Skip to content

fix(riscv): reject masked viota.m writing v0 - #253

Closed
carlosqwqqwq wants to merge 1 commit into
HexRaysSA:masterfrom
carlosqwqqwq:fix-riscv-viota-masked-vd-v0
Closed

fix(riscv): reject masked viota.m writing v0#253
carlosqwqqwq wants to merge 1 commit into
HexRaysSA:masterfrom
carlosqwqqwq:fix-riscv-viota-masked-vd-v0

Conversation

@carlosqwqqwq

Copy link
Copy Markdown
Contributor

fix(riscv): reject masked viota.m writing v0

Closes #248

Summary

The masked form of the vector iota instruction reads its predicate from v0, and the RISC-V V extension requires that a masked viota.m destination cannot overlap the mask register (riscv-v-spec, "Vector Iota Instruction" and Section 5.3). The affected Op::Viota branch only trapped on a non-zero vstart, so the masked vd == v0 encoding such as viota.m v0, v2, v0.t was executed and clobbered the mask. QEMU raises SIGILL for these encodings at decode time via trans_viota_m / require_vm.

The fix rejects any masked viota.m whose destination is v0, before the vstart check, matching QEMU's check order.

Validation

  • cargo test --lib: the targeted viota tests pass, and the full library test suite passes with no regressions.

No new upstream test files are added; this is a source-only change.

@19h

19h commented Aug 12, 2026

Copy link
Copy Markdown
Member

Thank you for reporting #248 and proposing a fix. This is now independently consolidated in #255, including masked vd=v0, destination/source overlap, and the nonzero-vstart rule, with transactional direct and SMIR/JIT coverage plus QEMU controls. To keep review and CI focused on one rollup, I am closing this PR in favor of #255. You are credited as co-author on the rollup commit.

@19h 19h closed this Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

masked viota.m writing v0 is executed

2 participants