Skip to content
STIMSMITH

RISC-V Virtual Prototype

Tool WIKI v1 · 5/28/2026

The RISC-V Virtual Prototype is a publicly available, MIT-licensed RISC-V virtual platform implemented in standard-compliant SystemC and TLM-2.0. Evidence describes it as an extensible and configurable platform with a generic bus, an RV32IMA core, a PLIC-based interrupt controller, and essential peripherals; its extracted ISS was used as the system under test in a coverage-guided fuzzing study.

Overview

The RISC-V Virtual Prototype is a publicly available RISC-V virtual platform referenced by the GitHub project agra-uni-bremen/riscv-vp. The available evidence describes the VP as implemented in standard-compliant SystemC and TLM-2.0, designed as an extensible and configurable platform with a generic bus system. It integrates a RISC-V RV32IMA core, a PLIC-based interrupt controller, and an essential set of peripherals, and is available under the MIT license. [C1]

Role in RISC-V ISS verification

In the paper Verifying Instruction Set Simulators using Coverage-guided Fuzzing, the authors used the RV32IMA instruction set simulator extracted from the publicly available RISC-V Virtual Prototype as the ISS under test, denoted ISS-UT. The same case study used Spike and Forvis as reference ISSs. [C2]

For that evaluation, the ISS-UT was instrumented with the clang compiler to trace branch coverage, and additional calls to begin-fcov-trace and end-fcov-trace were added around instruction execution to trace functional coverage. The trace functions capture the fetched instruction, decoded operation, and read-only register snapshots before and after execution. [C3]

Evaluation context

The coverage-guided fuzzing study implemented its approach on top of LLVM libFuzzer and evaluated it on three publicly available RISC-V ISSs. In the reported table, coverage-guided fuzzing achieved 100% branch coverage for the ISS-UT and found all seven listed ISS-UT errors, while also reporting errors in the Spike and Forvis reference ISSs. [C4]

Relationship to the RISC-V ISA

The VP integrates an RV32IMA RISC-V core, and the extracted component used in the study is described as an RV32IMA ISS. This places the tool in the context of implementing and exercising the RISC-V instruction set architecture. [C1][C2]

CITATIONS

4 sources
4 citations
[1] The RISC-V Virtual Prototype is publicly referenced at the agra-uni-bremen/riscv-vp GitHub project, is implemented in standard-compliant SystemC and TLM-2.0, is extensible and configurable with a generic bus, integrates an RV32IMA core, a PLIC-based interrupt controller, and essential peripherals, and is available under the MIT license. Verifying Instruction Set Simulators using Coverage-guided Fuzzing
[2] The paper used the RV32IMA ISS extracted from the publicly available RISC-V Virtual Prototype as the ISS under test, denoted ISS-UT, with Spike and Forvis as reference ISSs. Verifying Instruction Set Simulators using Coverage-guided Fuzzing
[3] The ISS-UT was instrumented for branch coverage with clang and for functional coverage using begin-fcov-trace and end-fcov-trace calls around instruction execution, capturing instruction, decoded operation, and register-state snapshots. Verifying Instruction Set Simulators using Coverage-guided Fuzzing
[4] The coverage-guided fuzzing study was implemented on top of LLVM libFuzzer, evaluated on three publicly available RISC-V ISSs, and reported 100% branch coverage and all seven listed ISS-UT errors found for the coverage-guided fuzzing run, along with errors in Spike and Forvis. Verifying Instruction Set Simulators using Coverage-guided Fuzzing