FA-89726 / Instruction set emulation / Open access

Privilege requirement read from the access-type bits · case 01

Supervisor code can access machine CSRs.

Verified by executionVariant 1 · 11 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The minimum privilege is taken from bits 11:10 instead of 9:8.

THE FAILURE

The minimum privilege is taken from bits 11:10 instead of 9:8.

Unsuccessful approach: Reading bits 10:9 mixes one access bit into the privilege field.

Case contract

Input [priv, csr, op, rs1, value, csrs] with priv 0 (U), 1 (S) or 3 (M) and csrs mapping decimal-string CSR numbers to values. Unknown CSR -> 'illegal'. Bits 9:8 of the CSR number give the lowest privilege allowed; bits 11:10 equal to 3 mark it read-only. csrrw/csrrwi always write; csrrs/csrrc/csrrsi/csrrci write only when the rs1 field (register index, or the 5-bit immediate for i-forms) is nonzero. Writing a read-only CSR -> 'illegal'. Operand: the register value, or the rs1 field itself for i-forms. New value: rw -> operand, rs -> old | operand, rc -> old & ~operand. Return ['ok', old, new (old if no write)].

Why this case matters

Privileged-architecture emulation must reject illegal CSR accesses exactly, since operating systems probe CSRs and rely on traps.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(*args):
    priv, csr, op, rs1, val, csrs = args
    if str(csr) not in csrs:
        return 'illegal'
    ro = (csr >> 10) & 3 == 3
    need = (csr >> 10) & 3
    if priv < need:
        return 'illegal'
    imm = op.endswith('i')
    v = rs1 if imm else val
    writes = op in ('csrrw', 'csrrwi') or rs1 != 0
    if ro and writes:
        return 'illegal'
    old = csrs[str(csr)]
    base = op[:5]
    if base == 'csrrw': new = v
    elif base == 'csrrs': new = old | v
    else: new = old & ~v & 0xFFFFFFFF
    return ['ok', old, new if writes else old]
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[('machine writes machine csr', [3, 768, 'csrrw', 5, 9, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 6144, 9]), ('user reads read-only counter', [0, 3072, 'csrrs', 0, 124, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 2457, 2457]), ('user set-bits with nonzero rs1 on read-only', [0, 3072, 'csrrs', 3, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('supervisor touches machine csr', [1, 768, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('immediate write to read-only hart id', [3, 3860, 'csrrwi', 0, 9, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('clear bits in user csr', [0, 1, 'csrrc', 2, 6, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 1]), ('set bits immediate form', [0, 1, 'csrrsi', 2, 100, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 7]), ('custom machine read-write csr', [3, 1985, 'csrrw', 1, 4, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 7, 4]), ('machine counter is writable', [3, 2816, 'csrrwi', 4, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 50, 4]), ('user reads supervisor csr', [0, 256, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('missing csr', [3, 292, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal')], [('machine writes machine csr', [3, 768, 'csrrw', 5, 10, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 6144, 10]), ('user reads read-only counter', [0, 3072, 'csrrs', 0, 125, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 2457, 2457]), ('user set-bits with nonzero rs1 on read-only', [0, 3072, 'csrrs', 3, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('supervisor touches machine csr', [1, 768, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('immediate write to read-only hart id', [3, 3860, 'csrrwi', 0, 9, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('clear bits in user csr', [0, 1, 'csrrc', 2, 6, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 1]), ('set bits immediate form', [0, 1, 'csrrsi', 2, 101, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 7]), ('custom machine read-write csr', [3, 1985, 'csrrw', 1, 5, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 7, 5]), ('machine counter is writable', [3, 2816, 'csrrwi', 4, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 50, 4]), ('user reads supervisor csr', [0, 256, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('missing csr', [3, 293, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal')], [('machine writes machine csr', [3, 768, 'csrrw', 5, 11, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 6144, 11]), ('user reads read-only counter', [0, 3072, 'csrrs', 0, 126, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 2457, 2457]), ('user set-bits with nonzero rs1 on read-only', [0, 3072, 'csrrs', 3, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('supervisor touches machine csr', [1, 768, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('immediate write to read-only hart id', [3, 3860, 'csrrwi', 0, 9, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('clear bits in user csr', [0, 1, 'csrrc', 2, 6, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 1]), ('set bits immediate form', [0, 1, 'csrrsi', 2, 102, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 7]), ('custom machine read-write csr', [3, 1985, 'csrrw', 1, 6, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 7, 6]), ('machine counter is writable', [3, 2816, 'csrrwi', 4, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 50, 4]), ('user reads supervisor csr', [0, 256, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('missing csr', [3, 294, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal')], [('machine writes machine csr', [3, 768, 'csrrw', 5, 12, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 6144, 12]), ('user reads read-only counter', [0, 3072, 'csrrs', 0, 127, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 2457, 2457]), ('user set-bits with nonzero rs1 on read-only', [0, 3072, 'csrrs', 3, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('supervisor touches machine csr', [1, 768, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('immediate write to read-only hart id', [3, 3860, 'csrrwi', 0, 9, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('clear bits in user csr', [0, 1, 'csrrc', 2, 6, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 1]), ('set bits immediate form', [0, 1, 'csrrsi', 2, 103, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 7]), ('custom machine read-write csr', [3, 1985, 'csrrw', 1, 7, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 7, 7]), ('machine counter is writable', [3, 2816, 'csrrwi', 4, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 50, 4]), ('user reads supervisor csr', [0, 256, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('missing csr', [3, 295, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal')], [('machine writes machine csr', [3, 768, 'csrrw', 5, 13, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 6144, 13]), ('user reads read-only counter', [0, 3072, 'csrrs', 0, 128, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 2457, 2457]), ('user set-bits with nonzero rs1 on read-only', [0, 3072, 'csrrs', 3, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('supervisor touches machine csr', [1, 768, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('immediate write to read-only hart id', [3, 3860, 'csrrwi', 0, 9, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('clear bits in user csr', [0, 1, 'csrrc', 2, 6, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 1]), ('set bits immediate form', [0, 1, 'csrrsi', 2, 104, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 7]), ('custom machine read-write csr', [3, 1985, 'csrrw', 1, 8, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 7, 8]), ('machine counter is writable', [3, 2816, 'csrrwi', 4, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 50, 4]), ('user reads supervisor csr', [0, 256, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('missing csr', [3, 296, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal')]]
for label, args, expected in fixtures[N-1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
machine writes machine csr	`['ok', 6144, 9]`	`['ok', 6144, 9]`	Passed
user reads read-only counter	`illegal`	`['ok', 2457, 2457]`	Failed
user set-bits with nonzero rs1 on read-only	`illegal`	`illegal`	Passed
supervisor touches machine csr	`['ok', 6144, 6144]`	`illegal`	Failed
immediate write to read-only hart id	`illegal`	`illegal`	Passed
clear bits in user csr	`['ok', 5, 1]`	`['ok', 5, 1]`	Passed
set bits immediate form	`['ok', 5, 7]`	`['ok', 5, 7]`	Passed
custom machine read-write csr	`['ok', 7, 4]`	`['ok', 7, 4]`	Passed
machine counter is writable	`['ok', 50, 4]`	`['ok', 50, 4]`	Passed
user reads supervisor csr	`['ok', 34, 34]`	`illegal`	Failed
missing csr	`illegal`	`illegal`	Passed

SHA-256 / 5a0d26bb339dac3865c3bec2060e7b744bb261d8bb9b1e1a0a54b07303aee2c1

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(*args):
    priv, csr, op, rs1, val, csrs = args
    if str(csr) not in csrs:
        return 'illegal'
    ro = (csr >> 10) & 3 == 3
    need = (csr >> 9) & 3
    if priv < need:
        return 'illegal'
    imm = op.endswith('i')
    v = rs1 if imm else val
    writes = op in ('csrrw', 'csrrwi') or rs1 != 0
    if ro and writes:
        return 'illegal'
    old = csrs[str(csr)]
    base = op[:5]
    if base == 'csrrw': new = v
    elif base == 'csrrs': new = old | v
    else: new = old & ~v & 0xFFFFFFFF
    return ['ok', old, new if writes else old]
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
fixtures = [[('machine writes machine csr', [3, 768, 'csrrw', 5, 9, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 6144, 9]), ('user reads read-only counter', [0, 3072, 'csrrs', 0, 124, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 2457, 2457]), ('user set-bits with nonzero rs1 on read-only', [0, 3072, 'csrrs', 3, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('supervisor touches machine csr', [1, 768, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('immediate write to read-only hart id', [3, 3860, 'csrrwi', 0, 9, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('clear bits in user csr', [0, 1, 'csrrc', 2, 6, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 1]), ('set bits immediate form', [0, 1, 'csrrsi', 2, 100, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 7]), ('custom machine read-write csr', [3, 1985, 'csrrw', 1, 4, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 7, 4]), ('machine counter is writable', [3, 2816, 'csrrwi', 4, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 50, 4]), ('user reads supervisor csr', [0, 256, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('missing csr', [3, 292, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal')], [('machine writes machine csr', [3, 768, 'csrrw', 5, 10, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 6144, 10]), ('user reads read-only counter', [0, 3072, 'csrrs', 0, 125, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 2457, 2457]), ('user set-bits with nonzero rs1 on read-only', [0, 3072, 'csrrs', 3, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('supervisor touches machine csr', [1, 768, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('immediate write to read-only hart id', [3, 3860, 'csrrwi', 0, 9, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('clear bits in user csr', [0, 1, 'csrrc', 2, 6, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 1]), ('set bits immediate form', [0, 1, 'csrrsi', 2, 101, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 7]), ('custom machine read-write csr', [3, 1985, 'csrrw', 1, 5, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 7, 5]), ('machine counter is writable', [3, 2816, 'csrrwi', 4, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 50, 4]), ('user reads supervisor csr', [0, 256, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('missing csr', [3, 293, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal')], [('machine writes machine csr', [3, 768, 'csrrw', 5, 11, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 6144, 11]), ('user reads read-only counter', [0, 3072, 'csrrs', 0, 126, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 2457, 2457]), ('user set-bits with nonzero rs1 on read-only', [0, 3072, 'csrrs', 3, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('supervisor touches machine csr', [1, 768, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('immediate write to read-only hart id', [3, 3860, 'csrrwi', 0, 9, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('clear bits in user csr', [0, 1, 'csrrc', 2, 6, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 1]), ('set bits immediate form', [0, 1, 'csrrsi', 2, 102, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 7]), ('custom machine read-write csr', [3, 1985, 'csrrw', 1, 6, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 7, 6]), ('machine counter is writable', [3, 2816, 'csrrwi', 4, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 50, 4]), ('user reads supervisor csr', [0, 256, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('missing csr', [3, 294, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal')], [('machine writes machine csr', [3, 768, 'csrrw', 5, 12, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 6144, 12]), ('user reads read-only counter', [0, 3072, 'csrrs', 0, 127, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 2457, 2457]), ('user set-bits with nonzero rs1 on read-only', [0, 3072, 'csrrs', 3, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('supervisor touches machine csr', [1, 768, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('immediate write to read-only hart id', [3, 3860, 'csrrwi', 0, 9, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('clear bits in user csr', [0, 1, 'csrrc', 2, 6, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 1]), ('set bits immediate form', [0, 1, 'csrrsi', 2, 103, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 7]), ('custom machine read-write csr', [3, 1985, 'csrrw', 1, 7, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 7, 7]), ('machine counter is writable', [3, 2816, 'csrrwi', 4, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 50, 4]), ('user reads supervisor csr', [0, 256, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('missing csr', [3, 295, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal')], [('machine writes machine csr', [3, 768, 'csrrw', 5, 13, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 6144, 13]), ('user reads read-only counter', [0, 3072, 'csrrs', 0, 128, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 2457, 2457]), ('user set-bits with nonzero rs1 on read-only', [0, 3072, 'csrrs', 3, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('supervisor touches machine csr', [1, 768, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('immediate write to read-only hart id', [3, 3860, 'csrrwi', 0, 9, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('clear bits in user csr', [0, 1, 'csrrc', 2, 6, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 1]), ('set bits immediate form', [0, 1, 'csrrsi', 2, 104, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 5, 7]), ('custom machine read-write csr', [3, 1985, 'csrrw', 1, 8, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 7, 8]), ('machine counter is writable', [3, 2816, 'csrrwi', 4, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], ['ok', 50, 4]), ('user reads supervisor csr', [0, 256, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal'), ('missing csr', [3, 296, 'csrrs', 0, 0, {'768': 6144, '3860': 17, '256': 34, '3072': 2457, '1': 5, '1985': 7, '2816': 50}], 'illegal')]]
for label, args, expected in fixtures[N-1]:
    check(label, solve(*args), expected)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
machine writes machine csr	`['ok', 6144, 9]`	`['ok', 6144, 9]`	Passed
user reads read-only counter	`illegal`	`['ok', 2457, 2457]`	Failed
user set-bits with nonzero rs1 on read-only	`illegal`	`illegal`	Passed
supervisor touches machine csr	`['ok', 6144, 6144]`	`illegal`	Failed
immediate write to read-only hart id	`illegal`	`illegal`	Passed
clear bits in user csr	`['ok', 5, 1]`	`['ok', 5, 1]`	Passed
set bits immediate form	`['ok', 5, 7]`	`['ok', 5, 7]`	Passed
custom machine read-write csr	`['ok', 7, 4]`	`['ok', 7, 4]`	Passed
machine counter is writable	`['ok', 50, 4]`	`['ok', 50, 4]`	Passed
user reads supervisor csr	`['ok', 34, 34]`	`illegal`	Failed
missing csr	`illegal`	`illegal`	Passed

SHA-256 / ddf7add34c7fb9cfe20444416c3fa7630bb47671c3a47bea428bbdbf91bc815e

HELD IN THE MEMBER ARCHIVE

The verified repair and its recorded checks are member-only.

This mechanism has 11 recorded checks per implementation. The open-access tier publishes the failure and the unsuccessful fix; the repaired source that passes every check, and the observations that prove it, are available to members.

Every case sharing this mechanism uses the same contract and the same repair, so this one record is held back for all of them.

Member access is invitation-based. Sign in with your invited account to inspect the repair.

Verification & scope

A deterministic bounded teaching model of one emulator rule; the instruction semantics are a stipulated contract inspired by common ISAs and are not a claim of cycle-exact or architectural conformance. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:51:20.280679+00:00.

Case digest / 912a4491ba983bf0f6c9fbb2a382aadda04ba545e2a84cb1e56accc03a988d7f