Skip to content

Make leader discovery reachability-aware - #18

Merged
jserv merged 2 commits into
sysprog21:mainfrom
thc1006:rvopt-reachable-jalr-leaders
Aug 3, 2026
Merged

Make leader discovery reachability-aware#18
jserv merged 2 commits into
sysprog21:mainfrom
thc1006:rvopt-reachable-jalr-leaders

Conversation

@thc1006

@thc1006 thc1006 commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Follow-up to #13. The same leader-marking problem also affects direct JAL and branch targets. An unreachable control transfer can mark an instruction in a reachable block as a leader, causing analyze_syscalls() to clear constant-propagation state and reject a valid ecall.

Use a conservative reachability walk to seed leader discovery. Mark a transfer target as a leader only when the source instruction is reachable, then recompute syscall classification, JALR targets, leaders, and reachability to a fixed point.

Add off-path JAL, branch, and JALR regression cases. The chained-JALR case runs the emitted image and requires the exact output AB. The existing RV32I test ELFs remain byte-for-byte identical.

A pre-existing false rejection remains when code following an ecall that is later classified as an exit jumps back into an earlier block. This change preserves the conservative behavior and does not retract previously discovered leaders.

make check-all passes.
make fuzz-rvopt passes.


Summary by cubic

Make leader discovery depend on reachability so off-path transfers no longer split live blocks and break syscall constant propagation. Also stop CFG traversal at illegal words and iterate syscall/JALR/leader/reachability until stable.

  • Bug Fixes
    • Iterate syscall classification, JALR targets, leaders, and reachability to a fixed point; leaders only grow (conservative post-ecall behavior preserved).
    • Treat K_ILL as a block end and stop CFG traversal.
    • Tests: add off-path control-flow regressions, jump-over reserved JALR/CSR cases, and a chained static JALR image that must print "AB"; fail fast when packing words.

Written for commit e43b54d. Summary will update on new commits.

Review in cubic

Unsupported JALR and SYSTEM encodings are decoded as K_ILL. K_ILL
does not end a basic block, so constant propagation can cross an
unreachable illegal word and resolve a later JALR.

Make K_ILL end the block and stop CFG traversal. Add jump-over cases
for a reserved JALR and a CSR word. Also stop the encoding test when
PACK_WORDS fails.

make check-all passes.

Signed-off-by: thc1006 <hctsai1006@cs.nctu.edu.tw>
cubic-dev-ai[bot]

This comment was marked as resolved.

decode_graph() marks every static JAL and branch target as a leader,
while resolve_jalr() does the same for targets resolved by block-local
constant propagation. An unreachable transfer can therefore split a
reachable block and make syscall analysis lose constants on the actual
path.

Seed leader discovery with a conservative reachability walk. Then
recompute syscall classification, JALR targets, leaders, and
reachability until the state is unchanged. Add off-path control-flow
cases, an ecall reached only through a return, and run a chained JALR
image to check its exact output.

Keep the existing conservative rejection for a jump after an ecall
that later proves to exit; this change does not retract leaders.

make check-all passes.
make fuzz-rvopt passes.

Signed-off-by: thc1006 <hctsai1006@cs.nctu.edu.tw>
@thc1006
thc1006 force-pushed the rvopt-reachable-jalr-leaders branch from f7aebc8 to e43b54d Compare August 3, 2026 12:28
@jserv
jserv merged commit b5f8b2f into sysprog21:main Aug 3, 2026
6 checks passed
@jserv

jserv commented Aug 3, 2026

Copy link
Copy Markdown
Collaborator

Thank @thc1006 for contributing!

@thc1006
thc1006 deleted the rvopt-reachable-jalr-leaders branch August 3, 2026 13:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants