[BUG] instr_queue changes instruction guest-page faults to page faults when RVC is disabled

[YangKefan-rk]

Code of Conduct

• I have searched the existing bug issues.
• I am a human engaging in an interpersonal interaction. During this interaction, my words are my own and are not generated. If relevant, I provide links to my sources.

CVA6 commit affected

81245a4

Bug Description

Bug Description:

When the hypervisor extension is enabled and the compressed-instruction
extension is disabled (RVH=1, RVC=0), instr_queue changes an incoming
FE_INSTR_GUEST_PAGE_FAULT into INSTR_PAGE_FAULT (exception cause 12).
The architectural cause should remain INSTR_GUEST_PAGE_FAULT (cause 20).

The RVC-enabled path already handles this case correctly:

if (instr_data_out[i].ex == ariane_pkg::FE_INSTR_ACCESS_FAULT) begin
  fetch_entry_o[0].ex.cause = riscv::INSTR_ACCESS_FAULT;
end else if (CVA6Cfg.RVH &&
             instr_data_out[i].ex == ariane_pkg::FE_INSTR_GUEST_PAGE_FAULT) begin
  fetch_entry_o[0].ex.cause = riscv::INSTR_GUEST_PAGE_FAULT;
end else begin
  fetch_entry_o[0].ex.cause = riscv::INSTR_PAGE_FAULT;
end

In gen_downstream_itf_without_c, the corresponding logic only distinguishes
instruction access faults from all other faults:

if (instr_data_out[0].ex == ariane_pkg::FE_INSTR_ACCESS_FAULT) begin
  fetch_entry_o[0].ex.cause = riscv::INSTR_ACCESS_FAULT;
end else begin
  fetch_entry_o[0].ex.cause = riscv::INSTR_PAGE_FAULT;
end

The no-RVC path preserves tval, tval2, tinst, and gva; only the cause is
misclassified.

Steps to reproduce

The issue was reproduced using a full-core differential test:
CVA6's ariane_testharness under Verilator 5.036 and Spike execute
the same bare-metal RISC-V ELF, and their register writeback traces
are compared.

The RTL configuration is derived from cv64a6_imafdch_sv39, with
RVH enabled and RVC disabled.

1. Set vsatp to Bare and configure an Sv39x4 G-stage page table.
2. Map the guest instruction address using a valid leaf PTE with
   execute permission cleared (X=0).
3. Disable exception delegation, install an M-mode trap handler,
   and enter VS-mode using mret.
4. The guest instruction fetch triggers a G-stage permission fault.
   The trap cause differs between CVA6 and Spike: CVA6 reports
   mcause=12, while Spike reports mcause=20.

Expected behavior

mcause should be 20, which is instruction guest-page fault.

Observed behavior

CVA6 reports mcause=12, while Spike reports the expected mcause=20.

[124107157-KV]

Hi, I'd like to work on this issue. I checked the non-RVC instr_queue path and confirmed that it is missing the FE_INSTR_GUEST_PAGE_FAULT mapping that already exists in the RVC-enabled path.

I plan to make the minimal exception-cause mapping fix and add a directed regression covering RVH=1 with RVC=0.

Could you please assign this issue to me? Thanks!

[YangKefan-rk]

I don’t have permission to assign issues in this repository.