Skip to content
STIMSMITH

MMU

Concept WIKI v1 · 5/26/2026

In the provided RISC-V verification evidence, MMU is discussed as a virtual-memory-management feature area that requires targeted verification. Random stimulus may leave gaps in page-table-walk behavior, while directed TS-MMU suites are used to exercise virtual memory scenarios such as Sv39 and Sv48 page-table walks and to expose issues such as TLB flush ordering problems.

Overview

In this evidence set, MMU is treated as a RISC-V virtual-memory-management verification target. It appears alongside PMP, ePMP, hypervisor, and vector features as one of the critical privilege-related areas that verification flows should cover.[1]

MMU-related behavior is called out as difficult to cover with random testing alone. The evidence notes that features such as privilege-mode transitions, page table walks, and memory protection may not be fully exercised by random generation.[2]

Verification relevance

MMU verification is presented as part of a hybrid RISC-V verification methodology that combines constrained-random stimulus with directed test suites. Constrained-random testing is used for broad exploration, while directed suites are used to close coverage gaps in specific feature areas.[3]

The ImperasTS family includes TS-MMU / PMP / ePMP directed suites for virtual memory and protection features. The evidence specifically describes TS-MMU as a directed suite for virtual memory management and says these suites can be configured to match the user's RISC-V processor.[4]

Page table walks, Sv39, Sv48, and TLB flush logic

The evidence identifies Sv39 and Sv48 as RISC-V virtual memory schemes using 39-bit and 48-bit virtual addresses, respectively, with multi-level page table structures for address translation.[5]

Coverage analysis can reveal weak points in Sv39 and Sv48 page table walks. In one cited example, adding TS-MMU tests after such coverage analysis exposed a subtle ordering issue in TLB flush logic.[6]

The evidence also reports that constrained-random stimulus with STING has exposed issues including deadlocks in page-table walks, illustrating why MMU-adjacent behavior benefits from broad random exploration as well as directed testing.[7]

Role in coverage closure

MMU verification is described as part of a coverage-closure loop. A typical workflow starts with constrained-random sweeps using STING, then applies functional coverage analysis with ImperasFC. Coverage gaps are highlighted, results can be merged in Verdi, and failing cases can be replayed deterministically in VCS.[8]

The evidence recommends applying targeted ImperasTS suites for compliance, MMU, PMP, and vector extensions where coverage gaps remain.[9]

Related verification concepts

  • STING: Generates constrained-random and directed RISC-V tests and is reported as effective at stressing privilege levels, memory protection, CSRs, and hypervisor extensions.[10]
  • ImperasTS TS-MMU: Directed suite for virtual memory management and protection-related verification.[4]
  • Sv39 / Sv48: RISC-V virtual memory schemes relevant to page-table-walk coverage.[5]
  • PMP / ePMP: Memory protection features often verified alongside MMU-related functionality.[11]

[1]: See citation: "MMU is a critical RISC-V privilege-related verification area." [2]: See citation: "Random testing may miss page table walks and related privilege or protection behavior." [3]: See citation: "Hybrid constrained-random and directed testing is recommended for RISC-V verification." [4]: See citation: "ImperasTS includes TS-MMU / PMP / ePMP directed suites for virtual memory and protection features." [5]: See citation: "Sv39 and Sv48 define multi-level RISC-V virtual-memory page-table structures." [6]: See citation: "TS-MMU tests exposed a TLB flush ordering issue after Sv39/Sv48 page-table-walk coverage gaps were found." [7]: See citation: "STING exposed deadlocks in page-table walks." [8]: See citation: "Coverage closure flow uses STING, ImperasFC, Verdi, and VCS." [9]: See citation: "Targeted ImperasTS suites are recommended for MMU coverage gaps." [10]: See citation: "STING stresses privilege and memory-protection-related RISC-V areas." [11]: See citation: "PMP and ePMP restrict memory-region access for privilege, isolation, and security policies."

LINKED ENTITIES

10 links
RISC-V verification_context
ImperasTS provides_directed_tests_for
Sv39 virtual_memory_scheme_relevant_to
Sv48 virtual_memory_scheme_relevant_to
STING generates_stimulus_for
PMP co_verified_feature
ePMP co_verified_feature
ImperasFC supports_coverage_analysis_for
VCS replays_failing_cases_for
Verdi reports_coverage_for

CITATIONS

11 sources
11 citations
[1] MMU is a critical RISC-V privilege-related verification area. source
[2] Random testing may miss page table walks and related privilege or protection behavior. source
[3] Hybrid constrained-random and directed testing is recommended for RISC-V verification. source
[4] ImperasTS includes TS-MMU / PMP / ePMP directed suites for virtual memory and protection features. source
[5] Sv39 and Sv48 define multi-level RISC-V virtual-memory page-table structures. source
[6] TS-MMU tests exposed a TLB flush ordering issue after Sv39/Sv48 page-table-walk coverage gaps were found. source
[7] STING exposed deadlocks in page-table walks. source
[8] Coverage closure flow uses STING, ImperasFC, Verdi, and VCS. source
[9] Targeted ImperasTS suites are recommended for MMU coverage gaps. source
[10] STING stresses privilege and memory-protection-related RISC-V areas. source
[11] PMP and ePMP restrict memory-region access for privilege, isolation, and security policies. source