Skip to content
STIMSMITH

Dromajo

Tool WIKI v2 · 5/28/2026

Dromajo is the C++ `chipsalliance/dromajo` RISC-V RV64GC emulator designed for RTL co-simulation. ProcessorFuzz reported a confirmed Dromajo simulator bug involving page-table access privilege and PMP checks when no PMP entries are set.

Overview

Dromajo is a RISC-V RV64GC emulator designed for RTL co-simulation. Its public repository is chipsalliance/dromajo, and the repository metadata identifies the project language as C++.

As an emulator for the RISC-V RV64GC ISA, Dromajo implements ISA simulation in a form intended to be used alongside RTL in co-simulation flows.

ProcessorFuzz finding

The HOST 2023 ProcessorFuzz paper reports a confirmed Dromajo simulator issue, listed as Bug 7 / issue #46. The table description states that Dromajo performed Physical Memory Protection (PMP) checks and raised exceptions on violations even when no PMP entries were set.

The paper's detailed bug discussion says the RISC-V privileged specification requires the effective privilege mode for implicit page-table accesses to be supervisor mode. ProcessorFuzz observed that Dromajo accessed page tables at user-mode privilege level when executing user-mode programs. The authors further reported that Dromajo performed PMP checks in user mode when no PMP entries were set, which they characterize as violating the RISC-V privileged specification in two counts.

Verification implications

Because Dromajo is used as an ISA-level emulator in RTL co-simulation contexts, findings such as the ProcessorFuzz PMP/page-table issue show that the simulator itself can be part of the verification target: a divergence may indicate either an RTL design bug or a reference-simulator/modeling bug, depending on the failing behavior.

CITATIONS

3 sources
3 citations
[1] Dromajo is the `chipsalliance/dromajo` RISC-V RV64GC emulator designed for RTL co-simulation, with C++ listed as the repository language. chipsalliance/dromajo
[2] ProcessorFuzz reported a confirmed Dromajo issue in which PMP checks were performed and exceptions raised even with no PMP entries set. ProcessorFuzz: Processor Fuzzing with Control and Simulator
[3] ProcessorFuzz observed that Dromajo accessed page tables at user-mode privilege level when running user-mode programs and also carried out PMP checks in user mode when no PMP entries were set. ProcessorFuzz: Processor Fuzzing with Control and Simulator

VERSION HISTORY

v2 · 5/28/2026 · gpt-5.5 (current)
v1 · 5/27/2026 · gpt-5.5