Revert #1875: spurious load page fault after a wrong-path ITLB walk fault (#1885)

[davidharrishmc]

Reverts #1875 (310dbfabe) to fix #1885.

Why

#1875 removed the walker/LSU arbitration guards #1871 had added:

-  assign ITLBReq   = ITLBMissOrUpdateAF & ~MemAccessInFlightM;
-  assign HPTWFlushW = (AcceptReq & ~MemAccessDoneM) | (WalkerState != IDLE & HPTWFaultM);

plus the MemAccessDone / ReadDataHold state in lsu.sv. Without them, an M-stage access that
has already been performed can be flushed by an ITLB request arriving the next cycle, and a
wrong-path fetch whose walk ends in FAULT leaves a spurious load page fault on an unrelated load:
the load hits in the D$ and returns the correct data in the very cycle the core traps on it
(scause=13, stval = the load's own address). Three Sv arch tests then livelock in a recursive
trap. Full trace and reproducer ELFs are in #1885.

The sequencing argument in #1875 may well be right — but something still has to cover the window
where the M-stage access has been performed and an ITLB request arrives in the next cycle. This
revert is the conservative step while that is worked out; happy to close it in favour of a narrower
fix.

Verification

Verilator 5.036, plus Questa + ImperasDV where noted. "main" = ff84ec108, "#1871" = b3d3ac1a1.

	main	this PR
#1885 reproducers (3 tests, rv64gc)	watchdog livelock	pass, 0 IDV mismatches
#1766 ELF (rv32gc)	pass	pass, 0 IDV mismatches
arch64vm_sv48_a / _b, arch64vm_sv39, arch64vm_sv48, arch32vm_sv32	pass	pass
ACT Sv at act4 HEAD (rv32gc 30, rv64gc 97)	pass	pass
ACT Sv at 22c01e88b1 (rv32gc 30, rv64gc 97)	94/97 on rv64gc	pass
lint-wally	rv64gc/rv32gc/rv32imc/rv32i/rv64i pass	same

(lint-wally also reports fdqh_rv64gc failed lint on both main and this branch in a fresh
worktree — missing generated config/deriv, not a code difference.)

regression-wally results to follow in a comment.

🤖 Generated with Claude Code

[davidharrishmc]

regression-wally (Verilator, default suite): 6 failed configurations on this branch and the same 6 on unmodified ff84ec108, with identical failure lines — no difference introduced by the revert.

config	main	this PR	cause
rv32i_arch32i, rv64i_arch64i, rv32e_arch32e	fail	fail	compile: testbench.sv:797 dereferences core.priv.priv.csr.counters.HPMCOUNTER_REGW unconditionally, so configs without the privileged unit do not elaborate
rv64gc_arch64vm_sv57	fail	fail	vm_sv57 reference ELFs not built on this machine
rv64gc_coverage64gc	fail	fail	tests/coverage/sfencevmaglobal.elf not built on this machine
rv64gc_wally64priv	fail	fail	Error on test rv64i_m/privilege/src/WALLY-trap-01.S, identical on both (also confirmed with a standalone wsim rv64gc wally64priv on each)

Both runs were done in fresh worktrees prepared identically (derivgen.pl, and the prebuilt tests/fp/vectors, tests/periph, tests/coverage, tests/riscof/work linked in), so the first five are environment gaps rather than regressions; I have not chased the wally64priv / WALLY-trap-01 failure, only established that it predates this change.

[rosethompson]

I will merge this, but I suspect there is a deeper issue in the control logic that needs to be debugged.

[davidharrishmc]

Alternative: #1887 fixes #1885 with one line (restores the #1871 SelHPTWAdr, keeps the rest of #1875). Root cause is in #1885. Both are verified the same way; this revert is the conservative choice because it also restores the MemAccessInFlightM/MemAccessDoneM guards, which #1887 leaves removed.