fix(riscv): enforce RVV reserved encoding constraints

[19h]

@carlosqwqqwq — this rollup consolidates the architectural fixes from #197, #198, #199, #200, #201, #202, #206, #208, #210, #212, #214, and #216. The broader module split in #202 is superseded by the focused validation and vector configuration/memory extraction in this rollup and was closed in favor of #203. Could you review the incremental #212/#214/#216 integrations and approval follow-up commit 9bf48ace, especially FP16-to-integer8 flags, precise RVV restart state, and decoder-profile gating?

Overview

This PR centralizes RVV architectural-constraint checking before any instruction can mutate guest state, completes the restart behavior identified during review, and corrects the related SMIR decode profile boundary:

• vmsbf/vmsif/vmsof are accepted with vd == vs2 #192 / fix(riscv): reject vmsbf/vmsif/vmsof with vd == vs2 #197: enforce vmsbf.m, vmsif.m, and vmsof.m restart and destination-overlap constraints.
• vadc/vsbc are accepted with vd == v0 #193 / fix(riscv): reject vadc/vsbc with vd == v0 #198: require the masked encoding and a non-v0 destination for every decoded vadc/vsbc form.
• vslide1up/vfslide1up are accepted with vd == vs2 #194 / fix(riscv): reject vslide1up/vfslide1up with vd == vs2 #199 and riscv: vslideup accepts partial vd/vs2 group overlap #204: reject every overlapping or misaligned source/destination group for vslideup, vslide1up, and vfslide1up, while retaining legal downward-slide overlap.
• narrowing instructions are executed with partial vd/vs2 group overlap #195 / fix(riscv): reject partial vd/vs2 overlap in narrowing ops #200: validate narrowing operands with exact rational LMUL/EMUL, including fractional LMUL, group alignment, legal lowest-register overlap, and the EMUL=16 reserved frontier.
• vector floating-point instructions are executed with a reserved frm value #196 / fix(riscv): reject vector FP ops with reserved frm #201: reject reserved frm=5/6/7 for every decoded OPFVV/OPFVF encoding, including exact and fixed-rounding operations when vl=0 or vstart>=vl.
• widening integer ops accept illegal vd/vs2 group overlaps #205 / fix(riscv): reject widening vd/vs2 overlap beyond the high part #206 and FP widening ops are executed with illegal vd/vs2 group overlaps #207 / fix(riscv): reject FP widening vd/vs2 overlap beyond the high part #208: validate integer and floating-point widening add/subtract, multiply, MAC/FMA, .w, conversion, extension, and reduction forms. Destructive MAC/FMA operands reject every overlap, as required when one source register would be read at two EEWs.
• vector floating-point instructions are executed at reserved SEW=8 #209 / fix(riscv): reject vector FP ops at SEW=8 #210: reject OPFVV/OPFVF operations that consume or produce unsupported FP8 values at SEW=8 while retaining the Zvfh-defined conversion exceptions.
• vfncvt FP-to-int narrowing is wrongly rejected at SEW=8 #211 / fix(riscv): allow vfncvt FP-to-int narrowing at SEW=8 #212: implement all four legal FP16-to-integer8 vfncvt forms at SEW=8, including exact RNE/RTZ behavior, signed and unsigned saturation, NaN/infinity handling, and accrued NV/NX flags. FP8-producing variants remain reserved.
• vid.v is executed with reserved non-zero vs2 #213 / fix(riscv): reject vid.v with non-zero vs2 #214: require the reserved VMUNARY0 vs2 field of vid.v to encode v0 in masked and unmasked forms.
• SMIR FP/vector lifters decode with a fixed rv64gc profile #215 / fix(riscv): lift FP and vector with the configured decoder profile #216: decode FP load/store, OP-FP, FMA, and RVV instructions with the configured SMIR extension profile instead of a fixed rv64gc profile.
• Approval follow-up: require the reserved vs2=v0 field for vmv.v.v/vmv.v.x/vmv.v.i; validate same-width integer vector groups; reject reductions with nonzero vstart; reset vstart after successful vsetvli/vsetivli/vsetvl; and implement precise vstart units, fault publication, vill handling, and restart semantics for mask and whole-register memory transfers.

The rational group model also validates vzext/vsext source EMUL for vf2/vf4/vf8. Widening reductions retain the scalar vd/vs1 exemption while still validating the vector source group.

Execution-plane behavior

The pre-execution validator is shared by the direct interpreter and the opaque SMIR/JIT RVV helper. Invalid arithmetic encodings trap before architectural state or memory is committed; legal overlap, fractional-LMUL, reduction-scalar, mixed conversion, and reserved-field controls remain accepted.

RVV memory restart state is now modeled at the architectural frontier. VLM/VSM use byte-indexed vstart; whole-register transfers use encoded-EEW element indices and remain legal with vill; all vector memory paths publish the exact faulting element; and the opaque SMIR interpreter commits partial vector state plus vstart on a memory trap. Native vector-memory lowering remains fail-closed, while native OP-V execution inherits the centralized validator and configuration behavior.

The touched oversized CPU implementation is split into focused vector_config and vector_memory modules. No new SMIR IR operation, optimizer contract, public Rust API, C ABI, backend adapter, or machine/device model is introduced. The SMIR profile fix reuses the existing decoder_isa() projection at every affected helper. The QEMU vector oracle applies input vstart after vsetvl, so restartability probes are not silently reset before execution.

Validation

• cargo fmt --all --check
• cargo build --all-targets --no-default-features --features x86_64-suite,smir-jit
• cargo build --all-targets --no-default-features --features x86_64-suite
• cargo clippy --all-targets --features x86_64-suite
• cargo test --no-default-features --features x86_64-suite,smir-jit --lib -- --include-ignored --test-threads=1: 8,249/8,249 passed, with zero ignored or filtered.
• GitHub Actions: 24/24 checks passed across formatting/Clippy, four host builds, four host core-test lanes, cross builds, and both microkernel runs.
• 26/26 focused direct RVV validation/configuration/memory tests and 69/69 broader RISC-V CPU tests passed.
• 10/10 focused SMIR interpreter tests passed, including partial vector-state and precise-vstart memory traps.
• 4/4 focused x86-64 O0/O2 JIT validation tests passed.
• The complete live QEMU RVV differential suite passed 33/33 batches without reported skips.
• The RISC-V SMIR lift differential suite passed 13/13 tests; its vector sweep reported 2,151 matches, zero gaps, and zero divergence.
• Direct semantic coverage includes legal/reserved controls, exact FP16-to-integer8 results and flags, restart boundaries, mask-byte and whole-register vstart units, vill, and faulting-element publication.
• The configured-profile regression reaches all three FP decoder sites with F enabled and D disabled, plus V-disabled and enabled RVV controls.

CI stability

The earlier CI repair commit in this rollup also:

• restores pure-interpreter and no-JIT builds by gating JIT-only EVEX lowering modules and runtime-only admission tests;
• supplies the ARMv6 __aeabi_uread4 helper required by the current nightly, with all four address residues tested during bare-metal boot;
• keeps mandatory cross targets fail-closed while reporting best-effort MIPS/Sparc toolchain failures as visible warnings;
• vendors the exact Arm 2025Q4 Run-time ABI source and provenance used for the helper contract.

Review notes and completed follow-up

Carlos independently confirmed the centralized overlap and reserved-encoding behavior, including the stricter destructive MAC/FMA rule, against RVV 1.0 and QEMU/native probes. The acknowledgements on #206, #208, and #210 do not request further rollup changes. The edited #204 report is fully covered by the shared slide-up group validator.

The newly opened #217/#218, #219/#220, #221/#222, and #223/#224 pairs cover separate, non-RVV SMIR control-flow, system-extension, and scalar-memory gaps. They were reviewed independently and are intentionally not consolidated here; each currently needs to be rebased off the closed #202 split and have its duplicated test attribute removed before merge. #222 also needs independent Zicsr/F/V gate controls, and #224 needs end-to-end optimized/native fault and side-effect coverage for its otherwise unused load result.

Commit 9bf48ace implements all seven remaining RVV gaps identified in the approval: vmv reserved fields, mask/whole-register memory vstart, vsetvl reset behavior, nonrestartable reductions, same-width group alignment, the whole-register vill exception, and precise faulting-element publication. It carries Carlos's co-author trailer.

Fixes #192
Fixes #193
Fixes #194
Fixes #195
Fixes #196
Fixes #204
Fixes #205
Fixes #207
Fixes #209
Fixes #211
Fixes #213
Fixes #215

[19h]

@carlosqwqqwq — PR #203 is now ready for review and all CI checks are green. It consolidates the RVV fixes from #197, #198, #199, #200, and #201 into shared pre-execution validation, adds direct/SMIR-JIT/QEMU differential coverage, and includes the CI repairs for no-JIT builds, ARMv6 microkernel linking, and experimental cross-target reporting. Could you review the combined architectural constraints, especially register-group overlap and reserved frm handling?

[19h]

@carlosqwqqwq — I reviewed the additional PRs #206, #208, and #210 and incorporated their underlying fixes into #203 alongside #197, #198, #199, #200, and #201. The widening implementation here also covers the missing fractional-EMUL, destructive MAC/FMA, .w source-width, extension, and reduction-scalar cases; the SEW=8 FP rule preserves the Zvfh-defined conversion exceptions. I reviewed #202 as well and kept that mechanical module split separate from this semantic change.

The updated branch is green locally across 8,229 library tests (2 ignored), the full RISC-V lift/JIT/QEMU integration binaries, both portable all-targets feature builds, formatting, and Clippy. Could you review the consolidated behavior and the corrected differences from #206/#208/#210?

[carlosqwqqwq]

Confirmed the consolidated validation in vector_validation.rs against RVV 1.0 (§5.2 register-group overlap, §11 reserved encodings, §7 vstart, §8 SEW=8 FP) and QEMU 8.2.2 differential witnesses: frm=5/6/7 rejection for OPFVV/OPFVF, vmsbf/vmsif/vmsof vd==vs2 and masked vd==v0, vadc/vsbc vd==v0, vslideup group overlap, narrowing fractional-EMUL and lowest-register overlap, widening vv/vx/vf/.w forms, vzext/vsext source scaling, and reduction source-group alignment all match the spec and our local fixed builds.

Independent gaps outside #203 that remain on master (f508a8d, unchanged): vid.v non-zero vs2 (#213/#214), vmv.v.v reserved vs2, VLM/VSM and whole-register load/store vstart handling, vsetvl vstart clearing, reduction non-zero vstart, same-width vadd group alignment, vill exception path, and faulting-element vstart publication. Our D/S series (CSR/counters/misa/Zcmp and SMIR/JIT gating) are non-RVV and disjoint.

One semantic note on #206/#208: our patches allowed MAC/FMA high-part overlap while #203 rejects any vs2 overlap for destructive forms, which matches RVV §5.2. We treat the stricter #203 behavior as authoritative.

[19h]

@carlosqwqqwq — thank you for the detailed approval and for confirming that the stricter destructive MAC/FMA overlap rule is authoritative. Since that review, I incorporated corrected, co-authored versions of #212, #214, and #216; #203 now covers #197, #198, #199, #200, #201, #206, #208, #210, #212, #214, and #216, while #202 remains separate. I also added #204 to the closing references and recorded the remaining RVV gaps from your review as explicit follow-up scope. Could you review the three incremental commits, particularly the exact vfncvt flags/saturation behavior, centralized vid.v validation, and the F-enabled/D-disabled SMIR profile regression? Fresh CI is running on the updated head.

[19h]

@carlosqwqqwq — one scope update to my previous review request: #202 is now also closed as superseded by #203. The rollup keeps the structural change focused on centralized validation and the touched mixed-width conversion module rather than taking the broader mechanical split separately. The PR description now reflects that decision.

[19h]

@carlosqwqqwq — I addressed all seven remaining RVV gaps from your approval in commit 9bf48ace:

• reserved vs2=v0 encodings for the vmv.v.* family;
• byte-indexed VLM/VSM and EEW-indexed whole-register memory vstart;
• vstart=0 after successful vsetvli/vsetivli/vsetvl;
• illegal nonzero-vstart reductions;
• same-width integer group alignment and bounds;
• whole-register memory operation with vill; and
• precise faulting-element vstart publication, including partial-state commit through the opaque SMIR interpreter.

The commit carries your Co-authored-by trailer. Local verification passed 26/26 focused direct tests, 10/10 focused SMIR tests, 4/4 focused O0/O2 JIT tests, the complete 33/33 QEMU RVV differential suite, and 13/13 RISC-V lift differential tests with zero vector divergence. The PR description now documents the completed scope and validation; fresh CI is running on this head.

Could you review the incremental commit, particularly the memory restart frontier and whole-register vill exception?

[19h]

@carlosqwqqwq — final validation update for 9bf48ace: all 24 GitHub checks are green, including all four host core-test lanes, the cross-build matrix, and both microkernel runs. I also ran the exact Linux library configuration locally with ignored tests enabled and one test thread: 8,249/8,249 passed, with zero ignored or filtered. The PR description now records these final results.

[19h]

Follow-up monitoring after this rollup merged identified #245–#249. Because #203 and its first successor #231 are already merged, the independently reimplemented continuation is now #255, consolidating and superseding #250–#254 with Carlos credited as co-author.

[19h]

Follow-up validation and independently reimplemented RISC-V fixes now continue in #296. It consolidates the newly reported vector-memory, operand-validation, SRET, and WFI gaps, carries contributor credit, and is ready for review.