Add victim cache for I-cache

Introduce a small victim cache to reduce conflict misses
in the direct-mapped instruction cache. On an I-cache miss,
probe the victim cache; on hit, swap the victim block with
the current I-cache block and return the data.

Measurement shows that the number of virtual-to-physical translations
during instruction fetch (mmu_translate() calls) decreased by ~8%.

Author: yy214123

riscv.c

@@ -374,7 +374,7 @@ static void mmu_fetch(hart_t *vm, uint32_t addr, uint32_t *value)
     /* cache hit */
     uint32_t idx = (addr >> ICACHE_OFFSET_BITS) & ICACHE_INDEX_MASK;
     uint32_t tag = addr >> (ICACHE_OFFSET_BITS + ICACHE_INDEX_BITS);
-    icache_block_t *blk = &vm->icache.block[idx];
+    icache_block_t *blk = &vm->icache.i_block[idx];
     uint32_t vpn = addr >> RV_PAGE_SHIFT;
     uint32_t index = __builtin_parity(vpn) & 0x1;
 
@@ -387,6 +387,25 @@ static void mmu_fetch(hart_t *vm, uint32_t addr, uint32_t *value)
         return;
     }
 
+    /* search the victim cache */
+    uint32_t vcache_key = addr >> ICACHE_OFFSET_BITS;
+    for (int i = 0; i < VCACHE_BLOCKS; i++) {
+        victim_cache_block_t *vblk = &vm->icache.v_block[i];
+
+        /* victim cache hit, swap blocks */
+        if (vblk->valid && vblk->tag == vcache_key) {
+            icache_block_t tmp = *blk;
+            *blk = *vblk;
+            *vblk = tmp;
+            blk->tag = tag;
+            vblk->tag = (tmp.tag << ICACHE_INDEX_BITS) | idx;
+
+            uint32_t ofs = addr & ICACHE_BLOCK_MASK;
+            *value = *(const uint32_t *) (blk->base + ofs);
+            return;
+        }
+    }
+
 #ifdef MMU_CACHE_STATS
     vm->cache_fetch[index].misses++;
 #endif
@@ -408,7 +427,16 @@ static void mmu_fetch(hart_t *vm, uint32_t addr, uint32_t *value)
     *value =
         vm->cache_fetch[index].page_addr[(addr >> 2) & MASK(RV_PAGE_SHIFT - 2)];
 
-    /* fill into the cache */
+    /* Move the current icache block into the victim cache before replacement */
+    if (blk->valid) {
+        victim_cache_block_t *vblk = &vm->icache.v_block[vm->icache.v_next];
+        *vblk = *blk;
+        vblk->tag = (blk->tag << ICACHE_INDEX_BITS) | idx;
+        vblk->valid = true;
+        vm->icache.v_next = (vm->icache.v_next + 1) % VCACHE_BLOCKS;
+    }
+
+    /* fill into the icache */
     uint32_t block_off = (addr & RV_PAGE_MASK) & ~ICACHE_BLOCK_MASK;
     blk->base = (const uint8_t *) vm->cache_fetch[index].page_addr + block_off;
     blk->tag = tag;

riscv.h

@@ -87,6 +87,16 @@ typedef struct __vm_internel vm_t;
 #define ICACHE_OFFSET_BITS 8
 #define ICACHE_INDEX_BITS 8
 
+/* Define the victim cache.
+ *
+ * The block size of the victim cache is identical to that of the primary
+ * instruction cache (IC), ensuring full block compatibility.
+ * However, the number of blocks is smaller, allowing the VC to store
+ * a few recently evicted cache lines to reduce conflict misses.
+ */
+#define VCACHE_BLOCK_SIZE ICACHE_BLOCKS_SIZE
+#define VCACHE_BLOCKS 16
+
 /* For power-of-two sizes, (size - 1) sets all low bits to 1,
  * allowing fast extraction of an address.
  */
@@ -100,8 +110,12 @@ typedef struct {
     bool valid;
 } icache_block_t;
 
+typedef icache_block_t victim_cache_block_t;
+
 typedef struct {
-    icache_block_t block[ICACHE_BLOCKS];
+    icache_block_t i_block[ICACHE_BLOCKS];
+    victim_cache_block_t v_block[VCACHE_BLOCKS];
+    uint32_t v_next;
 } icache_t;
 
 struct __hart_internal {