fix: report guest-page fault for G-stage fetch

[124107157-KV]

• I have searched for similar pull requests
• I am a human engaging in an interpersonal interaction. During this interaction, my words are my own and are not generated. If relevant, I provide links to my sources.

Why is this PR needed?

Under pure G-stage translation with vsatp.MODE = Bare and hgatp.MODE = Sv39x4, the instruction-fetch address is a guest physical address (GPA).

For Sv39x4, GPA bits [63:41] must be zero. If any of these bits are set, the access must raise a guest-page-fault exception.

The instruction-fetch path in core/cva6_mmu/cva6_mmu.sv currently combines the VS-stage virtual-address canonicality check and the pure G-stage GPA-width check in the same condition. As a result, both cases report INSTR_PAGE_FAULT.

The VS-stage case is correct, but the pure G-stage GPA-width failure must report INSTR_GUEST_PAGE_FAULT.

This distinction matters because INSTR_PAGE_FAULT may be delegated to VS-mode through hedeleg, while INSTR_GUEST_PAGE_FAULT must remain under hypervisor control.

What does this PR change?

This change separates the two instruction-fetch address checks.

• VS-stage virtual-address canonicality failures continue to raise INSTR_PAGE_FAULT.
• Pure G-stage Sv39x4 GPA-width failures now raise INSTR_GUEST_PAGE_FAULT.
• tval2 remains zero for this exception path, which is permitted for a guest-page fault.
• Existing data-side behavior is unchanged.

A directed regression test is added with two variants:

• rv64h-p-gstage-overflow-fetch
• rv64h-p-gstage-overflow-data

The fetch variant enables pure G-stage Sv39x4 translation with vsatp=Bare, enters VS-mode, and attempts to fetch from a GPA with bit 41 set.

The data-side variant performs the corresponding load and is included as a control.

Verification

Target: cv64a6_imafdch_sv39

The directed tests were run with the Verilator test harness and Spike:

• rv64h-p-gstage-overflow-fetch
• rv64h-p-gstage-overflow-data

Before the fix, the fetch case exposes the mismatch: CVA6 reports INSTR_PAGE_FAULT with mcause 12 while Spike reports INSTR_GUEST_PAGE_FAULT with mcause 20.

With this change applied, the fetch test agrees with Spike and passes.

The data-side control continues to report LOAD_GUEST_PAGE_FAULT with mcause 21 and passes on both CVA6 and Spike.

The following existing regression tests were also checked:

• rv64si-p-dirty
• rv64mi-p-ma_addr

Both continue to pass.

git diff --check also passes.

Related issue

Fixes #3428

Limitations

No known functional limitations.

The behavioral change is limited to the RV64 pure G-stage instruction-fetch GPA-width failure. Existing VS-stage page-fault behavior and non-hypervisor configurations are unchanged.