PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond

LIU Yu

liuyu@huimtlab.org

Open Source @ Siemens 2025

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 1 / 24

Collaborative (concurrent) engineering 101

Sequential engineering Collaborative engineering specification fixes in specification rag fivesin specification

Jw  is fn rs    sign ines it
—      ~~

—

SW Sw

    6 18 % 2 6 1s

    ime [month]

. . . the executable specification may be used as a golden reference model for the software development process . . . . Indeed, such a specification and the use of cosimulation tools may also help to reveal errors in the test and firmware development cycle very early. [1]

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 2 / 24

Agenda

1 Motivation

2 Notable Features

3 Real-World Examples

4 Our Open-Source Playbook

5 Remarks and Outlook

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 3 / 24

Motivation

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 4 / 24

What Spike is all about

De facto standard RISC-V ISA simulator [2]

• functional model of RISC-V processors (harts) with state-of-the-art ISA support; • originated from UC Berkeley, alongside RISC-V, actively maintained for 15+ years; https://github.com/riscv-software-src/riscv-isa-sim ◦ reference model for hardware / software co-verification, e.g. differential testing [3]:

LIU Yu (EsionTech & HuiMt Labs)  PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond  Open Source @ Siemens 2025 5 / 24

What Spike is all about

De facto standard RISC-V ISA simulator [2]

◦ functional model of RISC-V processors (harts) with state-of-the-art ISA support; ◦ originated from UC Berkeley, alongside RISC-V, actively maintained for 15+ years; https://github.com/riscv-software-src/riscv-isa-sim • reference model for hardware / software co-verification, e.g. differential testing [3]:

LIU Yu (EsionTech & HuiMt Labs)  PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond  Open Source @ Siemens 2025 5 / 24

What Spike is all about (cont’d)

Spike [2], the upstream project at a glance

• C++ code base (40k+ lines), 190+ contributors, 2.9k stars on GitHub (2025/10); • CLI tools (spike, xspike, spike-dasm, . . . ) and C++ libs (libriscv.so, . . . ); ◦ plugin system based on dynamic loading (dlopen) of shared objects / libraries;

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 6 / 24

What Spike is all about (cont’d)

Spike [2], the upstream project at a glance

◦ C++ code base (40k+ lines), 190+ contributors, 2.9k stars on GitHub (2025/10); ◦ CLI tools (spike, xspike, spike-dasm, . . . ) and C++ libs (libriscv.so, . . . ); • plugin system based on dynamic loading (dlopen) of shared objects / libraries;

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 6 / 24

What Spike is all about (cont’d)

Spike [2], the upstream project at a glance

◦ C++ code base (40k+ lines), 190+ contributors, 2.9k stars on GitHub (2025/10); ◦ CLI tools (spike, xspike, spike-dasm, . . . ) and C++ libs (libriscv.so, . . . ); • plugin system based on dynamic loading (dlopen) of shared objects / libraries;

 $  spike \
    --isa=rv64gc_xmyisa \
    --priv=msu \
    --extlib=my_plugin.so \
    --extension=myrocc \
    --device=mydev,0x20000000 \
    program.elf

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 6 / 24

Why Spike needs Python bindings

Agile co-verification calls for the feasibility of . . .

• fast-prototyping custom instructions, accelerators, peripherals, . . . ; ◦ programmatically manipulating Spike for interoperation with testbenches; ◦ reusing small goodies like ISA-string parser, RISC-V disassembler, . . . ;

$  pyspike \
   --isa=rv64gc_xmyisa \
   --priv=msu \
   --extlib=my_plugin.py \
   --extension=myrocc \
   --device=mydev,0x20000000 \
   program.elf



LIU Yu (EsionTech & HuiMt Labs)  PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond  Open Source @ Siemens 2025 7 / 24

Why Spike needs Python bindings

Agile co-verification calls for the feasibility of . . .

◦ fast-prototyping custom instructions, accelerators, peripherals, . . . ; • programmatically manipulating Spike for interoperation with testbenches; • reusing small goodies like ISA-string parser, RISC-V disassembler, . . . ;

                                                    $ python     -q
                                                    >>>   from riscv.sim     import     *
                                                    >>>   help(sim_t)
                                                    Help on class sim_t in module
                                                     ,→   riscv._riscv.sim:

                                                    class sim_t(riscv._riscv.htif.h ⌋
                                                     ,→   tif_t,
                                                     ,→   riscv._riscv.simif.simif_t)
                                                    ...

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 7 / 24

Notable Features

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 8 / 24

Getting started with PySpike

Install PyPI package: spike 1 setup virtual environment (optional): $ python3 -m venv venv $ source venv/bin/activate 2 install spike package with pip: (venv) $ pip install --pre spike Collecting spike Downloading spike-0.0.5.dev... 3 check availability of pyspike: (venv) $ pyspike --help Spike RISC-V ISA Simulator 1.1.1-dev ... usage: spike [host options] <target ,→ program> [target options] ... (Supports Linux / macOS; requires Python 3.8+)

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 9 / 24

What PySpike has to offer, exactly

Feature #1: Python in Spike (PIS) 1 # @file myisa.pyi • write instruction / peripheral models in 2 from typing import List 3 from riscv import isa Python, and plug them into Spike; 4 from riscv.csrs import * 5 from riscv.disasm import * 6 from riscv.processor import * 7 8 @isa.register("myisa") 9 class MyISA(isa.ISA): 10 def init(self): ... 11 def get_instructions(self, proc) ,→ -> List[insn_desc_t]: ... 12 def get_disasms(self, proc) -> ,→ List[disasm_insn_t]: ... $ pyspike --isa=rv32gc_xmyisa 13 def get_csrs(self, proc) -> ,→ --extlib=myisa.py program.elf ,→ List[csr_t]: ... 14 def reset(self, proc) -> None: ...

LIU Yu (EsionTech & HuiMt Labs)  PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond  Open Source @ Siemens 2025 10 / 24

What PySpike has to offer, exactly

Feature #1: Python in Spike (PIS) 1 # @file mydev.pyi • write instruction / peripheral models in 2 from typing import Optional 3 from riscv import dev Python, and plug them into Spike; 4 from riscv.sim import sim_t 5 6 @dev.register("mydev") 7 class MyDEV(dev.MMIO): 8 def init(self, sim: sim_t, ,→ args: Optional[str]): ... 9 def load(self, addr: int, size: ,→ int) -> bytes: ... 10 def store(self, addr: int, data: ,→ bytes) -> None: ... 11 def size(self) -> int: ... $ pyspike --isa=rv32gc --extlib=mydev.py 12 def tick(self, rtc_ticks: int) -> ,→ --device=mydev,0x20000000 ,→ None: ,→ program.elf

  LIU Yu (EsionTech & HuiMt Labs)  PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond  Open Source @ Siemens 2025 10 / 24

What PySpike has to offer, exactly (cont’d)

Feature #2: Spike in Python (SIP) 1 # @file conftest.py • instantiate and seamlessly integrate 2 import pytest 3 from riscv.cfg import * Spike DUT into Python testbenches; 4 from riscv.debug_module import * 5 from riscv.sim import sim_t 6 7 @pytest.fixture 8 def mydut(): 9 yield sim_t( 10 cfg=cfg_t(isa="rv32gc", priv="m", ,→ mem_layout=[mem_cfg_t( ,→ 0x90000000, 0x40000)]), 11 halted=False, 12 plugin_device_factories=[("mydev", $ PYSPIKE_LIBS=mydev.py \ ,→ ("0x20000000", ))], pytest -v testbench.py 13 args=["program.elf"], 14 dm_config=debug_module_config_t())

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 11 / 24

What PySpike has to offer, exactly (cont’d)

Feature #2: Spike in Python (SIP) 1 #!/usr/bin/env python3 • reuse Spike’s internal gadgets in 2 # @file mydasm.py 3 from sys import argv Python, i.e., RISC-V disassembler; 4 from elftools.elf.elffile import * 5 from riscv.decode import * 6 from riscv.disasm import * 7 from riscv.isa_parser import * 8 9 d = disassembler_t(isa_parser_t( ,→ "rv64gc_xmyisa", "msu")) 10 e = ELFFile.load_from_path(argv[1]) 11 s = e.get_section_by_name(".text") 12 pc = s.header.sh_addr 13 for op in insn_fetch_all(s.data()): $ PYSPIKE_LIBS=myisa.py \ 14 print(f"0x{pc:08x} (0x{op:08x}):", python mydasm.py program.elf ,→ d.disassemble(x:=insn_t(op))) 15 pc += len(x)

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 11 / 24

Real-World Examples

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 12 / 24

PySpike in the big picture of co-verification

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 13 / 24

PySpike in the big picture of co-verification

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 13 / 24

Case #1: Continuous test program verifier

• PySpike provides a reference DUT for verifying test-programs.

$ dut_arbitrator.py target-pyspike $ openocd
Listening for remote bitbang --file target.tcl
,→ connection on port 12345. --file test_foo.tcl ...

LIU Yu (EsionTech & HuiMt Labs)  PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond  Open Source @ Siemens 2025 14 / 24

Case #1: Continuous test program verifier

• PySpike provides a reference DUT for verifying test-programs.

$ dut_arbitrator.py target-pyspike $ openocd
Listening for remote bitbang --file target.tcl
,→ connection on port 12345. --file test_foo.tcl CPU1> Hello World! ...

LIU Yu (EsionTech & HuiMt Labs)  PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond  Open Source @ Siemens 2025 14 / 24

Case #1: Continuous test program verifier

• PySpike provides a reference DUT for verifying test-programs.

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 14 / 24

Case #2: CPU trace log decoder and beyond

• PySpike provides extensible RISC-V disassembler with top-norch ISA support.

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 15 / 24

Our Open-Source Playbook

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 16 / 24

Strategy #1: Extend, don’t modify

Concept • design exclusively through Spike’s dlopen-based plugin system, avoid instrusive patches to Spike’s code; • bundle Spike by compiling directly from upstream source at pinned commit;

Rationale • zero-effort adoption for existing Spike users, w/ or w/o custom plugins; • minimal maintenance overhead when syncing with upstream changes;

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 17 / 24

Strategy #1: Extend, don’t modify

Concept $ pyspike
• design exclusively through Spike’s --isa=rv64gc_xmyisa
--priv=msu
dlopen-based plugin system, avoid --extlib=myisa.py
instrusive patches to Spike’s code; --device=mydev,0x20000000
• bundle Spike by compiling directly from program.elf upstream source at pinned commit; Rationale $ PYSPIKE_LIBS=myisa.py
spike
• zero-effort adoption for existing Spike --isa=rv64gc_xmyisa
users, w/ or w/o custom plugins; --priv=msu
--extlib=libpython3.8.so
• minimal maintenance overhead when --extlib=_riscv.so
syncing with upstream changes; --device=mydev,0x20000000
program.elf

LIU Yu (EsionTech & HuiMt Labs)  PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond  Open Source @ Siemens 2025 17 / 24

Strategy #1: Extend, don’t modify

Concept • design exclusively through Spike’s dlopen-based plugin system, avoid instrusive patches to Spike’s code; • bundle Spike by compiling directly from upstream source at pinned commit;

Rationale • zero-effort adoption for existing Spike users, w/ or w/o custom plugins; • minimal maintenance overhead when syncing with upstream changes;

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 17 / 24

Strategy #2: Upstream, don’t fork

Concept Example (the ‘--device’ args fix) • proactively engage with upstream: 2023/12: Someone proposed to fix Spike’s identify hurdles early and resolve them CLI option ‘--device’, i.e., through discussions or pull requests; Fix Spike --device option to pass • strictly avoid maintaining divergent forks on args to downstream plugins #1522 of Spike or PySpike, even internally; $ spike --extlib=my_plugin.so
Rationale -+ --device=
--device=,
• prevent technical debt accumulation program.elf from conflicts and parallel development; The PR broke our then-in-house prototype • strengthen the upstream foundation, PySpike for 1) the ‘fixed’ option assumed which benefits the whole community; ‘,’-separated values, and 2) per-device args for the same name was impossible.

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 18 / 24

Strategy #2: Upstream, don’t fork

Concept Example (the ‘--device’ args fix) • proactively engage with upstream: identify hurdles early and resolve them through discussions or pull requests; • strictly avoid maintaining divergent forks of Spike or PySpike, even internally;

Rationale • prevent technical debt accumulation from conflicts and parallel development; • strengthen the upstream foundation, which benefits the whole community;

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 18 / 24

Strategy #2: Upstream, don’t fork

Concept Example (the ‘--device’ args fix) • proactively engage with upstream: 2024/04: We raised our concern to the identify hurdles early and resolve them maintainers, received positive feedback, through discussions or pull requests; and got our PR merged in ∼1 week. • strictly avoid maintaining divergent forks Counter-intuitive MMIO device argu- of Spike or PySpike, even internally; ments behavior #1652 Support per-device arguments and Rationale device factory reuse #1655 • prevent technical debt accumulation from conflicts and parallel development; • strengthen the upstream foundation, which benefits the whole community;

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 18 / 24

Strategy #3: Publicize workflows

Concept Example (developing workflow) • share PySpike’s development, testing, 1 get source code: and packaging workflows openly; $ git clone --recurse-submodules
• leverage CI / CD services to automate git@github.com:huimtlab/pyspike $ cd pyspike and enforce quality adherence; 2 setup virtual environment: Rationale $ python3 -m venv venv $ source venv/bin/activate • foster transparency and reproducibility 3 install in editable mode: for external contributors and users; (venv) $ pip install -e '.[dev]' • open-source software thrive on 4 lint & test & coverage: community trust, even more so for (venv) $ pytest -v quality-assuring tools like PySpike; ... 76 passed, 8 skipped in 9.42s

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 19 / 24

Strategy #3: Publicize workflows

Concept Example (packaging workflow) • share PySpike’s development, testing, PySpike bundles Spike binaries as Python and packaging workflows openly; package data. We migrated internal build • leverage CI / CD services to automate & package workflow to GitHub Actions. and enforce quality adherence;

Rationale • foster transparency and reproducibility for external contributors and users; • open-source software thrive on community trust, even more so for Agile chip design methodology is still quality-assuring tools like PySpike; of limited usage due to lack of tool- chain and developing framework [4]

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 19 / 24

Remarks and Outlook

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 20 / 24

We are rolling out the first Beta release!

Closing remarks and key takeaways • PySpike opens up Spike’s C++ internals for interoperation with Python scripts; we showcase PySpike’s potential in boosting agile co-verification with a few examples; • The development of PySpike is guided by our open-source playbook, promising non-intrusive design, upstream engagement, and open engineering process;

Future outlook and call for collaboration • Distributing embedded toolchains via the Python Package Index (PyPI) grants wider accessibility, and brings in extra benefits like dependency management, environment isolation, multi-version coexistence, . . . ; we hope to explore this area in the future; • As a language binding, PySpike needs the community’s help to keep up with Spike’s changes to its evolving feature set and unstable C++ API’s;

LIU Yu (EsionTech & HuiMt Labs)  PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond  Open Source @ Siemens 2025 21 / 24

Who we are, and what we do

EsionTech (中微亿芯) • subsidiary of CETC’s Research Institute 58, founded in 2013; • headquarter in Wuxi, R&D centers in Beijing, Shanghai, Wuhan, . . . ; • vendor of all-programmable and heterogeneous computing chips; • new player in the RISC-V ecosystem, since early 2023;

HuiMt Labs (惠山实验室) • affiliated with EsionTech’s Beijing R&D Center; • small group of open-source software enthusiasts; •• veterans in HW / SW co-design and co-verification; te contributors to RISC-V tools, i.e. gcc, spike, riscv-dv, . . . ;

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 22 / 24

Thank You!

LIU Yu (EsionTech & HuiMt Labs) PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond Open Source @ Siemens 2025 23 / 24

References I

[1] J ¨urgen Teich. “Hardware/Software Codesign: The Past, the Present, and Predicting the Future”. In: Proceedings of the IEEE 100.Special Centennial Issue (2012), pp. 1411–1430. DOI: 10.1109/JPROC.2011.2182009. [2] Andrew Waterman et al. Spike RISC-V ISA Simulator. https://github.com/riscv-software-src/riscv-isa-sim. 2010-2025. (Visited on 10/29/2025). [3] William M. McKeeman. “Differential Testing for Software”. In: Digital Technical Journal 10.1 (1998). [4] Yinan Xu et al. “Towards Developing High Performance RISC-V Processors Using Agile Methodology”. In: IEEE/ACM International Symposium on Microarchitecture (MICRO). IEEE, 2022, pp. 1178–1199. DOI: 10.1109/MICRO56248.2022.00080.

LIU Yu (EsionTech & HuiMt Labs)  PySpike: Agile Co-Verification of RISC-V SoC’s and Beyond  Open Source @ Siemens 2025 24 / 24