  Existing techniques to ensure functional correctness and hardware trust
during pre-silicon verification face severe limitations. In this work, we
systematically leverage two key ideas: 1) Symbolic Quick Error Detection
(Symbolic QED or SQED), a recent bug detection and localization technique using
Bounded Model Checking (BMC); and 2) Symbolic starting states, to present a
method that: i) Effectively detects both "difficult" logic bugs and Hardware
Trojans, even with long activation sequences where traditional BMC techniques
fail; and ii) Does not need skilled manual guidance for writing testbenches,
writing design-specific assertions, or debugging spurious counter-examples.
Using open-source RISC-V cores, we demonstrate the following: 1. Quick (<5
minutes for an in-order scalar core and <2.5 hours for an out-of-order
superscalar core) detection of 100% of hundreds of logic bug and hardware
Trojan scenarios from commercial chips and research literature, and 97.9% of
"extremal" bugs (randomly-generated bugs requiring ~100,000 activation
instructions taken from random test programs). 2. Quick (~1 minute) detection
of several previously unknown bugs in open-source RISC-V designs.
