`mtval` is written on delegated traps handled in S-mode, which Priv 1.10 forbids ("otherwise, `mtval` is never written by the implementation")

[dreamqin68]

Summary

On main at b91c909, the machine-level mtval is written by an early trap-entry path that is not conditioned on the trap actually being taken into M-mode. When an exception is delegated and handled in S-mode, mtval is clobbered with that exception's value even though no trap into M-mode occurred.

The divergent write is visible in the RTL and is measured below by a testbench probe. It cannot be read by a software sequence after the fact, and the reason is architectural rather than a property of this core: the observability section states it and closes the interrupt route as well.

The rule

Privileged Architecture 1.10, src/machine.tex:

When a trap is taken into M-mode, mtval is written with exception-specific information to assist software in handling the trap. Otherwise, mtval is never written by the implementation, though it may be explicitly written by software.

The sentence entered the manual twenty-six days before 1.10 was tagged, under the subject "Clarify [s/m][epc/tval/cause] are only written on exceptions into that mode" — the commit message states the rule directly. It is verbatim in ratified 1.11 and 1.12.

riscv-isa-manual bf25f06a004196d445e50014f9ac9b68f37de701   // added 2017-04-11

The C910 manual §1.5 declares Privileged Architecture 1.10 and names exactly one post-1.10 adoption (mcountinhibit), so this rule is in the declared target. The manual carries one version statement and no later or narrower one.

We deliberately do not rest this on 1.12's delegated-trap list, which additionally names mtval where 1.10's corresponding paragraph enumerates only mcause, mepc, MPP and MPIE. The claim stands on the 1.10 sentence above.

What the RTL does

C910_RTL_FACTORY/gen_rtl/cp0/rtl/ct_cp0_regs.v. The mtval write has two arms, and the early one is not qualified by the trap's destination:

:2045   else if((rtu_cp0_expt_vld || iui_regs_inv_expt) && !mdeleg_vld)    // mtval
:2376   else if((rtu_cp0_expt_vld || iui_regs_inv_expt) && mdeleg_vld)     // stval

iui_regs_inv_expt asserts before rtu_cp0_expt_vld, and while it is asserted mdeleg_vld still reads 0 for the exception in question — so !mdeleg_vld is satisfied and the early term admits a write for an exception that is about to be delegated to S-mode. In the run below the two events are three cycles apart (3291 and 3294); we report the measured separation rather than a fixed number, because the flop between them lives in ct_cp0_iui.v and we have not characterised its latency across cases.

That mdeleg_vld reads 0 during the early window is the pivot of the whole report, so here is what it is made of, in ct_cp0_regs.v:

:1790 assign medeleg_vld = (pm[1] == 1'b0) && !rtu_yy_xx_expt_vec[5]
:1791                  && |(vec_num[15:0] & edeleg[15:0]);
:1839 assign mideleg_vld = (pm[1] == 1'b0) && rtu_yy_xx_expt_vec[5]
:1840                  && |(vec_num[18:0] & mideleg_value[18:0]);
:1842 assign mdeleg_vld = medeleg_vld || mideleg_vld;

It is a function of the privilege mode and of the exception vector RTU presents, and it does not reference rtu_cp0_expt_vld at all, so it is not a delayed copy of the trap event. The 0 in the probe line below is therefore a measured value of this expression during the early window, not an assumption about pipeline timing. What we did not establish is which of its terms reads 0 there, which is also why the separation above is reported as measured rather than derived.

"Early" here means early relative to the trap, not early relative to commit, and that bound matters. A signal that wrote an architectural register from the execution stage would raise a second and worse question — whether a flushed wrong-path instruction can write mtval with no trap taken at all — and the answer is no: iui_regs_inv_expt is itself qualified by RTU's commit of that exact instruction. The divergence here is about WHICH register a committed, trapping instruction writes, and not about speculative state escaping a flush.

The commit qualification, and where the six occurrences of the early term are

In ct_cp0_iui.v:

:1081 assign iui_ex2_commit = rtu_yy_xx_commit0
:1082                         && (rtu_yy_xx_commit0_iid[6:0]
:1083                             == iui_ex1_iid[6:0]);
:1140 assign cp0_ex2_select = (cur_state[1:0] == EX2) && iui_ex2_commit;
:1430 assign iui_regs_inv_expt     = !iui_privilege && cp0_ex2_select;

A wrong-path instruction never appears on rtu_yy_xx_commit0 with its own iid, so it never asserts iui_regs_inv_expt and never reaches :2045. That is where we stop following the chain, and the reason is that the two terms answer the question between them: commit is by definition after the flush that would kill a wrong-path instruction, and the iid comparison makes the signal specific to this instruction rather than to whatever else is committing.

Back in ct_cp0_regs.v, mtval and stval are the only two registers in the file whose trap-entry arm carries iui_regs_inv_expt, and one grep shows it. Grepping the file for that signal returns six lines, quoted whole so the count and the classification are checkable rather than asserted:

:176   iui_regs_inv_expt,
:270 input            iui_regs_inv_expt;
:802 wire             iui_regs_inv_expt;
:1098                         || iui_regs_inv_expt
:2045   else if((rtu_cp0_expt_vld || iui_regs_inv_expt) && !mdeleg_vld)
:2376   else if((rtu_cp0_expt_vld || iui_regs_inv_expt) && mdeleg_vld)

The last two are the mtval and stval guards quoted above, and they are the only two in a guard anywhere in the file. Three of the remaining four are declarations. The fourth is one term of a clock-gating enable:

:1092 assign regs_flush_clk_en = rtu_yy_xx_flush || iui_regs_sel
:1098                         || iui_regs_inv_expt

That one is worth naming rather than waving past: it can wake the gated clock these flops run on, which is part of how the early write happens at all, but it is an enable and cannot write a register.

Every other trap-entry register in the file is written on rtu_cp0_expt_vld alone. Each guard is quoted with the assignment underneath it, so the attribution is checkable rather than a list to be trusted:

Every other trap-entry write in `ct_cp0_regs.v`, guard and assignment

:1620   else if(rtu_cp0_expt_vld && !mdeleg_vld)
:1621     mpp[1:0] <= pm[1:0];
:1635   else if(rtu_cp0_expt_vld && mdeleg_vld)
:1636     spp <= pm[0];
:1655   else if(rtu_cp0_expt_vld && !mdeleg_vld)
:1656     mpie <= mie_bit;
:1669   else if(rtu_cp0_expt_vld && mdeleg_vld)
:1670     spie <= sie_bit;
:1685   else if(rtu_cp0_expt_vld && !mdeleg_vld)
:1686     mie_bit <= 1'b0;
:1699   else if(rtu_cp0_expt_vld && mdeleg_vld)
:1700     sie_bit <= 1'b0;
:1987   else if(rtu_cp0_expt_vld && !mdeleg_vld)
:1988     mepc_reg[62:0] <= rtu_cp0_epc[63:1];
:2009   else if(rtu_cp0_expt_vld && !mdeleg_vld)
:2010     m_intr <= rtu_yy_xx_expt_vec[5];
:2021   else if(rtu_cp0_expt_vld && !mdeleg_vld)
:2022     m_vector[4:0] <= rtu_yy_xx_expt_vec[4:0];
:2318   else if(rtu_cp0_expt_vld && mdeleg_vld)
:2319     sepc_reg[62:0] <= rtu_cp0_epc[63:1];
:2340   else if(rtu_cp0_expt_vld && mdeleg_vld)
:2341     s_intr <= rtu_yy_xx_expt_vec[5];
:2352   else if(rtu_cp0_expt_vld && mdeleg_vld)
:2353     s_vector[4:0] <= rtu_yy_xx_expt_vec[4:0];
:2653   if(rtu_cp0_expt_vld && !mdeleg_vld)
:2654     pm_wdata[1:0] = 2'b11;
:2655   else if(rtu_cp0_expt_vld && mdeleg_vld)
:2656     pm_wdata[1:0] = 2'b01;

Fourteen guards, seven register pairs — the privilege mode's own next value, the privilege stack, the interrupt-enable stack, the exception PC, and the two halves of the cause register, each with its M-mode and S-mode arm — and not one of them admits the early term. Within this file the early term is the exception and not the pattern, and stval shares it because mtval and stval are the same write pair.

A fragment out of a priority chain cannot show that the guard quoted is the only condition under which the register is written, so here are both chains in full — the mtval block and, for the paragraph below on interrupts, the mcause one, both from ct_cp0_regs.v:

The complete always blocks

:2041 always @(posedge regs_flush_clk or negedge cpurst_b)
:2042 begin
:2043   if(!cpurst_b)
:2044     mtval_data[63:0] <= 64'b0;
:2045   else if((rtu_cp0_expt_vld || iui_regs_inv_expt) && !mdeleg_vld)
:2046     mtval_data[63:0] <= mtval_upd_data[63:0];
:2047   else if(mtval_local_en)
:2048     mtval_data[63:0] <= iui_regs_src0[63:0];
:2049   else
:2050     mtval_data[63:0] <= mtval_data[63:0];
:2051 end
:2052 assign mtval_value[63:0] = mtval_data[63:0];
:2005 always @(posedge regs_flush_clk or negedge cpurst_b)
:2006 begin
:2007   if(!cpurst_b)
:2008     m_intr <= 1'b0;
:2009   else if(rtu_cp0_expt_vld && !mdeleg_vld)
:2010     m_intr <= rtu_yy_xx_expt_vec[5];
:2011   else if(mcause_local_en)
:2012     m_intr <= iui_regs_src0[63];
:2013   else
:2014     m_intr <= m_intr;
:2015 end

Both ranges are quoted line for line, :2041 to :2052 and :2005 to :2015, with nothing omitted — an excerpt could not establish what follows. Three arms each: reset, trap entry, and the CSR write, then the hold. No higher-priority arm can mask the trap-entry one, mtval_value is the readback and is the register itself, and there is no fourth write path — which is what makes the one-line change below sufficient rather than merely necessary.

Reproduction

A full reproduction — tool version strings, the exact commands, every test program and the whole of each run's output, each with a sha256 — is posted as the first comment on this issue.

Every transcript excerpt in this report is reformatted for reading — the probe's cycle column moved to the front, 0x added, short annotations appended, and lines the paragraph is not about left out. The reproduction comment carries each run's output verbatim and in full, so a line here can always be found there.

Whole SoC from reset, vendor smart_run Verilator flow, rv64imafdc, Verilator 5.048.

openc910 at b91c90914c19f114d35c8f6b73408eb241ed847c

Software writes a sentinel 0x0123456789abcdef into mtval from M-mode — which the specification explicitly permits — then delegates illegal-instruction (medeleg[2]), drops to S-mode and executes csrr a0, mstatus, which traps and is handled in S-mode.

Observed, in the reformatted shape stated above — the probe's own order is PROBE-EVENT cyc=<n> inv_expt=...:

cyc=2784  PROBE-MTVAL 0123456789abcdef   // the sentinel software wrote
cyc=3291  PROBE-EVENT inv_expt=1 expt_vld=0 mdeleg=0 upd=0000000030002573
cyc=3292  PROBE-MTVAL 0000000030002573   // <-- mtval clobbered with the opcode
cyc=3294  PROBE-EVENT inv_expt=0 expt_vld=1 mdeleg=1 upd=0000000030002573
cyc=3295  PROBE-STVAL 0000000030002573   // stval written, correctly
          STRAP 0000000000000002 0000000030002573   // the trap is handled in S-mode

The mtval write at 3292 follows the early event at 3291, before the trap event at 3294 has asserted mdeleg.

The STRAP line confirms the trap really went to S-mode. mtval was written anyway, and the value software had placed there is gone.

Controls, in companion runs of the same build — each case is its own simulation, so each transcript below is a separate run of the same model. A delegated ecall takes no early event, and the sentinel survives:

cyc=2784  PROBE-MTVAL 0123456789abcdef   // the sentinel, still there at the end
cyc=3264  PROBE-EVENT inv_expt=0 expt_vld=1 mdeleg=1 upd=0000000000000000
          STRAP 0000000000000009 0000000000000000   // ecall from S-mode, delegated

A non-delegated illegal instruction in S-mode, and one in M-mode, both write mtval correctly and read it back architecturally — these two are read by software, not by the probe:

MTRAP 0000000000000002 0000000030002573

MTRAP 0000000000000002 00000000f14090f3

About observability, stated plainly

The PROBE- lines above come from a testbench probe on the mtval write, not from software. That is not a weakening we chose — no software sequence can read mtval after a delegated trap, because entering M-mode to read it is itself a trap into M-mode, and every trap into M writes mtval. The specification sentence is precisely about a write that software cannot observe after the fact.

The obvious escape is an interrupt rather than an exception, and ct_cp0_regs.v closes that one too. mcause's interrupt bit is written under rtu_cp0_expt_vld && !mdeleg_vld, which IMPLIES :2045's guard rather than repeating it — :2045 admits the same condition and one more — and it takes its value from the interrupt indicator of the exception vector. Satisfying the guard is enough here because :2045 is the highest arm of its chain apart from reset, as the complete block above shows, so nothing higher can pre-empt it. A trap that reports an interrupt cause in M-mode has therefore necessarily written mtval as well:

:2009   else if(rtu_cp0_expt_vld && !mdeleg_vld)
:2010     m_intr <= rtu_yy_xx_expt_vec[5];
:2039 assign mtval_upd_data[63:0] = rtu_cp0_expt_vld ? rtu_cp0_expt_mtval[63:0]
:2040                                                : {32'b0, iui_regs_opcode[31:0]};

Neither guard discriminates between an interrupt and an exception, and the second line of :2039 is where the early window's upd=0x30002573 comes from: with rtu_cp0_expt_vld still 0, the update data is the IUI opcode. So an M-mode timer interrupt used to re-enter M-mode and read mtval overwrites it on the way in.

What it overwrites it with is decidable from the source, in C910_RTL_FACTORY/gen_rtl/rtu/rtl/ct_rtu_retire.v — quoted whole for the same reason as above, since the answer depends on where the interrupt arm sits in the chain:

The trap-value selection in full, then the two assignments that carry it out

:1212 // &CombBeg; @157
:1213 always @( rob_retire_inst0_mtval[39:0]
:1214        or retire_async_expt_vld
:1215        or rob_retire_inst0_immu_expt
:1216        or rob_retire_inst0_next_pc[38:11]
:1217        or ae_phy_addr[39:0]
:1218        or retire_ack_int
:1219        or rob_retire_inst0_high_hw_expt
:1220        or rob_retire_inst0_cur_pc[38:0])
:1221 begin
:1222   if(retire_async_expt_vld)
:1223     retire_expt_mtval_src[39:0] = ae_phy_addr[39:0];
:1224   else if(retire_ack_int)
:1225     retire_expt_mtval_src[39:0] = 40'b0;
:1226   else if(rob_retire_inst0_immu_expt && !rob_retire_inst0_high_hw_expt)
:1227     retire_expt_mtval_src[39:0] = {rob_retire_inst0_cur_pc[38:0],1'b0};
:1228   //32 bit inst cross 4k page fault, high half-word is 4k align of next pc
:1229   else if(rob_retire_inst0_immu_expt)
:1230     retire_expt_mtval_src[39:0] = {rob_retire_inst0_next_pc[38:11],12'b0};
:1231   else
:1232     retire_expt_mtval_src[39:0] = rob_retire_inst0_mtval[39:0];
:1233 // &CombEnd; @169
:1234 end
:1236 assign retire_expt_mtval[63:0] =
:1237   mmu_xx_mmu_en && !retire_async_expt_vld
:1238   ? {{24{retire_expt_mtval_src[39]}}, retire_expt_mtval_src[39:0]}
:1239   : {24'b0, retire_expt_mtval_src[39:0]};
:1244 assign retire_ack_int     = retire_expt_int;
:1313 assign rtu_cp0_expt_mtval[63:0] = retire_expt_mtval[63:0];

:1212 to :1239 is quoted line for line apart from the blank line :1235; :1244 and :1313 are two further assignments in the same file, quoted because the chain needs them.

The qualification first, because it is what a single-line quotation would have hidden: the interrupt arm at :1224 is second in the chain, under retire_async_expt_vld, which is the access-error state of the retire unit's asynchronous-exception machine (:2163 assign retire_async_expt_vld = (ae_cur_state[1:0] == AE_EXPT);). We did not characterise whether that arm can be live in the same retire as an interrupt, so what follows holds for an interrupt taken with no asynchronous exception valid alongside it. With that said: zero. The widening at :1236 sign-extends a value that is all zeros, so it is zero at 64 bits either way.

The other two terms are one line each in the same file, for a reader who wants the chain closed rather than named:

:1198 assign retire_expt_int           = rob_retire_inst0_int_vld
:1199                                    && !rob_retire_inst0_split
:1200                                    && !rob_retire_inst0_intmask;
:2163 assign retire_async_expt_vld             = (ae_cur_state[1:0] == AE_EXPT);

That the 40-bit selection above is the same wire as the 64-bit rtu_cp0_expt_mtval the mtval block reads is not an inference from the names. :1313 is the module output, and ct_core.v declares the wire and connects it to both instances:

:2054 wire    [63 :0]  rtu_cp0_expt_mtval;
:4688   .rtu_cp0_expt_mtval              (rtu_cp0_expt_mtval             ),
:4919   .rtu_cp0_expt_mtval                   (rtu_cp0_expt_mtval                  ),

So the interrupt path does not carry a second wrong value — it carries the benign one, and still destroys anything software had placed there. We are deliberately not building a second finding on that write: 1.10's paragraph enumerates the exceptions for which mtval is written and says it "is not modified for other exceptions", and says nothing about interrupts, so whether a zeroing write on an interrupt is permitted is a reading of 1.10 we are not going to assert. This whole section is read from the source and was not separately simulated; the reproduction above measures the exception path.

The probe testbench is the vendor's tb_verilator.v plus inserted lines only; the tooling refuses to run if the diff against the vendor file contains anything but insertions. It is one block, and this is all of the code in it:

`define CP0_REGS `CPU_TOP.x_ct_top_0.x_ct_core.x_ct_cp0_top.x_ct_cp0_regs

always @(posedge clk)
  if(rst_b)
  begin
    if(`CP0_REGS.iui_regs_inv_expt || `CP0_REGS.rtu_cp0_expt_vld)
      $display("PROBE-EVENT cyc=%0d inv_expt=%b expt_vld=%b mdeleg=%b upd=%h",
               cycle_count, `CP0_REGS.iui_regs_inv_expt,
               `CP0_REGS.rtu_cp0_expt_vld, `CP0_REGS.mdeleg_vld,
               `CP0_REGS.mtval_upd_data);
    if(`CP0_REGS.mtval_data !== probe_mtval_last)
    begin
      $display("PROBE-MTVAL cyc=%0d %h", cycle_count, `CP0_REGS.mtval_data);
      probe_mtval_last = `CP0_REGS.mtval_data;
    end
    if(`CP0_REGS.stval_data !== probe_stval_last)
    begin
      $display("PROBE-STVAL cyc=%0d %h", cycle_count, `CP0_REGS.stval_data);
      probe_stval_last = `CP0_REGS.stval_data;
    end
  end

It reads flops, drives nothing, and takes no trap, so it cannot be the cause of what it reports. The two probe_*_last registers are declared and initialised beside it; the surrounding comment block is omitted here.

The practical consequence is the one the sentence protects: mtval cannot hold M-mode state across S-mode execution on this core, even though the specification explicitly permits software to write it.

Suggested change

Drop the early term from the two guards, leaving the arm every other trap-entry register in the file already uses:

diff --git a/C910_RTL_FACTORY/gen_rtl/cp0/rtl/ct_cp0_regs.v b/C910_RTL_FACTORY/gen_rtl/cp0/rtl/ct_cp0_regs.v
index 11e7518..391041d 100644
--- a/C910_RTL_FACTORY/gen_rtl/cp0/rtl/ct_cp0_regs.v
+++ b/C910_RTL_FACTORY/gen_rtl/cp0/rtl/ct_cp0_regs.v
@@ -2042,7 +2042,7 @@ always @(posedge regs_flush_clk or negedge cpurst_b)
 begin
   if(!cpurst_b)
     mtval_data[63:0] <= 64'b0;
-  else if((rtu_cp0_expt_vld || iui_regs_inv_expt) && !mdeleg_vld) 
+  else if(rtu_cp0_expt_vld && !mdeleg_vld) 
     mtval_data[63:0] <= mtval_upd_data[63:0];
   else if(mtval_local_en)
     mtval_data[63:0] <= iui_regs_src0[63:0];
@@ -2373,7 +2373,7 @@ always @(posedge regs_flush_clk or negedge cpurst_b)
 begin
   if(!cpurst_b)
     stval_data[63:0] <= 64'b0;
-  else if((rtu_cp0_expt_vld || iui_regs_inv_expt) && mdeleg_vld) 
+  else if(rtu_cp0_expt_vld && mdeleg_vld) 
     stval_data[63:0] <= stval_upd_data[63:0];
   else if(stval_local_en)
     stval_data[63:0] <= iui_regs_src0[63:0];

That block is a file git apply will take from the repository root, checked against b91c909 as it stands rather than being retyped here. sha256 08f408027946a456921c4a8bacd9d0093136820a875b607d4e5ae03a5456f620 is over exactly those bytes. Take it with the code block's own copy control rather than by selecting the text; the note below says why that matters here.

The two hunks touch only the mtval and stval trap-entry guards in ct_cp0_regs.v and do not reach the pending-bit assignments earlier in that file, so they do not overlap them; note that it does change ct_cp0_regs.v, so if you are applying more than one patch to that file, apply each to a clean tree or expect the second index pre-image not to match.

Why the copy method matters for this diff

Here all four changed lines end in one of the vendor file's trailing spaces, and selecting the text by hand out of a rendered page is free to drop them. sha256sum on what you pasted answers whether the copy survived. If it does not match, recopy rather than reaching for a flag: we checked, and a copy with those four spaces gone applies under neither git apply nor git apply --ignore-whitespace, because the removed lines no longer match the file they are removing.

We re-elaborated the entire SoC from this patched source and re-ran the four cases; the reproduction comment carries every line of both runs under The whole output, with the suggested change applied. The clobbering write disappears and the sentinel survives. In the two non-delegated cases the write does not disappear but relocates to the trap event three cycles later with the same value — case C moves from cycle 3292 to 3295 and case D from 2834 to 2837 — and the architectural MTRAP readbacks are unchanged. That is a measured result, not a prescription.

Only the first of those two lines has a measurement behind it, and the diff says both because both are what we built. In every case we ran, :2376's early term contributed nothing: mdeleg_vld reads 0 while iui_regs_inv_expt is asserted, which fails that guard, and the stval write at 3295 comes from the ordinary rtu_cp0_expt_vld arm. We are not claiming the term is dead — its guard does not depend on rtu_cp0_expt_vld, so the source does not rule out a case in which it fires, and we did not construct one. The second line is a symmetric change carrying no evidence of its own; it is in the diff because the model we elaborated and measured contains it, and separating the two would mean publishing a patch we never built. To drop it, delete the second hunk — the one headed @@ -2373 — and the remainder applies on its own; the two hunks touch different registers and neither depends on the other.

Practical scenario

The first consequence needs no hypothetical user, and the evidence for it is the guard table above. mepc at :1987, and both halves of mcause at :2009 and :2021, take their trap-entry value under rtu_cp0_expt_vld && !mdeleg_vld and nothing more; each also has a CSR write arm below it, which is the software write the architecture requires and not a second trap path. mtval at :2045 is the one whose trap-entry arm carries an extra term. Those three registers, across four trap-entry write sites, exist to describe one trap between them, and after any delegated exception they describe two: mcause and mepc still hold the last trap that genuinely entered M-mode, while mtval holds an instruction that was handled entirely in S-mode. The M-mode trap record is internally inconsistent, and it is the extra term on one register that makes it so.

State the same limit here as in the observability section: that inconsistency is not software-observable either, for the same reason — every path back to M-mode rewrites mtval before anything can read it. It is a better statement of the same fact, not a second finding.

The sentence also makes one specific pattern legal: mtval may be written by software, and is otherwise written only on traps into M-mode, so a value placed there survives S-mode execution. Machine-mode firmware that uses it as scratch across an sret — an SBI implementation, a monitor staging a value before resuming a supervisor, a nested-trap debug path — gets the value back on this core only if no delegated exception occurred in between, and reads the opcode of whatever S-mode instruction trapped if one did. We did not find such a user in shipped firmware and do not claim one exists. The claim is narrower: the specification permits the pattern, and this core does not support it.

[dreamqin68]

Reproduction — mtval delegated write

Everything below is derived from the runs that produced the report: the programs are the sources that were assembled, the output is the whole of what the simulation printed, and each digest is over the text as quoted here.

Environment

what	value
simulator	Verilator 5.048 2026-04-26 rev v5.048
simulator image	verilator/verilator:v5.048 (Apptainer)
compiler	riscv64-unknown-elf-gcc (13.2.0-11ubuntu1+12) 13.2.0
compiler target	riscv64-unknown-elf
ISA string	rv64imafdc
source files elaborated	536
flow	the vendor's own smart_run Verilator flow, with an additive probe testbench
vendor testbench	smart_run/logical/tb/tb_verilator.v
vendor testbench sha256	fddf65cbd13688cc0b27f854792e5daf8937b918449c08a9bdd6f2649b8a12d3
probe testbench	$HARNESS/tb_mtval_probe.v
probe testbench sha256	51555ecfa4a1f948afe3ec795fada942fc6a1a7eec88a383479ffeeb8074d686
vendor lines	437
probe lines	501
added lines	64
deleted or modified lines	0
diff is additive only	True
enforced by	difflib.SequenceMatcher opcodes; anything but equal/insert exits rc=1

This unit runs an additive probe testbench rather than the vendor file unchanged; the rows above are the runner's own record of that diff, and the probe source is quoted below in full.

The simulation driver is the vendor's own logical/tb/sim_main1.cpp, unmodified, on every run quoted here -- it is in the elaboration command printed below. That it changes nothing against the driver this campaign used previously is checked rather than claimed: the same programs were run both ways on this simulator and every transcript came out byte-identical.

That comparison covers 12 transcripts, from the 3 elaborations that were run both ways.

One edit is made to the outputs below: paths under the harness directory are written as $HARNESS, because Verilator prints the absolute path of the file that calls $finish. Nothing else in any transcript is altered.

Checked out at:

openc910 at b91c90914c19f114d35c8f6b73408eb241ed847c

Commands

# 1. Elaborate the whole SoC, in verilator/verilator:v5.048 (Apptainer), from a directory beside smart_run/logical
verilator -x-assign 0 -Wno-fatal -Wno-TIMESCALEMOD --no-timing --threads 4 -cc --exe --top-module top -f ../logical/filelists/ip.fl -f ../logical/filelists/smart.fl +libext+.v+.h+.V+.sv+ +incdir+../logical/tb+ -y ../logical/tb $HARNESS/tb_mtval_probe.v ../logical/tb/sim_main1.cpp +define+NO_DUMP
cp ../logical/tb/Makefile_obj ./Makefile_obj
make -j$(nproc) -C obj_dir -f ../Makefile_obj

# 2. Build the test program, with riscv64-unknown-elf-gcc (13.2.0-11ubuntu1+12) 13.2.0
riscv64-unknown-elf-gcc -march=rv64imafdc -mabi=lp64d -nostdlib -nostartfiles \
    -T $HARNESS/link_fullcore.ld $HARNESS/<program>.S -o <program>.elf
riscv64-unknown-elf-objcopy -O srec <program>.elf <program>_inst.hex -j .text -j .rodata
smart_run/tests/bin/Srec2vmem <program>_inst.hex inst.pat
: > data.pat

# 3. Run, with inst.pat and data.pat beside the model
smart_run/work/obj_dir/Vtop

The programs

mtval_witness.S — sha256 6ae5ec564b366a95cbd3ecd440f5cb644632c81a925257611dd9835109f2cba8

// Full-core witness for the mtval delegated-trap class.
//
// The cone replay of this class DROVE iui_regs_inv_expt and mdeleg_vld
// separately, because the flop that separates them lives in ct_cp0_iui.v,
// outside the replayed cone. That made the one-cycle separation the class turns
// on an assumption of the harness rather than an observation. This program makes
// it arise: a real illegal instruction, executed by real software, at a real
// privilege level, on the whole SoC booting from reset.
//
// The mechanism, quoted from ct_cp0_regs.v:2045 and :2377, is two symmetric
// write conditions:
//
//     mtval: (rtu_cp0_expt_vld || iui_regs_inv_expt) && !mdeleg_vld
//     stval: (rtu_cp0_expt_vld || iui_regs_inv_expt) &&  mdeleg_vld
//
// and iui_regs_inv_expt = !iui_privilege && cp0_ex2_select at ct_cp0_iui.v:1430,
// which is EX2 -- long before the retire head where mdeleg_vld is computed. If
// that ordering holds in a real pipeline, an illegal instruction whose trap is
// delegated to S-mode writes BOTH registers, and mtval loses its value on a trap
// that was never taken into M-mode.
//
// Four cases, one per build. Each runs to the vendor PASS magic value from
// whichever handler it lands in.
//
//   CASE_A  medeleg[2]=1, illegal instruction in S-mode  -> delegated to S
//           THE CASE. Predicted: mtval loses the sentinel anyway.
//   CASE_B  medeleg[9]=1, ecall in S-mode                -> delegated to S
//           CONTROL. A delegated trap with NO early illegal-instruction pulse.
//           If the sentinel survives here and not in A, the early path is the
//           identified cause rather than delegation itself.
//   CASE_C  medeleg=0,    illegal instruction in S-mode  -> taken into M
//           CONTROL. Conformant: a trap into M-mode MAY write mtval. Also the
//           only case where mtval can be read architecturally, which is what
//           makes it a check on the probe rather than a second use of it.
//   CASE_D  medeleg[2]=1, illegal instruction in M-mode  -> taken into M
//           CONTROL. Delegation needs pm[1]==0, so an M-mode trap is never
//           delegated. Tests on real hardware the claim recorded in
//           openc910_mtval_delegated_write.md that the early arm DOES fire from
//           M-mode and is harmless there because of pm[1], not because it cannot
//           happen.
//
// Output, through the vendor character port at 0x01fffff0:
//
//     #<letter>
//     S                       (printed on entry to S-mode, cases A B C)
//     MTRAP <mcause> <mtval>  (M-mode handler; mtval is readable there)
//     STRAP <scause> <stval>  (S-mode handler; mtval is NOT readable there)
//     DONE
//
// Plain rv64imafdc. No T-Head custom instruction and no custom CSR.
//
// satp is deliberately never touched. It is zero at reset, which is Bare, so
// this class's measurement does not depend on the satp class's behaviour.

#define PRINT_PORT 0x01fffff0
#define SENTINEL   0x0123456789abcdef

#if defined(CASE_A)
# define CASE_LETTER 65
# define MEDELEG_MASK (1 << 2)
#elif defined(CASE_B)
# define CASE_LETTER 66
# define MEDELEG_MASK (1 << 9)
#elif defined(CASE_C)
# define CASE_LETTER 67
# define MEDELEG_MASK 0
#elif defined(CASE_D)
# define CASE_LETTER 68
# define MEDELEG_MASK (1 << 2)
#else
# error "define one of CASE_A CASE_B CASE_C CASE_D"
#endif

    .section .text.init, "ax"
    .globl __start
__start:
    li      sp, 0xee000

    li      a0, 35                      // '#'
    call    putc
    li      a0, CASE_LETTER
    call    putc
    li      a0, 10
    call    putc

    // One NAPOT PMP entry covering the whole address space, R|W|X, unlocked.
    // Without it S-mode cannot reach the character port and the run would look
    // like a silent hang. This is ordinary bare-metal setup and is not part of
    // what is being measured.
    li      t0, -1
    csrw    pmpaddr0, t0
    li      t0, 0x1f                    // A = NAPOT, R | W | X
    csrw    pmpcfg0, t0

    la      t0, mtvec_handler
    csrw    mtvec, t0
    la      t0, stvec_handler
    csrw    stvec, t0

    li      t0, MEDELEG_MASK
    csrw    medeleg, t0

    // The sentinel: a value only software put in mtval. If it is still there
    // after the trap, mtval was not written.
    li      t0, SENTINEL
    csrw    mtval, t0

#ifdef CASE_D
    // Never leaves M-mode. A write to the read-only mhartid drives iui_w_inv,
    // which drives iui_privilege low, which asserts iui_regs_inv_expt at EX2 --
    // from M-mode. Encoding: csrrw x1, mhartid, x1 = 0xf14090f3.
    csrrw   x1, mhartid, x1
    j       unreached
#else
    // mstatus.MPP = 01 (S), then mret.
    la      t0, smode_entry
    csrw    mepc, t0
    li      t1, (3 << 11)
    csrc    mstatus, t1
    li      t1, (1 << 11)
    csrs    mstatus, t1
    mret
#endif

    .align  2
smode_entry:
    li      a0, 83                      // 'S'
    call    putc
    li      a0, 10
    call    putc

#ifdef CASE_B
    // A delegated trap that does NOT go through the early illegal-instruction
    // path: an environment call, reported by the retire head only.
    ecall
#else
    // Illegal from S-mode: read an M-level CSR. csr_addr_inv drives
    // iui_privilege low and the trap cause is 2. Encoding:
    // csrrs a0, mstatus, x0 = 0x30002573.
    csrr    a0, mstatus
#endif
    j       unreached

    .align  2
mtvec_handler:
    // M-mode. mtval IS readable here, architecturally, with no probe.
    li      a0, 77                      // 'M'
    call    putc
    li      a0, 84                      // 'T'
    call    putc
    li      a0, 82                      // 'R'
    call    putc
    li      a0, 65                      // 'A'
    call    putc
    li      a0, 80                      // 'P'
    call    putc
    li      a0, 32
    call    putc
    csrr    a0, mcause
    call    puthex64
    li      a0, 32
    call    putc
    csrr    a0, mtval
    call    puthex64
    li      a0, 10
    call    putc
    j       done

    .align  2
stvec_handler:
    // S-mode. mtval is NOT readable here and no sequence from here can read it
    // without destroying it, which is why this class has a probe at all. What
    // IS read here is architectural and proves the trap was delegated.
    li      a0, 83                      // 'S'
    call    putc
    li      a0, 84                      // 'T'
    call    putc
    li      a0, 82                      // 'R'
    call    putc
    li      a0, 65                      // 'A'
    call    putc
    li      a0, 80                      // 'P'
    call    putc
    li      a0, 32
    call    putc
    csrr    a0, scause
    call    puthex64
    li      a0, 32
    call    putc
    csrr    a0, stval
    call    puthex64
    li      a0, 10
    call    putc
    j       done

unreached:
    // The instruction that was supposed to trap did not. Print it so the run is
    // reported as void rather than read as a null result.
    li      a0, 88                      // 'X'
    call    putc
    li      a0, 10
    call    putc

done:
    li      a0, 68                      // 'D'
    call    putc
    li      a0, 79                      // 'O'
    call    putc
    li      a0, 78                      // 'N'
    call    putc
    li      a0, 69                      // 'E'
    call    putc
    li      a0, 10
    call    putc

    // The vendor testbench finishes with TEST PASS on this value crossing an
    // integer writeback port. It is reached unconditionally: this program
    // reports and does not adjudicate.
    li      t0, 0x444333222
    add     t1, x0, t0
spin:
    j       spin

// a0 = character. Clobbers t0 only.
putc:
    li      t0, PRINT_PORT
    sw      a0, 0(t0)
    ret

// a0 = 64-bit value, printed as 16 lower-case hex digits.
puthex64:
    addi    sp, sp, -16
    sd      ra, 0(sp)
    sd      s8, 8(sp)
    mv      s8, a0
    li      t1, 60
puthex_digit:
    srl     a0, s8, t1
    andi    a0, a0, 0xf
    li      t2, 10
    blt     a0, t2, puthex_dec
    addi    a0, a0, 87
    j       puthex_emit
puthex_dec:
    addi    a0, a0, 48
puthex_emit:
    call    putc
    addi    t1, t1, -4
    bgez    t1, puthex_digit
    ld      s8, 8(sp)
    ld      ra, 0(sp)
    addi    sp, sp, 16
    ret

tb_mtval_probe.v — sha256 51555ecfa4a1f948afe3ec795fada942fc6a1a7eec88a383479ffeeb8074d686

/*Copyright 2019-2021 T-Head Semiconductor Co., Ltd.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
/*Copyright 2019-2021 T-Head Semiconductor Co., Ltd.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

`timescale 1ns/100ps

`define CLK_PERIOD          10
`define TCLK_PERIOD         40
`define MAX_RUN_TIME        32'h3000000

`define SOC_TOP             top.x_soc
`define RTL_MEM             top.x_soc.x_axi_slave128.x_f_spsram_large

`define CPU_TOP             top.x_soc.x_cpu_sub_system_axi.x_rv_integration_platform.x_cpu_top
`define tb_retire0          `CPU_TOP.core0_pad_retire0
`define retire0_pc          `CPU_TOP.core0_pad_retire0_pc[39:0]
`define tb_retire1          `CPU_TOP.core0_pad_retire1
`define retire1_pc          `CPU_TOP.core0_pad_retire1_pc[39:0]
`define tb_retire2          `CPU_TOP.core0_pad_retire2
`define retire2_pc          `CPU_TOP.core0_pad_retire2_pc[39:0]
`define CPU_CLK             `CPU_TOP.pll_cpu_clk
`define CPU_RST             `CPU_TOP.pad_cpu_rst_b
`define clk_en              `CPU_TOP.axim_clk_en
`define CP0_RSLT_VLD        `CPU_TOP.x_ct_top_0.x_ct_core.x_ct_cp0_top.x_ct_cp0_iui.cp0_iu_ex3_rslt_vld
`define CP0_RSLT            `CPU_TOP.x_ct_top_0.x_ct_core.x_ct_cp0_top.x_ct_cp0_iui.cp0_iu_ex3_rslt_data[63:0]

// `define APB_BASE_ADDR       40'h4000000000
`define APB_BASE_ADDR       40'hb0000000

module top(
  input wire clk
);
  reg jclk;
  reg rst_b;
  reg jrst_b;
  reg jtap_en;
  wire jtg_tms;
  wire jtg_tdi;
  wire jtg_tdo;
  wire  pad_yy_gate_clk_en_b;
  
  static integer FILE;
  
  wire uart0_sin;
  wire [7:0]b_pad_gpio_porta;
  
  assign pad_yy_gate_clk_en_b = 1'b1;
  
  //initial
  //begin
  //  clk =0;
  //  forever begin
  //    #(`CLK_PERIOD/2) clk = ~clk;
  //  end
  //end
  


  integer jclkCnt;
  initial 
  begin 
    jclk = 0;
    jclkCnt = 0;
    //forever begin
    //  #(`TCLK_PERIOD/2) jclk = ~jclk;
    //end
  end
  always@(posedge clk) begin
    if(jclkCnt < `TCLK_PERIOD / `CLK_PERIOD / 2 - 1) begin
      jclkCnt = jclkCnt + 1;
    end
    else begin
      jclkCnt = 0;
      jclk = !jclk;
    end
  end
  
  integer rst_bCnt;
  initial
  begin
    rst_bCnt = 0;
    rst_b = 1;
    //#100;
    //rst_b = 0;
    //#100;
    //rst_b = 1;
  end

  always@(posedge clk) begin
    rst_bCnt = rst_bCnt + 1;
    if(rst_bCnt > 10 && rst_bCnt < 20) rst_b = 0;
    else if(rst_bCnt > 20) rst_b = 1;
  end
  
  integer jrstCnt;
  initial
  begin
    jrst_b = 1;
    jrstCnt = 0;
    //#400;
    //jrst_b = 0;
    //#400;
    //jrst_b = 1;
  end
  always@(posedge clk) begin
    jrstCnt = jrstCnt + 1;
    if(jrstCnt > 40 && jrstCnt < 80) jrst_b = 0;
    else if(jrstCnt > 80) jrst_b = 1;
  end
 
  integer i;
  bit [31:0] mem_inst_temp [65536];
  bit [31:0] mem_data_temp [65536];
  integer j;
  initial
  begin
    $display("\t********* Init Program *********");
    $display("\t********* Wipe memory to 0 *********");
    for(i=0; i < 32'h16384; i=i+1)
    begin
      `RTL_MEM.ram0.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram1.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram2.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram3.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram4.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram5.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram6.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram7.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram8.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram9.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram10.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram11.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram12.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram13.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram14.mem[i][7:0] = 8'h0;
      `RTL_MEM.ram15.mem[i][7:0] = 8'h0;
    end
  
    $display("\t********* Read program *********");
    $readmemh("inst.pat", mem_inst_temp);
    $readmemh("data.pat", mem_data_temp);
  
    $display("\t********* Load program to memory *********");
    i=0;
    for(j=0;i<32'h4000;i=j/4)
    begin
      `RTL_MEM.ram0.mem[i][7:0] = mem_inst_temp[j][31:24];
      `RTL_MEM.ram1.mem[i][7:0] = mem_inst_temp[j][23:16];
      `RTL_MEM.ram2.mem[i][7:0] = mem_inst_temp[j][15: 8];
      `RTL_MEM.ram3.mem[i][7:0] = mem_inst_temp[j][ 7: 0];
      j = j+1;
      `RTL_MEM.ram4.mem[i][7:0] = mem_inst_temp[j][31:24];
      `RTL_MEM.ram5.mem[i][7:0] = mem_inst_temp[j][23:16];
      `RTL_MEM.ram6.mem[i][7:0] = mem_inst_temp[j][15: 8];
      `RTL_MEM.ram7.mem[i][7:0] = mem_inst_temp[j][ 7: 0];
      j = j+1;
      `RTL_MEM.ram8.mem[i][7:0] = mem_inst_temp[j][31:24];
      `RTL_MEM.ram9.mem[i][7:0] = mem_inst_temp[j][23:16];
      `RTL_MEM.ram10.mem[i][7:0] = mem_inst_temp[j][15: 8];
      `RTL_MEM.ram11.mem[i][7:0] = mem_inst_temp[j][ 7: 0];
      j = j+1;
      `RTL_MEM.ram12.mem[i][7:0] = mem_inst_temp[j][31:24];
      `RTL_MEM.ram13.mem[i][7:0] = mem_inst_temp[j][23:16];
      `RTL_MEM.ram14.mem[i][7:0] = mem_inst_temp[j][15: 8];
      `RTL_MEM.ram15.mem[i][7:0] = mem_inst_temp[j][ 7: 0];
      j = j+1;
    end
    i=0;
    for(j=0;i<32'h4000;i=j/4)
    begin
      `RTL_MEM.ram0.mem[i+32'h4000][7:0]  = mem_data_temp[j][31:24];
      `RTL_MEM.ram1.mem[i+32'h4000][7:0]  = mem_data_temp[j][23:16];
      `RTL_MEM.ram2.mem[i+32'h4000][7:0]  = mem_data_temp[j][15: 8];
      `RTL_MEM.ram3.mem[i+32'h4000][7:0]  = mem_data_temp[j][ 7: 0];
      j = j+1;
      `RTL_MEM.ram4.mem[i+32'h4000][7:0]  = mem_data_temp[j][31:24];
      `RTL_MEM.ram5.mem[i+32'h4000][7:0]  = mem_data_temp[j][23:16];
      `RTL_MEM.ram6.mem[i+32'h4000][7:0]  = mem_data_temp[j][15: 8];
      `RTL_MEM.ram7.mem[i+32'h4000][7:0]  = mem_data_temp[j][ 7: 0];
      j = j+1;
      `RTL_MEM.ram8.mem[i+32'h4000][7:0]   = mem_data_temp[j][31:24];
      `RTL_MEM.ram9.mem[i+32'h4000][7:0]   = mem_data_temp[j][23:16];
      `RTL_MEM.ram10.mem[i+32'h4000][7:0]  = mem_data_temp[j][15: 8];
      `RTL_MEM.ram11.mem[i+32'h4000][7:0]  = mem_data_temp[j][ 7: 0];
      j = j+1;
      `RTL_MEM.ram12.mem[i+32'h4000][7:0]  = mem_data_temp[j][31:24];
      `RTL_MEM.ram13.mem[i+32'h4000][7:0]  = mem_data_temp[j][23:16];
      `RTL_MEM.ram14.mem[i+32'h4000][7:0]  = mem_data_temp[j][15: 8];
      `RTL_MEM.ram15.mem[i+32'h4000][7:0]  = mem_data_temp[j][ 7: 0];
      j = j+1;
    end
  end

  integer clkCnt;
  always@(posedge clk) begin
    clkCnt = clkCnt + 1;
    if(clkCnt > `MAX_RUN_TIME) begin
      $display("**********************************************");
      $display("*   meeting max simulation time, stop!       *");
      $display("**********************************************");
      FILE = $fopen("run_case.report","w");
      $fwrite(FILE,"TEST FAIL");   
      $finish;
    end
  end
  initial
  begin
    clkCnt = 0;
  //#(`MAX_RUN_TIME * `CLK_PERIOD);
  //  $display("**********************************************");
  //  $display("*   meeting max simulation time, stop!       *");
  //  $display("**********************************************");
  //  FILE = $fopen("run_case.report","w");
  //  $fwrite(FILE,"TEST FAIL");   
  //$finish;
  end
  
  reg [31:0] retire_inst_in_period;
  reg [31:0] cycle_count;
  
  `define LAST_CYCLE 50000
  always @(posedge clk or negedge rst_b)
  begin
    if(!rst_b)
      cycle_count[31:0] <= 32'b1;
    else 
      cycle_count[31:0] <= cycle_count[31:0] + 1'b1;
  end
  
  
  always @(posedge clk or negedge rst_b)
  begin
    if(!rst_b) //reset to zero
      retire_inst_in_period[31:0] <= 32'b0;
    else if( (cycle_count[31:0] % `LAST_CYCLE) == 0)//check and reset retire_inst_in_period every 50000 cycles
    begin
      if(retire_inst_in_period[31:0] == 0)begin
        $display("*************************************************************");
        $display("* Error: There is no instructions retired in the last %d cycles! *", `LAST_CYCLE);
        $display("*              Simulation Fail and Finished!                *");
        $display("*************************************************************");
        //#10;
        FILE = $fopen("run_case.report","w");
        $fwrite(FILE,"TEST FAIL");   
  
        $finish;
      end
      retire_inst_in_period[31:0] <= 32'b0;
    end
    else if(`tb_retire0 || `tb_retire1 || `tb_retire2)
      retire_inst_in_period[31:0] <= retire_inst_in_period[31:0] + 1'b1;
  end
  
  
  
  reg [31:0] cpu_awaddr;
  reg [3:0]  cpu_awlen;
  reg [15:0] cpu_wstrb;
  reg        cpu_wvalid;
  reg [63:0] value0;
  reg [63:0] value1;
  reg [63:0] value2;
  
  
  always @(posedge clk)
  begin
    cpu_awlen[3:0]   <= `SOC_TOP.x_axi_slave128.awlen[3:0];
    cpu_awaddr[31:0] <= `SOC_TOP.x_axi_slave128.mem_addr[31:0];
    cpu_wvalid       <= `SOC_TOP.biu_pad_wvalid;
    cpu_wstrb        <= `SOC_TOP.biu_pad_wstrb;
    // value0           <= `CPU_TOP.core0_pad_wb0_data[63:0];
    // value1           <= `CPU_TOP.core0_pad_wb1_data[63:0];
    // value2           <= `CPU_TOP.core0_pad_wb2_data[63:0];
    value0              <= `CPU_TOP.x_ct_top_0.x_ct_core.x_ct_iu_top.x_ct_iu_rbus.rbus_pipe0_wb_data[63:0];
    value1              <= `CPU_TOP.x_ct_top_0.x_ct_core.x_ct_iu_top.x_ct_iu_rbus.rbus_pipe1_wb_data[63:0];
    value2              <= `CPU_TOP.x_ct_top_0.x_ct_core.x_ct_lsu_top.x_ct_lsu_ld_wb.ld_wb_preg_data_sign_extend[63:0];
  end
  
  always @(posedge clk)
  begin
      if(value0 == 64'h444333222 || value1 == 64'h444333222 || value2 == 64'h444333222)
    begin
      $display("**********************************************");
      $display("*    simulation finished successfully        *");
      $display("**********************************************");
     //#10;
     FILE = $fopen("run_case.report","w");
     $fwrite(FILE,"TEST PASS");   
  
     $finish;
    end
      else if (value0 == 64'h2382348720 || value1 == 64'h2382348720 || value2 == 64'h444333222)
    begin
     $display("**********************************************");
     $display("*    simulation finished with error          *");
     $display("**********************************************");
     //#10;
     FILE = $fopen("run_case.report","w");
     $fwrite(FILE,"TEST FAIL");   
  
     $finish;
    end
  
    else if((cpu_awlen[3:0] == 4'b0) &&
  //     (cpu_awaddr[31:0] == 32'h6000fff8) &&
  //     (cpu_awaddr[31:0] == 32'h0003fff8) &&
       (cpu_awaddr[31:0] == 32'h01ff_fff0) &&
        cpu_wvalid &&
       `clk_en)
    begin
     if(cpu_wstrb[15:0] == 16'hf)
     begin
        $write("%c", `SOC_TOP.biu_pad_wdata[7:0]);
     end
     else if(cpu_wstrb[15:0] == 16'hf0)
     begin
        $write("%c", `SOC_TOP.biu_pad_wdata[39:32]);
     end
     else if(cpu_wstrb[15:0] == 16'hf00)
     begin
        $write("%c", `SOC_TOP.biu_pad_wdata[71:64]);
     end
     else if(cpu_wstrb[15:0] == 16'hf000)
     begin
        $write("%c", `SOC_TOP.biu_pad_wdata[103:96]);
     end
    end
  
  end
  
  
  

  //--------------------------------------------------------------------------
  // ADDED by openc910_mtval_full_core. This file is the vendor's
  // smart_run/logical/tb/tb_verilator.v plus THIS BLOCK and nothing else;
  // run_mtval_fullcore.py fails closed unless the diff against the vendor file
  // is added lines only, with zero deletions and zero modifications.
  //
  // Why a probe is needed at all. mtval cannot be read by ANY software sequence
  // after a trap that was delegated to S-mode: reading an M-level CSR needs
  // M-mode, entering M-mode needs a trap into M, and on this core every trap
  // into M writes mtval --
  //
  //     else if((rtu_cp0_expt_vld || iui_regs_inv_expt) && !mdeleg_vld)
  //       mtval_data[63:0] <= mtval_upd_data[63:0];        ct_cp0_regs.v:2045
  //
  // so the act of getting into a position to read it destroys what is being
  // read. The REFERENCE leg of this class has exactly the same problem and
  // solves it the same way, by reading the register through Spike's debugger
  // rather than through the architecture. This block is the subject-side
  // equivalent: it reads the flop, takes no trap, drives nothing, and is
  // observation only.
  //
  // What is NOT probed, because it does not need to be: that the trap really
  // was delegated. The witness program reads scause and stval in its S-mode
  // handler and prints them through the vendor character port, which is an
  // ordinary architectural observation.
  //--------------------------------------------------------------------------
  `define CP0_REGS `CPU_TOP.x_ct_top_0.x_ct_core.x_ct_cp0_top.x_ct_cp0_regs

  reg [63:0] probe_mtval_last;
  reg [63:0] probe_stval_last;
  initial
  begin
    probe_mtval_last = 64'hdeadbeefdeadbeef;
    probe_stval_last = 64'hdeadbeefdeadbeef;
  end

  always @(posedge clk)
  begin
    if(rst_b)
    begin
      // Every cycle on which either trap-value register COULD be written, with
      // the two terms of the condition separated. This is the measurement the
      // cone replay could not make: there iui_regs_inv_expt and mdeleg_vld were
      // DRIVEN, because the flop that separates them lives in ct_cp0_iui.v,
      // outside the replayed cone. Here they arise.
      if(`CP0_REGS.iui_regs_inv_expt || `CP0_REGS.rtu_cp0_expt_vld)
        $display("PROBE-EVENT cyc=%0d inv_expt=%b expt_vld=%b mdeleg=%b upd=%h",
                 cycle_count, `CP0_REGS.iui_regs_inv_expt,
                 `CP0_REGS.rtu_cp0_expt_vld, `CP0_REGS.mdeleg_vld,
                 `CP0_REGS.mtval_upd_data);
      if(`CP0_REGS.mtval_data !== probe_mtval_last)
      begin
        $display("PROBE-MTVAL cyc=%0d %h", cycle_count, `CP0_REGS.mtval_data);
        probe_mtval_last = `CP0_REGS.mtval_data;
      end
      if(`CP0_REGS.stval_data !== probe_stval_last)
      begin
        $display("PROBE-STVAL cyc=%0d %h", cycle_count, `CP0_REGS.stval_data);
        probe_stval_last = `CP0_REGS.stval_data;
      end
    end
  end

  parameter cpu_cycle = 110;
  `ifndef NO_DUMP
  initial
  begin
  `ifdef NC_SIM
    $dumpfile("test.vcd");
    $dumpvars;  
  `else
    `ifdef IVERILOG_SIM
      $dumpfile("test.vcd");
      $dumpvars;  
    `else
      $dumpfile("test.vcd");
      $dumpvars;  
    `endif
  `endif
  end
  `endif
  
  assign jtg_tdi = 1'b0;
  assign uart0_sin = 1'b1;
  
  
  soc x_soc(
    .i_pad_clk           ( clk                  ),
    .b_pad_gpio_porta    ( b_pad_gpio_porta     ),
    .i_pad_jtg_trst_b    ( jrst_b               ),
    .i_pad_jtg_tclk      ( jclk                 ),
    .i_pad_jtg_tdi       ( jtg_tdi              ),
    .i_pad_jtg_tms       ( jtg_tms              ),
    .i_pad_uart0_sin     ( uart0_sin            ),
    .o_pad_jtg_tdo       ( jtg_tdo              ),
    .o_pad_uart0_sout    ( uart0_sout           ),
    .i_pad_rst_b         ( rst_b                )
  );
  
  int_mnt x_int_mnt(
  );
  
  // debug_stim x_debug_stim(
  // );

// Latest Power control
`ifdef UPF_INCLUDED
  import UPF::*;

  initial
  begin
        supply_on ("VDD", 1.00);
     	supply_on ("VDDG", 1.00);
  end

  initial 
  begin
    $deposit(top.x_soc.pmu_cpu_pwr_on,  1'b1);
    $deposit(top.x_soc.pmu_cpu_iso_in,  1'b0);
    $deposit(top.x_soc.pmu_cpu_iso_out, 1'b0);
    $deposit(top.x_soc.pmu_cpu_save,    1'b0);
    $deposit(top.x_soc.pmu_cpu_restore, 1'b0);
  end
`endif
  
  reg [31:0] virtual_counter;
  
  always @(posedge `CPU_CLK or negedge `CPU_RST)
  begin
    if(!`CPU_RST)
      virtual_counter[31:0] <= 32'b0;
    else if(virtual_counter[31:0]==32'hffffffff)
      virtual_counter[31:0] <= virtual_counter[31:0];
    else
      virtual_counter[31:0] <= virtual_counter[31:0] +1'b1;
  end 
  
  //always @(*)
  //begin
  //if(virtual_counter[31:0]> 32'h3000000) $finish;
  //end
  
endmodule

The whole output

vehicle_check is a bring-up program: it exercises the character port and the load path and touches none of the registers this report is about. It runs on every build below, so a build that had been broken by the change rather than corrected by it would say so here, independently of every value above. Its output carries the probe testbench's own lines as well, which is why it prints more than a bring-up program otherwise would.

mtval_witness_A — as printed, in full — sha256 8aa8355e991ee59bb628414ce4b0623b37d2c2e16a6522647836e31f56fad793

	********* Init Program *********
	********* Wipe memory to 0 *********
	********* Read program *********
	********* Load program to memory *********
PROBE-MTVAL cyc=1370603193 0000000000000000
PROBE-STVAL cyc=1370603193 0000000000000000
#A
PROBE-MTVAL cyc=2784 0123456789abcdef
S
PROBE-EVENT cyc=3291 inv_expt=1 expt_vld=0 mdeleg=0 upd=0000000030002573
PROBE-MTVAL cyc=3292 0000000030002573
PROBE-EVENT cyc=3294 inv_expt=0 expt_vld=1 mdeleg=1 upd=0000000030002573
PROBE-STVAL cyc=3295 0000000030002573
STRAP 0000000000000002 0000000030002573
DONE
**********************************************
*    simulation finished successfully        *
**********************************************
- $HARNESS/tb_mtval_probe.v:315: Verilog $finish

mtval_witness_B — as printed, in full — sha256 9acd838d0de8bd7485a23ca1c40a5a41cacbd35eebe3f9c26b58a677e7f382e0

	********* Init Program *********
	********* Wipe memory to 0 *********
	********* Read program *********
	********* Load program to memory *********
PROBE-MTVAL cyc=1370603193 0000000000000000
PROBE-STVAL cyc=1370603193 0000000000000000
#B
PROBE-MTVAL cyc=2784 0123456789abcdef
S
PROBE-EVENT cyc=3264 inv_expt=0 expt_vld=1 mdeleg=1 upd=0000000000000000
STRAP 0000000000000009 0000000000000000
DONE
**********************************************
*    simulation finished successfully        *
**********************************************
- $HARNESS/tb_mtval_probe.v:315: Verilog $finish

mtval_witness_C — as printed, in full — sha256 0c9e305dd0de5fde6f569a035d4f6a1f56f4f1e8b7ba0f051469ef582223432b

	********* Init Program *********
	********* Wipe memory to 0 *********
	********* Read program *********
	********* Load program to memory *********
PROBE-MTVAL cyc=1370603193 0000000000000000
PROBE-STVAL cyc=1370603193 0000000000000000
#C
PROBE-MTVAL cyc=2784 0123456789abcdef
S
PROBE-EVENT cyc=3291 inv_expt=1 expt_vld=0 mdeleg=0 upd=0000000030002573
PROBE-MTVAL cyc=3292 0000000030002573
PROBE-EVENT cyc=3294 inv_expt=0 expt_vld=1 mdeleg=0 upd=0000000030002573
MTRAP 0000000000000002 0000000030002573
DONE
**********************************************
*    simulation finished successfully        *
**********************************************
- $HARNESS/tb_mtval_probe.v:315: Verilog $finish

mtval_witness_D — as printed, in full — sha256 f1c8c4bfd1af589f5c31efd889c71873e617c497e6a995179c95158724a7febf

	********* Init Program *********
	********* Wipe memory to 0 *********
	********* Read program *********
	********* Load program to memory *********
PROBE-MTVAL cyc=1370603193 0000000000000000
PROBE-STVAL cyc=1370603193 0000000000000000
#D
PROBE-MTVAL cyc=2784 0123456789abcdef
PROBE-EVENT cyc=2833 inv_expt=1 expt_vld=0 mdeleg=0 upd=00000000f14090f3
PROBE-MTVAL cyc=2834 00000000f14090f3
PROBE-EVENT cyc=2836 inv_expt=0 expt_vld=1 mdeleg=0 upd=00000000f14090f3
MTRAP 0000000000000002 00000000f14090f3
DONE
**********************************************
*    simulation finished successfully        *
**********************************************
- $HARNESS/tb_mtval_probe.v:315: Verilog $finish

vehicle_check — as printed, in full — sha256 24d2d996e0903414512dc760422eccdf9669648f7af7573e048eae9fe1203907

	********* Init Program *********
	********* Wipe memory to 0 *********
	********* Read program *********
	********* Load program to memory *********
PROBE-MTVAL cyc=1370603193 0000000000000000
PROBE-STVAL cyc=1370603193 0000000000000000
VEHICLE-OK
**********************************************
*    simulation finished successfully        *
**********************************************
- $HARNESS/tb_mtval_probe.v:315: Verilog $finish

The whole output, with the suggested change applied

The body above quotes this run. It is the same simulator, the same programs, the same testbench and the same driver as everything above; the one difference is that one entry of the RTL filelist points into $PATCHED, a directory holding one file: the vendor's, with the diff from the report's Suggested change section applied. The vendor tree itself is never edited, which is why the command names a path outside it rather than being the command above run against a modified checkout. Applying that diff to a clean clone and running the unpatched command reaches the same source. The elaboration differs from the one above in that argument alone:

verilator -x-assign 0 -Wno-fatal -Wno-TIMESCALEMOD --no-timing --threads 4 -cc --exe --top-module top -f $PATCHED/C910_asic_rtl_patched.fl -f ../logical/filelists/smart.fl +libext+.v+.h+.V+.sv+ +incdir+../logical/tb+ -y ../logical/tb $HARNESS/tb_mtval_probe.v ../logical/tb/sim_main1.cpp +define+NO_DUMP

The two elaborations produced different binaries, which is checked rather than assumed: 6d2b6b03bcf0ae6a3fb5ffcab3ace6f8b1c79ad4546b65556afd01994973512c unpatched against 9639ffb9978d76fed28fac597d73bf17056279ccf4b5acaa7ff30a4757239ed0 patched.

mtval_witness_A, patched — as printed, in full — sha256 0418f18d1386d46a4cad6107c1d6218d17e4cd03a11aa1857464bdca5cf969bc

	********* Init Program *********
	********* Wipe memory to 0 *********
	********* Read program *********
	********* Load program to memory *********
PROBE-MTVAL cyc=1370603193 0000000000000000
PROBE-STVAL cyc=1370603193 0000000000000000
#A
PROBE-MTVAL cyc=2784 0123456789abcdef
S
PROBE-EVENT cyc=3291 inv_expt=1 expt_vld=0 mdeleg=0 upd=0000000030002573
PROBE-EVENT cyc=3294 inv_expt=0 expt_vld=1 mdeleg=1 upd=0000000030002573
PROBE-STVAL cyc=3295 0000000030002573
STRAP 0000000000000002 0000000030002573
DONE
**********************************************
*    simulation finished successfully        *
**********************************************
- $HARNESS/tb_mtval_probe.v:315: Verilog $finish

mtval_witness_B, patched — as printed, in full — sha256 9acd838d0de8bd7485a23ca1c40a5a41cacbd35eebe3f9c26b58a677e7f382e0

	********* Init Program *********
	********* Wipe memory to 0 *********
	********* Read program *********
	********* Load program to memory *********
PROBE-MTVAL cyc=1370603193 0000000000000000
PROBE-STVAL cyc=1370603193 0000000000000000
#B
PROBE-MTVAL cyc=2784 0123456789abcdef
S
PROBE-EVENT cyc=3264 inv_expt=0 expt_vld=1 mdeleg=1 upd=0000000000000000
STRAP 0000000000000009 0000000000000000
DONE
**********************************************
*    simulation finished successfully        *
**********************************************
- $HARNESS/tb_mtval_probe.v:315: Verilog $finish

mtval_witness_C, patched — as printed, in full — sha256 24d6911eb4d4c91a109afe77f61ffaf335565cb95edc36d2b785a4aab6a46062

	********* Init Program *********
	********* Wipe memory to 0 *********
	********* Read program *********
	********* Load program to memory *********
PROBE-MTVAL cyc=1370603193 0000000000000000
PROBE-STVAL cyc=1370603193 0000000000000000
#C
PROBE-MTVAL cyc=2784 0123456789abcdef
S
PROBE-EVENT cyc=3291 inv_expt=1 expt_vld=0 mdeleg=0 upd=0000000030002573
PROBE-EVENT cyc=3294 inv_expt=0 expt_vld=1 mdeleg=0 upd=0000000030002573
PROBE-MTVAL cyc=3295 0000000030002573
MTRAP 0000000000000002 0000000030002573
DONE
**********************************************
*    simulation finished successfully        *
**********************************************
- $HARNESS/tb_mtval_probe.v:315: Verilog $finish

mtval_witness_D, patched — as printed, in full — sha256 55704e4ece2cf8df23d67b3b7d185c92faacb0d3ccaf39921eb9dfcbec05141e

	********* Init Program *********
	********* Wipe memory to 0 *********
	********* Read program *********
	********* Load program to memory *********
PROBE-MTVAL cyc=1370603193 0000000000000000
PROBE-STVAL cyc=1370603193 0000000000000000
#D
PROBE-MTVAL cyc=2784 0123456789abcdef
PROBE-EVENT cyc=2833 inv_expt=1 expt_vld=0 mdeleg=0 upd=00000000f14090f3
PROBE-EVENT cyc=2836 inv_expt=0 expt_vld=1 mdeleg=0 upd=00000000f14090f3
PROBE-MTVAL cyc=2837 00000000f14090f3
MTRAP 0000000000000002 00000000f14090f3
DONE
**********************************************
*    simulation finished successfully        *
**********************************************
- $HARNESS/tb_mtval_probe.v:315: Verilog $finish

vehicle_check, patched — as printed, in full — sha256 24d2d996e0903414512dc760422eccdf9669648f7af7573e048eae9fe1203907

	********* Init Program *********
	********* Wipe memory to 0 *********
	********* Read program *********
	********* Load program to memory *********
PROBE-MTVAL cyc=1370603193 0000000000000000
PROBE-STVAL cyc=1370603193 0000000000000000
VEHICLE-OK
**********************************************
*    simulation finished successfully        *
**********************************************
- $HARNESS/tb_mtval_probe.v:315: Verilog $finish

$HARNESS is wherever the sources above are placed; every other path is relative to the root of the openc910 checkout.