csr_regfile: legalize mstatus.MPP against reserved 2'b10 when RVH=1

[codeadpool]

Why this PR is needed

mstatus.MPP is WARL over the implemented privilege modes, the current write path rejects the reserved encoding 2'b10 (PRIV_LVL_HS) only when CVA6Cfg.RVH=0:

if ((!CVA6Cfg.RVH & mstatus_d.mpp == riscv::PRIV_LVL_HS) |
    (!CVA6Cfg.RVS & mstatus_d.mpp == riscv::PRIV_LVL_S) |
    (!CVA6Cfg.RVU & mstatus_d.mpp == riscv::PRIV_LVL_U)) begin
  mstatus_d.mpp = mstatus_q.mpp;
end

2'b10 is not a legal privilege encoding for MPP, even when the hypervisor extension is implemented. HS-mode uses S-mode privilege (2'b01) with V=0; the H extension does not add a fourth privilege encoding.

With RVH=1, the first check is disabled, so an M-mode write of MPP=2'b10 retains that reserved value.

What changed

This PR makes the MPP=2'b10 check unconditional by removing the !CVA6Cfg.RVH condition. the existing checks for unsupported S-mode and U-mode are unchanged.

An attempted write of 2'b10 now retains the previous MPP value under both RVH=0 and RVH=1.

Verification

Formal checking was run with yosys, yosys-slang, and SymbiYosys on cv64a6_imafdch_sv39 (RVH=1). The checked property requires mstatus.MPP to remain in {M, S, U}.

PR #3387 was applied to both runs to remove the independent dcsr.prv/dret path:

• Before this change: counterexample at step 3.
• After this change: unbounded proof with PDR.

Checker and logs: https://github.com/codeadpool/cva6-priv-sva/tree/main/evidence/probe/probe_mpp_legal_rvh_fixed_prove/

Related issues

Fixes #3411.

This completes the RVH=1 case missed by #1988/PR #2035 and #2274/PR #2285.

The trap-to-M path can separately copy an already-invalid priv_lvl_q into MPP. That independent dcsr.prv/dret path is covered by #3383 and PR #3387. This PR fixes the direct mstatus CSR-write path.

[Maanvi212006]

Reviewed and the core fix looks correct — legalizing mpp against the reserved HS (2'b10) encoding regardless of RVH matches spec behavior.
One note: the diff includes unrelated CI/workflow bumps and an hpdcache submodule bump (from merge-from-master commits, not yet in upstream master). Could you rebase onto origin/master so the diff is just the one-line fix? Makes it easier to review/merge cleanly.

[cainria]

@Maanvi212006 I don't know which diff you are viewing but these are merges from upstream master and the current diff only contains the one-line change.

[Maanvi212006]

@Maanvi212006 I don't know which diff you are viewing but these are merges from upstream master and the current diff only contains the one-line change.

@cainria Ah, my mistake! I was looking at the wrong commit history. Thanks for clearing that up.