fix(riscv): enforce execution, CSR, and SMIR constraints

src/backend/emulator/riscv/cpu.rs

@@ -12,7 +12,7 @@
 
 use std::sync::{Arc, Mutex};
 
-use vm_memory::{Bytes, GuestAddress, GuestMemoryMmap};
+use vm_memory::{Bytes, GuestAddress, GuestMemory, GuestMemoryMmap};
 
 use crate::error::{Error, Result};
 use crate::isa::riscv::{MemError, MemResult, Memory, RiscVConfig, RiscVCpu, RiscVExit};
@@ -53,6 +53,14 @@ fn in_uart(addr: u64) -> bool {
 }
 
 impl Memory for GuestBridge {
+    fn probe(&self, addr: u64, size: usize, _write: bool) -> MemResult<()> {
+        if in_uart(addr) || self.mem.check_range(GuestAddress(addr), size) {
+            Ok(())
+        } else {
+            Err(MemError::OutOfBounds { addr, size })
+        }
+    }
+
     fn read(&self, addr: u64, buf: &mut [u8]) -> MemResult<()> {
         if in_uart(addr) {
             for (i, b) in buf.iter_mut().enumerate() {

src/isa/riscv/compressed.rs

@@ -65,8 +65,8 @@ fn zcmp_sreg(r: u32) -> u8 {
 fn zcmp_reg_count(rlist: u32) -> Option<u32> {
     match rlist {
         4 => Some(1),              // ra
-        5 => Some(3),              // ra, s0-s1
-        6 => Some(3),              // alternate encoding for ra, s0-s1
+        5 => Some(2),              // ra, s0
+        6 => Some(3),              // ra, s0-s1
         7..=14 => Some(rlist - 3), // ra, s0-s1, s2..s(rlist-6)
         15 => Some(13),            // ra, s0-s1, s2-s11
         _ => None,
@@ -118,6 +118,9 @@ fn decode_q0(h: u16, funct3: u32, rv64: bool, isa: &Isa) -> Insn {
         }
         0b001 => {
             // C.FLD -> fld rd', off(rs1')  (RV32 & RV64; double)
+            if !isa.d {
+                return ill(h);
+            }
             let off = (bits(h, 12, 10) << 3) | (bits(h, 6, 5) << 6);
             mk(Op::Fld, rd_, rs1_, 0, off as i64, h)
         }
@@ -144,6 +147,9 @@ fn decode_q0(h: u16, funct3: u32, rv64: bool, isa: &Isa) -> Insn {
         }
         0b101 => {
             // C.FSD -> fsd rs2', off(rs1')
+            if !isa.d {
+                return ill(h);
+            }
             let off = (bits(h, 12, 10) << 3) | (bits(h, 6, 5) << 6);
             mk(Op::Fsd, 0, rs1_, rvc_reg(bits(h, 4, 2)), off as i64, h)
         }
@@ -348,6 +354,9 @@ fn decode_q2(h: u16, funct3: u32, rv64: bool, isa: &Isa) -> Insn {
         }
         0b001 => {
             // C.FLDSP -> fld rd, off(x2)
+            if !isa.d {
+                return ill(h);
+            }
             let off = (bit(h, 12) << 5) | (bits(h, 6, 5) << 3) | (bits(h, 4, 2) << 6);
             mk(Op::Fld, rd, 2, 0, off as i64, h)
         }
@@ -420,6 +429,9 @@ fn decode_q2(h: u16, funct3: u32, rv64: bool, isa: &Isa) -> Insn {
                 return decode_zcmp_zcmt(h, rv64, isa);
             }
             // C.FSDSP -> fsd rs2, off(x2)
+            if !isa.d {
+                return ill(h);
+            }
             let off = (bits(h, 12, 10) << 3) | (bits(h, 9, 7) << 6);
             mk(Op::Fsd, 0, 2, bits(h, 6, 2) as u8, off as i64, h)
         }
@@ -538,6 +550,43 @@ mod tests {
         assert_eq!(i.len, 2);
     }
 
+    #[test]
+    fn compressed_double_memory_encodings_require_d() {
+        let cases = [
+            (0x2000, Op::Fld), // C.FLD
+            (0x2002, Op::Fld), // C.FLDSP
+            (0xA000, Op::Fsd), // C.FSD
+            (0xA002, Op::Fsd), // C.FSDSP
+        ];
+        let with_d = Isa::rv64gc();
+        let no_d = Isa { d: false, ..with_d };
+
+        for xlen in [Xlen::Rv32, Xlen::Rv64] {
+            for (half, expected) in cases {
+                assert_eq!(
+                    decode_rvc(half, xlen, &with_d).op,
+                    expected,
+                    "{xlen:?}, half={half:#06x}, D enabled"
+                );
+                assert_eq!(
+                    decode_rvc(half, xlen, &no_d).op,
+                    Op::Illegal,
+                    "{xlen:?}, half={half:#06x}, D disabled"
+                );
+            }
+        }
+
+        // The Q2/FUNCT3=101 slot belongs to Zcmp/Zcmt when either extension is
+        // enabled; a D gate must not hide a valid compressed macro encoding.
+        let mut zcmp_without_d = no_d;
+        zcmp_without_d.zcmp = true;
+        let cm_push = ((0b101 << 13) | (0x18 << 8) | (5 << 4) | (1 << 2) | 0b10) as u16;
+        assert_eq!(
+            decode_rvc(cm_push, Xlen::Rv64, &zcmp_without_d).op,
+            Op::CmPush
+        );
+    }
+
     #[test]
     fn c_li() {
         // c.li x10, -1 : funct3=010, rd=10, imm=-1 (all imm bits set)
@@ -676,12 +725,18 @@ mod tests {
         let i = decode_rvc(cm_push, Xlen::Rv64, &isa);
         assert_eq!(i.op, Op::CmPush);
         assert_eq!(i.rd, 5);
-        assert_eq!(i.imm, 48);
+        assert_eq!(i.imm, 32);
 
         let cm_popretz = ((0b101 << 13) | (0x1c << 8) | (5 << 4) | 0b10) as u16;
         let i = decode_rvc(cm_popretz, Xlen::Rv64, &isa);
         assert_eq!(i.op, Op::CmPopRetz);
-        assert_eq!(i.imm, 32);
+        assert_eq!(i.imm, 16);
+
+        let cm_push_s1 = ((0b101 << 13) | (0x18 << 8) | (6 << 4) | (1 << 2) | 0b10) as u16;
+        let i = decode_rvc(cm_push_s1, Xlen::Rv64, &isa);
+        assert_eq!(i.op, Op::CmPush);
+        assert_eq!(i.rd, 6);
+        assert_eq!(i.imm, 48);
 
         let cm_mvsa01 =
             ((0b101 << 13) | (0b011 << 10) | (0 << 7) | (0b01 << 5) | (2 << 2) | 0b10) as u16;