Skip to content
STIMSMITH

AXI Bus Protocol

Concept WIKI v1 · 7/12/2026

The AXI (Advanced eXtensible Interface) bus protocol is an on-chip communication standard used in the TaPaFuzz FPGA-accelerated graybox fuzzing framework, where a RISC-V CVA5 processor accesses instruction, data, and result memories over AXI4 slave and master ports. An AXI Reset Wrapper shim is placed between the CVA5 core and the downstream AXI4 memory bus to complete in-flight transactions when the core is reset, preventing the bus from locking up.

AXI Bus Protocol

Overview

The AXI (Advanced eXtensible Interface) bus protocol is a point-to-point on-chip interconnect standard used to connect processing elements to memory and control resources. In the TaPaFuzz framework, AXI is used to wire the CVA5 RISC-V core to the BRAM-based instruction, data, and result memories, as well as to provide PE control and optional DRAM access.

AXI in the TaPaFuzz Processing Element

The Fuzzer Processing Element (PE) in TaPaFuzz exposes two AXI slave ports and one optional AXI master port [1]:

  • S_AXI_CTRL: enables PE control, e.g., reset and restart, and provides status information on request.
  • S_AXI_BRAM: allows writing into the PE's instruction, data, and fuzzing-result memories.
  • Optional M_AXI master port: when connected to an AXI-DRAM controller, it replaces or extends the BRAM-based instruction and data memories needed for larger, possibly non-IoT, targets.

The CVA5 RISC-V processor connects to downstream memory via an AXI4 memory bus, with the AXI Reset Wrapper shim module placed between the core and this AXI4 bus [2].

Transaction Model

AXI uses independent VALID/READY handshake channels for write address, write data, write response, read address, and read data phases. Transactions consist of bursts composed of multiple beats. The AXI Reset Wrapper maintains counters for in-flight requests and the remaining number of beats in a write transaction, and keeps a registered copy of each handshake from the core [2].

Reset Behavior and the AXI Reset Wrapper

A naive core reset could leave outstanding AXI transactions incomplete, which can lock up the downstream bus. To prevent this, the AXI Reset Wrapper shim intervenes on a synchronous local core reset by [2]:

  1. Stabilizing pending handshakes from the core using the registered copies until accepted by the bus, to match the AXI specification.
  2. Completing outstanding write bursts by sending write beats with all bytes disabled (wstrb ← 0) matching each outstanding burst's length.
  3. Waiting for response handshakes — final read beats and write responses — to arrive from the bus before notifying the fuzzing controller that the bus is stable and the core reset can be released.

While the core operates normally, the wrapper combinationally passes through the AXI signals and keeps a registered copy of each handshake from the core [2].

Stalling and Overflow Protection

The wrapper stalls write handshakes only if the burst-length FIFO or an in-flight access counter would overflow. For the CVA5 core, such stalling does not occur in practice because the core sends all write beats before starting the next burst [2].

Portability Assumptions Beyond the AXI Standard

The shim module is designed to be portable across different cores or other AXI components and makes only a few assumptions beyond the AXI standard [2]:

  • The core never issues handshakes for write beats (data) before the write burst request (address, length).
  • No more than a configurable number of in-flight read requests (default 15) are sent by the core and accepted by the downstream bus.

Role in the System

  • TaPaFuzz (Tool) — uses the AXI bus protocol as the interconnect backbone for its Fuzzer Processing Elements, enabling memory and control access for RISC-V IoT graybox fuzzing.
  • AXI Reset Wrapper (Code Artifact) — implements a shim that completes in-flight AXI4 transactions on core reset to keep the bus stable.

References

LINKED ENTITIES

2 links
TaPaFuzz USES
AXI Reset Wrapper IMPLEMENTS

CITATIONS

5 sources
5 citations
[1] The Fuzzer PE in TaPaFuzz has two AXI slave ports (S_AXI_CTRL for control/reset/restart and S_AXI_BRAM for writing instruction, data, and fuzzing-result memories) plus an optional AXI master port for connecting to an AXI-DRAM controller. TaPaFuzz - An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing
[2] A wrapper module is placed in-between the CVA5 core and the downstream AXI4 memory bus to complete remaining transactions even when the core resets, while passing AXI signals combinationally and keeping a registered copy of each handshake from the core during normal operation. TaPaFuzz - An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing
[3] The AXI Reset Wrapper maintains counters for in-flight requests and the remaining number of beats in a write transaction, and stalls write handshakes only if the burst-length FIFO or an in-flight access counter would overflow; for the CVA5, this stalling does not occur in practice because the core sends all write beats before starting the next burst. TaPaFuzz - An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing
[4] On a synchronous local core reset, the AXI Reset Wrapper stabilizes pending handshake requests using registered copies until accepted by the bus, sends write beats with all bytes disabled (wstrb set to 0) for each outstanding write burst, and waits for all response handshakes (final read beats and write responses) before notifying the fuzzing controller that the bus is stable and the reset can be released. TaPaFuzz - An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing
[5] The AXI Reset Wrapper shim is portable across different cores or other AXI components, making only two assumptions beyond the AXI standard: the core never issues write-beat (data) handshakes before the write-burst request (address, length), and no more than a configurable number of in-flight read requests (default 15) are sent by the core and accepted by the downstream bus. TaPaFuzz - An FPGA-Accelerated Framework for RISC-V IoT Graybox Fuzzing