CSR

Concept

In the supplied RISC-V verification evidence, CSR refers to RISC-V control status registers as architectural state that must be modeled, checkpointed, and compared correctly. Dromajo includes CSRs in checkpoints and has exposed multiple CSR-related implementation bugs in RISC-V cores, including dcsr privilege-bit handling and incorrect stval/mtval trap values. Ibex verification uses the RISCV-DV handshaking mechanism to verify correct CSR updates during external-stimulus scenarios where standard RTL/ISS trace comparison is insufficient.

First seen 5/26/2026

Last seen 6/6/2026

Evidence 6 chunks

Wiki v3

WIKI

CSR

In the supplied RISC-V processor-verification evidence, CSR is used for RISC-V control status registers. CSRs are treated as part of the processor architectural state: Dromajo checkpoints include registers, CSRs, memory, interrupt state, and performance counters. [C1]

Role in RISC-V co-simulation

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

4 connections

STING ← evaluates 93% 1e

STING stresses CSRs as part of its verification capability.

RISC-V ISA part of → 92% 1e

CSRs are control and status registers that are part of the RISC-V ISA.

Dromajo ← uses 100% 1e

Dromajo checkpoints include CSR state and leverages RISC-V debug spec for CSR manipulation.

handshaking mechanism ← uses 1e

The handshaking mechanism supports verification of correct CSR updates during external stimulus scenarios.

LINKED ENTITIES

1 links

handshaking mechanism USES Extracted graph relationship

CITATIONS

10 sources

10 citations — click to expand

[1] Dromajo checkpoints include registers, CSRs, memory, interrupt state, and performance counters as part of architectural state. Effective Processor Verification with Logic Fuzzer Enhanced Co-simulation (MICRO-54)

[2] Dromajo alone found nine bugs across the evaluated RISC-V cores; Dromajo enhanced with Logic Fuzzer exposed thirteen total bugs using the same set of listed tests. Effective Processor Verification with Logic Fuzzer Enhanced Co-simulation (MICRO-54)

[3] Bug B1: A CVA6 bug involved incorrect update logic for the debug control status register; after dret, execution should jump to the PC indicated by dpc and resume in the privilege mode indicated by prv bits in dcsr, but CVA6 resumed in machine mode while Dromajo resumed in user mode. Effective Processor Verification with Logic Fuzzer Enhanced Co-simulation (MICRO-54)

[4] Bug B3: According to RISC-V ISA, stval CSR is written with exception-specific information when the processor traps into supervisor mode; Dromajo caught a mismatch when reading stval inside the exception handler due to incorrect setting. Effective Processor Verification with Logic Fuzzer Enhanced Co-simulation (MICRO-54)

[5] Bug B4: A CVA6 issue involved mtval being written with an incorrect value, analogous to the stval bug. Effective Processor Verification with Logic Fuzzer Enhanced Co-simulation (MICRO-54)

[6] Bug B13: A BOOM bug was exposed when Dromajo flagged a mismatch while reading mtval CSR; the value read from BOOM was off by 2, attributed to handling of compressed RISC-V instructions and misaligned-instruction exceptions. The scenario also involved mepc being set to 0x196 during a setup code path that ended in an mret. Effective Processor Verification with Logic Fuzzer Enhanced Co-simulation (MICRO-54)

[7] STING lists CSRs among the areas it is effective at stressing, alongside privilege levels, memory protection, and hypervisor extensions. Effective Processor Verification with Logic Fuzzer Enhanced Co-simulation (MICRO-54)

[8] In Ibex's end-to-end RTL/ISS co-simulation flow, standard trace-log comparison of register writebacks is insufficient for scenarios involving external stimulus such as interrupts and debug requests, because ISS models can simulate traps due to exceptions but not traps due to external stimulus. Verification — Ibex Documentation

[9] To verify that the core enters the proper interrupt handler, enters Debug Mode properly, and updates CSRs correctly under external stimulus, the Ibex flow uses the handshaking mechanism provided by the RISCV-DV instruction generator, with signature address 0x8ffffffc. Verification — Ibex Documentation

[10] Because the ISS trace log lacks execution information in the debug ROM and interrupt handler code, Ibex uses a modified trace-log comparison that only checks the final values contained in every register at the end of the test. Verification — Ibex Documentation