Code of Conduct
CVA6 commit affected
81245a4
Bug Description
On cv64a6_imafdc_sv39 (RV64, ZKN = 1, RVB = 1), the following encodings are accepted,
executed and retired, although each is defined for RV32 only and must raise
illegal-instruction (mcause = 2) on RV64. The vendored Spike raises mcause = 2 for every one.
| instruction |
encoding (rd = x5, rs1 = x6, rs2 = x7) |
CVA6 |
Spike |
aes32esi |
0x227302b3 |
retires |
illegal |
aes32esmi |
0x267302b3 |
retires |
illegal |
aes32dsi |
0x2a7302b3 |
retires |
illegal |
aes32dsmi |
0x2e7302b3 |
retires |
illegal |
sha512sum0r |
0x507302b3 |
retires |
illegal |
sha512sum1r |
0x527302b3 |
retires |
illegal |
sha512sig0l |
0x547302b3 |
retires |
illegal |
sha512sig0h |
0x5c7302b3 |
retires |
illegal |
sha512sig1l |
0x567302b3 |
retires |
illegal |
sha512sig1h |
0x5e7302b3 |
retires |
illegal |
rev8 (RV32 form, imm = 0x698) |
0x69835293 |
retires |
illegal |
Controls, same program and flow:
| instruction |
encoding |
CVA6 |
Spike |
zip / unzip (fixed by #3527) |
0x08f31293 / 0x08f35293 |
illegal |
illegal |
aes64es (RV64) |
0x327302b3 |
retires |
retires |
sha512sum0 (RV64) |
0x10431293 |
retires |
retires |
Where
core/decoder.sv at 81245a47f:
- the R-type Zkn block (
aes32* around lines 938-983, sha512sig*/sha512sum*r at
1003-1047) checks only CVA6Cfg.ZKN, e.g. line 1035 {7'b010_1000, 3'b000} → SHA512SUM0R;
- line 1226:
else if (instr.instr[31:20] == 12'b011010011000) → REV8, with no XLEN
term, next to the guarded RV64 form on line 1224 (CVA6Cfg.IS_XLEN64 && ... 12'b011010111000).
zip/unzip on lines 1188 and 1238 now carry CVA6Cfg.IS_XLEN32; the same term is missing on
the lines above. (By the same reading the RV64-only aes64* / sha512sum0/1, sha512sig0/1
lack IS_XLEN64 for RV32 configurations; not tested here.)
decoder-zkn-rv32-only-rv64.elf.zip
Code of Conduct
CVA6 commit affected
81245a4
Bug Description
On
cv64a6_imafdc_sv39(RV64,ZKN = 1,RVB = 1), the following encodings are accepted,executed and retired, although each is defined for RV32 only and must raise
illegal-instruction (
mcause = 2) on RV64. The vendored Spike raisesmcause = 2for every one.rd = x5, rs1 = x6, rs2 = x7)aes32esi0x227302b3aes32esmi0x267302b3aes32dsi0x2a7302b3aes32dsmi0x2e7302b3sha512sum0r0x507302b3sha512sum1r0x527302b3sha512sig0l0x547302b3sha512sig0h0x5c7302b3sha512sig1l0x567302b3sha512sig1h0x5e7302b3rev8(RV32 form,imm = 0x698)0x69835293Controls, same program and flow:
zip/unzip(fixed by #3527)0x08f31293/0x08f35293aes64es(RV64)0x327302b3sha512sum0(RV64)0x10431293Where
core/decoder.svat81245a47f:aes32*around lines 938-983,sha512sig*/sha512sum*rat1003-1047) checks only
CVA6Cfg.ZKN, e.g. line 1035{7'b010_1000, 3'b000}→SHA512SUM0R;else if (instr.instr[31:20] == 12'b011010011000)→REV8, with no XLENterm, next to the guarded RV64 form on line 1224 (
CVA6Cfg.IS_XLEN64 && ... 12'b011010111000).zip/unzipon lines 1188 and 1238 now carryCVA6Cfg.IS_XLEN32; the same term is missing onthe lines above. (By the same reading the RV64-only
aes64*/sha512sum0/1,sha512sig0/1lack
IS_XLEN64for RV32 configurations; not tested here.)decoder-zkn-rv32-only-rv64.elf.zip