[davidharrishmc]

With menvcfg.ADUE=1, the page-table walker decided whether to update A/D with its own copy of the leaf checks (OtherPageFault in hptw.sv). That copy lacked tlbcontrol's BadPBMT, BadNAPOT and BadReserved. A store through a leaf PTE with any of these therefore had A and D written to the PTE before the store page fault:

• PBMT=3;
• PBMT≠0 while menvcfg.PBMTE=0;
• N=1 with a reserved NAPOT encoding;
• any of bits 60:54 set.

The privileged spec stops translation with a page fault at step 3 for these encodings, before the A/D update, and D updates must be exact.

This adds the three checks to the walker. They are computed from its PTE and only gate HPTWUpdateDA. A module shared with tlbcontrol was deferred, because tlbcontrol works on the TLB's compressed entry bits on the hit path.

The new self-checking test hptwReservedAD checks:

• each reserved case takes a store page fault with the right mtval and leaves the PTE unchanged;
• legal PTEs, including PBMT=NC with PBMTE=1, still get A and D.

It fails on main, and ImperasDV flags the PTE readback there; with the fix it passes with 0 mismatches.

Found while reviewing #1924/#1931/#1932, which share the root cause: the walker's checks and controls drift from the TLB's. Related to #1921.

🤖 Generated with Claude Code

[rosethompson]

Is this PR no longer needed after the merge of PR #1916?

[davidharrishmc]

Redundant after 1916.