Gem5中跳过Store Queue搜索的特殊Load指令引发Guest崩溃求助

我基于Gem5 22.0.0.1开展研究项目，测试一种特殊Load指令——该指令在发出时不搜索Store Queue以进行潜在的存储转发。
我通过在lsq_unit.cc的LSQUnit::read函数中添加goto语句实现了这一逻辑：从Store Queue搜索循环（起始行1390）之前跳转到循环结束后的缓存访问代码（行1568）。

具体代码实现如下：

//The load_idx=isnt->lqIdx from the LSQ::pushRequest
Fault
LSQUnit::read(LSQRequest *request, ssize_t load_idx)
{
    LQEntry& load_entry = loadQueue[load_idx];
    const DynInstPtr& load_inst = load_entry.instruction();

    load_entry.setRequest(request);

    ...

    auto store_it = load_inst->sqIt;
    assert (store_it >= storeWBIt);
    /*=== my goto === */
    if (load_inst->isSpecbCheck()){
        goto cache;
    }
    /*=== store queue search loop ===*/
    // End once we've reached the top of the LSQ
    while (store_it != storeWBIt && !load_inst->isDataPrefetch()) {
        // Move the index to one younger
        store_it--;
        assert(store_it->valid());
        assert(store_it->instruction()->seqNum < load_inst->seqNum);
        int store_size = store_it->size();

        ...

    }

    /*=== code which performs cache access ===*/
    cache:

    // If there's no forwarding case, then go access memory
    DPRINTF(LSQUnit, "Doing memory access for inst [sn:%lli] PC %s\n",
            load_inst->seqNum, load_inst->pcState());

    ...
}

但该修改导致Gem5频繁崩溃：在使用simpoints运行Spec2017时，约40%包含新Load指令操作码的checkpoint出现如下错误：

build/ARM/sim/faults.cc:102: panic: panic condition !handled && !tc->getSystemPtr()->trapToGdb(SIGSEGV, tc->contextId()) occurred: Page table fault when accessing virtual address 0x54000000540

不含该指令的同类型checkpoint无此问题，移除goto语句后崩溃的checkpoint也能正常运行。我查阅了存储转发代码仍无法定位原因，恳请各位提供排查思路。

内容的提问来源于stack exchange，提问作者muke