## Host environment - Operating system: Ubuntu 24.04.4 LTS - OS/kernel version: 6.18.33.2-microsoft-standard-WSL2 - Architecture: x86_64 - QEMU flavor: qemu-riscv32 linux-user - QEMU version: qemu-riscv32 version 11.0.91 - QEMU command line: `./qemu-riscv32 -cpu rv32e,h=false,zcd=false,zca=true,zcmp=true,zicsr=true ./rv32e_target_cm_mvsa01_s2_s3.elf` ## Emulated/Virtualized environment - Operating system: static RV32 test ELFs executed through Linux user mode - Architecture: riscv32 - CPU configurations: - `rv32e,h=false,zcd=false,zca=true,zcmp=true,zicsr=true` - `rv32i,h=false,zcd=false,zca=true,zcmp=true,zicsr=true` ## Description of problem On RV32E, the saved-register subset is smaller than on RV32I. The attached witnesses stay on that exact boundary: one legal RV32E control uses the low saved-register subset, two target cases use the high-sreg forms on RV32E, and the same raw words are also provided as legal RV32I controls. Current `qemu-riscv32` retires all five cases. Because the same raw words are legal on RV32I but also accepted on RV32E, this points to a missing RV32E high-sreg legality check in `cm.mvsa01/cm.mva01s`, not to a general decode failure. Observed: | case | raw word | observed | | --- | --- | --- | | `rv32e_control_cm_mvsa01_s0_s1.elf` | `0xac26` | `exit=42` | | `rv32e_target_cm_mvsa01_s2_s3.elf` | `0xad2e` | `exit=42` | | `rv32e_target_cm_mva01s_s2_s3.elf` | `0xad6e` | `exit=42` | | `rv32i_control_cm_mvsa01_s2_s3.elf` | `0xad2e` | `exit=42` | | `rv32i_control_cm_mva01s_s2_s3.elf` | `0xad6e` | `exit=42` | Expected: - the RV32E `s0/s1` control should retire - the RV32E `s2/s3` forms should be rejected - the RV32I controls should keep retiring ## Steps to reproduce 1. Save the five attached source files. 2. Build the RV32E witnesses with: `riscv64-linux-gnu-gcc -nostdlib -static -march=rv32e_zca -mabi=ilp32e -Wl,-e,_start -o <name>.elf <name>.S` 3. Build the RV32I controls with: `riscv64-linux-gnu-gcc -nostdlib -static -march=rv32i_zca -mabi=ilp32 -Wl,-e,_start -o <name>.elf <name>.S` 4. Run the RV32E witnesses with: `./qemu-riscv32 -cpu rv32e,h=false,zcd=false,zca=true,zcmp=true,zicsr=true ./<name>.elf` 5. Run the RV32I controls with: `./qemu-riscv32 -cpu rv32i,h=false,zcd=false,zca=true,zcmp=true,zicsr=true ./<name>.elf` 6. Observe that all five witnesses retire with `exit=42`. ## Additional information - Reproduced on current upstream build: (`qemu-riscv32 version 11.0.91`) - The same raw words are legal controls on `RV32I + Zcmp`, but they are also accepted on `RV32E + Zcmp`. - Relevant current source locations: - `target/riscv/tcg/insn_trans/trans_rvzce.c.inc:272-282` - `target/riscv/tcg/insn_trans/trans_rvzce.c.inc:285-296` - `target/riscv/translate.c:836-839` - `target/riscv/tcg/insn_trans/trans_rvzce.c.inc:116-165` - `trans_cm_mva01s()` and `trans_cm_mvsa01()` accept these forms, while nearby `cm.push/cm.pop/...` paths already carry an explicit RV32E legality guard. - Relevant ISA boundary: these RV32E selector combinations are outside the legal saved-register subset. ## Attachments - [rv32e_control_cm_mvsa01_s0_s1.S](/uploads/b433382470085b091ab1b620015bb3b5/rv32e_control_cm_mvsa01_s0_s1.S) - [rv32e_target_cm_mvsa01_s2_s3.S](/uploads/599fa95c8e86bc2be633579d54aa5b1b/rv32e_target_cm_mvsa01_s2_s3.S) - [rv32e_target_cm_mva01s_s2_s3.S](/uploads/ebf0630e30242b700e2b211cfa9339b2/rv32e_target_cm_mva01s_s2_s3.S) - [rv32i_control_cm_mvsa01_s2_s3.S](/uploads/e092835fcde30e0ecd54cb4ba7a99fa9/rv32i_control_cm_mvsa01_s2_s3.S) - [rv32i_control_cm_mva01s_s2_s3.S](/uploads/f6c4d620654161ac0f807a78f313fa2c/rv32i_control_cm_mva01s_s2_s3.S)