Fix a few width issues identified by verilator lint. All of them gave

well-defined correct results already (i.e. correctly zero-extended per
spec) but best to avoid the noise.

hdl/arith/hazard3_alu.v

@@ -38,7 +38,7 @@ wire [W_DATA-1:0] op_a_shifted =
 
 wire [W_DATA-1:0] op_b_inv = op_b ^ {W_DATA{inv_op_b}};
 
-wire [W_DATA-1:0] sum  = op_a_shifted + op_b_inv + sub;
+wire [W_DATA-1:0] sum  = op_a_shifted + op_b_inv + {{W_DATA-1{1'b0}}, sub};
 wire [W_DATA-1:0] op_xor = op_a ^ op_b;
 
 wire cmp_is_unsigned = aluop == ALUOP_LTU ||
@@ -200,7 +200,7 @@ always @ (*) begin
 		{7'bzzzzz1z, ALUOP_BREV8  }: result = {op_a_rev[7:0], op_a_rev[15:8], op_a_rev[23:16], op_a_rev[31:24]};
 		{7'bzzzzz1z, ALUOP_UNZIP  }: result = unzip;
 		{7'bzzzzz1z, ALUOP_ZIP    }: result = zip;
-		// Xh3b
+		// Xh3bextm
 		{7'bzzzzzz1, ALUOP_BEXTM  }: result = shift_dout & {24'h0, {~(8'hfe << funct7_32b[3:1])}};
 
 		default:                    result = bitwise;

hdl/arith/hazard3_muldiv_seq.v

@@ -120,7 +120,7 @@ always @ (*) begin: alu
 		{neg_l_borrow, accum_next[XLEN-1:0]} = {~accum[XLEN-1:0]} + 1'b1;
 	if (accum_incr_h || accum_inv_h)
 		accum_next[XLEN +: XLEN] = (accum[XLEN +: XLEN] ^ {XLEN{accum_inv_h}})
-			+ accum_incr_h;
+			+ {{XLEN-1{1'b0}}, accum_incr_h};
 end
 
 // ----------------------------------------------------------------------------

hdl/arith/hazard3_onehot_encode.v

@@ -20,7 +20,7 @@ always @ (*) begin: encode
 	reg [W_GNT:0] i;
 	gnt = {W_GNT{1'b0}};
 	for (i = 0; i < W_REQ; i = i + 1) begin
-		gnt = gnt | ({W_GNT{req[i]}} & i[W_GNT-1:0]);
+		gnt = gnt | ({W_GNT{req[i[W_GNT-1:0]]}} & i[W_GNT-1:0]);
 	end
 end
 

hdl/hazard3_core.v

@@ -840,7 +840,7 @@ if (PMP_REGIONS > 0) begin: have_pmp
 
 end else begin: no_pmp
 
-	assign x_pmp_cfg_rdata = 1'b0;
+	assign x_pmp_cfg_rdata = 32'd0;
 	assign x_loadstore_pmp_fail = 1'b0;
 	assign x_exec_pmp_fail = 1'b0;
 

hdl/hazard3_frontend.v

@@ -119,6 +119,7 @@ reg                  fifo_err        [0:FIFO_DEPTH];
 reg  [1:0]           fifo_predbranch [0:FIFO_DEPTH];
 reg  [1:0]           fifo_valid_hw   [0:FIFO_DEPTH];
 reg                  fifo_valid      [0:FIFO_DEPTH];
+reg                  fifo_valid_m1   [0:FIFO_DEPTH];
 
 wire [W_DATA-1:0] fifo_rdata       = fifo_mem[0];
 wire              fifo_full        = fifo_valid[FIFO_DEPTH - 1];
@@ -135,9 +136,16 @@ always @ (*) begin: boundary_conditions
 	fifo_predbranch[FIFO_DEPTH] = 2'b00;
 	fifo_err[FIFO_DEPTH] = 1'b0;
 	fifo_valid_hw[FIFO_DEPTH] = 2'b00;
-	fifo_valid[FIFO_DEPTH] = 1'b0;
 	for (i = 0; i < FIFO_DEPTH; i = i + 1) begin
 		fifo_valid[i] = |EXTENSION_C ? |fifo_valid_hw[i] : fifo_valid_hw[i][0];
+		// valid-to-right condition: i == 0 || fifo_valid[i - 1], but without
+		// using negative array bound (seems broken in Yosys?) or OOB in the
+		// short circuit case (gives lint although result is well-defined)
+		if (i == 0) begin
+			fifo_valid_m1[i] = 1'b1;
+		end else begin
+			fifo_valid_m1[i] = fifo_valid[i - 1];
+		end
 	end
 end
 
@@ -158,11 +166,11 @@ always @ (posedge clk or negedge rst_n) begin: fifo_update
 				fifo_predbranch[i] <= fifo_valid[i + 1] ? fifo_predbranch[i + 1] : mem_data_predbranch;
 			end
 			fifo_valid_hw[i] <=
-				jump_now                                                 ? 2'h0                            :
-				fifo_valid[i + 1] && fifo_pop                            ? fifo_valid_hw[i + 1]            :
-				fifo_valid[i]     && fifo_pop                            ? mem_data_hwvld & {2{fifo_push}} :
-				fifo_valid[i]                                            ? fifo_valid_hw[i]                :
-				fifo_push && !fifo_pop && (i == 0 || fifo_valid[i - |i]) ? mem_data_hwvld                  : 2'h0;
+				jump_now                                   ? 2'h0                            :
+				fifo_valid[i + 1] && fifo_pop              ? fifo_valid_hw[i + 1]            :
+				fifo_valid[i]     && fifo_pop              ? mem_data_hwvld & {2{fifo_push}} :
+				fifo_valid[i]                              ? fifo_valid_hw[i]                :
+				fifo_push && !fifo_pop && fifo_valid_m1[i] ? mem_data_hwvld                  : 2'h0;
 		end
 		// Allow DM to inject instructions directly into the lowest-numbered
 		// queue entry. This mux should not extend critical path since it is
@@ -259,6 +267,11 @@ wire btb_match_next_addr    = btb_match_word && btb_src_overhanging;
 
 wire btb_match_now = btb_match_current_addr || btb_prev_start_of_overhanging;
 
+// Post-increment if jump request is going straight through
+wire [W_ADDR-1:0] jump_target_post_increment =
+	{jump_target[W_ADDR-1:2],                          2'b00} +
+	{{W_ADDR-3{1'b0}}, mem_addr_rdy && !mem_addr_hold, 2'b00};
+
 always @ (posedge clk or negedge rst_n) begin
 	if (!rst_n) begin
 		fetch_addr <= RESET_VECTOR;
@@ -267,8 +280,7 @@ always @ (posedge clk or negedge rst_n) begin
 		btb_prev_start_of_overhanging <= 1'b0;
 	end else begin
 		if (jump_now) begin
-			// Post-increment if jump request is going straight through
-			fetch_addr <= {jump_target[W_ADDR-1:2] + (mem_addr_rdy && !mem_addr_hold), 2'b00};
+			fetch_addr <= jump_target_post_increment;
 			fetch_priv <= jump_priv || !U_MODE;
 			btb_prev_start_of_overhanging <= 1'b0;
 		end else if (mem_addr_vld && mem_addr_rdy) begin
@@ -506,7 +518,7 @@ always @ (posedge clk or negedge rst_n) begin
 		buf_level <= 2'h0;
 		cir_vld <= 2'h0;
 		hwbuf <= 16'h0;
-		cir <= 16'h0;
+		cir <= 32'h0;
 		cir_bus_err <= 3'h0;
 		cir_predbranch_reg <= 3'h0;
 	end else begin