Overview

RV32IM is described in the available evidence as a RISC-V instruction subset used as the configured target for a VexRiscv processor-verification evaluation. The RISC-V ISA includes 32-bit, 64-bit, and 128-bit base integer sets such as RV32I, RV64I, and RV128I, and optional standard extensions such as multiply/divide (M) and compressed instructions (C). In the cited case study, VexRiscv was configured to support the RV32IM instruction subset. [citation: RISC-V ISA structure and RV32IM configuration]

Role in the VexRiscv fuzzing case study

The RV32IM configuration appears in the manual-analysis section of Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing. The paper evaluates a fuzzing-based processor-verification flow that uses co-simulation between an instruction-set simulator (ISS) and an RTL core, collects coverage and return-code feedback, and categorizes generated test vectors by whether they produce equal behavior or an execution mismatch. [citation: Co-simulation fuzzing workflow]

For the VexRiscv evaluation, the authors state that they configured VexRiscv to support RV32IM and then found errors associated with the instruction decoder and many errors associated with control and status registers (CSRs). [citation: VexRiscv RV32IM evaluation]

Instruction-set boundary

Because the tested core was configured only for RV32IM, the paper treats execution of instructions outside that 32-bit configuration as erroneous. The clearest example is LWU: the authors report that VexRiscv executed the RV64I LWU instruction, even though LWU is valid only on a 64-bit RISC-V core and not on a 32-bit RISC-V core. [citation: LWU outside RV32IM boundary]

Reported bugs in the RV32IM configuration

Decoder bugs

The evaluation reports several decoder-related bugs for the RV32IM-configured VexRiscv core. Besides the erroneous execution of RV64I LWU, VexRiscv executed several illegal instructions. The paper traces these illegal-instruction executions to three similar decoding bugs in SLLI, SRLI, and SRAI: their encodings contained an additional incorrect don't-care bit, so the processor misinterpreted many illegal instructions as one of those shift instructions. [citation: RV32IM decoder bugs]

CSR bugs

The same evaluation reports CSR-related bugs. The RISC-V privileged architecture specifies the ID CSRs mvendorid, marchid, mimpid, and mhartid as read-only hardware-identifier registers. In the tested VexRiscv configuration, write attempts to these four CSRs erroneously did not raise an exception. [citation: ID CSR write-exception bugs]

The paper also describes bugs involving counter CSRs. Write attempts to the read-only cycle CSRs cycle, cycleh, instret, and instreth did not raise an exception. Conversely, although the authors state that all counter CSRs should be defined and allow read access, VexRiscv erroneously raised an exception on reads of time, timeh, hpmcounter, hpmcounterh, mcounteren, mhpmcounter3-31, mhpmcounter3-31h, and mhpmevent. [citation: Counter CSR bugs]

Significance

Within the provided evidence, RV32IM is significant primarily as the instruction subset used to bound and test the behavior of a VexRiscv configuration. That boundary made it possible to identify both decoder conformance issues, such as accepting RV64I LWU on a 32-bit core, and CSR-access mismatches discovered through fuzzing-based co-simulation. [citation: RV32IM verification significance]