit): set vector instructions never use simple split type (#4024)

* when use simple split type, instruction cannot send to complex decoder
and not do the exception check
* vs dirty is setted when split type is not simple

show more ...

feat(MemBlock): add support for Zacas extension

fix(AtomicsUnit, MemBlock): fix loss of multiple stds

In the previous design, AtomicsUnit receives stds from StdExeUnit and
arbitrate at most one std

feat(MemBlock): add support for Zacas extension

fix(AtomicsUnit, MemBlock): fix loss of multiple stds

In the previous design, AtomicsUnit receives stds from StdExeUnit and
arbitrate at most one std uop for one cycle. This works fine on most of
the AMOs and LR/SC because they require only one std uop. However AMOCAS
requires at least two std uops, which may be issued from two separate
issue queues at the same time, leading to the loss of std uops.

This commit fixes this by taking all the outputs of the StdExeUnits into
account with arbitration logics.

fix(AtomicsUnit): DCache req can only be sent at `s_cache_req`

fix(AtomicsUnit, difftest): fix difftest io for atomic events

fix(MainPipe): fix precedence of `&` and `=/=` operator

fix(MainPipe): AMOCAS should not wait for AMOALU

fix(MemBlock): remove unnecessary assertion

fix(MainPipe): only CAS instruction can assert `s3_cas_fail`

fix(AtomicsUnit): fix bug in data select logic

submodule(difftest): bump difftest

show more ...

feat(Backend): add support for Zacas extension

misc: remove assert temporarily

feat(Ss/Smdbltrp) : Support RISC-V Ss/Smdbltrp Extension (#3789)

* NEMU commit: 066cb1f1c61feb21153399c26ca393dfb3a560d7
* NEMU configs:
* riscv64-xs-ref_defconfig
* riscv64-dual-xs-ref_defco

feat(Ss/Smdbltrp) : Support RISC-V Ss/Smdbltrp Extension (#3789)

* NEMU commit: 066cb1f1c61feb21153399c26ca393dfb3a560d7
* NEMU configs:
* riscv64-xs-ref_defconfig
* riscv64-dual-xs-ref_defconfig

Including:
* fix(format): adjust code format and add one config (OpenXiangShan/NEMU#603)
* fix(vfredusum): set xstatus.fs and xstatus.vs dirty (OpenXiangShan/NEMU#605)
* fix(vf): do not set dirtyFs for some instructions (OpenXiangShan/NEMU#606)
* feat(trigger): add trigger support for rva.
* configs(xs): open Sm/sdbltrp extension and add MDT_INIT config (OpenXiangShan/NEMU#604)

---

* spike commit: c0b18d3913d8ceac83743a053a7dbd2fb8716c83
* spike config: CPU=XIANGSHAN

Including:
* fix(rva, trigger): For rva instr, raise BP from trigger prior to misaligned.
* fix(Makefile): Increase maxdepth for finding .h files.
* fix(tdata1): CPU_XIANGSHAN do not implement hit bit in tdata1.
* fix(icount): place the read before the return of the detect_icount_match.

show more ...

feat(fof): let fof vector load uop always need oldvd wakeup

feat(rv64v): support first only fault instruction

feat(rv64v): support vleff instruction in backend

* use the last uop to update vl
* the vleff instructions are run inorder

feat(VLSU): element in which the exception occurs needs to retain its old value

fix(cmo): support DiffTest with cbo.inval instruction (#3662)

When the DUT executes a cbo.inval, a set in Difftest is used to record
its cacheline address.
Later, if there is a data mismatch betwe

fix(cmo): support DiffTest with cbo.inval instruction (#3662)

When the DUT executes a cbo.inval, a set in Difftest is used to record
its cacheline address.
Later, if there is a data mismatch between DUT and GoldenMem in the
address space operated by the cbo.inval instruction, the Pmem of REF and
GoldenMem will be directly updated using the data of DUT.

show more ...

feat(ROB): add InstInfoEntry back and record when writing back

Frontend,Backend: add xxtvala support

* utils
* Add checkInputWidth function in NamedUInt to check if the UInt arg passed in has the same width as it defined.
* Frontend
* Pass the unexpanded in

Frontend,Backend: add xxtvala support

* utils
* Add checkInputWidth function in NamedUInt to check if the UInt arg passed in has the same width as it defined.
* Frontend
* Pass the unexpanded instruciton to IBuffer if the C extension 16 bits instruction is illegal.
* No need to use bypass illBuf, since the origin 16 bits instruction will be passed in the ctrlflow bundle.
* IBuffer
* Merge exceptionType and crossPageIPFFix into 3bit field, which type is IBufferExceptionType.
* IBufferExceptionType can hold illegal instruction exception.
* Backend
* CSROpType.ro is removed, since we can use rs1 and rd passed in imm field to distinguish CSRR and CSRW in CSR module.
* Create TrapInstMod to store the trap instruction and handle its update.

show more ...

Backend: support Shvstvala and Sstvala extension

zfhmin:add zfhmin extensions

*decode unit adds decoding of zfhmin extension related instructions
*Re exemplified the functional units for scalar fpcvt

Trigger: refactor trigger information in pipeline. (#3403)

Remove unused ALUOpType branch ops from package.scalar

ALUOpType still defines the unused beq/bne/blt/bge/bltu/bgeu/ operations, that have been mvoed to BRUOpType

RVV: fix conflict of fuOpType between RVH and RVV (#3286)

CSR, RVH: fix the wrong stval and htval when igpf happens

Decode: let CSRR vl executed in Vsetu

NewCSR: fix connection of IMSIC

NewCSR: VS level interrupt should map as VS level in higher privilege