TestRIG
ToolTestRIG is an open-source framework/repository for randomized testing of RISC-V CPU implementations using RVFI-DII-style direct instruction injection and verification-engine trace checking. The provided evidence describes its use with QCVEngine, reduced counterexamples, CHERI-on-Ibex development, a Flute debugging case, and future directions such as richer generators and memory-concurrency testing.
First seen 5/27/2026
Last seen 8/11/2026
Evidence 44 chunks
Wiki v1
WIKI
Overview
TestRIG is presented in the paper Randomized Testing of RISC-V CPUs using Direct Instruction Injection as a RISC-V testing framework centered on open implementations, RVFI-DII-compatible components, and verification engines. The authors state that current TestRIG-compatible implementations and verification engines have been collated into an open-source TestRIG repository with documentation, and they expect TestRIG to contribute toward a standardized RISC-V testing framework that uses instrumentation of open implementations.
Verification approach
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
50 connectionsTestRIG uses the RVFI-DII interface as its core communication protocol.','confidence':0.99},"description":"TestRIG is built around the RVFI-DII interface for passing instruction and execution traces between components.",'confidence':0.99}]},{"src_label":"Tool","src_name":"TestRIG","relation_type":"USES","dst_label":"Concept","dst_name":"Random Instruction Generation","evidence_chunk_ids":["2d1a953c-bbc5-45f5-957a-56c3d6263029"],"quote":"Framework for testing RISC-V processors with Random Instruction Generation.","claim":"TestRIG uses Random Instruction Generation to verify RISC-V processors.","description":"TestRIG employs random instruction generation as a core technique for processor verification.","confidence":0.98},{"src_label":"Tool","src_name":"TestRIG","relation_type":"USES","dst_label":"Concept","dst_name":"Vengine","evidence_chunk_ids":["2d1a953c-bbc5-45f5-957a-56c3d6263029"],"quote":"TestRIG supports two types of components: 1. Vengines (verification engines)","claim":"TestRIG uses Vengines as one of its two main component types.","description":"Vengines are a key component type in the TestRIG framework responsible for generating and consuming traces.","confidence":0.99},{"src_label":"Tool","src_name":"TestRIG","relation_type":"USES","dst_label":"Concept","dst_name":"Instruction Trace","evidence_chunk_ids":["2d1a953c-bbc5-45f5-957a-56c3d6263029"],"quote":"Vengines generate one or more DII streams of instruction traces","claim":"TestRIG uses instruction traces as the mechanism for feeding instructions to implementations.","description":"Instruction traces (itraces) are generated by vengines and consumed by implementations in TestRIG.","confidence":0.98},{"src_label":"Tool","src_name":"TestRIG","relation_type":"USES","dst_label":"Concept","dst_name":"Execution Trace","evidence_chunk_ids":["2d1a953c-bbc5-45f5-957a-56c3d6263029"],"quote":"consume one or more RVFI streams of execution traces","claim":"TestRIG uses execution traces returned by implementations to verify behaviour.","description":"Execution traces (etraces) are produced by implementations and consumed by vengines for comparison.","confidence":0.98},{"src_label":"Tool","src_name":"TestRIG","relation_type":"USES","dst_label":"Concept","dst_name":"Direct Instruction Injection","evidence_chunk_ids":["2d1a953c-bbc5-45f5-957a-56c3d6263029","42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"As TestRIG relies on direct instruction injection, bypassing fetch through PC","claim":"TestRIG uses direct instruction injection to bypass the fetch stage and inject instructions directly.","description":"Direct instruction injection is a key mechanism in TestRIG that allows bypassing the PC-based fetch.","confidence":0.99},{"src_label":"Tool","src_name":"TestRIG","relation_type":"USES","dst_label":"Concept","dst_name":"Counterexample Reduction","evidence_chunk_ids":["2d1a953c-bbc5-45f5-957a-56c3d6263029"],"quote":"we can expect automatically reduced counterexamples on the order of a handful of instructions","claim":"TestRIG supports automated counterexample reduction by eliminating instructions from traces.","description":"TestRIG enables counterexample reduction by shortening instruction sequences to find minimal divergences.","confidence":0.97},{"src_label":"Tool","src_name":"TestRIG","relation_type":"EVALUATES","dst_label":"Concept","dst_name":"RISC-V","evidence_chunk_ids":["2d1a953c-bbc5-45f5-957a-56c3d6263029"],"quote":"TestRIG is a framework for RISC-V processor verification","claim":"TestRIG targets RISC-V processors for verification.","description":"TestRIG is specifically designed to verify RISC-V processor implementations.","confidence":0.99},{"src_label":"Tool","src_name":"TestRIG","relation_type":"HAS_PART","dst_label":"Tool","dst_name":"QuickCheck Verification Engine","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"The root makefile can currently build the QuickCheck Verification Engine, Spike, and the Sail implementation.","claim":"The QuickCheck Verification Engine is a provided module within TestRIG.","description":"TestRIG includes the QuickCheck Verification Engine as one of its built-in components.","confidence":0.97},{"src_label":"Tool","src_name":"TestRIG","relation_type":"HAS_PART","dst_label":"Tool","dst_name":"Spike","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"The root makefile can currently build the QuickCheck Verification Engine, Spike, and the Sail implementation.","claim":"Spike is a provided module within TestRIG.","description":"TestRIG includes Spike as one of its supported implementations.","confidence":0.95},{"src_label":"Tool","src_name":"TestRIG","relation_type":"HAS_PART","dst_label":"Tool","dst_name":"Sail","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"The root makefile can currently build the QuickCheck Verification Engine, Spike, and the Sail implementation.","claim":"Sail is a provided implementation module within TestRIG.","description":"TestRIG includes a Sail model as one of its supported implementations.","confidence":0.95},{"src_label":"Tool","src_name":"TestRIG","relation_type":"HAS_PART","dst_label":"Tool","dst_name":"RVBS","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"The dependencies for RVBS are the Bluespec compiler `bsc`.","claim":"RVBS is a provided module within TestRIG.","description":"TestRIG includes RVBS as one of its supported implementations.","confidence":0.93},{"src_label":"Tool","src_name":"TestRIG","relation_type":"HAS_PART","dst_label":"Tool","dst_name":"Ibex","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"The dependencies for Ibex are verilator","claim":"Ibex is a provided module within TestRIG.","description":"TestRIG includes Ibex as one of its supported implementations.","confidence":0.93},{"src_label":"Tool","src_name":"TestRIG","relation_type":"HAS_PART","dst_label":"Tool","dst_name":"Toooba","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"Toooba depends on the Bluespec compiler (see the dependencies for RVBS) and verilator.","claim":"Toooba is a provided module within TestRIG.","description":"TestRIG includes Toooba as one of its supported implementations.","confidence":0.93},{"src_label":"Tool","src_name":"Ibex","relation_type":"DEPENDS_ON","dst_label":"Tool","dst_name":"Verilator","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"The dependencies for Ibex are verilator","claim":"Ibex depends on Verilator for building.","description":"Verilator is a required dependency for building the Ibex implementation in TestRIG.","confidence":0.99},{"src_label":"Tool","src_name":"Toooba","relation_type":"DEPENDS_ON","dst_label":"Tool","dst_name":"Verilator","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"Toooba depends on the Bluespec compiler (see the dependencies for RVBS) and verilator.","claim":"Toooba depends on Verilator for building.","description":"Verilator is a required dependency for the Toooba implementation in TestRIG.","confidence":0.99},{"src_label":"Tool","src_name":"Sail","relation_type":"MENTIONS","dst_label":"Concept","dst_name":"CHERI","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"Both Spike and Sail are built without CHERI support by default","claim":"Sail can optionally support CHERI extensions.","description":"Sail has optional CHERI support which is disabled by default in TestRIG.","confidence":0.95},{"src_label":"Tool","src_name":"Spike","relation_type":"MENTIONS","dst_label":"Concept","dst_name":"CHERI","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"Both Spike and Sail are built without CHERI support by default","claim":"Spike can optionally support CHERI extensions.","description":"Spike has optional CHERI support which is disabled by default in TestRIG.","confidence":0.95},{"src_label":"Organization","src_name":"CTSRD-CHERI","relation_type":"INTRODUCES","dst_label":"Tool","dst_name":"TestRIG","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"https://github.laiyagushi.com/CTSRD-CHERI/TestRIG","claim":"TestRIG is authored and maintained by the CTSRD-CHERI organization.","description":"The CTSRD-CHERI GitHub organization hosts and develops the TestRIG framework.","confidence":0.97},{"src_label":"CodeArtifact","src_name":"runTestRIG.py","relation_type":"PART_OF","dst_label":"Tool","dst_name":"TestRIG","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"$ utils/scripts/runTestRIG.py","claim":"runTestRIG.py is a utility script that is part of the TestRIG framework.","description":"runTestRIG.py is the main script used to run TestRIG verification sessions.","confidence":0.99},{"src_label":"Tool","src_name":"TestRIG","relation_type":"MENTIONS","dst_label":"Tool","dst_name":"L3","evidence_chunk_ids":["2d1a953c-bbc5-45f5-957a-56c3d6263029"],"quote":"If the specification is an executable model (see Sail, L3, and many other efforts)","claim":"TestRIG documentation mentions L3 as an example of an executable specification model.","description":"L3 is mentioned alongside Sail as an example of executable specification models compatible with TestRIG.","confidence":0.9},{"src_label":"Concept","src_name":"Vengine","relation_type":"USES","dst_label":"Concept","dst_name":"Instruction Trace","evidence_chunk_ids":["2d1a953c-bbc5-45f5-957a-56c3d6263029"],"quote":"Vengines generate one or more DII streams of instruction traces","claim":"Vengines generate instruction traces as DII streams.","description":"Instruction trace generation is a core responsibility of Vengines in the TestRIG framework.","confidence":0.99},{"src_label":"Concept","src_name":"Vengine","relation_type":"USES","dst_label":"Concept","dst_name":"Execution Trace","evidence_chunk_ids":["2d1a953c-bbc5-45f5-957a-56c3d6263029"],"quote":"and consume one or more RVFI streams of execution traces","claim":"Vengines consume execution traces returned by implementations.","description":"Execution trace consumption is a core responsibility of Vengines for checking correctness.","confidence":0.99},{"src_label":"Concept","src_name":"Vengine","relation_type":"USES","dst_label":"Concept","dst_name":"RVFI-DII","evidence_chunk_ids":["2d1a953c-bbc5-45f5-957a-56c3d6263029"],"quote":"The vengine then feeds these itraces into both a model and an implementation through two TCP sockets in the RVFI-DII format.","claim":"Vengines communicate with implementations using the RVFI-DII format.","description":"Vengines use the RVFI-DII protocol over TCP sockets to communicate instruction and execution traces.","confidence":0.99},{"src_label":"Tool","src_name":"QuickCheck Verification Engine","relation_type":"IMPLEMENTS","dst_label":"Concept","dst_name":"Vengine","evidence_chunk_ids":["42f69dc2-1bc8-4247-b342-561f49596e0a"],"quote":"The root makefile can currently build the QuickCheck Verification Engine, Spike, and the Sail implementation.","claim":"The QuickCheck Verification Engine is an implementation of the Vengine concept in TestRIG.","description":"The QuickCheck Verification Engine serves as a Vengine within the TestRIG framework.","confidence":0.9}]},
TestRIG is used to verify CHERI security extensions on RISC-V processors.
TestRIG is designed to evaluate and verify RISC-V implementations.
TestRIG is compared against RISCV-DV as an alternative test generation framework.
TestRIG matures the approach of PyH2P, addressing its shortcomings.
QCVEngine is TestRIG's QuickCheck-based Verification Engine component.
TestRIG added Direct Instruction Injection to Spike emulator to use it as a reference implementation.
TestRIG uses RVFI to observe execution traces from RISC-V implementations.
TestRIG has been used to test Toooba, a superscalar out-of-order RISC-V processor.
TestRIG uses the Direct Instruction Injection interface to execute generated instructions on the DUV.
TestRIG has been used to test the Piccolo RISC-V processor.
TestRIG has been used to test the Flute RISC-V processor.
TestRIG implements model-based verification by comparing implementations against a formal Sail model.
TestRIG has been used to test the Ibex RISC-V processor.
TestRIG uses a modular Verification Engine (VEngine) to stimulate implementations and compare traces.
TestRIG compares architectural state against the Sail formal model of the RISC-V ISA.
TestRIG is used to evaluate the Toooba processor.
TestRIG added Direct Instruction Injection to QEMU to use it as a reference implementation.
TestRIG uses Direct Instruction Injection, bypassing the PC fetch mechanism.
The paper introduces TestRIG as a testing framework for RISC-V implementations.
TestRIG uses the Sail model as its golden reference for verification.
TestRIG is explicitly compared to instruction-level unit tests and shown to replace them.
TestRIG evaluates architectural coverage using sailcov to measure branch coverage of the Sail RISC-V model.
TestRIG's model-based testing leads to counterexample-driven development.
TestRIG uses the RISC-V Formal Interface to obtain architectural state visibility after each instruction.
TestRIG uses tandem execution to compare execution traces between a model and an implementation.
TestRIG implements tandem verification for RISC-V implementations.
TestRIG uses RVFI-DII as its standardized communication interface.
TestRIG depends on a Verification Engine component to generate and compare instruction sequences.
TestRIG uses randomized instruction generation to produce test sequences.
TestRIG has completely replaced instruction-set level unit testing in the authors' development workflow.
TestRIG uses sailcov to measure architectural coverage of the Sail RISC-V model.
TestRIG uses RVFI-DII interfaces for direct instruction injection testing.
TestRIG uses randomized instruction generation to produce test sequences.
TestRIG is used to validate correctness of the Flute CHERI implementation.
TestRIG is used to validate correctness of the Piccolo CHERI implementation.
TestRIG uses Direct Instruction Injection as its core mechanism for injecting instructions into CPU implementations.
TestRIG has been used to test RVBS, a reference RISC-V implementation.
TestRIG compares execution traces to detect divergence between model and implementation.
TestRIG checks equivalence between a model and implementation by executing the same sequences on both and comparing traces.
TestRIG implements tandem execution by running the same instruction sequences on both a model and an implementation and comparing traces.
TestRIG supports annotating sequences as non-shrinkable to force initialization state coverage.
TestRIG evaluates Ibex as a RISC-V implementation.
TestRIG uses the Sail RISC-V model as a reference model for tandem verification.
The paper leverages TestRIG as the basis for security-aware benchmark generation.
QuickCheckVEngine is the verification engine used within the TestRIG infrastructure.
TestRIG is effective at detecting pipeline bugs in RISC-V processors.
TestRIG uses counterexample shrinking to reduce failing test sequences to minimal examples.
TestRIG is a model-based random testing tool that checks equivalence between a formal model and an implementation.
TestRIG mentions pipeline verification as an application area, finding bugs in pipeline implementations.
LINKED ENTITIES
32 linksRandomized Testing of RISC-V CPUs using Direct Instruction Injection INTRODUCES Extracted graph relationship
Direct Instruction Injection IMPLEMENTS Extracted graph relationship
Tandem Execution IMPLEMENTS Extracted graph relationship
Randomized Instruction Generation IMPLEMENTS Extracted graph relationship
RVFI-DII USES Extracted graph relationship
RVFI USES Extracted graph relationship
Execution Trace Comparison USES Extracted graph relationship
CHERI Security Extension EVALUATES Extracted graph relationship
RISC-V EVALUATES Extracted graph relationship
Test Case Shrinking USES Extracted graph relationship
Verification Engine (VEngine) USES Extracted graph relationship
Model-based Random Testing USES Extracted graph relationship
Tandem Verification USES Extracted graph relationship
Regression Testing USES Extracted graph relationship
Architectural Coverage USES Extracted graph relationship
RVBS EVALUATES Extracted graph relationship
Ibex EVALUATES Extracted graph relationship
Piccolo EVALUATES Extracted graph relationship
Flute EVALUATES Extracted graph relationship
Toooba EVALUATES Extracted graph relationship
Sail RISC-V Model USES Extracted graph relationship
spike USES Extracted graph relationship
QEMU USES Extracted graph relationship
Instruction Sequence Generation USES Extracted graph relationship
Counterexample-Driven Development IMPLEMENTS Extracted graph relationship
QCVEngine PART_OF Extracted graph relationship
PyH2P COMPARES_WITH Extracted graph relationship
Memory Concurrency Testing USES Extracted graph relationship
Pipeline Performance Testing USES Extracted graph relationship
Assertions in Instruction Sequences USES Extracted graph relationship
Non-shrinkable Sequences USES Extracted graph relationship
Sequence Import/Export IMPLEMENTS Extracted graph relationship
CITATIONS
11 sources11 citations — click to expand
[1] TestRIG-compatible implementations and verification engines were collated into an open-source TestRIG repository with documentation. Randomized Testing of RISC-V CPUs using Direct
[2] The authors expect TestRIG to contribute toward a standardized RISC-V testing framework using instrumentation of open implementations. Randomized Testing of RISC-V CPUs using Direct
[3] QCVEngine is described as the initial TestRIG verification engine, with Haskell generator infrastructure that supports rich and complex generators. Randomized Testing of RISC-V CPUs using Direct
[4] The evidence identifies future improvements to QCVEngine generators for virtual memory, cache testing, and floating-point operations. Randomized Testing of RISC-V CPUs using Direct
[5] Future memory-concurrency testing is described as injecting RVFI-DII instruction streams with specified timestamps into multiple shared-memory cores. Randomized Testing of RISC-V CPUs using Direct
[6] A more advanced verification engine would test RVFI traces for equivalence and against higher-level memory-model semantics. Randomized Testing of RISC-V CPUs using Direct
[7] A Flute bug was found after 42 tests and 20 rounds of shrinking; the reduced case involved overlapping memory operations, was found in under 10 seconds, and was fixed within an hour. Randomized Testing of RISC-V CPUs using Direct
[8] The Flute bug had escaped the development process, was not found by the RISC-V unit-test suite, and was difficult to debug from a full software trace. Randomized Testing of RISC-V CPUs using Direct
[9] TestRIG's model-based testing is described as leading to counterexample-driven development. Randomized Testing of RISC-V CPUs using Direct
[10] After Ibex was extended with RVFI-DII support, a summer intern added full CHERI functionality to Ibex in a month due to the reduced-counterexample loop provided by QCVEngine. Randomized Testing of RISC-V CPUs using Direct
[11] The evidence discusses a Sail-OCaml VEngine with direct access to Sail RISC-V model data structures to avoid independent encodings and support future template generation. Randomized Testing of RISC-V CPUs using Direct