Summary:
ifu_mmu_abort cannot retract a page-table walk that has already been granted — the walk drains through the iuTLB refill FSM's ABT state. ABT suppresses the uTLB write, the PLRU update and the walk's page fault, but not its access fault.
The stale fault is driven onto mmu_ifu_pavld + mmu_ifu_deny ~11 cycles after the abort. The IFU port has no request ID, so it is consumed as the answer for whatever PC is on the bus by then — a spurious instruction access fault on a correctly mapped page.
Root cause:
gen_rtl/mmu/rtl/ct_mmu_iutlb.v:2225
assign iutlb_acc_flt = jtlb_iutlb_acc_err && iutlb_refill_on;
iutlb_refill_on = (ref_cur_st != IDLE) (:854) is true in ABT. The three sibling outputs of the same walk all use the tighter qualifier:
:671 iutlb_plru_refill_on = iutlb_wfc; // WFC only
:862 iutlb_refill_vld = iutlb_wfc && jtlb_iutlb_ref_pavld; // WFC only
:864 iutlb_ref_pgflt = (ref_cur_st == PGFLT); // unreachable from ABT
:2225 iutlb_acc_flt = jtlb_iutlb_acc_err && iutlb_refill_on; // WFC *or ABT*
The dTLB handles the same case correctly — ct_mmu_dutlb_read.v:698 routes its access fault through a dedicated ACFLT state plus an ID match that includes !lsu_mmu_abort_x. The dTLB path is unaffected.
ifu_mmu_va_vld is tied to 1'b1 (ct_ifu_pcgen.v:889) and ifu_mmu_abort is combinational off pcgen_ifctrl_cancel (:888), which also reloads if_pc - so a cancel always puts a new PC on the bus immediately. iutlb_acc_flt has no va_vld term, so the fault asserts regardless, and if_cancel is a one-cycle pulse that has long deasserted by the time the response lands.
Summary:
ifu_mmu_abort cannot retract a page-table walk that has already been granted — the walk drains through the iuTLB refill FSM's ABT state. ABT suppresses the uTLB write, the PLRU update and the walk's page fault, but not its access fault.
The stale fault is driven onto mmu_ifu_pavld + mmu_ifu_deny ~11 cycles after the abort. The IFU port has no request ID, so it is consumed as the answer for whatever PC is on the bus by then — a spurious instruction access fault on a correctly mapped page.
Root cause:
gen_rtl/mmu/rtl/ct_mmu_iutlb.v:2225assign iutlb_acc_flt = jtlb_iutlb_acc_err && iutlb_refill_on;iutlb_refill_on = (ref_cur_st != IDLE)(:854) is true in ABT. The three sibling outputs of the same walk all use the tighter qualifier:The dTLB handles the same case correctly — ct_mmu_dutlb_read.v:698 routes its access fault through a dedicated ACFLT state plus an ID match that includes !lsu_mmu_abort_x. The dTLB path is unaffected.
ifu_mmu_va_vld is tied to 1'b1 (ct_ifu_pcgen.v:889) and ifu_mmu_abort is combinational off pcgen_ifctrl_cancel (:888), which also reloads if_pc - so a cancel always puts a new PC on the bus immediately. iutlb_acc_flt has no va_vld term, so the fault asserts regardless, and if_cancel is a one-cycle pulse that has long deasserted by the time the response lands.