[davidharrishmc]

The IFU's spill logic decodes the fetched instruction's low bits even on a fetch that faults before reaching the bus, taking the data from the AHB fetch buffer. rv32imc fetches everything from the IROM, so that buffer is never written and stays X in 4-state simulation: riscv-arch-test's ExceptionsSm jump to the nonexistent halfword-aligned address 0x2 drove X into SelSpillNextF and the next PC, and Questa and VCS hung where Verilator, which starts flops at 0, took the access fault. Hardware traps correctly whatever the buffer holds, so only the IFU's buffer gets a reset. With #1962 this leaves the nightly regression of #1963 with no known failures.

🤖 Generated with Claude Code

[davidharrishmc]

Merge order: merge together with #1982. Both close the X / first-half-fault spill hole on the IFU side. #1982 likely stops the rv32imc hang reproducing on its own, which makes this the defense-in-depth half. Merge both.

🤖 Generated with Claude Code

[rosethompson]

Should both the LSU and IFU reset FetchBuffer?

[davidharrishmc]

Should both the LSU and IFU reset FetchBuffer?

No. The LSU's buffer only carries data: load data, uncached AMO operands, and PTEs in the no-D$ derivatives. Nothing reads it as control before a bus read fills it, and a load that faults before the bus never writes back. In the HPTW, a PTE read that takes an access fault checks HPTWFaultM before it looks at the PTE. So an X can reach the PTE register for one cycle in FAULT, and the walk ends in FAULT whatever the register holds. The IFU is different: its spill logic decodes FetchBuffer[1:0] on every fetch, including one that faulted before the bus, so an X there reaches the next PC. Resetting the LSU copy would add XLEN reset flops to the no-D$ configs and change nothing. The cached interfaces fill their buffer on the first line fill, and no config pairs an IROM with an I$.