fix(riscv): validate vector, scalar, and privileged semantics

[19h]

@carlosqwqqwq, this is the next independently implemented consolidation after #203, #231, and #255. Thank you for continuing to identify RISC-V gaps. Please review the consolidated behavior and tests here.

Overview

This change independently reproduces the reported failures against the current ISA contracts and implements the accepted fixes without importing contributor commits or copying their patches:

• require the F extension for RV32 compressed floating-point encodings;
• reject reserved CBO, obsolete SFENCE.VM, and obsolete URET encodings;
• centralize RVV operand-group, alignment, mask, overlap, SEW/EMUL, and segment validation;
• implement segment fault-only-first load behavior, including precise first-element faults and later vl trimming;
• make whole-register moves honor vstart in SEW elements and preserve overlapping sources;
• restore architectural SRET state and privilege transitions;
• make WFI wake on locally enabled pending interrupts without fabricating a trap when global interrupt conditions do not permit one;
• enforce each CSR encoding's minimum privilege before reads or writes;
• canonicalize modeled mstatus, mip, medeleg, and mideleg WARL fields and derive the read-only mstatus.SD aggregate;
• implement 32-bit mcounteren, add scounteren, and enforce lower-privilege counter access gates;
• enforce instruction-fetch IALIGN before direct or JIT region execution;
• implement RV32 Zfa fmvh.x.d/fmvp.d.x and admit HLVX.WU on RV32 across decode, direct execution, disassembly, and SMIR/JIT;
• cover direct execution, SMIR/JIT O0 and O2 paths, and QEMU differential cases.

Scope reconciliation

The x86 native-replay and AVX-512 repairs that temporarily accompanied this branch independently landed on master in e0f2daf6. This PR was rebased onto that master and contains only the RISC-V consolidation in commits b53add43 and 9027ae1f.

Consolidated reports

This supersedes #261, #262, #263, #264, #265, #272, #273, #274, #275, #282, #283, #284, #285, #291, #292, #293, #294, #295, #302, #303, #304, #306, #312, #314, #315, and #316.

#271 is already covered by merged #255. #281 was withdrawn after its reduction-overlap report proved to be a false positive, so it is intentionally excluded.

For #294, SRET is incorporated, while URET is rejected because the current privileged architecture no longer defines the former N-extension instruction. For #295, the valid WFI wake condition is incorporated, while the proposed unconditional trap is not: wake eligibility and interrupt trap eligibility are separate architectural decisions.

#300/#305 and #308/#313 were independently falsified and closed rather than incorporated:

• RVV indexed segment instructions use the encoded EEW for the index vector; each data field remains SEW-wide, so changing field spacing to index EEW would corrupt legal execution. A defensive regression test now fixes that distinction in place.
• sip/sie are restricted views of mip/mie; when SSIP is not delegated through mideleg, the supervisor-visible bit is read-only zero. Making it writable regardless of delegation would violate the privileged architecture.

Issues

Fixes #256
Fixes #257
Fixes #258
Fixes #259
Fixes #260
Fixes #267
Fixes #268
Fixes #269
Fixes #270
Fixes #277
Fixes #278
Fixes #279
Fixes #280
Fixes #286
Fixes #287
Fixes #288
Fixes #289
Fixes #290
Fixes #297
Fixes #298
Fixes #299
Fixes #301
Fixes #307
Fixes #309
Fixes #310
Fixes #311

#266 is a duplicate of behavior already fixed by #255. #276 was withdrawn with #281. #300 and #308 were closed as invalid after the specification checks above.

Validation

Final local tree:

• cargo fmt --all --check
• cargo clippy --all-targets --features x86_64-suite
• cargo clippy --lib --no-default-features --features x86_64-suite,smir-jit -- -D warnings
• cargo build --all-targets --no-default-features --features x86_64-suite,smir-jit
• exhaustive serial library gate with ignored cases enabled: 8,598 passed, 0 failed
• focused RISC-V library tests: 186 passed, 0 failed
• RISC-V SMIR lift/oracle tests: 13 passed; 177,078 audited encodings, with the existing five CSR-immediate helper gaps reported explicitly
• RISC-V x86-64 SMIR/JIT tests: 36 passed at the covered O0/O2 boundaries
• RVV differential tests: 33 passed, including reserved-encoding validation
• scalar RISC-V differential tests: 30 passed
• QEMU/reference sweeps were exercised: FP 38,598; vector 2,151; compressed 20,000; CSR 20,428; control-flow 60,000, with zero reported divergence

Hosted checks for head 9027ae1f328eb81e705c2e42a11d8d61e41ce216 are available on the PR checks page and will be reflected here after completion.

Change-surface audit

Plane	Result
Direct decode	Affected for compressed-F gating, CBO, obsolete privileged encodings, RVV legality, RV32 Zfa moves, and RV32 HLVX.WU.
Direct execute	Affected for centralized RVV validation, segment fault-only-first behavior, whole-register restart, SRET, WFI, CSR gates/WARL behavior, fetch alignment, and Zfa moves.
CPU state	Adds private scounteren state; derives SD on reads; rejected forms and traps remain transactional. No public ABI layout changes.
Memory/MMU	Vector memory alignment/group checks and segment fault ordering are affected; RV32 HLVX.WU uses the existing hypervisor-load memory contract.
SMIR lift	Invalid RISC-V forms fail before opaque execution; RV32 Zfa moves lift to existing integer operations; HLVX.WU uses the existing load representation.
SMIR IR	Existing operations express the behavior; no new OpKind is required.
SMIR interpreter	Existing operations and opaque RISC-V helpers cover the corrected paths.
Optimizer	O0/O2 equivalence is retained and covered; no pass rule changes.
Native lowering	Existing integer/load lowering covers the newly admitted Zfa and HLVX forms; unsupported paths remain fail-closed.
JIT runtime	Checks IALIGN before region formation and shares transactional RISC-V validation/fallback behavior.
Backend	Emulator adapters use the corrected CPU paths; KVM/HVF contracts are unchanged.
Machine/device	Unaffected.
Oracle/analysis	Decode rejection/admission follows the corrected direct decoder; no schema change.
C ABI	Unaffected.
Tests/docs	Direct, SMIR/JIT, differential, WARL, counter, and reserved-encoding coverage is affected.

Assumption Register

ID	Assumption	Basis	Dependent result	Stress test	Falsification probe	Status
A1	Current privileged ISA text is authoritative for obsolete SFENCE.VM and URET encodings.	Current privileged specification and present extension ownership supersede historical encodings.	Both encodings reject unless their current owning extension is implemented.	Decode the exact historical words under all implemented privilege modes.	A current ratified specification defining either historical instruction at that encoding.	confirmed
A2	WFI local wake eligibility is distinct from global interrupt trap eligibility.	The privileged architecture specifies wake conditions separately from interrupt-taking conditions.	A locally enabled pending interrupt wakes WFI without fabricating a trap when global conditions block delivery.	Pending interrupts across M/S/U privilege and global/local enable combinations.	A normative rule requiring every WFI wake to synthesize an interrupt trap.	confirmed
A3	Segment fault-only-first loads require execution semantics rather than decode-only admission.	RVV defines first-element precise traps and later-element vl trimming.	Later segment faults shorten vl; first-element faults remain precise.	Fault each field/lane boundary, including element zero and nonzero vstart.	Direct/QEMU behavior trapping on every later-element segment fault.	confirmed
A4	Shared pre-execution RVV validation reaches direct and opaque SMIR/JIT execution before architectural mutation.	Both paths enter the same validator and the helper copies state only on successful completion.	Reserved encodings reject transactionally at O0 and O2.	Seed all destination/state fields and run every rejected form through both paths.	Any JIT validation case committing CPU or memory state for a rejected encoding.	confirmed
A5	CSR address bits 9:8 encode the minimum implemented privilege and the modeled privilege values are U=0, S=1, M=3.	Privileged CSR encoding rules and the repository's Priv representation agree.	Generic CSR instruction privilege enforcement.	U→S/M and S→M accesses, read-suppressed CSRRW, and destination preservation.	A recognized CSR whose access rule is not represented by its encoded privilege field.	confirmed
A6	Counter access in U-mode requires both mcounteren and scounteren; S-mode requires mcounteren.	Current privileged counter-enable definitions.	Counter-read illegal-instruction gates and 32-bit CSR masks.	CY clear/set across M/S/U and high-bit writes.	A current normative rule allowing U access with either enable clear.	confirmed
A7	Indexed-segment data fields are SEW-wide while the encoded EEW describes indices.	Current vector load/store specification and its SEW=32/EI8 examples.	#300/#305 are rejected; existing field spacing is retained.	EI8 index with SEW=32 and distinct adjacent words.	A normative indexed-segment address equation using index EEW for data-field stride.	confirmed
A8	Correcting RV32 HLVX.WU decode legality can use the repository's existing flat-memory H-load execution model.	All currently modeled HLV/HLVX forms share that explicit contract.	RV32 admission, direct execution, and SMIR/JIT parity.	RV32/RV64 decode gates and unsigned 32-bit load behavior.	Introduction of VS-stage translation or execute-only permission modeling in the H-load path.	retained

Out-of-scope findings

Impact	Finding	Evidence	Blocks this PR?
High	Hypervisor virtual loads/stores currently use the flat-memory load/store path and do not model VS-stage translation or HLVX execute-permission distinctions.	Existing hypervisor_virtual_load_store_use_flat_memory contract and shared HLV/HLVX execution arms.	No for correcting the RV32 encoding gate, but this limits claims about full H-extension memory semantics.

Co-authored-by: carlos 102978772+carlosqwqqwq@users.noreply.github.com

[carlosqwqqwq]

Reviewed the consolidated rollup against the reported issues. All accepted behaviors are implemented through the shared pre-execution validator (direct interpreter and SMIR/JIT helper paths), and the regression tests cover the reported encodings:

• RV32 C.FLW/C.FSW F-extension gate, reserved CBO funct7, obsolete SFENCE.VM and URET handling;
• operand-group alignment for vmul/vdiv/vrem, vsaddu/vsadd/vssubu/vssub, vssrl/vssra, vslide1down/vfslide1down, vsmul, vmseq family, vid.v, segment and non-segment vector memory ops;
• masked-destination v0 rule, vmadc/vmsbc mask-result overlap, viota.m overlap disposition, whole-register moves honoring vstart, segment fault-only-first execution semantics, SRET supervisor restore, and WFI local-wake semantics.

I also verified locally on the current head (75e7172): cargo test --lib evex_fma3_register_replay (8/8), evex_integer_unary_memory_source (12/12), evex_packed_extend_memory_source (13/13), and evex_packed_fp_unary_memory_source (21/21) all pass, including the native replay cases that previously raised SIGILL on the hosted linux-x64 lane. CI on the replacement hosted run is green across all platforms.

Thanks for the co-author credit and for consolidating these fixes.

[19h]

@carlosqwqqwq, the CI repair is complete on c08010fd. I independently validated and corrected the hosted AVX-512 failures: scalar FPCLASS LLIG replay is canonicalized without narrowing guest acceptance, VSCALEF/REDUCE edge semantics now match the Intel tables and runner hardware, SHA replay drops inert prefixes, and the native differentials now use exact vector bridge and byte-granular scratch state. CI, Cross-build, Microkernel, the 17-job Full suite, and all sanitizer/toolchain lanes are green; the replacement runs are linked in the updated description. The rollup still explicitly references every consolidated PR (#261-#265, #272-#275, #282-#285, and #291-#295) and records the accepted/rejected portions. Please review the updated head when convenient.

[19h]

@carlosqwqqwq, I have pushed commit 9027ae1 and expanded this rollup to cover #297, #298, #299, #301, #307, #309, #310, and #311. The corresponding implementation PRs #302, #303, #304, #306, #312, #314, #315, and #316 are now closed as consolidated here. I also independently checked #300/#305 and #308/#313 and documented in the PR description why those two proposals contradict the current specifications. Please review the updated direct, CSR, SMIR/JIT, and differential coverage when convenient.