Add support for pipelining and compressed instructions in RVFI_DII

.gitmodules

@@ -52,3 +52,6 @@
 [submodule "vendor/zero-day/axi_tagcontroller"]
 	path = vendor/zero-day/axi_tagcontroller
 	url = https://github.com/ninolomata/axi_cheri_tagcontroller.git
+[submodule "corev_apu/tb/tb_testRig_cheri/src/RVFI-DII-utils"]
+	path = corev_apu/tb/tb_testRig_cheri/src/RVFI-DII-utils
+	url = https://github.com/CTSRD-CHERI/RVFI-DII-utils.git

core/branch_unit.sv

@@ -1,5 +1,6 @@
 // Copyright 2018 ETH Zurich and University of Bologna.
 // Copyright 2025 Bruno Sá and Zero-Day Labs.
+// Copyright 2025 Capabilities Limited.
 // Copyright and related rights are licensed under the Solderpad Hardware
 // License, Version 0.51 (the "License"); you may not use this file except in
 // compliance with the License.  You may obtain a copy of the License at
@@ -32,6 +33,8 @@ module branch_unit #(
     input fu_data_t fu_data_i,
     // Instruction PC - ISSUE_STAGE
     input logic [CVA6Cfg.PCLEN-1:0] pc_i,
+    // Instruction stream DII ID - ISSUE_STAGE
+    input logic [CVA6Cfg.DIIIDLEN-1:0] dii_id_i,
     // Instruction is compressed - ISSUE_STAGE
     input logic is_compressed_instr_i,
     // any functional unit is valid, check that there is no accidental mis-predict - TO_BE_COMPLETED
@@ -144,6 +147,7 @@ module branch_unit #(
       branch_result_o = next_pc;
     end
     resolved_branch_o.pc = pc_i[CVA6Cfg.VLEN-1:0];
+    if (CVA6Cfg.RVFI_DII) resolved_branch_o.dii_id = dii_id_i;
     // There are only two sources of mispredicts:
     // 1. Branches
     // 2. Jumps to register addresses
@@ -198,11 +202,10 @@ module branch_unit #(
     target_pcc_top        = target_pcc.top;
     target_pcc_address    = target_pcc.addr;
     target_pcc_is_sealed  = (operand_a.otype != cva6_cheri_pkg::UNSEALED_CAP);
-    // TODO-cheri(ninolomata): fix this once we disable compressed instructions without trigering errors
-    min_instr_off = ((CVA6Cfg.RVC && !CVA6Cfg.RVFI_DII) ? {{CVA6Cfg.XLEN-2{1'b0}}, 2'h2} : {{CVA6Cfg.XLEN-3{1'b0}}, 3'h4});
+    min_instr_off = ((CVA6Cfg.RVC) ? {{CVA6Cfg.XLEN-2{1'b0}}, 2'h2} : {{CVA6Cfg.XLEN-3{1'b0}}, 3'h4});
     // Only throw instruction address misaligned exception if this is indeed a `taken` conditional branch or
     // an unconditional jump
-    if (branch_valid_i && (target_address[0] || ((!CVA6Cfg.RVC || CVA6Cfg.RVFI_DII) && target_address[1])) && jump_taken) begin
+    if (branch_valid_i && (target_address[0] || (!CVA6Cfg.RVC && target_address[1])) && jump_taken) begin
       branch_exception_o.valid = 1'b1;
     end
     if (CVA6Cfg.CheriPresent && branch_valid_i && jump_taken) begin

core/cache_subsystem/wt_cache_subsystem.sv

@@ -1,4 +1,5 @@
 // Copyright 2018 ETH Zurich and University of Bologna.
+// Copyright 2025 Capabilities Limited.
 // Copyright and related rights are licensed under the Solderpad Hardware
 // License, Version 0.51 (the "License"); you may not use this file except in
 // compliance with the License.  You may obtain a copy of the License at
@@ -33,7 +34,6 @@ module wt_cache_subsystem
     parameter type                   dcache_req_o_t = logic,
     parameter type                   icache_req_t   = logic,
     parameter type                   icache_rtrn_t  = logic,
-    parameter type                   rvfi_dii_inst_pack_t = logic,
     parameter int unsigned           NumPorts       = 4,
     parameter type                   noc_req_t      = logic,
     parameter type                   noc_resp_t     = logic
@@ -73,11 +73,7 @@ module wt_cache_subsystem
     // Invalidations
     input logic [63:0] inval_addr_i,
     input logic inval_valid_i,
-    output logic inval_ready_o,
-    // RVFI_DII Interface
-    input  logic         rvfi_dii_rtrn_vld_i,
-    input  rvfi_dii_inst_pack_t rvfi_dii_inst_pack_i,
-    output logic         rvfi_dii_data_ready_o
+    output logic inval_ready_o
     // TODO: interrupt interface
 );
 
@@ -122,16 +118,12 @@ module wt_cache_subsystem
       .CVA6Cfg(CVA6Cfg),
       .icache_dreq_t(icache_dreq_t),
       .icache_drsp_t(icache_drsp_t),
-      .exception_t (exception_t),
-      .rvfi_dii_inst_pack_t (rvfi_dii_inst_pack_t)
+      .exception_t (exception_t)
     ) i_cva6_rvfi_dii_generator (
       .clk_i         (clk_i),
       .rst_ni        (rst_ni),
       .dreq_i        (icache_dreq_i),
-      .dreq_o        (icache_dreq_o),
-      .rvfi_dii_rtrn_vld_i (rvfi_dii_rtrn_vld_i),
-      .rvfi_dii_inst_pack_i (rvfi_dii_inst_pack_i),
-      .rvfi_dii_data_ready_o (rvfi_dii_data_ready_o)
+      .dreq_o        (icache_dreq_o)
     );
     assign icache_areq_o = '0;
     assign icache_adapter_data_req = '0;

core/commit_stage.sv

@@ -1,5 +1,6 @@
 // Copyright 2018 ETH Zurich and University of Bologna.
 // Copyright 2025 Bruno Sá and Zero-Day Labs.
+// Copyright 2025 Capabilities Limited.
 // Copyright and related rights are licensed under the Solderpad Hardware
 // License, Version 0.51 (the "License"); you may not use this file except in
 // compliance with the License.  You may obtain a copy of the License at
@@ -33,6 +34,8 @@ module commit_stage
     output exception_t exception_o,
     // Mark the F state as dirty - CSR_REGFILE
     output logic dirty_fp_state_o,
+    // Last committed DII ID - FRONTEND
+    output logic [CVA6Cfg.DIIIDLEN-1 : 0] dii_id_o,
     // TO_BE_COMPLETED - CSR_REGFILE
     input logic single_step_i,
     // The instruction we want to commit - ISSUE_STAGE
@@ -123,6 +126,7 @@ module commit_stage
   end
 
   assign pc_o = commit_instr_i[0].pc;
+  if (CVA6Cfg.RVFI_DII) assign dii_id_o = commit_instr_i[0].dii_id;
   // Dirty the FP state if we are committing anything related to the FPU
   always_comb begin : dirty_fp_state
     dirty_fp_state_o = 1'b0;

core/csr_regfile.sv

@@ -1,5 +1,6 @@
 // Copyright 2018 ETH Zurich and University of Bologna.
 // Copyright 2025 Bruno Sá and Zero-Day Labs.
+// Copyright 2025 Capabilities Limited.
 // Copyright and related rights are licensed under the Solderpad Hardware
 // License, Version 0.51 (the "License"); you may not use this file except in
 // compliance with the License.  You may obtain a copy of the License at
@@ -397,9 +398,6 @@ if (CVA6Cfg.CheriPresent) begin
                 riscv::CSR_MEPC: begin
                   wr_cap = mepcc_q;
                   wr_cap_addr  = {csr_wdata[riscv::XLEN-1:1], 1'b0};
-                  // TODO-ninolomata(cheri): fix this
-                  if (CVA6Cfg.RVFI_DII)
-                    wr_cap_addr  = {csr_wdata[riscv::XLEN-1:2], 2'b0};
                 end
                 riscv::CSR_MTVEC: begin
                   wr_cap = mtcc_q;
@@ -417,9 +415,6 @@ if (CVA6Cfg.CheriPresent) begin
                 riscv::CSR_SEPC: begin
                   wr_cap = sepcc_q;
                   wr_cap_addr  = {csr_wdata[riscv::XLEN-1:1], 1'b0};
-                  // TODO-ninolomata(cheri): fix this
-                  if (CVA6Cfg.RVFI_DII)
-                    wr_cap_addr  = {csr_wdata[riscv::XLEN-1:2], 2'b0};
                 end
                 riscv::CSR_STVEC: begin
                   wr_cap = stcc_q;
@@ -1218,7 +1213,6 @@ end
                         sscratchc_d = scr_wdata;
                     end
                     cva6_cheri_pkg::SCR_SEPCC: begin
-                      // TODO-cheri(ninolomata):fix this it should clear bit 1 only
                         sepcc_d = cva6_cheri_pkg::set_cap_reg_addr(scr_wdata, {scr_wdata[CVA6Cfg.XLEN-1:1], 1'b0});
                     end
                     cva6_cheri_pkg::SCR_MTCC: begin
@@ -1237,8 +1231,6 @@ end
                         mscratchc_d = scr_wdata;
                     end
                     cva6_cheri_pkg::SCR_MEPCC: begin
-                      // TODO-cheri(ninolomata):fix this it should clear bit 1 only
-                      //mepcc_d = cva6_cheri_pkg::set_cap_reg_addr(scr_wdata, {scr_wdata[CVA6Cfg.XLEN-1:2], 2'b00});
                       mepcc_d = cva6_cheri_pkg::set_cap_reg_addr(scr_wdata, {scr_wdata[CVA6Cfg.XLEN-1:1], 1'b0});
                     end
                     default: begin

core/cva6.sv

@@ -1,5 +1,6 @@
 // Copyright 2017-2019 ETH Zurich and University of Bologna.
 // Copyright 2025 Bruno Sá and Zero-Day Labs.
+// Copyright 2025 Capabilities Limited.
 // Copyright and related rights are licensed under the Solderpad Hardware
 // License, Version 0.51 (the "License"); you may not use this file except in
 // compliance with the License.  You may obtain a copy of the License at
@@ -30,7 +31,6 @@ module cva6
       logic csr;
       rvfi_probes_instr_t instr;
     },
-    parameter type rvfi_dii_inst_pack_t = `RVFI_DII_INSTR_T(CVA6Cfg),
 
     // branchpredict scoreboard entry
     // this is the struct which we will inject into the pipeline to guide the various
@@ -66,6 +66,7 @@ module cva6
     // I$ data requests
     localparam type icache_dreq_t = struct packed {
       logic                    req;      // we request a new word
+      logic [CVA6Cfg.DIIIDLEN-1:0] dii_id; // next requested DII ID in instruction stream
       logic                    kill_s1;  // kill the current request
       logic                    kill_s2;  // kill the last request
       logic                    spec;     // request is speculative
@@ -78,13 +79,15 @@ module cva6
       logic [CVA6Cfg.FETCH_WIDTH-1:0]      data;   // 2+ cycle out: tag
       logic [CVA6Cfg.FETCH_USER_WIDTH-1:0] user;   // User bits
       logic [CVA6Cfg.VLEN-1:0]             vaddr;  // virtual address out
+      logic [CVA6Cfg.DIIIDLEN-1:0]         dii_id; // First DII ID in the returned data
       exception_t                          ex;     // we've encountered an exception
     },
 
     // IF/ID Stage
     // store the decompressed instruction
     localparam type fetch_entry_t = struct packed {
       logic [CVA6Cfg.PCLEN-1:0] address;  // the address of the instructions from below
+      logic [CVA6Cfg.DIIIDLEN-1:0] dii_id; // the DII ID of the instruction in the stream
       logic [31:0] instruction;  // instruction word
       branchpredict_sbe_t     branch_predict; // this field contains branch prediction information regarding the forward branch path
       exception_t             ex;             // this field contains exceptions which might have happened earlier, e.g.: fetch exceptions
@@ -93,6 +96,7 @@ module cva6
     // ID/EX/WB Stage
     localparam type scoreboard_entry_t = struct packed {
       logic [CVA6Cfg.PCLEN-1:0] pc;  // PC of instruction
+      logic [CVA6Cfg.DIIIDLEN-1:0] dii_id;  // DII ID of the instruction in the stream
       logic [CVA6Cfg.REGLEN-1:0] ddc;
       logic [CVA6Cfg.TRANS_ID_BITS-1:0] trans_id;      // this can potentially be simplified, we could index the scoreboard entry
       // with the transaction id in any case make the width more generic
@@ -130,6 +134,7 @@ module cva6
     localparam type bp_resolve_t = struct packed {
       logic                    valid;           // prediction with all its values is valid
       logic [CVA6Cfg.VLEN-1:0] pc;              // PC of predict or mis-predict
+      logic [CVA6Cfg.DIIIDLEN-1:0] dii_id;      // dii id of branch
       logic [CVA6Cfg.PCLEN-1:0] target_address;  // target address at which to jump, or not
       logic                    is_mispredict;   // set if this was a mis-predict
       logic                    is_taken;        // branch is taken
@@ -311,9 +316,6 @@ module cva6
     input logic debug_req_i,
     // Probes to build RVFI, can be left open when not used - RVFI
     output rvfi_probes_t rvfi_probes_o,
-    input  logic         rvfi_dii_rtrn_vld_i,
-    input  rvfi_dii_inst_pack_t rvfi_dii_inst_pack_i,
-    output logic         rvfi_dii_data_ready_o,
     // CVXIF request - SUBSYSTEM
     output cvxif_req_t cvxif_req_o,
     // CVXIF response - SUBSYSTEM
@@ -359,6 +361,7 @@ module cva6
   exception_t                                   ex_commit;  // exception from commit stage
   bp_resolve_t                                  resolved_branch;
   logic             [         CVA6Cfg.PCLEN-1:0] pc_commit;
+  logic             [      CVA6Cfg.DIIIDLEN-1:0] dii_id_commit;
   logic                                         eret;
   logic             [CVA6Cfg.NrCommitPorts-1:0] commit_ack;
   logic             [CVA6Cfg.NrCommitPorts-1:0] commit_macro_ack;
@@ -396,6 +399,7 @@ module cva6
 
   fu_data_t fu_data_id_ex;
   logic [CVA6Cfg.PCLEN-1:0] pc_id_ex;
+  logic [CVA6Cfg.DIIIDLEN-1:0] dii_id_id_ex;
   logic is_compressed_instr_id_ex;
   logic [31:0] tinst_ex;
   // fixed latency units
@@ -564,6 +568,7 @@ module cva6
   logic flush_csr_ctrl;
   logic flush_unissued_instr_ctrl_id;
   logic flush_ctrl_if;
+  logic [CVA6Cfg.DIIIDLEN-1:0] flush_ctrl_dii_id_if;
   logic flush_ctrl_id;
   logic flush_ctrl_ex;
   logic flush_ctrl_bp;
@@ -634,6 +639,7 @@ module cva6
       .icache_dreq_o      (icache_dreq_if_cache),
       .resolved_branch_i  (resolved_branch),
       .pc_commit_i        (pc_commit),
+      .dii_id_commit_i    (dii_id_commit),
       .set_pc_commit_i    (set_pc_ctrl_pcgen),
       .set_debug_pc_i     (set_debug_pc),
       .epc_i              (epc_commit_pcgen),
@@ -785,6 +791,7 @@ module cva6
       .rs2_forwarding_o      (rs2_forwarding_id_ex),
       .fu_data_o             (fu_data_id_ex),
       .pc_o                  (pc_id_ex),
+      .dii_id_o              (dii_id_id_ex),
       .is_compressed_instr_o (is_compressed_instr_id_ex),
       .tinst_o               (tinst_ex),
       // fixed latency unit ready
@@ -866,6 +873,7 @@ module cva6
       .rs2_forwarding_i(rs2_forwarding_id_ex),
       .fu_data_i(fu_data_id_ex),
       .pc_i(pc_id_ex),
+      .dii_id_i(dii_id_id_ex),
       .is_compressed_instr_i(is_compressed_instr_id_ex),
       .tinst_i(tinst_ex),
       // fixed latency units
@@ -1015,6 +1023,7 @@ module cva6
       .amo_resp_i        (amo_resp),
       .commit_csr_o      (csr_commit_commit_ex),
       .pc_o              (pc_commit),
+      .dii_id_o          (dii_id_commit),
       .csr_op_o          (csr_op_commit_csr),
       .csr_wdata_o       (csr_wdata_commit_csr),
       .csr_rdata_i       (csr_rdata_csr_commit),
@@ -1248,7 +1257,6 @@ module cva6
         .dcache_req_i_t(dcache_req_i_t),
         .dcache_req_o_t(dcache_req_o_t),
         .exception_t (exception_t),
-        .rvfi_dii_inst_pack_t(rvfi_dii_inst_pack_t),
         .NumPorts  (NumPorts),
         .noc_req_t (noc_req_t),
         .noc_resp_t(noc_resp_t)
@@ -1284,10 +1292,7 @@ module cva6
         .noc_resp_i        (noc_resp_i),
         .inval_addr_i      (inval_addr),
         .inval_valid_i     (inval_valid),
-        .inval_ready_o     (inval_ready),
-        .rvfi_dii_rtrn_vld_i (rvfi_dii_rtrn_vld_i),
-        .rvfi_dii_inst_pack_i (rvfi_dii_inst_pack_i),
-        .rvfi_dii_data_ready_o (rvfi_dii_data_ready_o)
+        .inval_ready_o     (inval_ready)
     );
   end else if (CVA6Cfg.DCacheType == config_pkg::HPDCACHE) begin : gen_cache_hpd
     cva6_hpdcache_subsystem #(

core/cva6_rvfi.sv

@@ -1,5 +1,6 @@
 // Copyright 2024 Thales DIS France SAS
 // Copyright 2025 Bruno Sá and Zero-Day Labs.
+// Copyright 2025 Capabilities Limited.
 //
 // Licensed under the Solderpad Hardware Licence, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -270,32 +271,38 @@ module cva6_rvfi
 
   always_ff @(posedge clk_i) begin
     for (int i = 0; i < CVA6Cfg.NrCommitPorts; i++) begin
+      logic [31:0] instr;
       logic exception;
+      logic [4:0] rd_addr;
+      logic [4:0] rs2_addr;
+      instr = mem_q[commit_pointer[i]].instr;
       exception = commit_instr_valid[i][0] && ex_commit_valid;
+      rd_addr = commit_instr_rd[i][4:0];
+      rs2_addr = (is_amo_sc(commit_instr_op[i]) && wdata[i] == 1) ? '0 : commit_instr_rs2[i][4:0];
       rvfi_instr_o[i].valid    <= (commit_ack[i] && !ex_commit_valid) ||
         (exception && (ex_commit_cause == riscv::ENV_CALL_MMODE ||
                   ex_commit_cause == riscv::ENV_CALL_SMODE ||
                   ex_commit_cause == riscv::ENV_CALL_UMODE ||
                   ex_commit_cause == cva6_cheri_pkg::CAP_EXCEPTION));
-      rvfi_instr_o[i].insn <= mem_q[commit_pointer[i]].instr;
+      rvfi_instr_o[i].insn <= instr;
       // when trap, the instruction is not executed
       rvfi_instr_o[i].trap <= exception;
       rvfi_instr_o[i].cause <= ex_commit_cause;
       rvfi_instr_o[i].mode <= (CVA6Cfg.DebugEn && debug_mode) ? 2'b10 : priv_lvl;
       rvfi_instr_o[i].ixl <= CVA6Cfg.XLEN == 64 ? 2 : 1;
       rvfi_instr_o[i].rs1_addr <= (is_amo_sc(commit_instr_op[i]) && wdata[i] == 1) ? '0 : commit_instr_rs1[i][4:0];
-      rvfi_instr_o[i].rs2_addr <= (is_amo_sc(commit_instr_op[i]) && wdata[i] == 1) ? '0 : commit_instr_rs2[i][4:0];
-      rvfi_instr_o[i].rd_addr <= commit_instr_rd[i][4:0];
-      rvfi_instr_o[i].rd_wdata <= (rvfi_instr_o[i].rd_addr == 0) ? '0 : (CVA6Cfg.FpPresent && is_rd_fpr(
+      rvfi_instr_o[i].rs2_addr <= rs2_addr;
+      rvfi_instr_o[i].rd_addr <= rd_addr;
+      rvfi_instr_o[i].rd_wdata <= (rd_addr == 0) ? '0 : (CVA6Cfg.FpPresent && is_rd_fpr(
           commit_instr_op[i]
       )) ? commit_instr_result[i] : wdata[i];
       rvfi_instr_o[i].pc_rdata <= commit_instr_pc[i];
-      if (mem_q[commit_pointer[i]].instr == 32'h30200073 && !exception) begin
+      if (instr == 32'h30200073 && !exception) begin
         rvfi_instr_o[i].pc_wdata <= csr.mepcc_q[63:0];
-      end else if (mem_q[commit_pointer[i]].instr == 32'h10200073 && !exception) begin
+      end else if (instr == 32'h10200073 && !exception) begin
         rvfi_instr_o[i].pc_wdata <= csr.sepcc_q[63:0];
       end else begin
-        rvfi_instr_o[i].pc_wdata <= (exception) ? {csr.mtcc_q[63:2], 2'b00} : (commit_instr_fu[i] == CTRL_FLOW) ? commit_instr_next_pc[i] : commit_instr_pc[i] + 4;
+        rvfi_instr_o[i].pc_wdata <= (exception) ? {csr.mtcc_q[63:2], 2'b00} : (commit_instr_fu[i] == CTRL_FLOW) ? commit_instr_next_pc[i] : commit_instr_pc[i] + (instr[1:0] == 2'b11 ? 4 : 2);
       end
       rvfi_instr_o[i].mem_addr <= mem_q[commit_pointer[i]].lsu_addr + ((commit_instr_op[i] == ariane_pkg::CLOAD_TAGS) ? 0 : 0);
       // So far, only write paddr is reported. TODO: read paddr
@@ -305,7 +312,7 @@ module cva6_rvfi
       rvfi_instr_o[i].mem_rmask <= /* (mem_q[commit_pointer[i]].lsu_wmask == 16'hFFFF) ? '0 :  */mem_q[commit_pointer[i]].lsu_rmask >> mem_q[commit_pointer[i]].lsu_addr[3:0];
       rvfi_instr_o[i].mem_rdata <= commit_instr_result[i];
       rvfi_instr_o[i].rs1_rdata <= mem_q[commit_pointer[i]].rs1_rdata;
-      rvfi_instr_o[i].rs2_rdata <= (rvfi_instr_o[i].rs2_addr == 0) ? '0 : mem_q[commit_pointer[i]].rs2_rdata;
+      rvfi_instr_o[i].rs2_rdata <= (rs2_addr == 0) ? '0 : mem_q[commit_pointer[i]].rs2_rdata;
     end
   end
 
@@ -422,4 +429,4 @@ module cva6_rvfi
   endgenerate
   ;
 
-endmodule
+endmodule

core/decoder.sv

@@ -1,5 +1,6 @@
 // Copyright 2018 ETH Zurich and University of Bologna.
 // Copyright 2025 Bruno Sá and Zero-Day Labs.
+// Copyright 2025 Capabilities Limited.
 // Copyright and related rights are licensed under the Solderpad Hardware
 // License, Version 0.51 (the "License"); you may not use this file except in
 // compliance with the License.  You may obtain a copy of the License at
@@ -36,6 +37,7 @@ module decoder
     // PC from fetch stage - FRONTEND
     // TODO-cheri: make cheri optional
     input logic [CVA6Cfg.PCLEN-1:0] pc_i,
+    input logic [CVA6Cfg.DIIIDLEN-1:0] dii_id_i,
     // Is a compressed instruction - compressed_decoder
     input logic is_compressed_i,
     // Compressed form of instruction - FRONTEND
@@ -191,6 +193,7 @@ module decoder
     instruction_o.use_zimm                 = 1'b0;
     instruction_o.bp                       = branch_predict_i;
     instruction_o.vfp                      = 1'b0;
+    if (CVA6Cfg.RVFI_DII) instruction_o.dii_id = dii_id_i;
     if (CVA6Cfg.CheriPresent) begin
       instruction_o.ddc     = ddc_i;
       instruction_o.use_ddc = 1'b0;