BOOM
BOOM is a RISC-V core generator developed and maintained at UC Berkeley’s Berkeley Architecture Research group. In the cited evaluation, BOOM is described as written in the Chisel hardware construction language and configurable to generate Verilog BOOM designs with varying complexity. The generated cores implement the 64-bit RISC-V instruction set. The evaluation used the default MediumBoomConfig, characterized in the paper as a 2-wide, out-of-order RV64GC core supporting M, S, and U privilege modes with SV39 virtual memory; the paper also notes that a more complex BOOM configuration had been taped out in 28 nm technology. [c1]
Role in Dromajo and Logic Fuzzer evaluation
The MICRO-54 paper Effective Processor Verification with Logic Fuzzer Enhanced Co-simulation evaluated its verification approach on three RISC-V cores: CVA6, BlackParrot, and BOOM. For BOOM, the authors ran 228 RISC-V ISA tests and 120 random tests. [c2]
The evaluation compared a base Dromajo co-simulation setup with a setup enhanced by Logic Fuzzer. Across the three evaluated cores, Dromajo alone found nine bugs, while enabling Logic Fuzzer increased the exposed bug count to thirteen using the same set of tests. [c3]
Dromajo integration point
The paper describes integrating Dromajo into BOOM by calling the Dromajo DPI wrapper from monitor logic in BOOM’s Reorder Buffer. When the instruction at the head of the buffer is valid and ready to commit, the wrapper can be called; Dromajo then commits one instruction on its side, compares the communicated data, and returns a non-zero code on mismatch. [c4]
Logic Fuzzer use with BOOM
BOOM was also used as a target for Logic Fuzzer instrumentation. To address productivity issues in inserting congestors, the authors implemented a proof-of-concept automatic insertion mechanism for BOOM that allowed congestors to be inserted by annotating RTL signals. This relied on Chiffre and FIRRTL-based transformation support for Chisel hardware, and the paper states that this experiment was limited to BOOM because Chiffre only worked with Chisel hardware descriptions. [c5]
As an example of induced microarchitectural activity, the authors inserted a congestor at the ready signal of BOOM’s Reorder Buffer and randomly pulled the ready signal low when the ROB was otherwise ready. They reported that this single congestor caused 12 additional signals to toggle in the frontend module, 40 in the core module, and 32 in the load-store unit. [c6]
Reported BOOM finding
The paper reports a BOOM-related bug as Bug ID B13. During a random instruction stream, Dromajo flagged a mismatch when reading the mtval CSR. The fault scenario involved an instruction page fault where the ISA requires mtval to contain the address of the instruction that caused the exception; BOOM’s value was reported as off by 2. According to the designer feedback quoted in the paper, the bug was due to handling of compressed RISC-V instructions, specifically exception handling on misaligned instructions, and the bug disappeared in later BOOM commits. [c7]
Verification caveats
The paper notes that Logic Fuzzer can create microarchitectural states that no program could reach, so co-simulation failures exposed by fuzzing are treated as potential bugs that engineers must prove or disprove. The authors state that the bugs presented in the paper were confirmed by designers. They also report two Logic Fuzzer false bugs that were not included in the paper, one in CVA6 and one in BOOM. [c8]