Skip to content
Rivoryxa Technologies
Discuss a problem

Results you can inspect. Checks you can rerun.

Real issues from public open source RISC-V cores, and smaller demonstrations of the method. Each page shows the problem, what we found, and the limits.

All repositories on GitHub

Upstream work on real RISC-V cores

Real issues from public open source RISC-V cores, each taken from the GitHub issue to a result. Every page shows the issue, what we found, and the full report.

Start here

A waived condition that can still happen

Reaching an interrupt and debug clash as a core wakes up

A coverage hole in a RISC-V core's controller. We proved one of its conditions can never happen and wrote a test that reaches the other one.

Reachable, test suppliedRead the case
Every part of the hole closed

Proving a debug path in a RISC-V core can never run

An open coverage hole in a RISC-V core's controller. We proved two of its conditions can never happen and wrote a test that reaches the third.

Dead code, provenRead the case
A bug wider than the report said

Showing a debug halt let a register write slip through

A closed bug report on a RISC-V core: a control register write went through while debug halted the core. We reproduced it and proved the maintainers' fix holds.

Bug reproduced, fix verifiedRead the case

What the outcomes mean

Dead code, proven
The code can never run. Proven for every reachable state, so it is safe to exclude from coverage.
Waiver, with a software rule
The code can run only if software breaks a stated rule. Safe to exclude only while software follows it.
Reachable, test supplied
The code can run, so it must not be excluded. We wrote a test that reaches it.
Bug reproduced, fix verified
We made the reported bug happen on the old design and showed it cannot happen with the fix.

Coverage holes

Code that none of the maintainers' simulations ever reached. For each hole we show whether it can never run, can run only if software breaks a rule, or can run and now has a test.

Issue 1004Reachable, test supplied

Reaching an interrupt and debug clash as a core wakes up

A coverage hole in a RISC-V core's controller. We proved one of its conditions can never happen and wrote a test that reaches the other one.

Read the case
Issue 1010Dead code, proven

Proving a debug path in a RISC-V core can never run

An open coverage hole in a RISC-V core's controller. We proved two of its conditions can never happen and wrote a test that reaches the third.

Read the case
Issue 1005Waiver, with a software rule

Showing a hardware loop hole needs software to break a rule

A coverage hole in a RISC-V core's controller that only a badly set up hardware loop can reach. We proved it is unreachable while software follows the rule.

Read the case
Issue 1007Dead code, proven

Proving a single step stall in a RISC-V core never happens

A coverage hole in a RISC-V core's controller during debug single step. We proved with formal verification that the uncovered branch can never run.

Read the case
Issue 1022Dead code, proven

Why the FPU arbiter in a RISC-V core never arbitrates

A coverage hole in a RISC-V core's FPU arbiter. We proved two FPU operation groups never present a result in the same cycle, so its selection logic never runs.

Read the case
Show all coverage holes
Issue 1006Waiver, with a software rule

Showing two hardware loop guards need a software rule

Two coverage holes in a RISC-V core's controller that only badly placed hardware loops can reach. We proved both unreachable while software follows the rule.

Read the case
Issue 1011Dead code, proven

Proving a debug entry in a RISC-V core always has a cause

Two open coverage holes in the debug entry logic of a RISC-V core's controller. We proved with formal verification that neither can ever be reached.

Read the case
Issue 1012Dead code, proven

Proving three debug cause cases in a RISC-V core never occur

An open coverage hole in a RISC-V core's controller. We proved with formal verification that all three uncovered rows of a debug condition can never happen.

Read the case
Issue 1015Dead code, proven

Proving an operand select case in a RISC-V core never occurs

An open coverage hole in a RISC-V core's ID stage. We proved that the one uncovered combination of its operand select signals can never happen.

Read the case
Issue 1016Dead code, proven

Proving a write back clash in a RISC-V core can never occur

An open coverage hole in a RISC-V core's execute stage, with the floating point unit built in. We proved the uncovered case can never happen.

Read the case
Issue 1017Dead code, proven

Proving a multiply flag case in a RISC-V core never occurs

An open coverage hole in a RISC-V core's execute stage. We proved that the high multiply flag can never be set without a high multiply operation.

Read the case
Issue 1018Dead code, proven

Proving an execute stage condition row can never happen

A coverage hole in a RISC-V core's execute stage, in the FPU build. We proved the one uncovered row of the condition can never happen.

Read the case
Issue 1019Dead code, proven

Proving a divide unit branch in a RISC-V FPU can never run

A coverage hole in the divide and square root unit of a RISC-V core's FPU. We proved the uncovered branch can never run inside the real core.

Read the case

Bug reports

Bug reports from people using the core. We tried to reproduce each one from the report alone, and where the core's maintainers had fixed it, we checked their fix.

Issue 196Bug reproduced, fix verified

Catching an interrupt that broke debug single stepping

A closed bug report on a RISC-V core: an interrupt during a debug single step let a handler instruction run. We reproduced it and proved the maintainers' fix holds.

Read the case
Issue 198Bug reproduced, fix verified

Showing a debug halt let a register write slip through

A closed bug report on a RISC-V core: a control register write went through while debug halted the core. We reproduced it and proved the maintainers' fix holds.

Read the case
Issue 323Bug reproduced, fix verified

Reproducing a decoder bug that rejected zext.h as illegal

A closed bug report on a RISC-V core: the zext.h instruction was rejected as illegal with the B extension on. We reproduced it and proved the maintainers' fix holds.

Read the case
Issue 333Bug reproduced, fix verified

Showing debug registers could be accessed outside debug mode

A closed bug report on a RISC-V core: accessing a debug register outside debug mode did not trap. We reproduced it and proved the maintainers' fix holds.

Read the case
Issue 410Bug reproduced, fix verified

Showing a RISC-V core ran before halting for debug at reset

A closed bug report on a RISC-V core: a debug request at reset let the core start running before it halted. We reproduced it and verified the maintainers' fix.

Read the case
Issue 558Bug reproduced, fix verified

Proving the fix for an instruction count bug in debug mode

A closed bug report on a RISC-V core: an mret run in debug mode raised the retired instruction counter. We reproduced it and proved the maintainers' fix holds.

Read the case

Integration and subsystem examples

Explore the tested configuration, interacting behaviours, and recorded evidence. Each example has a defined scope.

Historical bug

A timer write triggers an interrupt at rollover

An ordinary timer test passes. A write at the carry boundary reproduces a historical upstream defect and its spurious interrupt.

Problem, evidence, and limits
Architectural tests

Architectural tests, from generation to RTL results

Generate and run the exact ACT4 matrix for a pinned open source RISC-V core configuration.

Problem, evidence, and limits
Regression automation

A green regression needs a complete report

Run three pinned RTL projects and reject incomplete, stale, or inconsistent evidence before reporting success.

Problem, evidence, and limits
Debug, interrupts, exceptions

A brief halt request is lost at a control boundary

Ordinary tests pass, but requests arriving during a stall, exception flush, or debug return expose seeded faults in a real RISC-V controller.

Problem, evidence, and limits
FIFO assertions

Check the FIFO rules while data moves

A stale full decision can allow one write too many. Concurrent traffic and independent pointer assertions expose the error.

Problem, evidence, and limits

Method examples

Small designs we built to show methods the real issues do not cover, such as testbench building and clock domain crossing.

Bug to verified fix

From a missed timer interrupt to a verified fix

A RISC-V machine timer with a seeded bug, taken from failing test to counterexample, root cause, proven fix, and closed coverage holes.

Problem, evidence, and limits
Clock domain crossing

A FIFO bug the random test missed

A deliberately broken full-write guard exposes a gap in the original test. A directed regression catches it.

Problem, evidence, and limits
Python testbench

A Python testbench that checks itself

A reference model, random stimulus, and a coverage count per operation.

Problem, evidence, and limits
UVM testbench

A UVM scoreboard that detects a mismatch

Execute the UVM classes and check every transaction against a reference model.

Problem, evidence, and limits

Seen the method? Tell us about your problem.

Describe the problem in a few lines. An engineer replies, and we agree the scope together.

Discuss a verification problem