Hey @Aquaticfuller,
A small issue found with expections exceptions. AI summary again, not verified manually:
File: models/cpu/iss/isa_gen/isa_riscv_gen.py
Affects: every core whose ISA string contains v but not d (e.g. rv32imafv)
Severity: high — any single trap becomes an unbounded trap loop
What is wrong
misa extension bits are letter-indexed: A=0, B=1, C=2, D=3, E=4, F=5, I=8, M=12, V=21.
The generator assigns bit 3 for 'v', which is the D bit. Every other extension in the same
if/elif chain uses the correct index, so this reads as a copy-paste slip from the 'd' branch
directly above it.
Why it matters
A runtime is entitled to trust misa. snRuntime's crt0 trap handler does exactly that:
csrr t0, misa
andi t0, t0, 8 # D present?
beqz t0, skip_fp_save
addi sp, sp, -256
fsd ft0, 248(sp) # illegal on a core without D -> traps again, inside the handler
mtvec catches exceptions as well as interrupts, so the re-trap re-enters the same handler at the
same instruction and nests forever, consuming 336 bytes of stack per iteration.
Symptom
A stack overflow, with no indication that an ISA mismatch is involved.
Reproduction
- Build any core with
isa='rv32imafv' and an mtvec handler that branches on misa bit 3.
- Provoke one exception of any kind (we hit a load access fault).
- Observe the handler re-entering itself until the stack is exhausted.
Fix
diff --git a/models/cpu/iss/isa_gen/isa_riscv_gen.py b/models/cpu/iss/isa_gen/isa_riscv_gen.py
index b7504c89..10d1e8f6 100644
--- a/models/cpu/iss/isa_gen/isa_riscv_gen.py
+++ b/models/cpu/iss/isa_gen/isa_riscv_gen.py
@@ -1041,7 +1041,12 @@ class RiscvIsa(Isa):
self.add_isa(Rv32d())
elif isa == 'v':
- misa |= 1 << 3
+ misa |= 1 << 21
self.add_isa(Rv32v())
if inc_priv:
Hey @Aquaticfuller,
A small issue found with expections exceptions. AI summary again, not verified manually:
File:
models/cpu/iss/isa_gen/isa_riscv_gen.pyAffects: every core whose ISA string contains
vbut notd(e.g.rv32imafv)Severity: high — any single trap becomes an unbounded trap loop
What is wrong
misaextension bits are letter-indexed: A=0, B=1, C=2, D=3, E=4, F=5, I=8, M=12, V=21.The generator assigns bit 3 for
'v', which is the D bit. Every other extension in the sameif/elifchain uses the correct index, so this reads as a copy-paste slip from the'd'branchdirectly above it.
Why it matters
A runtime is entitled to trust
misa. snRuntime'scrt0trap handler does exactly that:mtveccatches exceptions as well as interrupts, so the re-trap re-enters the same handler at thesame instruction and nests forever, consuming 336 bytes of stack per iteration.
Symptom
A stack overflow, with no indication that an ISA mismatch is involved.
Reproduction
isa='rv32imafv'and anmtvechandler that branches onmisabit 3.Fix