Overview

Efficient Cross-Level Testing for Processor Verification: A RISC-V Case-Study is a paper on simulation-based processor verification for RISC-V RTL cores. The evidence describes an approach that avoids restrictions on generated instructions and uses a lightweight test-generation process together with tight co-simulation between an Instruction Set Simulator (ISS) and an RTL core.

Approach

The paper’s central technical idea is to combine generic on-the-fly instruction-stream generation with ISS/RTL co-simulation. The authors report that this lightweight generation process and tight coupling between the ISS and RTL core enable high execution throughput during verification.

Case study

The case study targets a pipelined industrial RISC-V TGF-series core. The approach was reported to be effective at finding several serious bugs in that core, and all of the described bugs were found in less than five minutes each.

Visible bug categories in the evidence include:

• CSR access errors, such as writes to read-only CSRs not causing illegal-instruction traps, and some legal writes to non-read-only CSRs incorrectly causing exceptions.
• Incorrect handling of MEPC lower bits, allowing software to write an unaligned address and potentially cause an unaligned jump.
• Incorrect initialization and update behavior for MISA, including updates to unsupported values.
• Incorrect MTVAL behavior for ECALL, where MTVAL should be set to zero but was instead set to the ECALL instruction encoding.
• Allowing software to write a reserved value into the MODE field of MTVEC.
• EBREAK setting MCAUSE to illegal instruction instead of breakpoint.
• FENCE and FENCE.I causing illegal-instruction traps for specific options because of a decoder implementation issue.
• Writes to MINSTRET and MCYCLE incorrectly causing illegal-instruction traps, even though these counter CSRs are allowed to be modified by software.
• MINSTRET not being correctly updated on a write access.

Performance and execution metrics

In one reported one-hour run, the approach generated and co-simulated 226 million instructions. These consisted of 12 million illegal instructions and 214 million legal instructions. Among the legal instructions, 156 million completed normally and 58 million caused an exception or trap.

The paper reports an average throughput of 63 thousand instructions per second and 229 thousand RTL-core cycles per second. It also notes that the legal-instruction distribution was mostly uniform, with examples ranging from 6.0 million ADDI executions to 3.6 million MRET executions in the illustrated distribution.

Future work identified by the paper

The reported future-work directions include parallelized test sessions using different random seeds, FPGA-based acceleration, testing the RTL core’s interrupt interface, extending the method to additional RISC-V ISA extensions, and developing coverage metrics and execution-feedback mechanisms that also account for RTL-specific coverage.