RSD 1.1
Disabled floating-point access
Expected: Operations requiring FP state should trap when architectural FP access is disabled.
Observed: The documented test proceeded without the expected illegal-instruction exception.
Research case study / RISC-V verification
Investigating ISA-conformance failures in RSD
Six documented findings from collaborative RTL security-verification research on the open-source RSD out-of-order RISC-V processor at Texas A&M's SETH Lab.
6
Documented findings
2
Architectural failure categories
7b65f6b
Historical RSD commit referenced by reports
Verification approach
Translated RISC-V privileged-ISA requirements into targeted tests, simulated architectural behavior in the RTL processor, and compared expected exceptions and state transitions against trace and waveform evidence. Findings were documented collaboratively with a description of the mismatch, affected architectural behavior, and the simulation context.
01
ISA requirement
02
Targeted test
03
RTL trace review
04
Technical finding
RTL evidence
Six reported findings
4 FP-state · 2 CSR-access
RSD 1.2
Floating-point dirty-state tracking
Expected: Modifying FP register state should update the relevant architectural context status.
Observed: The report records FP state changes without the expected FS status update.
RSD 1.3
Aggregate dirty-state reporting
Expected: The aggregate SD indicator should reflect dirty extension state.
Observed: The indicator remained clear under the reported test conditions.
RSD 1.4
Read-only status-bit handling
Expected: Architecturally read-only status bits should not be directly modified by software writes.
Observed: The report documents an unexpected change to the SD status bit.
RSD 2.1
User-mode access to machine CSRs
Expected: Access to machine-only CSRs from user mode should raise an illegal-instruction exception.
Observed: The supplied simulation traces show disallowed CSR access proceeding without the expected exception.
RSD 2.2
Writes to read-only CSRs
Expected: Illegal writes to read-only CSRs should be rejected with the architecturally required exception.
Observed: The report records attempts that did not trigger the expected trap.
Research scope and disclosure
These findings were marked as reported in the research tracker and refer to the historical RSD revision above; they do not establish the current upstream status, confirmed exploitability, or unique vulnerability identifiers. The work was collaborative. In particular, the aggregate dirty-state finding overlaps an earlier public RSD issue. Only cleared, sanitized reports should be linked publicly.
View published PDF reports