fix(exception): check high address bits of jump target

src/main/scala/xiangshan/Bundle.scala

@@ -20,6 +20,7 @@ import org.chipsalliance.cde.config.Parameters
 import chisel3._
 import chisel3.util.BitPat.bitPatToUInt
 import chisel3.util._
+import chisel3.experimental.BundleLiterals._
 import utility._
 import utils._
 import xiangshan.backend.decode.{ImmUnion, XDecode}
@@ -118,6 +119,10 @@ class CfiUpdateInfo(implicit p: Parameters) extends XSBundle with HasBPUParamete
   val isMisPred = Bool()
   val shift = UInt((log2Ceil(numBr)+1).W)
   val addIntoHist = Bool()
+  // raise exceptions from backend
+  val backendIGPF = Bool() // instruction guest page fault
+  val backendIPF = Bool() // instruction page fault
+  val backendIAF = Bool() // instruction access fault
 
   def fromFtqRedirectSram(entry: Ftq_Redirect_SRAMEntry) = {
     // this.hist := entry.ghist
@@ -130,6 +135,8 @@ class CfiUpdateInfo(implicit p: Parameters) extends XSBundle with HasBPUParamete
     this.topAddr := entry.topAddr
     this
   }
+
+  def hasBackendFault = backendIGPF || backendIPF || backendIAF
 }
 
 // Dequeue DecodeWidth insts from Ibuffer
@@ -138,6 +145,7 @@ class CtrlFlow(implicit p: Parameters) extends XSBundle {
   val pc = UInt(VAddrBits.W)
   val foldpc = UInt(MemPredPCWidth.W)
   val exceptionVec = ExceptionVec()
+  val exceptionFromBackend = Bool()
   val trigger = TriggerAction()
   val pd = new PreDecodeInfo
   val pred_taken = Bool()
@@ -305,6 +313,7 @@ class Redirect(implicit p: Parameters) extends XSBundle {
   val level = RedirectLevel()
   val interrupt = Bool()
   val cfiUpdate = new CfiUpdateInfo
+  val fullTarget = UInt(XLEN.W) // only used for tval storage in backend
 
   val stFtqIdx = new FtqPtr // for load violation predict
   val stFtqOffset = UInt(log2Up(PredictWidth).W)
@@ -631,6 +640,40 @@ class DistributedCSRUpdateReq(implicit p: Parameters) extends XSBundle {
   }
 }
 
+class AddrTransType(implicit p: Parameters) extends XSBundle {
+  val bare, sv39, sv39x4, sv48, sv48x4 = Bool()
+
+  def checkAccessFault(target: UInt): Bool = bare && target(XLEN - 1, PAddrBits).orR
+  def checkPageFault(target: UInt): Bool =
+    sv39 && target(XLEN - 1, 39) =/= VecInit.fill(XLEN - 39)(target(38)).asUInt ||
+    sv48 && target(XLEN - 1, 48) =/= VecInit.fill(XLEN - 48)(target(47)).asUInt
+  def checkGuestPageFault(target: UInt): Bool =
+    sv39x4 && target(XLEN - 1, 41).orR || sv48x4 && target(XLEN - 1, 50).orR
+}
+
+object AddrTransType {
+  def apply(bare: Boolean = false,
+            sv39: Boolean = false,
+            sv39x4: Boolean = false,
+            sv48: Boolean = false,
+            sv48x4: Boolean = false)(implicit p: Parameters): AddrTransType =
+    (new AddrTransType).Lit(_.bare -> bare.B,
+                            _.sv39 -> sv39.B,
+                            _.sv39x4 -> sv39x4.B,
+                            _.sv48 -> sv48.B,
+                            _.sv48x4 -> sv48x4.B)
+
+  def apply(bare: Bool, sv39: Bool, sv39x4: Bool, sv48: Bool, sv48x4: Bool)(implicit p: Parameters): AddrTransType = {
+    val addrTransType = Wire(new AddrTransType)
+    addrTransType.bare := bare
+    addrTransType.sv39 := sv39
+    addrTransType.sv39x4 := sv39x4
+    addrTransType.sv48 := sv48
+    addrTransType.sv48x4 := sv48x4
+    addrTransType
+  }
+}
+
 class L1CacheErrorInfo(implicit p: Parameters) extends XSBundle {
   // L1CacheErrorInfo is also used to encode customized CACHE_ERROR CSR
   val source = Output(new Bundle() {

src/main/scala/xiangshan/backend/Backend.scala

@@ -455,6 +455,7 @@ class BackendImp(override val wrapper: Backend)(implicit p: Parameters) extends
   csrio.vpu.vl := ZeroExt(debugVl_s1, XLEN)
   csrio.vpu.dirty_vs := ctrlBlock.io.robio.csr.dirty_vs
   csrio.exception := ctrlBlock.io.robio.exception
+  csrio.robDeqPtr := ctrlBlock.io.robio.robDeqPtr
   csrio.memExceptionVAddr := io.mem.exceptionAddr.vaddr
   csrio.memExceptionGPAddr := io.mem.exceptionAddr.gpaddr
   csrio.externalInterrupt := RegNext(io.fromTop.externalInterrupt)

src/main/scala/xiangshan/backend/Bundles.scala

@@ -44,6 +44,7 @@ object Bundles {
     val pc              = UInt(VAddrBits.W)
     val foldpc          = UInt(MemPredPCWidth.W)
     val exceptionVec    = ExceptionVec()
+    val isFetchMalAddr  = Bool()
     val trigger         = TriggerAction()
     val preDecodeInfo   = new PreDecodeInfo
     val pred_taken      = Bool()
@@ -56,6 +57,7 @@ object Bundles {
       this.pc               := source.pc
       this.foldpc           := source.foldpc
       this.exceptionVec     := source.exceptionVec
+      this.isFetchMalAddr   := source.exceptionFromBackend
       this.trigger          := source.trigger
       this.preDecodeInfo    := source.pd
       this.pred_taken       := source.pred_taken
@@ -73,6 +75,7 @@ object Bundles {
     val pc              = UInt(VAddrBits.W)
     val foldpc          = UInt(MemPredPCWidth.W)
     val exceptionVec    = ExceptionVec()
+    val isFetchMalAddr  = Bool()
     val trigger         = TriggerAction()
     val preDecodeInfo   = new PreDecodeInfo
     val pred_taken      = Bool()
@@ -166,6 +169,7 @@ object Bundles {
     val pc              = UInt(VAddrBits.W)
     val foldpc          = UInt(MemPredPCWidth.W)
     val exceptionVec    = ExceptionVec()
+    val isFetchMalAddr  = Bool()
     val hasException    = Bool()
     val trigger         = TriggerAction()
     val preDecodeInfo   = new PreDecodeInfo
@@ -850,6 +854,7 @@ object Bundles {
     val instr = UInt(32.W)
     val commitType = CommitType()
     val exceptionVec = ExceptionVec()
+    val isFetchMalAddr = Bool()
     val gpaddr = UInt(GPAddrBits.W)
     val singleStep = Bool()
     val crossPageIPFFix = Bool()

src/main/scala/xiangshan/backend/CtrlBlock.scala

@@ -295,10 +295,16 @@ class CtrlBlockImp(
   private val s5_csrIsTrap = DelayN(rob.io.exception.valid, 4)
   private val s5_trapTargetFromCsr = io.robio.csr.trapTarget
 
-  val flushTarget = Mux(s5_csrIsTrap, s5_trapTargetFromCsr, s2_robFlushPc)
+  val flushTarget = Mux(s5_csrIsTrap, s5_trapTargetFromCsr.pc, s2_robFlushPc)
+  val s5_trapTargetIAF = Mux(s5_csrIsTrap, s5_trapTargetFromCsr.raiseIAF, false.B)
+  val s5_trapTargetIPF = Mux(s5_csrIsTrap, s5_trapTargetFromCsr.raiseIPF, false.B)
+  val s5_trapTargetIGPF = Mux(s5_csrIsTrap, s5_trapTargetFromCsr.raiseIGPF, false.B)
   when (s6_flushFromRobValid) {
     io.frontend.toFtq.redirect.bits.level := RedirectLevel.flush
     io.frontend.toFtq.redirect.bits.cfiUpdate.target := RegEnable(flushTarget, s5_flushFromRobValidAhead)
+    io.frontend.toFtq.redirect.bits.cfiUpdate.backendIAF := RegEnable(s5_trapTargetIAF, s5_flushFromRobValidAhead)
+    io.frontend.toFtq.redirect.bits.cfiUpdate.backendIPF := RegEnable(s5_trapTargetIPF, s5_flushFromRobValidAhead)
+    io.frontend.toFtq.redirect.bits.cfiUpdate.backendIGPF := RegEnable(s5_trapTargetIGPF, s5_flushFromRobValidAhead)
   }
 
   for (i <- 0 until DecodeWidth) {

src/main/scala/xiangshan/backend/MemBlock.scala

@@ -1287,7 +1287,11 @@ class MemBlockImp(outer: MemBlock) extends LazyModuleImp(outer)
   }
   val allRedirect = loadUnits.map(_.io.rollback) ++ hybridUnits.map(_.io.ldu_io.rollback) ++ Seq(lsq.io.nack_rollback) ++ lsq.io.nuke_rollback
   val oldestOneHot = selectOldestRedirect(allRedirect)
-  val oldestRedirect = Mux1H(oldestOneHot, allRedirect)
+  val oldestRedirect = WireDefault(Mux1H(oldestOneHot, allRedirect))
+  // memory replay would not cause IAF/IPF/IGPF
+  oldestRedirect.bits.cfiUpdate.backendIAF := false.B
+  oldestRedirect.bits.cfiUpdate.backendIPF := false.B
+  oldestRedirect.bits.cfiUpdate.backendIGPF := false.B
   io.mem_to_ooo.memoryViolation := oldestRedirect
   io.mem_to_ooo.lsqio.lqCanAccept  := lsq.io.lqCanAccept
   io.mem_to_ooo.lsqio.sqCanAccept  := lsq.io.sqCanAccept

src/main/scala/xiangshan/backend/exu/ExeUnit.scala

@@ -24,7 +24,7 @@ import freechips.rocketchip.diplomacy.{LazyModule, LazyModuleImp}
 import utility._
 import xiangshan.backend.fu.{CSRFileIO, FenceIO, FuncUnitInput}
 import xiangshan.backend.Bundles.{ExuInput, ExuOutput, MemExuInput, MemExuOutput}
-import xiangshan.{FPUCtrlSignals, HasXSParameter, Redirect, XSBundle, XSModule}
+import xiangshan.{AddrTransType, FPUCtrlSignals, HasXSParameter, Redirect, XSBundle, XSModule}
 import xiangshan.backend.datapath.WbConfig.{PregWB, _}
 import xiangshan.backend.fu.FuType
 import xiangshan.backend.fu.vector.Bundles.{VType, Vxrm}
@@ -44,6 +44,7 @@ class ExeUnitIO(params: ExeUnitParams)(implicit p: Parameters) extends XSBundle
   val vtype = Option.when(params.writeVConfig)((Valid(new VType)))
   val vlIsZero = Option.when(params.writeVConfig)(Output(Bool()))
   val vlIsVlmax = Option.when(params.writeVConfig)(Output(Bool()))
+  val instrAddrTransType = Option.when(params.hasJmpFu || params.hasBrhFu)(Input(new AddrTransType))
 }
 
 class ExeUnit(val exuParams: ExeUnitParams)(implicit p: Parameters) extends LazyModule {
@@ -329,6 +330,7 @@ class ExeUnitImp(
     fuio =>
       exuio <> fuio
       fuio.exception := DelayN(exuio.exception, 2)
+      fuio.robDeqPtr := DelayN(exuio.robDeqPtr, 2)
   }))
   io.csrin.foreach(exuio => funcUnits.foreach(fu => fu.io.csrin.foreach{fuio => fuio := exuio}))
   io.csrToDecode.foreach(toDecode => funcUnits.foreach(fu => fu.io.csrToDecode.foreach(fuOut => toDecode := fuOut)))
@@ -339,6 +341,7 @@ class ExeUnitImp(
   io.vxrm.foreach(exuio => funcUnits.foreach(fu => fu.io.vxrm.foreach(fuio => fuio <> exuio)))
   io.vlIsZero.foreach(exuio => funcUnits.foreach(fu => fu.io.vlIsZero.foreach(fuio => exuio := fuio)))
   io.vlIsVlmax.foreach(exuio => funcUnits.foreach(fu => fu.io.vlIsVlmax.foreach(fuio => exuio := fuio)))
+  io.instrAddrTransType.foreach(exuio => funcUnits.foreach(fu => fu.io.instrAddrTransType.foreach(fuio => fuio := exuio)))
 
   // debug info
   io.out.bits.debug     := 0.U.asTypeOf(io.out.bits.debug)

src/main/scala/xiangshan/backend/exu/ExuBlock.scala

@@ -53,6 +53,9 @@ class ExuBlockImp(
 //    }
     XSPerfAccumulate(s"${(exu.wrapper.exuParams.name)}_fire_cnt", PopCount(exu.io.in.fire))
   }
+  exus.find(_.io.csrio.nonEmpty).map(_.io.csrio.get).foreach { csrio =>
+    exus.map(_.io.instrAddrTransType.foreach(_ := csrio.instrAddrTransType))
+  }
   val aluFireSeq = exus.filter(_.wrapper.exuParams.fuConfigs.contains(AluCfg)).map(_.io.in.fire)
   for (i <- 0 until (aluFireSeq.size + 1)){
     XSPerfAccumulate(s"alu_fire_${i}_cnt", PopCount(aluFireSeq) === i.U)

src/main/scala/xiangshan/backend/fu/CSR.scala

@@ -29,7 +29,9 @@ import xiangshan._
 import xiangshan.backend.fu.util._
 import xiangshan.cache._
 import xiangshan.backend.Bundles.{ExceptionInfo, TrapInstInfo}
+import xiangshan.backend.fu.NewCSR.CSREvents.TargetPCBundle
 import xiangshan.backend.fu.NewCSR.CSRNamedConstant.ContextStatus
+import xiangshan.backend.rob.RobPtr
 import utils.MathUtils.{BigIntGenMask, BigIntNot}
 
 class FpuCsrIO extends Bundle {
@@ -90,9 +92,10 @@ class CSRFileIO(implicit p: Parameters) extends XSBundle {
   val vpu = Flipped(new VpuCsrIO)
   // from rob
   val exception = Flipped(ValidIO(new ExceptionInfo))
+  val robDeqPtr = Input(new RobPtr)
   // to ROB
   val isXRet = Output(Bool())
-  val trapTarget = Output(UInt(VAddrBits.W))
+  val trapTarget = Output(new TargetPCBundle)
   val interrupt = Output(Bool())
   val wfi_event = Output(Bool())
   // from LSQ
@@ -107,6 +110,8 @@ class CSRFileIO(implicit p: Parameters) extends XSBundle {
   val debugMode = Output(Bool())
   // Custom microarchiture ctrl signal
   val customCtrl = Output(new CustomCSRCtrlIO)
+  // instruction fetch address translation type
+  val instrAddrTransType = Output(new AddrTransType)
 }
 
 class VtypeStruct(implicit p: Parameters) extends XSBundle {

src/main/scala/xiangshan/backend/fu/FuConfig.scala

@@ -170,6 +170,10 @@ case class FuConfig (
 
   def isCsr: Boolean = fuType == FuType.csr
 
+  def isBrh: Boolean = fuType == FuType.brh
+
+  def isJmp: Boolean = fuType == FuType.jmp
+
   def isFence: Boolean = fuType == FuType.fence
 
   def isVecArith: Boolean = fuType == FuType.vialuF || fuType == FuType.vimac ||

src/main/scala/xiangshan/backend/fu/FuncUnit.scala

@@ -94,6 +94,7 @@ class FuncUnitIO(cfg: FuConfig)(implicit p: Parameters) extends XSBundle {
   val vtype = OptionWrapper(cfg.writeVlRf, (Valid(new VType)))
   val vlIsZero = OptionWrapper(cfg.writeVlRf, Output(Bool()))
   val vlIsVlmax = OptionWrapper(cfg.writeVlRf, Output(Bool()))
+  val instrAddrTransType = Option.when(cfg.isJmp || cfg.isBrh)(Input(new AddrTransType))
 }
 
 abstract class FuncUnit(val cfg: FuConfig)(implicit p: Parameters) extends XSModule {

src/main/scala/xiangshan/backend/fu/NewCSR/CSREvents/CSREvent.scala

@@ -110,8 +110,10 @@ class TrapEntryEventInput(implicit val p: Parameters) extends Bundle with HasXSP
   val trapPc = Input(UInt(VaddrMaxWidth.W))
   val trapPcGPA = Input(UInt(GPAddrBits.W))
   val trapInst = Input(ValidIO(UInt(InstWidth.W)))
+  val fetchMalTval = Input(UInt(XLEN.W))
   val isCrossPageIPF = Input(Bool())
   val isHls = Input(Bool())
+  val isFetchMalAddr = Input(Bool())
 
   // always current privilege
   val iMode = Input(new PrivState())
@@ -126,7 +128,7 @@ class TrapEntryEventInput(implicit val p: Parameters) extends Bundle with HasXSP
 
   val tcontrol = Input(new TcontrolBundle)
 
-  val pcFromXtvec = Input(UInt(VaddrMaxWidth.W))
+  val pcFromXtvec = Input(UInt(XLEN.W))
 
   val satp = Input(new SatpBundle)
   val vsatp = Input(new SatpBundle)
@@ -137,3 +139,12 @@ class TrapEntryEventInput(implicit val p: Parameters) extends Bundle with HasXSP
   val virtualInterruptIsHvictlInject = Input(Bool())
   val hvictlIID = Input(UInt(HIIDWidth.W))
 }
+
+class TargetPCBundle extends Bundle {
+  val pc = UInt(XLEN.W)
+  val raiseIPF = Bool()
+  val raiseIAF = Bool()
+  val raiseIGPF = Bool()
+
+  def raiseFault = raiseIPF || raiseIAF || raiseIGPF
+}

src/main/scala/xiangshan/backend/fu/NewCSR/CSREvents/DretEvent.scala

@@ -2,17 +2,19 @@ package xiangshan.backend.fu.NewCSR.CSREvents
 
 import chisel3._
 import chisel3.util._
+import org.chipsalliance.cde.config.Parameters
 import xiangshan.backend.fu.NewCSR.CSRConfig.VaddrMaxWidth
-import xiangshan.backend.fu.NewCSR.CSRDefines.PrivMode
+import xiangshan.backend.fu.NewCSR.CSRDefines.{HgatpMode, PrivMode, SatpMode}
 import xiangshan.backend.fu.NewCSR._
+import xiangshan.AddrTransType
 
 
 class DretEventOutput extends Bundle with EventUpdatePrivStateOutput with EventOutputBase {
   val dcsr = ValidIO((new DcsrBundle).addInEvent(_.V, _.PRV))
   val mstatus = ValidIO((new MstatusBundle).addInEvent(_.MPRV))
   val debugMode = ValidIO(Bool())
   val debugIntrEnable = ValidIO(Bool())
-  val targetPc = ValidIO(UInt(VaddrMaxWidth.W))
+  val targetPc = ValidIO(new TargetPCBundle)
 
   override def getBundleByName(name: String): ValidIO[CSRBundle] = {
     name match {
@@ -26,12 +28,32 @@ class DretEventInput extends Bundle {
   val dcsr = Input(new DcsrBundle)
   val dpc = Input(new Epc)
   val mstatus = Input(new MstatusBundle)
+  val satp = Input(new SatpBundle)
+  val vsatp = Input(new SatpBundle)
+  val hgatp = Input(new HgatpBundle)
 }
 
-class DretEventModule extends Module with CSREventBase {
+class DretEventModule(implicit p: Parameters) extends Module with CSREventBase {
   val in = IO(new DretEventInput)
   val out = IO(new DretEventOutput)
 
+  private val satp = in.satp
+  private val vsatp = in.vsatp
+  private val hgatp = in.hgatp
+  private val nextPrivState = out.privState.bits
+
+  private val instrAddrTransType = AddrTransType(
+    bare = nextPrivState.isModeM ||
+           (!nextPrivState.isVirtual && satp.MODE === SatpMode.Bare) ||
+           (nextPrivState.isVirtual && vsatp.MODE === SatpMode.Bare && hgatp.MODE === HgatpMode.Bare),
+    sv39 = !nextPrivState.isModeM && !nextPrivState.isVirtual && satp.MODE === SatpMode.Sv39 ||
+           nextPrivState.isVirtual && vsatp.MODE === SatpMode.Sv39,
+    sv48 = !nextPrivState.isModeM && !nextPrivState.isVirtual && satp.MODE === SatpMode.Sv48 ||
+           nextPrivState.isVirtual && vsatp.MODE === SatpMode.Sv48,
+    sv39x4 = nextPrivState.isVirtual && vsatp.MODE === SatpMode.Bare && hgatp.MODE === HgatpMode.Sv39x4,
+    sv48x4 = nextPrivState.isVirtual && vsatp.MODE === SatpMode.Bare && hgatp.MODE === HgatpMode.Sv48x4
+  )
+
   out := DontCare
 
   out.debugMode.valid       := valid
@@ -41,12 +63,15 @@ class DretEventModule extends Module with CSREventBase {
   out.debugIntrEnable.valid := valid
   out.targetPc.valid        := valid
 
-  out.privState.bits.PRVM  := in.dcsr.PRV.asUInt
-  out.privState.bits.V     := in.dcsr.V
-  out.mstatus.bits.MPRV    := Mux(!out.privState.bits.isModeM, 0.U, in.mstatus.MPRV.asUInt)
-  out.debugMode.bits       := false.B
-  out.debugIntrEnable.bits := true.B
-  out.targetPc.bits        := in.dpc.asUInt
+  out.privState.bits.PRVM     := in.dcsr.PRV.asUInt
+  out.privState.bits.V        := in.dcsr.V
+  out.mstatus.bits.MPRV       := Mux(!out.privState.bits.isModeM, 0.U, in.mstatus.MPRV.asUInt)
+  out.debugMode.bits          := false.B
+  out.debugIntrEnable.bits    := true.B
+  out.targetPc.bits.pc        := in.dpc.asUInt
+  out.targetPc.bits.raiseIPF  := instrAddrTransType.checkPageFault(in.dpc.asUInt)
+  out.targetPc.bits.raiseIAF  := instrAddrTransType.checkAccessFault(in.dpc.asUInt)
+  out.targetPc.bits.raiseIGPF := instrAddrTransType.checkGuestPageFault(in.dpc.asUInt)
 }
 
 trait DretEventSinkBundle { self: CSRModule[_] =>