[MMU/iuTLB] M-mode bypass PA corrupted by concurrent iuTLB hit - pa/pgs/flg terms are OR'd, not muxed

[anamdev-TT]

Summary:
In ct_mmu_iutlb.v, pa_fin, pgs_fin and flg_fin OR the translation-bypass value with the TLB-hit value instead of selecting between them. The two selectors are not mutually exclusive, so when both are asserted the outputs are the bitwise OR of two different results.

Code:
C910_RTL_FACTORY/gen_rtl/mmu/rtl/ct_mmu_iutlb.v:2299

assign pa_fin[PPN_WIDTH-1:0] =
          {PPN_WIDTH{iutlb_off_hit}}  & iutlb_off_pa[PPN_WIDTH-1:0]
        | {PPN_WIDTH{iutlb_addr_hit}} & iutlb_hit_pa_fst[PPN_WIDTH-1:0];

pgs_fin (:2303) and flg_fin (:2307) have the same shape.

The two selectors are independent:

:554   assign iutlb_off_hit  = !regs_mmu_en || cp0_mach_mode;   // translation bypassed
:2035  assign iutlb_addr_hit = iutlb_entry_hit[0] || iutlb_entry_hit[8] || ...;  // CAM hit
:2199  assign iutlb_off_pa   = ifu_mmu_va[VPN_WIDTH+11:11];     // bypass PA = VA page

The CAM comparison has no privilege qualifier, so a resident entry still hits in M-mode.

Failure

1. A VA is translated in S-mode and its entry is resident in the iuTLB.
2. The core traps to M-mode and fetches from that same VA.
3. iutlb_off_hit = 1 (bypass, so pa_fin should be the VA page) and iutlb_addr_hit = 1 (stale entry still matches).
4. pa_fin becomes iutlb_off_pa | iutlb_hit_pa_fst — a physical address that is neither.