Describe the bug
Under matched VLEN = 4096 on both Spike and Ara, Ara can retire legal RVV segment-load instructions while only writing the first destination field and dropping the later fields. I reduced this to two single-element reproducers:
- indexed segment load:
vluxseg5ei32.v
- strided segment load:
vlsseg3e64.v
In both cases, Ara writes field 0 correctly but leaves the later destination fields at zero instead of loading the expected data.
Expected behavior
Subcase 1: indexed segment load
Testcase:
vsetivli x0, 1, e32, m1
vle32.v v14, (idx_data) # idx_data[0] = 0
vluxseg5ei32.v v18, (mem_data), v14
with:
idx_data:
.word 0
mem_data:
.word 0x00001800, 0x00001900, 0x00002000, 0x00002100, 0x00002200Expected result:
v18[0] = 0x1800v19[0] = 0x1900v20[0] = 0x2000v21[0] = 0x2100v22[0] = 0x2200
Spike probe-buffer writes:
mem 0x0000000080022628 0x0000000000001800
mem 0x0000000080022630 0x0000000000001900
mem 0x0000000080022638 0x0000000000002000
mem 0x0000000080022640 0x0000000000002100
mem 0x0000000080022648 0x0000000000002200
mem 0x0000000080022658 0x0000000000000000 # exit code
Subcase 2: strided segment load
Testcase:
vsetivli x0, 1, e64, m1
li t1, 32
vlsseg3e64.v v18, (mem_data), t1
with:
mem_data:
.dword 0x1800000000000000, 0x1900000000000000
.dword 0x2000000000000000, 0Expected result:
v18[0] = 0x1800000000000000v19[0] = 0x1900000000000000v20[0] = 0x2000000000000000
Spike probe-buffer writes:
mem 0x0000000080022728 0x1800000000000000
mem 0x0000000080022730 0x1900000000000000
mem 0x0000000080022738 0x2000000000000000
mem 0x0000000080022748 0x0000000000000000 # exit code
Observed behavior
Ara retires both testcases successfully, but only field 0 is written.
Subcase 1: indexed segment load
Ara RVFI/probe-buffer writes:
mem 0x0000000080022628 0x0000000000001800
mem 0x0000000080022630 0x0000000000000000
mem 0x0000000080022638 0x0000000000000000
mem 0x0000000080022640 0x0000000000000000
mem 0x0000000080022648 0x0000000000000000
mem 0x0000000080022658 0x0000000000000000 # exit code
Subcase 2: strided segment load
Ara RVFI/probe-buffer writes:
mem 0x0000000080022728 0x1800000000000000
mem 0x0000000080022730 0x0000000000000000
mem 0x0000000080022738 0x0000000000000000
mem 0x0000000080022748 0x0000000000000000 # exit code
Ara logs for both runs contain:
Core Test *** SUCCESS *** (tohost = 0)
So this is not an exception-path mismatch. Ara completes both instructions but
fails to write the later segment fields.
To Reproduce
Indexed repro
Build:
riscv64-unknown-elf-gcc -nostdlib -static \
-march=rv64imfdcv_zicsr_zifencei_zfh \
-mabi=lp64d \
-T /home/ara_audit_repros/common.ld \
-o /home/ara_audit_repros/b13_vluxseg5ei32_later_field_vl1.elf \
/home/ara_audit_repros/b13_vluxseg5ei32_later_field_vl1.S
Run Spike:
/home/projects/projects/riscv-isa-sim/install/bin/spike \
-p1 \
--isa=RV64IMAFDCV_ZICSR_ZIFENCEI_ZFH_ZVL4096B \
--log-commits \
/home/ara_audit_repros/b13_vluxseg5ei32_later_field_vl1.elf \
> b13_vluxseg5ei32_later_field_vl1.spike.log 2>&1
Run Ara:
/home/projects/projects/ara/hardware/build-rvfi9/verilator/Vara_tb_verilator \
-l ram,/home/ara_audit_repros/b13_vluxseg5ei32_later_field_vl1.elf,elf \
> b13_vluxseg5ei32_later_field_vl1.ara.log 2>&1
Strided repro
Build:
riscv64-unknown-elf-gcc -nostdlib -static \
-march=rv64imfdcv_zicsr_zifencei_zfh \
-mabi=lp64d \
-T /home/ara_audit_repros/common.ld \
-o /home/ara_audit_repros/b14_vlsseg3e64_later_field_vl1.elf \
/home/ara_audit_repros/b14_vlsseg3e64_later_field_vl1.S
Run Spike:
/home/projects/projects/riscv-isa-sim/install/bin/spike \
-p1 \
--isa=RV64IMAFDCV_ZICSR_ZIFENCEI_ZFH_ZVL4096B \
--log-commits \
/home/ara_audit_repros/b14_vlsseg3e64_later_field_vl1.elf \
> b14_vlsseg3e64_later_field_vl1.spike.log 2>&1
Run Ara:
/home/projects/projects/ara/hardware/build-rvfi9/verilator/Vara_tb_verilator \
-l ram,/home/ara_audit_repros/b14_vlsseg3e64_later_field_vl1.elf,elf \
> b14_vlsseg3e64_later_field_vl1.ara.log 2>&1
program.zip
Describe the bug
Under matched
VLEN = 4096on both Spike and Ara, Ara can retire legal RVV segment-load instructions while only writing the first destination field and dropping the later fields. I reduced this to two single-element reproducers:vluxseg5ei32.vvlsseg3e64.vIn both cases, Ara writes field 0 correctly but leaves the later destination fields at zero instead of loading the expected data.
Expected behavior
Subcase 1: indexed segment load
Testcase:
with:
Expected result:
v18[0] = 0x1800v19[0] = 0x1900v20[0] = 0x2000v21[0] = 0x2100v22[0] = 0x2200Spike probe-buffer writes:
Subcase 2: strided segment load
Testcase:
with:
Expected result:
v18[0] = 0x1800000000000000v19[0] = 0x1900000000000000v20[0] = 0x2000000000000000Spike probe-buffer writes:
Observed behavior
Ara retires both testcases successfully, but only field 0 is written.
Subcase 1: indexed segment load
Ara RVFI/probe-buffer writes:
Subcase 2: strided segment load
Ara RVFI/probe-buffer writes:
Ara logs for both runs contain:
So this is not an exception-path mismatch. Ara completes both instructions but
fails to write the later segment fields.
To Reproduce
Indexed repro
Build:
Run Spike:
Run Ara:
Strided repro
Build:
Run Spike:
Run Ara:
program.zip