mod(CSR): write satp will now flush pipeline

This modification is used to solve the following case:

```
ffffffe000000094:	8d4d                or	a0,a0,a1
ffffffe000000096:	12000073          	sfence.vma
ffffffe00000009a:	18051073          	csrw	satp,a0
ffffffe00000009e:	00000517          	auipc	a0,0x0
```

In that case, when executing `ffffffe00000009e`, noop get paddr from the new page table

src/main/scala/noop/Cache.scala

@@ -366,7 +366,7 @@ sealed class CacheStage3(implicit val cacheConfig: CacheConfig) extends CacheMod
   // is totally handled. We use io.isFinish to indicate when the
   // request really ends.
   io.isFinish := Mux(probe, io.cohResp.fire() && Mux(miss, state === s_idle, (state === s_release) && releaseLast),
-    Mux(hit || req.isWrite(), io.out.fire(), (state === s_wait_resp) && (io.out.fire() || alreadyOutFire))
+    Mux(hit || req.isWrite(), io.out.fire(), isIPF || (state === s_wait_resp) && (io.out.fire() || alreadyOutFire))
   )
 
   io.in.ready := io.out.ready && (state === s_idle) && !miss && !probe

src/main/scala/noop/fu/CSR.scala

@@ -423,6 +423,7 @@ class CSR(implicit val p: NOOPConfig) extends NOOPModule with HasCSRConst{
   // Debug(){when(wen){printf("[CSR] addr %x wdata %x func %x rdata %x\n", addr, wdata, func, rdata)}}
   MaskedRegMap.generate(mapping, addr, rdata, wen, wdata)
   val isIllegalAddr = MaskedRegMap.isIllegalAddr(mapping, addr)
+  val resetSatp = addr === Satp.U && wen // write to satp will cause the pipeline be flushed
   io.out.bits := rdata
 
   // Fix Mip/Sip write
@@ -542,8 +543,8 @@ class CSR(implicit val p: NOOPConfig) extends NOOPModule with HasCSRConst{
   val raiseExceptionIntr = (raiseException || raiseIntr) && io.instrValid
   val retTarget = Wire(UInt(AddrBits.W))
   val trapTarget = Wire(UInt(AddrBits.W))
-  io.redirect.valid := (valid && func === CSROpType.jmp) || raiseExceptionIntr
-  io.redirect.target := Mux(raiseExceptionIntr, trapTarget, retTarget)
+  io.redirect.valid := (valid && func === CSROpType.jmp) || raiseExceptionIntr || resetSatp
+  io.redirect.target := Mux(resetSatp, io.cfIn.pnpc, Mux(raiseExceptionIntr, trapTarget, retTarget))
 
   Debug(){
     when(raiseExceptionIntr){