yunsup made this fix..ask him

riscv/htif.cc

@@ -51,6 +51,11 @@ void htif_t::wait_for_start()
   while(wait_for_packet() != APP_CMD_START);
 }
 
+void htif_t::wait_for_tohost_write()
+{
+  while(wait_for_packet() != APP_CMD_READ_CONTROL_REG);
+}
+
 void htif_t::wait_for_fromhost_write()
 {
   while(wait_for_packet() != APP_CMD_WRITE_CONTROL_REG);

riscv/htif.h

@@ -19,6 +19,7 @@ public:
 
   // we block on the host if the target machine reads the fromhost register,
   // which provides determinism in tohost/fromhost communication.
+  void wait_for_tohost_write();
   void wait_for_fromhost_write();
 
 private:

riscv/sim.cc

@@ -58,6 +58,7 @@ void sim_t::set_tohost(reg_t val)
 {
   fromhost = 0;
   tohost = val;
+  htif->wait_for_tohost_write();
 }
 
 reg_t sim_t::get_fromhost()