Skip to content
STIMSMITH

CSR Testing

Concept WIKI v2 · 5/28/2026

CSR Testing is a processor-verification focus area for RISC-V Control and Status Registers. In the provided evidence, CSR-related checking appears in a coverage-guided fuzzing case study of VexRiscv configured for RV32IM, where the authors report many CSR bugs involving read-only CSR write attempts and erroneous exceptions on counter-CSR reads.

Overview

CSR Testing refers here to verification activity that exercises RISC-V Control and Status Register behavior and checks whether processor execution diverges from the expected behavior in a cross-level verification flow. In the cited coverage-guided fuzzing work, the evaluation configured VexRiscv for the RV32IM instruction subset and reported errors both in the decoder and in CSRs, with “many” errors associated with CSRs. [CSR bugs in RV32IM VexRiscv evaluation]

Role in coverage-guided fuzzing

The cited work compares Vanilla AFL with an enhanced AFL flow for processor verification. Test vectors that increase coverage are kept, while mismatching executions are counted as unique crashes after post-processing. The post-processing distinguishes result mismatches from instruction-address mismatches between the ISS and RTL core, and clusters test vectors based on the executed commands up to the faulty command. [Fuzzing mismatch detection and clustering]

For instruction-space exploration, the enhanced flow inserts RISC-V instructions and uses bitflip mutation to cover possible arguments and uncover unknown instructions. Its enhanced havoc stage adds RISC-V instruction insertion and a replacement variant; unlike the fixed-zero insertion phase, enhanced havoc supports non-fixed instruction arguments and compressed instructions. [Enhanced AFL instruction mutations]

CSR bug classes reported

Read-only ID CSRs

The RISC-V privileged architecture is described in the evidence as specifying four read-only ID CSRs: mvendorid, marchid, mimpid, and mhartid. These provide hardware identifiers. The reported VexRiscv bug was that write attempts to these CSRs did not raise an exception. [ID CSR write-protection bug]

Read-only cycle counter CSRs

The evidence also describes read-only counter CSRs used for performance measurements. For cycle, cycleh, instret, and instreth, the reported VexRiscv bug was the same pattern: a write attempt did not raise an exception. [Cycle counter CSR write-protection bug]

Counter CSR read access

The evidence states that all counter CSRs should be defined and allow read access. VexRiscv was reported to erroneously raise exceptions on reads to time, timeh, hpmcounter, hpmcounterh, mcounteren, mhpmcounter3-31, mhpmcounter3-31h, and mhpmevent. [Counter CSR read-access bug]

Evaluation signal

In the reported fuzzing results, Enhanced AFL produced a higher mean number of unique crashes than Vanilla AFL: 274.43 versus 237.36. The same table reports total unique crashes of 2021 for Enhanced AFL and 1619 for Vanilla AFL. These numbers are for the overall case study, not specifically CSR-only bugs. [Fuzzing results unique crashes]

Practical implications from the evidence

The evidence supports CSR tests that explicitly check exception behavior for illegal writes to read-only CSRs and legal read access to defined counter CSRs. It also supports using mismatch post-processing to identify the instruction associated with a divergence between the ISS and RTL core. [CSR-focused test implications]

VERSION HISTORY

v2 · 5/28/2026 · gpt-5.5 (current)
v1 · 5/26/2026 · gpt-5.5