Processor Verification using Symbolic Execution: A RISC-V Case-Study
PaperFirst seen 6/19/2026
Last seen 9/28/2026
Evidence 28 chunks
NEIGHBORHOOD
6 nodes · 6 edgesgraph · Processor Verification using Symbolic Execution: A RISC-V Case-Study · depth=1
RELATIONSHIPS
50 connectionsThe title indicates symbolic execution is the method applied for processor verification.
The paper uses KLEE as the symbolic execution engine for the co-simulation.
The paper uses error injection to evaluate the bug-hunting capabilities of its approach.
The paper integrates the ISS and RTL processor in a co-simulation setting.
The paper utilizes an ISS as a reference model for processor verification.
The paper introduces sliced symbolic registers to keep the state space manageable.
The paper presents results on verifying the MicroRV32 processor as a case study.
The paper uses the ISS from RISC-V VP as the reference model for verification.
The paper uses Verilator to translate the Verilog RTL processor into C++ for co-simulation.
The paper uses a voter component to detect mismatches between ISS and RTL processor outputs.
The paper discusses riscv-formal as a related formal verification approach and compares it to its own methodology.
The paper compares symbolic execution to fuzzing, noting that fuzzing is susceptible to missing corner-case bugs.
The co-simulation uses an instruction stream as part of its structure.
The voter in the paper's approach is based on RVFI to observe processor execution state.
The paper introduces and uses symbolic instruction memory to provide symbolic instructions to both ISS and RTL core.
The paper introduces and uses symbolic data memory for cross-processor verification.
The paper designs and introduces a dedicated symbolic execution interface for co-simulation integration.
The paper introduces the concept of sliced symbolic registers as an optimization.
The paper mentions PicoRV32 as an example of a RISC-V processor with a native bus interface.
The paper discusses model-based approaches as related work for test generation.
The paper is authored by Niklas Bruns.
The paper is authored by Vladimir Herdt.
The paper is authored by Rolf Drechsler.
The paper proposes a cross-level processor verification methodology using symbolic execution.
The paper uses SpinalHDL as the hardware description language for the processor.
The paper uses symbolic memory as part of the co-simulation.
The paper uses an execution controller to enforce runtime limitations.
The paper generates instructions symbolically for the co-simulation.
The paper handles CSR verification and notes riscv-formal does not support CSRs.
The paper uses the IBus to connect the symbolic instruction memory to the RTL core.
The paper uses the DBus to connect the symbolic data memory to the RTL core.
The paper mentions VexRiscV as a popular SpinalHDL-based processor.
The paper mentions BMC as used by riscv-formal and discusses it as related work.
The paper uses symbolic values to represent instructions and register values.
Two authors are affiliated with DFKI GmbH.
The paper mentions that MicroRV32 was already tested using constrained random techniques, contrasting with symbolic execution.
The paper is affiliated with and published by authors from the University of Bremen.
The paper targets processor verification at the RTL level.
The paper uses RISC-V as the ISA for the case study.
The paper mentions coverage-guided fuzzing as a related technique from the SW domain.
The paper verifies MicroRV32 using the RV32I instruction subset.
The paper references RISCV-DV in its bibliography.
The paper mentions randomized instruction stream generation as a classical test generation approach.
The paper discusses processor-level input stimuli generation techniques.
The paper discusses coverage-guided fuzzing as a related approach for processor verification.
The title explicitly states the case study is for RISC-V.
The paper mentions concolic testing on RTL models as related work.
The paper compiles the co-simulation into bytecode using the LLVM toolchain.
The paper uses the LLVM toolchain to compile the co-simulation into bytecode.
The paper mentions libFuzzer as a coverage-guided fuzzing tool.