Skip to content
STIMSMITH

Instruction Stream Generation

Technique WIKI v1 · 5/25/2026

Instruction Stream Generation is a processor-verification technique that produces instruction sequences for simulation or co-simulation. In the provided RISC-V verification evidence, it is used to generate endless, unrestricted instruction streams, with random generation as a baseline and optional guidance such as opcode injection to increase legal-instruction coverage.

Overview

Instruction Stream Generation is a test-generation technique for processor verification in which streams of instructions are produced and supplied to a processor model, simulator, or RTL core. In the provided RISC-V cross-level verification evidence, the stated goal is to generate an endless and unrestricted instruction stream for co-simulation, with the RTL core and instruction-set simulator (ISS) expected to behave identically in their observable architectural state, especially register updates. [c1]

Role in RISC-V verification

The evidence discusses instruction stream generation in the context of RISC-V. RISC-V includes mandatory base integer instruction sets such as RV32I, RV64I, and RV128I, plus optional extensions such as M for integer multiplication/division and C for compressed instructions. Instructions are grouped into classes such as computational, load/store, and branch/jump, and use register operands and immediates. [c2]

For the verification setup described in the evidence, unrestricted generation is intended to exercise broad processor behavior. The approach supports memory-access instructions, jump instructions including self-loops from on-the-fly generation, and special RISC-V CSR access instructions. [c3]

Generation strategy

The baseline generator described in the evidence fully randomizes generated instructions. This creates a foundation for testing because unrestricted generation can include legal and illegal encodings. A figure in the evidence notes that a fully random 32-bit word is most likely an illegal instruction. [c4]

The evidence also describes guided modifications to steer generation toward interesting cases. One such modification injects a random instruction opcode to create a valid instruction while keeping the remaining instruction fields randomized. This is described as simple, generic, effective, and important for ensuring that a large set of legal instructions is considered. [c5]

Co-simulation and instruction matching

Unrestricted instruction streams introduce a synchronization problem when the same stream must be supplied to both an RTL core and an ISS. A pipelined RTL core can prefetch instructions, but prefetched instructions may not execute after jumps or traps. As a result, the ISS may fetch a different sequence of program counters than the RTL core if matching is handled naively. [c6]

The evidence describes an instruction matching algorithm that stores generated instructions, together with their program counters, in a queue of pending instructions fetched by the RTL core but not yet consumed by the ISS. The ISS fetch path then searches this pending queue for a matching (PC, instruction) pair. If a match is found, the instruction is returned; otherwise, a mismatch is reported. [c7]

RTL completion detection

The evidence identifies instruction-completion detection in a pipelined RTL core as a key implementation challenge. Illegal instructions may bypass pipeline stages and may not trigger regular register write-back notifications. Pipeline flushes, jumps, traps, and multi-cycle operations can also introduce delays and gaps. To address this, the described setup uses a core adapter that observes internal core signal changes, especially pipeline signals, and notifies the test controller when the RTL core completes an instruction while preserving correct order for illegal instructions. [c8]

Comparison with other generation approaches

The evidence contrasts unrestricted generation with several existing RISC-V test-generation approaches:

  • RISC-V Torture Test is described as a Scala-based framework that generates tests from randomized instruction-sequence templates and supports several RISC-V ISA extensions. However, approaches based on predefined instruction-sequence building blocks are said to have limited coverage and to not support illegal instructions or exceptions. [c9]
  • Coverage-guided fuzzing at the ISS level loosens some instruction-stream generation restrictions but is reported to have problems with branches and jumps, platform-dependent CSR and memory accesses, and to produce comparatively small test suites. [c10]
  • RISC-V DV continuously generates RISC-V instruction streams from constrained-random descriptions, with each instruction stream representing a test case. The evidence says it supports many features including ISA extensions and CSR testing, but generated streams are restricted to avoid infinite loops and platform-dependent memory access operations. [c11]

Practical significance

Within the cited co-simulation setup, Instruction Stream Generation is significant because unrestricted on-the-fly generation can exercise legal instructions, illegal instructions, memory behavior, jumps, traps, and CSR accesses. The matching and core-adapter mechanisms are necessary to make this practical for pipelined RTL cores and ISS comparison without relying on the RTL core under test to define the executed stream. [c1] [c3] [c7] [c8]

LINKED ENTITIES

2 links
Cross-Level Testing USES
RISC-V TARGETS

CITATIONS

11 sources
11 citations
[1] c1: The described verification approach aims to generate an endless, unrestricted instruction stream and compare RTL core and ISS behavior on observable architectural state such as register updates.
[2] c2: RISC-V has mandatory base integer instruction sets, optional single-letter extensions, 32 general-purpose registers in RV32I, and instruction classes such as computational, load/store, and branch/jump.
[3] c3: The unrestricted approach supports memory-access instructions, jump instructions including self-loops from on-the-fly generation, and special RISC-V CSR access instructions.
[4] c4: The baseline generation algorithm fully randomizes generated instructions, and a fully random 32-bit word is most likely an illegal instruction.
[5] c5: A guided modification injects a random instruction opcode to create a valid instruction while keeping instruction fields randomized, helping ensure many legal instructions are considered.
[6] c6: RTL prefetch, jumps, and traps make it difficult to feed the same unrestricted instruction stream to the RTL core and ISS because prefetched instructions may not execute and the ISS may fetch a different PC sequence.
[7] c7: The instruction matching algorithm keeps a queue of pending RTL-fetched instructions with PCs and matches ISS fetches by PC and expected instruction, reporting a mismatch if no match is found.
[8] c8: A core adapter observes pipeline signal changes, detects completed instructions, preserves correct order for illegal instructions, and provides RTL register values for comparison with the ISS.
[9] c9: RISC-V Torture Test is a Scala-based randomized instruction-sequence-template framework, and approaches using predefined instruction-sequence building blocks are described as coverage-limited and lacking support for illegal instructions or exceptions.
[10] c10: Coverage-guided fuzzing for ISS-level verification loosens some instruction-stream generation restrictions but has problems with branches/jumps, platform-dependent CSR and memory accesses, and comparatively small test suites.
[11] c11: RISC-V DV uses constrained-random descriptions to continuously generate RISC-V instruction streams as test cases and supports features such as ISA extensions and CSR testing, but its generated streams are restricted to avoid infinite loops and platform-dependent memory accesses.