Control and Status Register

Concept

A Control and Status Register (CSR) is a special-purpose register in the RISC-V Instruction Set Architecture that controls and holds architectural processor state. CSRs are modeled by Instruction Set Simulators and are widely used as a coverage signal in coverage-guided hardware fuzzing, where transitions in CSRs indicate new processor states. The CSR-transition coverage metric was introduced by ProcessorFuzz and adopted in other hardware fuzzers including DIFUZZRTL, Cascade, and the FPGA-accelerated Lyra framework. Ibex provides a dedicated formal-friendly CSR register-model verification testbench that uses a C++ reference model linked via DPI.

First seen 5/25/2026

Last seen 7/16/2026

Evidence 14 chunks

Wiki v6

WIKI

Overview

A Control and Status Register (CSR) is a register that serves a special purpose in the RISC-V Instruction Set Architecture (ISA). CSRs are responsible for controlling and holding the state of the processor. A documented example is mtvec, the Machine Trap-Vector Base-Address CSR, which stores the address of the trap or interrupt handler. CSRs are part of an Instruction Set Simulator (ISS) in the sense that an ISS must model the architectural state defined by the CSRs of the target ISA.

Example CSRs

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

6 connections

ProcessorFuzz ← uses 100% 2e

ProcessorFuzz uses Control and Status Register transitions to guide fuzzing.

Forvis ← mentions 90% 1e

Forvis has an error related to CSR access privileges.

Instruction Set Architecture part of → 95% 1e

Control and Status Registers are part of the RISC-V ISA.

Lyra ← uses 85% 1e

Lyra incorporates control register-based coverage instrumentation.

Instruction Set Simulator part of → 90% 1e

The ISS includes Control and Status Registers.

Ibex ← evaluates 1e

Ibex formally evaluates the Control and Status Register model.

LINKED ENTITIES

1 links

Ibex EVALUATES Extracted graph relationship

CITATIONS

14 sources

14 citations — click to expand

[1] A Control and Status Register (CSR) is a special-purpose register in the RISC-V ISA that controls and holds processor state, and an ISS must model the architectural state defined by the CSRs of the target ISA. ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers

[2] The `mtvec` CSR is the Machine Trap-Vector Base-Address CSR that stores the address of the trap/interrupt handler. ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers

[3] CSRs are in charge of controlling and holding the state of the processor, so transitions in CSRs indicate a new processor state. ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers

[4] ProcessorFuzz introduced a novel CSR-transition coverage metric, is HDL-agnostic, requires no processor-design instrumentation, and was evaluated on Rocket, BOOM, and BlackParrot, exposing 8 new bugs across the three cores plus 1 new bug in a reference model, all confirmed by developers. ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers

[5] ProcessorFuzz triggered a set of ground-truth bugs 1.23× faster (on average) than DIFUZZRTL. ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers

[6] ProcessorFuzz's CSR-transition coverage metric monitors processor state changes and proved more efficient in bug detection than previous methods. FuzzWiz - Fuzzing Framework for Efficient Hardware Coverage

[7] Prior processor-fuzzing research used specific metrics such as mux toggle, CSR-transition, or register coverage to guide fuzzing, and it is questionable how these specific coverage metrics relate to traditional RTL code or functional coverage needed to verify the DUV. FuzzWiz - Fuzzing Framework for Efficient Hardware Coverage

[8] FuzzWiz is an automated hardware-fuzzing framework that takes a generic RTL design as input and performs fuzzing to improve overall HDL coverage with flexibility to choose which fuzzing engine to apply. FuzzWiz - Fuzzing Framework for Efficient Hardware Coverage

[9] DIFUZZRTL (Hur et al., 2021) improved upon RFUZZ by adding clock-sensitive optimization and incorporating a reference model. Lyra: A Hardware-Accelerated RISC-V Verification Framework with Generative Model-Based Processor Fuzzing

[10] ProcessorFuzz (Canakci et al., 2023) introduced a coverage metric guided by processor Control and Status Register (CSR) transitions. Lyra: A Hardware-Accelerated RISC-V Verification Framework with Generative Model-Based Processor Fuzzing

[11] Cascade (Solt et al., 2024) employed a program-generation approach to construct longer test programs with complex control and data flows. Lyra: A Hardware-Accelerated RISC-V Verification Framework with Generative Model-Based Processor Fuzzing

[12] Lyra is a heterogeneous GPU-CPU–FPGA co-verification framework that offloads test execution, differential checking, and coverage collection to hardware, uses the LyraGen domain-specialized generative model with RISC-V instruction tokenization, and achieves up to 1.27× higher coverage and 107×–3343× faster end-to-end verification. Lyra: A Hardware-Accelerated RISC-V Verification Framework with Generative Model-Based Processor Fuzzing

[13] Ibex verifies the behavior of its Control and Status Registers through a dedicated formal-friendly testbench tb_cs_registers that instantiates ibex_cs_registers and drives it using a DPI-based driver linked to a C++ reference model, checking register access, side effects, and reset values. Formal Verification | lowRISC/ibex | DeepWiki

[14] The Ibex CSR verification environment is configured via tb_cs_registers.core and is invoked through the formal-flow entry point `make run-csr-test`, and the Ibex formal flow supports both JasperGold and Yosys+rIC3 toolflows. Formal Verification | lowRISC/ibex | DeepWiki