Fix victim cache fill logic

Previous implementation did not correctly place the evicted I-cache
block into the victim cache, leaving all victim entries empty and
thus never hit. This patch properly stores the replaced I-cache
block into the victim cache before refill, allowing victim hits to
function as intended.

Measurement shows that the number of virtual-to-physical translations
during instruction fetch (mmu_translate() calls) decreased by ~7%.

Author: yy214123

riscv.c

@@ -333,13 +333,16 @@ static void mmu_fetch(hart_t *vm, uint32_t addr, uint32_t *value)
     }
 
     /* search the victim cache */
+    uint32_t vcache_key = addr >> ICACHE_OFFSET_BITS;
     for (int i = 0; i < VCACHE_BLOCKS; i++) {
         victim_cache_block_t *vblk = &vm->icache.v_block[i];
-        if (vblk->valid && vblk->tag == tag) {
-            /* victim cache hit, block swap*/
+
+        /* victim cache hit, swap blocks */
+        if (vblk->valid && vblk->tag == vcache_key) {
             icache_block_t tmp = *blk;
             *blk = *vblk;
             *vblk = tmp;
+            blk->tag = tag;
 
             uint32_t ofs = addr & ICACHE_BLOCK_MASK;
             *value = *(const uint32_t *) (blk->base + ofs);
@@ -351,7 +354,7 @@ static void mmu_fetch(hart_t *vm, uint32_t addr, uint32_t *value)
     vm->cache_fetch.misses++;
 #endif
 
-    /* cache miss, Continue using the original va->pa*/
+    /* icache miss, Continue using the original va->pa*/
     uint32_t vpn = addr >> RV_PAGE_SHIFT;
     uint32_t index = __builtin_parity(vpn) & 0x1;
     if (unlikely(vpn != vm->cache_fetch[index].n_pages)) {
@@ -370,7 +373,16 @@ static void mmu_fetch(hart_t *vm, uint32_t addr, uint32_t *value)
     *value =
         vm->cache_fetch[index].page_addr[(addr >> 2) & MASK(RV_PAGE_SHIFT - 2)];
 
-    /* fill into the cache */
+    /* Move the current icache block into the victim cache before replacement */
+    if (blk->valid) {
+        victim_cache_block_t *vblk = &vm->icache.v_block[vm->icache.v_next];
+        *vblk = *blk;
+        vblk->tag = (blk->tag << ICACHE_INDEX_BITS) | idx;
+        vblk->valid = true;
+        vm->icache.v_next = (vm->icache.v_next + 1) % VCACHE_BLOCKS;
+    }
+
+    /* fill into the icache */
     uint32_t block_off = (addr & RV_PAGE_MASK) & ~ICACHE_BLOCK_MASK;
     blk->base = (const uint8_t *) vm->cache_fetch[index].page_addr + block_off;
     blk->tag = tag;

riscv.h

@@ -119,6 +119,7 @@ typedef icache_block_t victim_cache_block_t;
 typedef struct {
     icache_block_t i_block[ICACHE_BLOCKS];
     victim_cache_block_t v_block[VCACHE_BLOCKS];
+    uint32_t v_next;
 } icache_t;
 
 struct __hart_internal {