Randomized Testing of RISC-V CPUs Using Direct Instruction Injection

From bibtex.

Abstract

TestRIG (Testing with Random Instruction Generation) is a testing framework for RISC-V implementations. The RISC-V community has standardized a formal model of the architecture in the Sail language1 , giving a human-readable specification that can also be used for simulation and verification. The Sail language is designed for this purpose by allowing instruction semantics to be described conveniently (for example, by supporting variable bit-widths). Ideally, a RISC-V implementor could formally prove equivalence between their implementation and the Sail model, but proof tools are not yet sufficiently automated to be routinely used on the wholeprocessor level. They instead focus on equivalence between combinational logic functions, with verification of a full outof-order microarchitecture remaining an open problem. As a pragmatic compromise, we use TestRIG to check equivalence between the model and an implementation by generating random instruction sequences, executing the same sequences on the model and the implementation under test, and comparing execution traces (tandem execution). This approach does not prove equivalence but can demonstrate divergence, and is usable in all stages of development. TestRIG uses the RISC-V Formal Interface (RVFI) standard2 to observe the change in state after each instruction of the implementation under test, and uses a novel technique that we are calling Direct Instruction Injection (DII) for test injection.