Transition Map

Concept

In ProcessorFuzz, the Transition Map (TM) is the session-wide data structure used to remember previously observed CSR transitions. The Transition Unit queries it to decide whether a test input exposes a new transition and should be treated as interesting.

First seen 5/28/2026

Last seen 6/8/2026

Evidence 12 chunks

Wiki v1

WIKI

Overview

In the ProcessorFuzz workflow, the Transition Map (TM) records CSR transitions that have already been observed during a fuzzing session. After the Transition Unit creates tuples for detected transitions, it queries the map to determine whether each transition is new or a duplicate. Tuples representing new transitions are added to the map, and the corresponding test input is marked as interesting. The transition map starts empty at the beginning of a fuzzing session and is maintained throughout the session.

Role in ProcessorFuzz

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

3 connections

ProcessorFuzz ← uses 100% 3e

ProcessorFuzz uses the Transition Map to store and check CSR transitions.

CSR-transition coverage ← uses 95% 2e

CSR-transition coverage uses the Transition Map to store observed transitions.

Transition Unit ← uses 100% 2e

The Transition Unit communicates with the Transition Map to store and check CSR transitions.

LINKED ENTITIES

3 links

ProcessorFuzz USES Extracted graph relationship

CSR-transition coverage USES Extracted graph relationship

Transition Unit USES Extracted graph relationship

CITATIONS

5 sources

5 citations — click to expand

[1] The Transition Map records detected transition tuples, is queried to distinguish new transitions from duplicates, starts empty, and is maintained throughout a fuzzing session. ProcessorFuzz: Processor Fuzzing with Control and

[2] The Transition Unit takes an extended ISA trace log as input and communicates with the Transition Map to determine whether the log contains new transitions. ProcessorFuzz: Processor Fuzzing with Control and

[3] ProcessorFuzz tracks CSR transitions rather than only unique CSR values because transition coverage can expose behavior that depends on the previous state. ProcessorFuzz: Processor Fuzzing with Control and

[4] ProcessorFuzz filters unnecessary CSR transitions and avoids monitoring CSRs such as instret when they would cause uninformative transitions on every committed instruction. ProcessorFuzz: Processor Fuzzing with Control and

[5] If a test input produces a unique CSR transition, ProcessorFuzz launches RTL simulation and compares extended RTL and ISA trace logs; if not, it discards the input. ProcessorFuzz: Processor Fuzzing with Control and