Processor Verification using Symbolic Execution: A RISC-V Case-Study
PaperFirst seen 6/19/2026
Last seen 7/12/2026
Evidence 27 chunks
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
50 connectionsThe paper uses KLEE as the symbolic execution engine for the co-simulation.
The paper integrates the ISS and RTL processor in a co-simulation setting.
The paper utilizes an ISS as a reference model for processor verification.
The paper uses error injection to evaluate the bug-hunting capabilities of its approach.
The paper uses the ISS from RISC-V VP as the reference model for verification.
The paper introduces sliced symbolic registers to keep the state space manageable.
The paper uses Verilator to translate the Verilog RTL processor into C++ for co-simulation.
The paper proposes leveraging symbolic execution techniques for processor verification.
The paper uses a voter component to detect mismatches between ISS and RTL processor outputs.
The paper presents results on verifying the MicroRV32 processor as a case study.
The paper compares symbolic execution to fuzzing, noting that fuzzing is susceptible to missing corner-case bugs.
The co-simulation uses an instruction stream as part of its structure.
The paper discusses riscv-formal as a related formal verification approach and compares it to its own methodology.
The paper discusses model-based approaches as related work for test generation.
The paper is authored by Niklas Bruns.
The paper is authored by Vladimir Herdt.
The paper is authored by Rolf Drechsler.
The paper proposes a cross-level processor verification methodology using symbolic execution.
The paper uses SpinalHDL as the hardware description language for the processor.
The paper uses an execution controller to enforce runtime limitations.
The paper uses symbolic memory as part of the co-simulation.
The paper generates instructions symbolically for the co-simulation.
The paper introduces and uses symbolic instruction memory to provide symbolic instructions to both ISS and RTL core.
The paper introduces and uses symbolic data memory for cross-processor verification.
The paper handles CSR verification and notes riscv-formal does not support CSRs.
The paper uses the IBus to connect the symbolic instruction memory to the RTL core.
The paper uses the DBus to connect the symbolic data memory to the RTL core.
The voter in the paper's approach is based on RVFI to observe processor execution state.
The paper mentions VexRiscV as a popular SpinalHDL-based processor.
The paper mentions BMC as used by riscv-formal and discusses it as related work.
The paper designs and introduces a dedicated symbolic execution interface for co-simulation integration.
The paper introduces the concept of sliced symbolic registers as an optimization.
The paper mentions PicoRV32 as an example of a RISC-V processor with a native bus interface.
The paper mentions libFuzzer as a coverage-guided fuzzing tool.
Two authors are affiliated with DFKI GmbH.
The paper compiles the co-simulation into bytecode using the LLVM toolchain.
The paper mentions that MicroRV32 was already tested using constrained random techniques, contrasting with symbolic execution.
The paper mentions coverage-guided fuzzing as a related technique from the SW domain.
The paper references RISCV-DV in its bibliography.
The paper uses the LLVM toolchain to compile the co-simulation into bytecode.
The paper uses symbolic values to represent instructions and register values.
The paper targets processor verification at the RTL level.
The paper uses RISC-V as the ISA for the case study.
The paper verifies MicroRV32 using the RV32I instruction subset.
The paper discusses processor-level input stimuli generation techniques.
The paper mentions concolic testing on RTL models as related work.
The paper is affiliated with and published by authors from the University of Bremen.
The paper mentions AFL as a coverage-guided fuzzer.
The paper mentions OSS-Fuzz as a fuzzing platform.
The paper mentions randomized instruction stream generation as a classical test generation approach.