RISC-V is an open-standard Instruction Set Architecture (ISA) that has gained significant popularity in both academia and industry. The adoption of RISC-V is propelled by open-source accessibility, design adaptability, cost efficiency, and an active global community. Based on a given ISA, the microarchitecture defines the specific hardware implementation, i.e. it details how the processor’s components are organized and interact to execute the instruction set. This implementation is typically carried out using a Hardware Description Language (HDL), such as VHDL or Verilog, to ultimately realize the processor as either an Application-Specific Integrated Circuit (ASIC) or a Field-Programmable Gate Array (FPGA). For students in computer architecture, a comprehensive understanding of single-cycle, multicycle, and pipelined microarchitectures is fundamental as they represent key approaches to how processors execute instructions. Although several books introduce these architectures, there is a lack of interactive tools that link the execution of assembly-level simulations on synthesizable hardware designs with corresponding visual representations of processor architecture and behavior. In this paper, we present SonicRV, a web-based educational platform for simulation and visualization of assembly programs on a single-cycle, multicycle, and pipelined RISC-V processor. Each of the three processors is provided as both a VHDL model and a corresponding block diagram, derived from an established textbook. SonicRVenables students to input custom assembly programs and simulate them on the different VHDL-based processor implementations. The results are interactively visualized through multiple synchronized views – including the assembly source, block diagram, state machine, and pipeline diagram – complemented by a simulation waveform for in-depth signal-level inspection. These features were rated positively in a small-scale survey by students. Furthermore, the processors are synthesizable to FPGAs via open source flows to bridge the gap between simulation and real hardware. SonicRV, along with carefully designed examples, will be released as open-source on GitHub.

Quantified Boolean Formulas (QBFs) extend propositional logic with existential and universal quantifiers, making their decision problem PSPACE-hard. Recent advances in QBF solvers have established QBFs as an attractive framework for encoding PSPACE-hard problems across domains such as formal verification, synthesis, and symbolic AI. Despite progress in solving techniques, less attention has been given to the infrastructure for constructing correct and efficient QBF encodings. For instance, it is often unclear whether two QBFs that encode the same problem in different ways yield the same solutions. Traditional QBF equivalence checking focuses only on free variables, yet in many cases, the quantified variables must also be considered. In this paper, we present QSOLE, the first fully automatic checker for solution-based QBF equivalence. Based on a recently introduced approach, QSOLE decomposes equivalence checks into smaller entailment computations and is capable of generating witnesses for detected inequivalences, which can be used to debug encodings. Furthermore, it allows for explicit exclusion of variables from equivalence checks enabling comparison of formulas using different local auxiliary variables.

Despite decades of mitigation efforts, memory corruption bugs remain a dominant source of security vulnerabilities. CHERI, a capability-based architecture, directly targets this problem by replacing traditional pointers with Capabilities that encode bounds, permissions, and tamper-protection tags. However, CHERI represents a significant architectural intervention that impacts not only the processors core, but the entire Hardware/Software platform. System-level evaluation methods, such as Virtual Prototypes (VPs), have shown to be highly valuable for exploring, validating, and optimizing such complex Hardware/Software systems. This paper introduces the first open-source SystemC/TLMbased CHERI-enhanced RISC-V VP. The VP comes with support for Virtual Memory Management (VMM) and is capable of executing complex software stacks, such as the general purpose and memory-safe CheriBSD operating system. A verification using TestRIG demonstrates the VP’s robustness, passing 2.15 million test cases. A case study with CheriBSD and 10 representative, demanding benchmark workloads highlights the VP’s capability to simulate complex CHERI-enabled systems and to provide valuable insights for Hardware/Software co-design. The CHERI-enhanced VP, along with the Software used in our case study is available as open-source on GitHub.

In this paper, we enhance RVVTS, an open-source framework for testing RISC-V vector instructions, to enable comprehensive floating-point (FP) verification across various RISC-V simulators and FP libraries. Our enhanced RVVTS, referred to as FP-RVVTS, adds support for the RISC-V FP extensions (F, D, Zfh) through a novel context-free grammar specification with annotations, strengthened automatic single-instruction isolation, and improved failure cause analysis.In the experiments we show that FP-RVVTS generates FP test sets achieving over 95% functional coverage, reveals critical bugs in several RISC-V simulators, and, using isolated instructions, supports to narrow down the causes of failures.

Transaction-level debugging in Virtual Prototypes (VPs) remains challenging due to the sheer number and intricate nature of interactions between software and hardware components. This paper presents ProtoLens, the first open-source tool for dynamic visualization of Transaction Level Modeling (TLM) transactions in SystemC-based VPs. Integrated with the open-source RISC-V VP++, ProtoLens provides an interactive web front-end that displays architecture-aware transaction flows in real-time. It captures transaction data via a lightweight extension of the TLM bus and enriches it with peripheral-specific views through user-defined modules, so-called Transaction View Modules (TVMs). Additionally, ProtoLens supports integration with software debuggers, allowing synchronized transaction inspection and control of the simulation flow. This enables developers to efficiently analyze issues such as incorrect memory mappings, unexpected peripheral behavior, and to better understand the overall system architecture.Two case studies highlight the capabilities of ProtoLens: one demonstrates how it complements classical debugging in a bare-metal software example, and the other showcases its ability to reconstruct real-time graphics output from a Linux-based game.

Checkpointing enables the storage and restoration of the simulation state of Virtual Protypes (VPs), significantly reducing the debugging and testing cycle times, thereby accelerating the overall development process. In this work, we present a novel methodology for checkpointing digital SystemC VPs, with a particular focus on storing and restoring SC_THREAD processes, which are integral to SystemC models. The proposed checkpointing methodology is non-intrusive to the SystemC kernel and is implemented as a SystemC library, which integrates seamlessly with existing digital VPs with minimal effort. The effectiveness of the proposed methodology is demonstrated through a case study on a digital Finite Impulse Response (FIR) filter. The filter’s state was successfully restored from a checkpoint, and its execution was validated to be consistent with the filter’s expected behavior. The results confirm that the proposed checkpointing library reliably restores the simulation state of digital VPs, enabling faster design iterations.

The waveform viewer is one of the most important tools in a hardware engineer's toolbox. It is the main interface used to track down design bugs found by simulation or formal verification. In this paper, we present Surfer, a modern waveform viewer designed to integrate with the broader hardware design ecosystem. It supports translation from bit vectors to semantically meaningful values, integration with simulation and verification tools, and lays the groundwork for interactive simulation in the open-source ecosystem.

Embedded systems play a crucial role in today’s Internet-of-Things (IoT) ecosystems. These systems can range from simple sensors to edge Artificial Intelligence (AI) solutions. However, their complex Hardware (HW)/Software (SW) interactions demand new analytical methodologies which encompass both the HW and the SW execution.In this work, we present a novel approach for early visualization of complex HW/SW interactions during SW development for embedded systems. Our approach traces the lifetime of HW and SW functions during the simulation of a Virtual Prototype (VP), which represents the HW while executing the SW. We dynamically instrument the execution of the VP at runtime such that neither the VP binary file nor the SW binary file has to be modified for tracing. The results are presented as a Function Lifetime Diagram (FLD) by storing the data into the Fast Transaction Recording (FTR) file format, which can be visualized, e.g. by the Surfer waveform viewer.To demonstrate the effectiveness of our approach, we first analyze the HW and SW interactions of a Micro-Electro-Mechanical System (MEMS) sensor. More specifically, the root causes of two already identified HW/SW interaction issues are analyzed. Second, the application flow of an edge AI application for recognizing handwritten digits on a touch display utilizing a pretrained Neural Network (NN) is analyzed. These experiments demonstrate that FLDs provide an effective abstraction to foster a deeper understanding of the embedded system behavior. An additional runtime evaluation reveals an approximately 1.9-fold runtime overhead, demonstrating that our instrumentation approach remains runtime-efficient even for larger IoT applications.

Modern applications increasingly rely on embedded systems that incorporate visual interfaces developed utilizing so-called embedded graphics libraries. Verifying these embedded graphics libraries is challenging due to hardware dependencies and the lack of reference outputs. The lack of reference outputs is tackled in Metamorphic Testing (MT) by constructing two Firmware (FW) versions with distinct implementations that maintain the same input-output relationships. These relations are known as Metamorphic Relations (MRs). However, the development of these MRs remains a tedious and challenging task.In this paper, we present a novel approach for generating MRs for MT of embedded graphics libraries using Large Language Models (LLMs). Because directly creating MRs with simple prompts is too complex for the LLM, we employ proven prompting strategies to develop our LLM-assisted MR pipeline. Strategies include role prompting, least-to-most prompting, zero-shot prompting, constraint-based prompting, and style prompting. In our experiments, we verify a widely used embedded graphics library. We compare our results with an existing manual approach and demonstrate that LLM-assisted MRs nearly doubles coverage and identifies additional bugs.

TheInstruction Set Simulators (ISSs) used in Virtual Prototypes (VPs) are typically implemented as interpreters with the goal to be easy to understand, and fast to adapt and extend. However, the performance of instruction interpretation is very limited and the ever-increasing complexity of Hardware (HW) poses an increasing challenge to this approach. In this paper, we present optimization techniques for interpreter-based ISSs that significantly boost performance while preserving comprehensibility and adaptability. We consider the Risc-V Iss of an existing, SystemC-based open-source VP with extensive capabilities such as running Linux and interactive graphical applications. The optimization techniques feature a Dynamic Basic Block Cache (DBBCache) to accelerate ISS in-struction processing and a Load/Store Cache (LSCache) to speed up ISS load and store operations to and from memory. In our evaluation, we consider 12 Linux-based benchmark workloads and compare our optimizations to the original VP as well as to the very efficient official RISC-V reference simulator Spike maintained by RISC-V International. Overall, we achieve up to 406.97 Million Instructions per Second (MIPS) and a significant average performance increase, by a factor of 8.98 over the original VP and 1.65 over the Spike simulator. To showcase the retention of both comprehensibility and adaptability, we implement support for RISC-V half-precision floating-point extension (Zfh) in both the original and the optimized VP. A comparison of these implementations reveals no significant differences, ensuring that the stated qualities remain unaffected. The optimized VP including Zfh is available as open-source on GitHub.

Embedded graphics libraries are part of the Firmware (FW) of embedded systems and provide complex functionalities optimized for specific hardware. After unit testing of embedded graphics libraries, integration testing is a significant challenge, in particular since the hardware is needed to obtain the output image as well as the inherent difficulty in defining the reference result. In this paper, we present a novel approach focusing on integration testing of embedded graphic libraries. We leverage Virtual Prototypes (VPs) and integrate them with Metamorphic Testing (MT). Metamorphic Testing (MT) is a software testing technique that uncovers faults or issues in a system by exploring how its outputs change under predefined input transformations, without relying on explicit oracles or predetermined results. In combination with virtualizing the displays in VPs, we even eliminate the need for physical hardware. This allows us to develop a Metamorphic Testing (MT) framework automating the verification process. In our evaluation, we demonstrate the effectiveness of our Metamorphic Testing (MT) framework. On an extended RISC-V Virtual Prototype (VP) for the GD32VF103VBT6 platform, we found 15 distinct bugs for the widely used TFT_eSPI embedded graphics library, confirming the strength our approach. We finish the evaluation of our Metamorphic Testing (MT) approach by discussing the achieved structural coverage for function, line and branch coverage.

While the Hardware (HW) domain and the Software (SW) domain use the concept of coverage to measure the thoroughness of tests, there isn’t an established common metric that applies to both worlds. In this paper we make two major contributions: First, leveraging the abstraction of Virtual Prototypes (VPs), we unify HW/SW coverage by viewing the HW/SW system as a single model. This enables the measurement of structural HW/SW metrics like line, function, and branch coverage via a novel non-intrusive approach, where neither the VP (representing the HW) nor the SW requires any modification. Second, based on the unified HW/SW coverage, we introduce relation coverage. The innovation is that the user can define a relation between the frequency of executing lines in the SW and the execution count of corresponding lines of the HW model. This relation expresses expected behavior to be covered during testing. As a case study, we consider HW/SW testing of a Gyroscope sensor controlled by SW running on a RISC-V VP.

Testing complex RISC-V extensions such as RISC-V Vector (RVV) with its 600+ highly configurable instructions is crucial. For this reason, test suites have been developed over the last years, including both hand-written and automatically generated tests. Although the process of running these tests is often highly automated, a significant portion of the work, namely the result analysis, has to be conducted manually after the run. This paper introduces the modular, open-source framework RVVTS for positive and negative testing of RVV implementations, featuring a novel technique called Single Instruction Isolation with Code Minimization, which significantly reduces manual result analysis of failing tests. We demonstrate the effectiveness of RVVTS by automatically generating and applying test sets to the RISC-V VP++ Virtual Prototype and the QEMU emulator, achieving a functional coverage of >94%. For RISC-V VP++, our framework detects and minimizes similar to 1, 849 failures and associate them with 10 isolated, failing instructions. Similarly, for QEMU, it detects similar to 19k failures and relates them to 168 instructions for debugging. Overall, we confirmed 3 new bugs in the RISC-V VP++ and 2 in QEMU (and 7 more are to be analyzed).