Fursoy: an open-source out-of-order RISC-V core that boots mainline Linux

A clean-slate 64-bit out-of-order superscalar RISC-V processor written in SystemVerilog has been demonstrated booting mainline Linux 6.6.50 into a BusyBox userspace. The project, Fursoy Slice-1, reached the Hacker News front page on November 14, and its GitHub repository (FURSOY/fursoy-cpu) describes a design spanning register renaming, Sv39 demand paging, privilege separation and a small system-on-chip — verified so far in simulation and block-level synthesis rather than in silicon.

A two-wide out-of-order machine

According to the repository, the core is two-wide at fetch, decode and rename, and retires in order through a 128-entry reorder buffer. Renaming maps architectural registers onto a 160-entry physical integer register file with a 128-entry speculative free list, and eight branch checkpoints let the register alias tables roll back speculative state in a single cycle after a mispredict. Execution draws on separate issue queues: 32 entries each for integer and memory operations, a floating-point unit with 64 physical registers, and a decoupled eight-entry vector queue feeding a unit with 48 physical registers, a 256-bit vector length and 64-bit elements. Arithmetic runs through single-cycle parallel-prefix (Kogge-Stone) adders in the ALU and branch unit, a three-stage pipelined multiplier and a hardware divider. The implemented ISA is RV64IMAFDV plus Zba, Zbb, Zicsr and Zifencei, with machine, supervisor and user privilege modes.

Sv39 translation and the surrounding SoC

Both first-level caches are 16 KiB and 4-way set-associative. The instruction cache is virtually indexed, physically tagged, with a next-line prefetcher and two miss-status registers; the data cache is eight-banked and non-blocking, with a 16-entry load queue, a 16-entry store queue, four MSHRs and a two-entry writeback buffer. Address translation is Sv39 on both sides, each with a 64-entry 4-way base TLB plus an eight-entry CAM for 2 MiB and 1 GiB superpages, and the data path adds a 32-entry translation request table. A shared hardware page-table walker watches for dirty lines in the data cache so page-table writes are visible to the walker without forcing an eviction, and SFENCE.VMA handling drains the store queue and synchronises with a cache clean.

The SoC ties the core to 256 MiB of DRAM, a CLINT timer, a PLIC with 31 external interrupt sources, a 16550 UART and custom M-mode firmware implementing SBI 2.0, all behind a five-way priority crossbar with anti-starvation arbitration.

The Linux boot, accounted cycle by cycle

The headline result is a full boot of Linux 6.6.50 in Verilator: across 89.9 million simulated cycles the design retired 76.2 million instructions — an IPC of 0.848 on a machine that can commit two per cycle — while servicing 2,255 demand page faults and roughly 2.2 million user-mode commits, with the repository reporting zero kernel panics, oopses or access faults. The project also instruments the pipeline with cycle-exact counters that sort every cycle into eight mutually exclusive buckets. During the boot, 47.9% of cycles committed useful work, 16.7% went to branch-misprediction and exception recovery, 16.5% to idle and pipeline drains, and rename and memory stalls together consumed another 12.5%. The buckets sum exactly to the cycle counter, which the project reports as zero conservation errors.

500 MHz timing closure, at block level

For physical estimates, eight core functional blocks were synthesised with Yosys 0.33, sv2v and OpenSTA 3.1.0 against the Nangate 45 nm library, targeting a 2 ns clock period. All eight blocks met timing after optimisation, totalling about 219 kGE of standard cells across 111,019 cells. The repository is candid about the limits: full-SoC place-and-route and SRAM macro compilation have not been run, so 500 MHz is a per-block synthesis result, not a measure of a finished chip.

Reproducing the work requires Verilator and a RISC-V toolchain on Ubuntu or WSL2. The repository ships lint, regression and synthesis scripts; the Linux boot closeout alone takes roughly 1.5 to 2 hours of wall time.

Why it matters

Booting mainline Linux is one of the hardest integration tests a CPU can face: it exercises privilege modes, page-table walks, interrupts, timers and console I/O, and a bug in any of them usually ends the boot. A clean-slate open design clearing that bar with a superscalar out-of-order core — an architecture style commercial vendors treat as crown-jewel IP — meaningfully narrows the gap between open hardware and contemporary processor engineering. The open EDA flow matters too: Yosys and OpenSTA closing 500 MHz timing on nontrivial sequential blocks shows the open toolchain coping with real logic depth. The cycle-accounting telemetry is notable discipline in its own right, since proving that every simulated cycle lands in exactly one category catches whole classes of accounting bugs. The caveats are real — no place-and-route, no SRAM macros, no silicon — but as a readable SystemVerilog reference for how modern cores are actually built, Fursoy is a significant open-hardware milestone.