Query Regarding Memory Access Exception Handling in Rocket Chip

# Query Regarding Memory Access Exception Handling in Rocket Chip

## Repo

For details, please see [canxin121:rocket_chip_bugs](https://github.com/canxin121/rocket_chip_bugs/tree/master/2)

## Query Summary

The Rocket core has been observed to handle certain memory access violations differently from the Spike reference implementation. Specifically, for some addresses, Rocket appears to report a different exception type than Spike, and it also seems to trigger exceptions on addresses that Spike accesses without issue. We would like to inquire if this is the intended behavior.

## Detailed Description

### Question 1: Discrepancy in Exception Classification for Misaligned Addresses

The Rocket core was observed to classify address misalignment exceptions as access fault exceptions for certain memory addresses, which differs from the behavior of the Spike reference.

**Expected Behavior (Spike):**
- Address `0x5`: Should trigger `Store/AMO address misaligned` (mcause=6) and `Load address misaligned` (mcause=4)
- Address `0xFFFFFFE1`: Should trigger `Store/AMO address misaligned` (mcause=6) and `Load address misaligned` (mcause=4)

**Actual Observed Behavior (Rocket):**
- Address `0x5`: Triggers `Store/AMO access fault` (mcause=7) and `Load access fault` (mcause=5)
- Address `0xFFFFFFE1`: Triggers `Store/AMO access fault` (mcause=7) and `Load access fault` (mcause=5)

### Question 2: Access Fault Triggered on a Seemingly Valid Memory Address

The Rocket core was observed to trigger an access fault exception on memory address `0xFFFFFFEC`, whereas no exception appears to occur in the Spike reference implementation.

**Expected Behavior (per Spike reference):**
- Address `0xFFFFFFEC`: Should execute normally without exceptions
- `amoxor.w.aqrl` instruction should complete successfully and modify register `x3`

**Actual Observed Behavior (Rocket):**
- Address `0xFFFFFFEC`: Triggers `Store/AMO access fault` (mcause=7) and `Load access fault` (mcause=5)
- Instructions fail to execute, register `x3` retains its original value `0xDEADBEEF`

## Test Case Details

### Test Environment
- **Test File:** `debug.S`
- **Compilation:** RISC-V 64-bit with floating-point support
- **Reference Implementation:** Spike ISA Simulator
- **Target Implementation:** Rocket Core

### Test Addresses and Results Comparison

| Address | Operation | Spike Result | Rocket Result | Comparison with Spike |
|---|---|---|---|---|
| `0x4` | Store/Load/AMO | Access Fault | Access Fault | Behavior Matches Spike |
| `0x5` | Store | Address Misaligned (mcause=6) | **Access Fault (mcause=7)** | Behavior Differs from Spike |
| `0x5` | Load | Address Misaligned (mcause=4) | **Access Fault (mcause=5)** | Behavior Differs from Spike |
| `0x5` | AMO | Address Misaligned (mcause=6) | **Access Fault (mcause=7)** | Behavior Differs from Spike |
| `0xFFFFFFE1` | Store | Address Misaligned (mcause=6) | **Access Fault (mcause=7)** | Behavior Differs from Spike |
| `0xFFFFFFE1` | Load | Address Misaligned (mcause=4) | **Access Fault (mcause=5)** | Behavior Differs from Spike |
| `0xFFFFFFE1` | AMO | Address Misaligned (mcause=6) | **Access Fault (mcause=7)** | Behavior Differs from Spike |
| `0xFFFFFFEC` | Store | No Exception | **Access Fault (mcause=7)** | Behavior Differs from Spike |
| `0xFFFFFFEC` | Load | No Exception | **Access Fault (mcause=5)** | Behavior Differs from Spike |
| `0xFFFFFFEC` | AMO | No Exception | **Access Fault (mcause=7)** | Behavior Differs from Spike |

### Evidence Data

**Final Register State Comparison:**
- **Spike:** `x3 = 0x1234ABCD` (instruction executed successfully)
- **Rocket:** `x3 = 0xDEADBEEF` (instruction failed due to an exception)

## Reproduction

Need to use the tools from my riscv_fuzz_test repo to conveniently parse the output.

```bash
cargo install --git https://github.com/canxin121/riscv_fuzz_test
````

Then directly use the `riscv_fuzz_test` tool for testing.

Set the environment variable ROCKET\_EMULATOR\_PATH to the path of your Rocket simulator. For Rocket emulator build configuration and version details, see [emulators/readme.md](https://raw.githubusercontent.com/canxin121/rocket_chip_bugs/refs/heads/master/emulators/readme.md). There's a pre-compiled one for x86 Ubuntu in the emulators folder.

```bash
export ROCKET_EMULATOR_PATH=
```

```bash
riscv_fuzz_test run -a ./debug.S -f common -b ./build
```

Start by reviewing the reported debug.S case and reproducing it with the riscv_fuzz_test command, using ROCKET_EMULATOR_PATH and the Rocket emulator. Compare Rocket and Spike results for the listed addresses and exception causes. Done requires a confirmed explanation of the discrepancy or a clearly scoped correction, which the issue does not currently identify.

Written by the indexing model from the issue text.