Issues

• [BUG] hedeleg[18] and hedeleg[19] are not writable

  Component:RTLStatus:NewType:Bug
  openhwfoundation/cva6#3732 · Filter by author fly-1011 opened on Nov 10, 2026

• [BUG] An AXI error response (RRESP=SLVERR/DECERR) on an instruction-cache refill is silently ignored: the errored data is executed as instructions and no exception is raised

  Type:Bug
  openhwfoundation/cva6#3731 · Filter by author qinkejiu opened on Nov 9, 2026
  1

• [BUG] An S-mode instruction fetch that must raise an instruction page fault is silently dropped: the walk completes, no exception is delivered, the hart stops

  Component:RTLPARAM:MMUStatus:NewType:Bug
  openhwfoundation/cva6#3730 · Filter by author qinkejiu opened on Nov 9, 2026

• [BUG] Zcmt: cm.jt/cm.jalt right after csrw jvt uses the previous JVT

  Component:RTLStatus:NewType:Bug
  openhwfoundation/cva6#3728 · Filter by author ttkxclr opened on Nov 9, 2026

• [BUG] VS-stage 64 KiB NAPOT leaf: the G-stage walk translates GPA with PPN[3:0] = 1000 instead of GVA[15:12]

  Component:RTLPARAM:MMUStatus:NewType:Bug
  openhwfoundation/cva6#3727 · Filter by author ttkxclr opened on Nov 9, 2026

• Bug Title: After a misaligned load/store, lsu_dtlb_ppn_o supplies the next load's virtual page, so a non-idempotent load is sent speculatively.

  Component:RTLPARAM:MMUStatus:NewType:Bug
  openhwfoundation/cva6#3724 · Filter by author hakunahmattatah opened on Nov 9, 2026

• Bug Title: A single speculation flag is cleared by any older branch resolution, so a younger unresolved prediction can still issue a non-idempotent fetch.

  Component:RTLStatus:NewType:Bug
  openhwfoundation/cva6#3723 · Filter by author hakunahmattatah opened on Nov 9, 2026
  1

• [BUG] First-half instruction-fetch page fault is lost when the second half succeeds

  Component:RTLStatus:NewType:Bug
  openhwfoundation/cva6#3722 · Filter by author kaci1928 opened on Nov 7, 2026
  1

• [BUG] Reserved FP encodings are accepted as FP16ALT operations instead of trapping

  Component:RTLPARAM:FPUStatus:NewType:Bug
  openhwfoundation/cva6#3717 · Filter by author fireceW opened on Nov 5, 2026
  2

• [BUG] Sdtrig: an action=0 trigger fires inside the M-mode trap handler (MIE=0) and overwrites mcause/mepc (no re-entrancy protection)

  Component:RTLStatus:NewType:Bug
  openhwfoundation/cva6#3711 · Filter by author BilalAli10x opened on Nov 5, 2026

• [BUG] Sdtrig: an etrigger/itrigger enabled in S-mode (s=1) never matches in S-mode when textra.sselect=0

  Component:RTLPARAM:SMODEStatus:NewType:Bug
  openhwfoundation/cva6#3710 · Filter by author BilalAli10x opened on Nov 5, 2026

• [BUG] <ssrdp at SSE=0 writes non-zero value>

  Component:RTLStatus:NewType:Bug
  openhwfoundation/cva6#3708 · Filter by author Security-HC opened on Nov 4, 2026

• [BUG] <Zicfiss sspopchk missing from is_ss() — shadow-stack bypass + several other CFI implementation issues>

  Type:Bug
  openhwfoundation/cva6#3707 · Filter by author Security-HC opened on Nov 4, 2026

• [BUG] A delegated S-level interrupt is taken ahead of a pending M-level interrupt in S/U-mode

  Component:RTLPARAM:SMODEStatus:NewType:Bug
  openhwfoundation/cva6#3706 · Filter by author davidharrishmc opened on Nov 4, 2026

• [BUG] Shared TLB: a lookup issued in the cycle the PTW writes the shared TLB reads the written set but the lookup set's valid bits, so a superpage entry removed by sfence.vma can hit and translate a later access

  Component:RTLStatus:NewType:Bug
  openhwfoundation/cva6#3705 · Filter by author harrypotter84923 opened on Nov 4, 2026

• [BUG] sfence.vma directly after a CSR instruction reads the CSR's write operand instead of rd, so the TLB flush uses the wrong ASID/vaddr and stale translations survive

  Component:RTLPARAM:CSRStatus:NewType:Bug
  openhwfoundation/cva6#3704 · Filter by author harrypotter84923 opened on Nov 4, 2026

• [BUG] Single-stepping MRET/SRET writes pc+4 to dpc and keeps the pre-xRET privilege in dcsr.prv

  Component:RTLPARAM:CSRStatus:NewType:Bug
  openhwfoundation/cva6#3701 · Filter by author iskindar opened on Nov 3, 2026

• [BUG] PTW PMP check ignores access size: 8-byte PTE read across a TOR boundary is allowed

  Component:RTLPARAM:MMUStatus:NewType:Bug
  openhwfoundation/cva6#3698 · Filter by author skye1577 opened on Nov 2, 2026

• [BUG] Misaligned LR.D reports cause 6 (store/AMO) instead of cause 4 (load)

  Component:RTLStatus:NewType:Bug
  openhwfoundation/cva6#3697 · Filter by author skye1577 opened on Nov 2, 2026

• [BUG] WT D$ drops AXI DECERR: load commits invalid data instead of raising an access fault

  Component:RTLStatus:NewType:Bug
  openhwfoundation/cva6#3696 · Filter by author skye1577 opened on Nov 2, 2026
  1

• [BUG] Virtual-instruction overrides illegal-instruction on write to read-only CSR hgeip

  Component:RTLPARAM:CSRStatus:NewType:Bug
  openhwfoundation/cva6#3695 · Filter by author skye1577 opened on Nov 2, 2026

• [Bug] PMP access fault overrides an already-valid page fault

  Component:RTLStatus:NewType:Bug
  openhwfoundation/cva6#3694 · Filter by author skye1577 opened on Nov 2, 2026

• [BUG] dpc low bits should be zero, same as the low bits of mepc

  Component:RTLPARAM:CSRStatus:NewType:Bug
  openhwfoundation/cva6#3693 · Filter by author pointerliu opened on Nov 2, 2026

• [BUG] dretdoes not clear mstatus.MPRV when resuming below M-mode

  Component:RTLStatus:NewType:Bug
  openhwfoundation/cva6#3692 · Filter by author pointerliu opened on Nov 2, 2026

• [BUG] Sdtrig: mcontrol6 action=1 trigger takes a breakpoint exception instead of entering Debug Mode

  Component:RTLStatus:NewType:Bug
  openhwfoundation/cva6#3691 · Filter by author pointerliu opened on Nov 2, 2026