Control and Status Registers (CSR)

Overview

Control and Status Registers (CSRs) are registers that control processor operation and hold processor state. In the ProcessorFuzz work, CSRs are treated as a compact architectural signal for observing when execution reaches a new processor state.

Use in processor fuzzing

ProcessorFuzz introduces a CSR-transition coverage metric for hardware fuzzing of processors. The key idea is that a new transition in CSR values counts as a coverage increase. Because CSRs control and hold processor state, transitions in their values are used as evidence that the processor has entered a new state.

The motivation for this metric is that prior processor-fuzzing coverage approaches were described as having two major problems: lack of support for widely used hardware description languages (HDLs) and misleading coverage feedback.

Coverage collection

ProcessorFuzz collects CSR-transition coverage with an ISA simulator rather than by instrumenting the RTL design directly. The authors describe this as making coverage collection more efficient and HDL-agnostic, and the arXiv summary further states that the approach does not require instrumentation in the processor design.

Example observed CSR fields

An example trace shown in the ProcessorFuzz presentation monitors CSR fields including mstatus, mcause, scause, medeleg, frm, and fflags. The slide illustrates instruction-by-instruction trace entries and highlights that a new CSR transition is treated as additional coverage.

Role in the verification workflow

The ProcessorFuzz workflow combines seed scheduling and mutation, ISA simulation, RTL simulation, a transition map driven by CSR coverage, and trace comparison. Trace mismatches between ISA and RTL executions are treated as potential bugs.

Reported results in ProcessorFuzz

The reported evaluation covers the Rocket, BOOM, and BlackParrot RISC-V processors. Across these experiments, ProcessorFuzz is reported to detect known bugs 23% faster than DifuzzRTL (equivalently, 1.23× faster on average in the arXiv summary) and to discover nine new bugs in total, including one in a reference model or ISA simulator.

References

• Sadullah Canakci et al., ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers, arXiv, 2022.
• Sadullah Canakci et al., ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance, IEEE HOST 2023.
• Chathura Rajapaksha et al., Fuzzing for Discovering Bugs and Side Channels in Processors, presentation slides, 2023.