Control and Status Registers (CSRs) Wiki

Definition

Control and Status Registers (CSRs) are processor registers used to hold control and status information, as well as additional instruction results. In the RISC-V architecture, CSRs are special-purpose registers that, for example, enable trap handling and environment interaction, and they are specified as part of the RISC-V privileged architecture specification.

Role in RISC-V verification

CSRs appear in several RISC-V verification strategies because they expose processor behavior that is relevant to state exploration:

CSR instructions as a coverage group

In cross-level processor-verification work, the RISC-V instruction set is partitioned into six instruction groups for coverage purposes: Arithmetic, Control Flow, Memory, Special & System, Control & Status Register (CSR), and Other. The CSR group is described as equivalent to the Zicsr extension. The cross-product of these six groups yields 36 coverage points in the corresponding case study.

CSR-aware test generation with RISC-V DV

The RISC-V DV framework supports CSR-related testing in multiple ways:

Specialized CSR test strategies: RISC-V DV provides additional specialized test strategies that focus on testing of CSRs, interrupts, and the MMU. These specialized strategies are documented as going beyond the default test strategies (such as basic_arithmetic_test, rand_instr_test, jump_stress_test, loop_test, and unaligned_load_store_test) used in evaluations that target the RV32IC ISA.
CSR state in the trace format: For each executed test, the RISC-V DV trace records changes of the internal simulation state, including the program counter, changes to a GPR or CSR, and a disassembly of the executed instruction. These traces are used to compare simulation results between a reference VP and a mutated VP, and the RISC-V DV framework can compute functional coverage information from them using SystemVerilog covergroup definitions.

CSR transitions as a coverage signal

In ProcessorFuzz, CSR transitions are used as a coverage metric to guide processor fuzzing. The paper's rationale is that CSRs are in charge of controlling and holding the state of the processor, so transitions in CSRs indicate that execution has reached a new processor state. Guiding the fuzzer with this feedback enables exploration of new processor states, and the approach is HDL-agnostic and does not require instrumentation in the processor design.

Practical significance

For verification, CSRs are useful in two complementary roles:

As instructions/state to generate: Generating CSR instructions and executing specialized CSR-focused test strategies exercises hardware/software interaction paths, including trap-handling and environment-interaction paths described in the RISC-V privileged architecture.
As state to observe: Recording CSR (and GPR) changes in the RISC-V DV trace format, and tracking CSR transitions, gives verification tools feedback about whether execution has reached a new processor state.

In evaluations of the RISC-V DV framework, the five default test strategies focus on arithmetic, branches, jumps, memory access, and randomized instructions; CSR-specific testing is treated as a separate, specialized capability that lies outside the default RV32IC evaluation scope but is provided by the framework.