riscv-boom.patch

diff --git a/src/main/scala/exu/core.scala b/src/main/scala/exu/core.scala
index bd532526..7c78fe41 100644
--- a/src/main/scala/exu/core.scala
+++ b/src/main/scala/exu/core.scala
@@ -1471,4 +1471,7 @@ class BoomCore(implicit p: Parameters) extends BoomModule
     io.trace map (t => t.valid := false.B)
     io.ifu.debug_ftq_idx := DontCare
   }
+
+  // SpecDoctor RoB meip connection
+  rob.io.meip := io.interrupts.meip
 }
diff --git a/src/main/scala/exu/rob.scala b/src/main/scala/exu/rob.scala
index 3ad32065..63145363 100644
--- a/src/main/scala/exu/rob.scala
+++ b/src/main/scala/exu/rob.scala
@@ -110,6 +110,9 @@ class RobIo(
 
 
   val debug_tsc = Input(UInt(xLen.W))
+
+  // SpecDoctor for detecting meip
+  val meip = Input(Bool())
 }
 
 /**
@@ -220,6 +223,10 @@ class Rob(
   val s_reset :: s_normal :: s_rollback :: s_wait_till_empty :: Nil = Enum(4)
   val rob_state = RegInit(s_reset)
 
+  // Tracking enq clock (for computing window_size later)
+  val enq_clk = RegInit(0.U(32.W))
+  enq_clk := enq_clk + 1.U
+
   //commit entries at the head, and unwind exceptions from the tail
   val rob_head     = RegInit(0.U(log2Ceil(numRobRows).W))
   val rob_head_lsb = RegInit(0.U((1 max log2Ceil(coreWidth)).W)) // TODO: Accurately track head LSB (currently always 0)
@@ -300,6 +307,52 @@ class Rob(
   rob_debug_inst_mem.write(rob_tail, rob_debug_inst_wdata, rob_debug_inst_wmask)
   val rob_debug_inst_rdata = rob_debug_inst_mem.read(rob_head, will_commit.reduce(_||_))
 
+  // For tracking SpecDoctor information
+  val t_none :: t_br :: t_xcpt :: t_flush :: Nil = Enum(4)
+  val mispredict_val    = Wire(Vec(coreWidth, Bool()))
+  val mispredict_pc     = Wire(Vec(coreWidth, UInt(coreMaxAddrBits.W)))
+  val mispredict_inst   = Wire(Vec(coreWidth, UInt(32.W)))
+  val mispredict_clk    = Wire(Vec(coreWidth, UInt(32.W)))
+
+  val mispredicted_val    = Wire(Vec(coreWidth, Bool()))
+  val mispredicted_target = Wire(Vec(coreWidth, UInt(coreMaxAddrBits.W)))
+  val mispredicted_clk    = Wire(Vec(coreWidth, UInt(32.W)))
+
+  val rob_head_clks       = Wire(Vec(coreWidth, UInt(32.W)))
+  val rob_tsx_vals        = Wire(Vec(coreWidth, Bool()))
+  val rob_tsx_clks        = Wire(Vec(coreWidth, UInt(32.W)))
+
+  // For SpecDoctor pseudo instructions
+  val pseudoFence         = 0x00001013.asUInt // slli x0, x0, 0
+
+  val asFence           = RegInit(false.B)
+  val toLoop            = RegInit(false.B)
+  val asLoopCnt         = RegInit(0.U(3.W))
+  val recvMeip          = RegInit(false.B)
+
+  def CheckPseudo(valid: Bool, inst: UInt) = {
+    // TODO: pseudo instructions must not be randomly generated
+    when(valid && inst === pseudoFence) {
+      asFence := true.asBool
+
+      toLoop := asFence
+      asLoopCnt := 0.U
+    } .elsewhen(valid && toLoop && asLoopCnt =/= 4.U) {
+      asLoopCnt := asLoopCnt + 1.U
+    }
+  }
+  def ReadAsFence(inst: UInt): Bool = {
+    asFence.asBool && (inst === pseudoFence)
+  }
+  def FallInLoop: Bool = {
+    asLoopCnt === 4.U && ~recvMeip.asBool
+  }
+
+  when (io.meip) {
+    recvMeip := true.asBool
+  }
+
+
   for (w <- 0 until coreWidth) {
     def MatchBank(bank_idx: UInt): Bool = (bank_idx === w.U)
 
@@ -312,6 +365,9 @@ class Rob(
     val rob_predicated = Reg(Vec(numRobRows, Bool())) // Was this instruction predicated out?
     val rob_fflags    = Mem(numRobRows, Bits(freechips.rocketchip.tile.FPConstants.FLAGS_SZ.W))
 
+    // tracking enq_clk
+    val rob_clk       = Reg(Vec(numRobRows, UInt(32.W)))
+
     val rob_debug_wdata = Mem(numRobRows, UInt(xLen.W))
 
     //-----------------------------------------------
@@ -329,6 +385,7 @@ class Rob(
       rob_exception(rob_tail) := io.enq_uops(w).exception
       rob_predicated(rob_tail)   := false.B
       rob_fflags(rob_tail)    := 0.U
+      rob_clk(rob_tail)       := enq_clk
 
       assert (rob_val(rob_tail) === false.B, "[rob] overwriting a valid entry.")
       assert ((io.enq_uops(w).rob_idx >> log2Ceil(coreWidth)) === rob_tail)
@@ -336,6 +393,10 @@ class Rob(
       rob_uop(rob_tail).debug_inst := BUBBLE // just for debug purposes
     }
 
+    //-----------------------------------------------
+    // SpecDoctor pseudoFence detection
+    CheckPseudo(io.enq_valids(w), io.enq_uops(w).inst)
+
     //-----------------------------------------------
     // Writeback
 
@@ -447,6 +508,7 @@ class Rob(
 
     // -----------------------------------------------
     // Kill speculated entries on branch mispredict
+
     for (i <- 0 until numRobRows) {
       val br_mask = rob_uop(i).br_mask
 
@@ -484,6 +546,8 @@ class Rob(
     rob_head_uses_stq(w) := rob_uop(rob_head).uses_stq
     rob_head_uses_ldq(w) := rob_uop(rob_head).uses_ldq
 
+    rob_head_clks(w)     := rob_clk(rob_head)
+
     //------------------------------------------------
     // Invalid entries are safe; thrown exceptions are unsafe.
     for (i <- 0 until numRobRows) {
@@ -523,6 +587,45 @@ class Rob(
     }
     io.commit.debug_wdata(w) := rob_debug_wdata(rob_head)
 
+    // SpecDoctor: for monitoring ROB
+    mispredict_val(w)  := false.B
+    mispredict_pc(w)   := DontCare
+    mispredict_inst(w) := DontCare
+    mispredict_clk(w)  := DontCare
+
+    when (io.brupdate.b2.mispredict &&
+      MatchBank(GetBankIdx(io.brupdate.b2.uop.rob_idx))) {
+      val rob_idx = GetRowIdx(io.brupdate.b2.uop.rob_idx)
+
+      mispredict_val(w)  := true.B
+      mispredict_pc(w)   := rob_uop(rob_idx).debug_pc
+      mispredict_inst(w) := rob_uop(rob_idx).debug_inst
+      mispredict_clk(w)  := rob_clk(rob_idx)
+    }
+
+    // All mispredicted entries are killed 1 cycle before
+    val isKilled = Range(0, numRobRows).map(i =>
+      rob_val(i) && IsKilledByBranch(io.brupdate, rob_uop(i).br_mask))
+    val mispredicted_idx = PriorityMux(isKilled, Range(0, numRobRows).map(_.U))
+
+    when (RegNext(isKilled.reduce(_ || _))) {
+      mispredicted_val(w)    := RegNext(rob_val(mispredicted_idx))
+      mispredicted_target(w) := RegNext(rob_uop(mispredicted_idx).debug_pc)
+      mispredicted_clk(w)    := RegNext(rob_clk(mispredicted_idx))
+    } .otherwise {
+      mispredicted_val(w)    := false.B
+      mispredicted_target(w) := 0.U
+      mispredicted_clk(w)    := 0.U
+    }
+
+    when (io.brupdate.b2.mispredict) {
+      rob_tsx_vals(w)    := mispredicted_val(w)
+      rob_tsx_clks(w)    := mispredicted_clk(w)
+    } .otherwise {
+      rob_tsx_vals(w)    := rob_val(WrapInc(rob_head, numRobRows))
+      rob_tsx_clks(w)    := rob_clk(WrapInc(rob_head, numRobRows))
+    }
+
   } //for (w <- 0 until coreWidth)
 
   // **************************************************************************
@@ -568,7 +671,9 @@ class Rob(
   io.com_xcpt.bits.is_rvc    := com_xcpt_uop.is_rvc
   io.com_xcpt.bits.pc_lob    := com_xcpt_uop.pc_lob
 
-  val flush_commit_mask = Range(0,coreWidth).map{i => io.commit.valids(i) && io.commit.uops(i).flush_on_commit}
+  val flush_commit_mask = Range(0,coreWidth).map{i =>
+    io.commit.valids(i) && (io.commit.uops(i).flush_on_commit || ReadAsFence(io.commit.uops(i).inst))
+  }
   val flush_commit = flush_commit_mask.reduce(_|_)
   val flush_val = exception_thrown || flush_commit
 
@@ -665,6 +770,51 @@ class Rob(
     "ROB is throwing an exception, but the stored exception information's " +
     "rob_idx does not match the rob_head")
 
+  // -----------------------------------------------
+  // SpecDoctor ROB Monitoring Logic
+  // Report {type, trigger_pc, trigger_inst, window_sz} on ROB clear
+
+  val flush_clk = Mux(exception_thrown,
+    PriorityMux(rob_head_vals, rob_head_clks),
+    Mux1H(flush_commit_mask, rob_head_clks)
+  )
+
+  val tsx_clk = Mux(rob_tsx_vals.reduce(_ || _),
+    PriorityMux(rob_tsx_vals, rob_tsx_clks),
+    enq_clk)
+
+  val trg_tpe = WireInit(t_none)
+  val trg_pc = WireInit(0.U(coreMaxAddrBits.W))
+  val trg_inst = WireInit(0.U(32.W))
+  val window_sz = WireInit(0.U(32.W))
+  val ewindow_sz = enq_clk - tsx_clk
+  val flush_pc = WireInit(0.U(coreMaxAddrBits.W))
+  when (flush_val) {
+    // Flush event (exception or flush instruction)
+    trg_tpe   := Mux(exception_thrown, t_xcpt, t_flush)
+    trg_pc    := flush_uop.debug_pc
+    trg_inst  := flush_uop.debug_inst
+    window_sz := enq_clk - flush_clk
+
+    // TODO: flush uop may not exists
+    flush_pc  := flush_uop.debug_pc + Mux(flush_uop.is_rvc, 2.U, 4.U)
+  } .elsewhen(io.brupdate.b2.mispredict) {
+    // Branch misprediction
+    trg_tpe   := t_br
+    trg_pc    := Mux1H(mispredict_val.asUInt, mispredict_pc)
+    trg_inst  := Mux1H(mispredict_val.asUInt, mispredict_inst)
+    window_sz := enq_clk - Mux1H(mispredict_val.asUInt, mispredict_clk)
+
+    // TODO: mispredicted_target may be inaccurate if trigger_uop and target in the same Rob row
+    flush_pc  := Mux(mispredicted_val.reduce(_ || _),
+      PriorityMux(mispredicted_val, mispredicted_target), 0.U)
+  }
+
+  when (io.brupdate.b2.mispredict || flush_val) {
+    printf("%d (0x%x) -> (0x%x) DASM(0x%x) [%d][%d]\n",
+      trg_tpe, trg_pc, flush_pc, trg_inst, window_sz, ewindow_sz)
+  }
+
   // -----------------------------------------------
   // ROB Head Logic
 
@@ -791,7 +941,7 @@ class Rob(
   io.rob_tail_idx := rob_tail_idx
   io.rob_pnr_idx  := rob_pnr_idx
   io.empty        := empty
-  io.ready        := (rob_state === s_normal) && !full && !r_xcpt_val
+  io.ready        := (rob_state === s_normal) && !full && !r_xcpt_val && !FallInLoop
 
   //-----------------------------------------------
   //-----------------------------------------------
@@ -809,7 +959,8 @@ class Rob(
           rob_state := s_rollback
         } .otherwise {
           for (w <- 0 until coreWidth) {
-            when (io.enq_valids(w) && io.enq_uops(w).is_unique) {
+            when (io.enq_valids(w) && (io.enq_uops(w).is_unique ||
+              ReadAsFence(io.enq_uops(w).inst))) {
               rob_state := s_wait_till_empty
             }
           }
@@ -838,7 +989,8 @@ class Rob(
           ; //rob_state := s_rollback
         } .otherwise {
           for (w <- 0 until coreWidth) {
-            when (io.enq_valids(w) && io.enq_uops(w).is_unique) {
+            when (io.enq_valids(w) && (io.enq_uops(w).is_unique ||
+              ReadAsFence(io.enq_uops(w).inst))) {
               rob_state := s_wait_till_empty
             }
           }