Skip to content
Rivoryxa Technologies
Discuss a problem

Showing a hardware loop hole needs software to break a rule

A coverage hole in a RISC-V core's controller that only a badly set up hardware loop can reach. We proved it is unreachable while software follows the rule.

Open source RISC-V core, coverage hole 1005Outcome: Waiver, with a software rule
View the issue Read the full report

1The issue

Line 640 of the core's controller handles the end of the second hardware loop. Hardware loops let the core repeat a block of code without branch instructions. One condition on this line was never covered. To reach it, the outer loop has to end inside the inner loop, which the loop rules forbid. The core's maintainers waived it on that reasoning and noted it could maybe be proven with a formal tool.

The points on the issue

Hardware aloneReachable. The hardware does not check loop addresses, and a formal search reaches the condition in 7 cycles with an illegal setup.
Software follows the loop nesting ruleCan never happen. Proven with formal verification under that rule.
End address left over from a finished loopCan also reach the condition, so the rule has to cover what is in the loop registers, not only how the code is nested.

2What we did

  1. 1Found that the condition needs the outer loop's end address to sit inside the inner loop's body, which the loop nesting rule forbids.
  2. 2Checked this with a solver. The condition is impossible with the rule and possible without it.
  3. 3Proved it on the design with an induction proof, assuming the rule, that each active loop starts before it ends, and that addresses do not wrap around.
  4. 4Kept the failed attempts as evidence. A first proof with the rule alone failed on an address wrap case, which is why the last two assumptions were added.

3Result

This is a waiver with a software rule, not dead code. While software keeps the loop registers within the rule, the condition cannot happen.

The waiver holds only while software obeys the stated rule. If software can break it, the code is reachable.

Read the full report

Have a coverage hole like this one?

Describe the problem in a few lines. An engineer replies, and we agree the scope together.

Discuss a verification problem