What This Course Measured, and What It Refused To

Sixteen limits, and the two that decide the other fourteen

The limits are printed in the artifact’s own words, so that a reader who copies a number out of the file cannot lose the sentence that limits it. The first two decide what everything else is allowed to say, and they are worth reading twice because they are the reason this course is weaker than the two before it and more honest than either.

$ python3 rvpriv.py --run | sed -n '/^  1\. NO TIMING/,/^  3\./p'
  1. NO TIMING. No cycle, no latency, no throughput, no speedup, no ratio
     of anything a machine did. There is no RISC-V machine, no emulator and
     no RISC-V linker on this host, so every figure is a bit pattern, a
     count of bit patterns, an arithmetic identity, or a refusal from a
     real assembler. The x86-64 section measured a 4.92x and a 27.65x;
     those have NO COUNTERPART HERE AND ARE NOT INVENTED TO FILL THE GAP.
  2. NOTHING IS EXECUTED. Not one instruction in this course has run. A
     page-table walk in section 9 has never walked a page; it is a function
     that the compiler emitted and a disassembly that named it.
                

Limit 1 is the one that will be tested. The x86-64 ABI course in this collection measured a 4.92x and a 27.65x on hardware it could run, and a reader who has just finished that course is looking for a ratio. The honest alternative to a ratio is not a smaller ratio — it is an instruction count, a byte count, a field width, and the sentence that a count does not know whether the instruction is fast. Those two numbers have no counterpart here and are not invented to fill the gap.

Limit 3 is six absences in one item, and each one is a separate thing this course would otherwise be able to say:

$ python3 rvpriv.py --run | sed -n '/^  3\. NO EXCEPTION/,/^  4\./p'
  3. NO EXCEPTION IS EVER TAKEN, NO INTERRUPT IS EVER TAKEN, NO PAGE FAULT
     IS EVER RAISED, NO TLB IS EVER CONSULTED AND NO ACCESS FAULT IS EVER
     RAISED. Six separate absences, and each one is a separate thing this
     course would otherwise be able to say.
                

And limit 4 is the one that protects concept 3, quoted because it is the sentence a reader is most likely to lose:

$ python3 rvpriv.py --run | sed -n '/^  4\. THE ecall/,/^  5\./p'
  4. THE ecall CONVENTION IS MEASURED AS EMITTED, WHICH IS WEAKER. What is
     measured is that clang emits the constant 0x00000073 and that the
     convention's registers are a7 and a0. What is NOT measured is that the
     trap is taken, that it reaches supervisor mode, that a7 is read, that a
     kernel exists, or that anything comes back.
                

Eight things you cannot conclude, beside ten that they can

A list of limits says what this file declines to do. A list of what a reader therefore cannot conclude is a different thing, and it is the one that protects the reader rather than the file — because those are the sentences that would be false if you carried the sixteen promises in one direction rather than the other. It is printed beside the limits, not in a footnote, because a footnote is where a scope statement goes to be skipped.

$ python3 rvpriv.py --run | sed -n '/A LIST OF SIXTEEN LIMITS/,/THE OTHER HALF/p' | head -22
  A LIST OF SIXTEEN LIMITS says what this file declines to do.  A LIST OF WHAT A
  READER THEREFORE CANNOT CONCLUDE is a different thing ...

  * That a page is ever walked.  `walk.c` compiles to a function whose body
    is three `auipc`/`ld` pairs and whose name says walk.  No pointer is
    dereferenced, no PPN is translated, and `priv-spec` section 11.1.4 is
    quoted rather than performed.
  * That an `ecall` traps.  What is measured is the constant 0x00000073 and
    the register a7 around it.  Whether the trap is taken, whether control
    reaches supervisor mode, and whether anything returns are four separate
    questions and none of them has been asked of a machine.
  * That writing `mtvec` from S-mode raises an illegal-instruction
    exception.  The privilege bits of the CSR address are measured as
    NUMBERS.  The rule that turns the numbers into an exception is quoted,
    and there is no S-mode here to be refused by.
                

And here is the other half, because a course that prints only a cannot-list teaches its reader that the subject is unknowable — which is the opposite of what fourteen sections of measured bits are for:

$ python3 rvpriv.py --run | sed -n '/THE OTHER HALF/,/THE POINT/p' | head -20
  * Every bit pattern in this course is byte-for-byte reproducible from the
    files in this directory and the exact clang invocation section 1 prints.
  * Every relocation NAME and NUMBER this course uses appears in the psABI
    table AND in the object files of the corpus.  Names are a convention;
    numbers are a fact, and both were read rather than remembered.
  * Every refusal, by running the assembler.  0x1000, 0x20 and the rest are
    the assembler's own words, quoted verbatim, not this file's summary of
    what it probably said.
  * The size arithmetic, exactly: 4096 / 8 = 512, 3 x 9 + 12 = 39,
    64 - 4 - 16 - 8 = 36, 2048 - 1 = 2047.  Four identities, each one
    load-bearing for a field width, each one checkable with a pencil.
                

Both lists are pinned whole, sentence by sentence, by the harness — eighteen needles in all. That is not fussiness. The substring checks that a normal harness would use all pass over a bullet edited from “That a page is ever walked” to “That a page is walked, always”: the sentence still contains the subject and the verb, and the edit reverses the meaning without touching a word any check was written against. A scope list you can soften without editing a test is not a scope list. The intended cost of pinning is that a reworded claim has to be re-argued in the harness too.

Seventeen retractions, and two that are not about the reader

Every one of the seventeen was asserted in a draft of this course or in the plan it was written from, measured, and withdrawn. They are printed in full rather than footnoted, and a separate harness asserts their text — because that is the only mechanism that has ever stopped a retraction being quietly dropped.

$ python3 rvpriv.py --run | sed -n '/^  R17  CLAIMED/,+3p'
  R17  CLAIMED: the first correction to R16 named that register `rd`
        SOURCE: this course's own first CORRECTION to R16 -- the value was
        right and the field name was not
         there is no rd in an S-TYPE word at all, and the number was right while
                the NAME was wrong. A store has no destination register, so its
                inst[24:20] is rs2 ...
                

R17 is the one worth reading twice, because it is a retraction of a correction. The first version of the immediate table read inst[31:20] out of an S-type store and printed 0x006, where an immediate should be — a store’s immediate is split across inst[31:25] and inst[11:7]. That became R16. Then the first fix explained the 0x006 as the destination register — and a store has no destination register. The number was right; the name was wrong, and that is worse in one specific way: a wrong value is caught by the next comparison, a wrong field name is not, and it gets copied.

Eleven of the seventeen are about a reader, an instrument or an experiment; six are about a comparison. But two are not about the reader at all, and they are worth naming because a list that is uniformly one thing is a list nobody read:

• R10: this course cannot say what a trap, a page fault or a syscall does. That is not a limitation section; it is stated in the file’s header, in section 1, at the end of every affected section, and in the table above.
• R14: the defect is in a sibling’s decoder, not in this file’s. The inherited decoder declines any SYSTEM word whose rd or rs1 is non-zero, because the only two it knew were ecall and ebreak — so it cannot name SFENCE.VMA at all. The first run of the cross-check reported twelve of them as disagreements, and a reader would have had to work out that a decoder printing (undefined) is claiming the architecture defines no meaning for a word the architecture defines precisely.

A retraction that admits a whole section is uncleared is not a retraction, it is a course that has decided it is being careful. And the one that admits the defect is elsewhere is the one that keeps the other courses honest.

The claim that ties the list together is at the end of it, and it is the most interesting thing on the page:

$ python3 rvpriv.py --run | grep -B 1 -A 3 'NOTHING HERE IS A MISTAKE'
  NOTHING HERE IS A MISTAKE ABOUT HOW A COMPUTER WORKS.  That is seventeen
  courses in a row, and it is the most interesting thing about the list.  The
  RISC-V privileged architecture did not surprise this course once.  What
  surprised it was a mask two registers wide, a pseudo-instruction whose
  letter does not mean what it says, an assembler that enforces nothing, and
  its own dead-code elimination reported as a calling convention.
                

Seventeen courses in a row, and not one of the retractions is a discovery about the hardware. Every single one is a discovery about the machinery built to read the hardware.