Skip to content

fix(riscv): reject masked vector instructions writing v0 - #272

Closed
carlosqwqqwq wants to merge 3 commits into
HexRaysSA:masterfrom
carlosqwqqwq:fix-riscv-masked-vd-v0
Closed

fix(riscv): reject masked vector instructions writing v0#272
carlosqwqqwq wants to merge 3 commits into
HexRaysSA:masterfrom
carlosqwqqwq:fix-riscv-masked-vd-v0

Conversation

@carlosqwqqwq

Copy link
Copy Markdown
Contributor

Closes #267

Summary

The RISC-V V extension reserves any masked vector instruction (vm=0) whose destination vector register group overlaps the mask register v0, because the mask is read from v0 while the destination is being written. The affected exec_vector path performed no such check for the ordinary arithmetic/logical/comparison families, so vadd.vv v0, v1, v2, v0.t executed and clobbered the mask mid-operation instead of raising an illegal-instruction trap. QEMU raises SIGILL for these encodings.

The fix rejects vm=0 with vd==v0 at the top of exec_vector, with exceptions for the carry/mask families that validate their own overlap constraints (vadc/vsbc/vmadc/vmsbc/vcompress and the mask-prefix ops viota/vmsbf/vmsif/vmsof, all of which already have dedicated checks).

Validation

  • cargo test --lib: the targeted masked-destination tests pass, and the full library test suite passes with no regressions.

No new upstream test files are added; this is a source-only change.

19h commented Aug 13, 2026

Copy link
Copy Markdown
Member

Thanks for the report and patch. I independently reproduced and validated this issue, then reimplemented the accepted masked-destination rule with shared direct/SMIR validation and expanded tests in #296. That rollup includes your co-author credit and asks for your review. I’m closing this PR as superseded by #296.

@19h 19h closed this Aug 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

masked vector instructions writing v0 are executed

2 participants