2026-07-30
5 items 196 entities 245 connections
Processed 31 entities and 28 relations.
DifuzzRTL MorFuzz SpecFuzz Transynther Cascade GenHuzz DiveFuzz RVISmith DIFUZZRTL: Differential Fuzz Testing to Find CPU Bugs MorFuzz: Fuzzing Processor via Runtime Instruction Morphing enhanced Synchronizable Co-simulation Cascade: CPU Fuzzing via Intricate Program Generation GenHuzz: An Efficient Generative Hardware Fuzzer DiveFuzz: Enhancing CPU Fuzzing via Diverse Instruction Construction RVISmith: Fuzzing Compilers for RVV Intrinsics Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities SpecDoctor: Differential Fuzz Testing to Find Transient Execution Vulnerabilities SpecFuzz: Bringing Spectre-type vulnerabilities to the surface differential fuzz testing for CPU verification golden-reference model fuzzing runtime instruction morphing intricate program generation for CPU fuzzing diverse instruction construction co-simulation for processor fuzzing CPU fuzzing RTL RISC-V transient execution vulnerabilities Spectre vulnerabilities Meltdown attacks microcode assists RVV intrinsics
Processed 25 entities and 32 relations.
SpecDoctor DifuzzRTL RTL Fuzzing Register Coverage Transient Execution Vulnerability Differential Fuzzing ISA Simulation CPU Verification Instruction Generation Fuzzing Template Multi-phased Fuzzing Cross-checking Coverage-guided Greybox Fuzzing RISC-V CPU BOOM (RISC-V CPU) NutShell-Argo CPU Side-channel Attack Spectre Meltdown ForeShadow RTL Design ISA Instruction Mutation DifuzzRTL: Differential Fuzz Testing to Find CPU Bug (S&P 2021) SpecDoctor: Differential Fuzz Testing to Find Transient Execution Vulnerabilities
Processed 46 entities and 53 relations.
Structured Random Differential Testing of Instruction Decoders Nathan Jay Barton P. Miller University of Wisconsin Fleece XED libopcodes LLVM Dyninst Capstone instruction decoder differential testing structured random testing instruction structure inference bit flipping mutation reassembly-based output verification model-based input generation grammar-based input generation CPU execution for valid input generation instruction set architecture x86 architecture ARM architecture PowerPC architecture opcode encoding EVEX prefix REX prefix VEX prefix binary executable analysis control flow graph format string deduplication pairwise structural bit flips field randomization special operand values Paleari et al. 2010 x86 decoder differential testing DERIVE system GNU assembler seed byte string instruction length detection reserved bit structural bit field bit unused bit output normalization error reporting Seidel 3DNow! extension
Processed 50 entities and 83 relations.
Efficient State Space Exploration: Interleaving Stateless and State-based Model Checking Malay K. Ganai Chao Wang Weihong Li NEC Laboratories America HMC (Hybrid Model Checker) State-based Model Checking Stateless Model Checking Bounded Model Checking (BMC) SMT-based Bounded Model Checking Presburger Arithmetic-based Symbolic Traversal State Decomposition State Prioritization Divide-and-Conquer Strategy Reachability Properties Frontier States Extended Finite State Machine (EFSM) Control Flow Graph (CFG) Satisfiability Modulo Theory (SMT) Presburger Arithmetic Disjunctive Normal Form (DNF) Image Computation Control State Reachability (CSR) State Traversal (ST) Path-based Reasoning (PR) Binary Decision Diagrams (BDDs) Linear Integer Arithmetic (LIA) Unbounded Model Checking Symbolic State Traversal State Disjunct Unreachable Block Constraint (UBC) Goal-directed Lighthouses (glh) Deep-state Prioritization (dfs) BMC Completeness Threshold Over-approximated Pre-image Operator Embedded Software Verification Program Slicing Constant Value Propagation Yices SMT Solver CUDD Library Omega Library Polyhedral Representation Fixpoint Computation Memory Bound Transition Relation SAT-based Model Checking Interpolant-based Approach State Partitioning Data Parallelism LTL Property
Processed 44 entities and 49 relations.
Antmicro CHIPS Alliance Google AMD NVIDIA Microsoft RISC-V International COMSEC ETH Zürich Caliptra Root of Trust Physical Memory Protection (PMP) RISC-V Control and Status Registers (CSR) Address Matching Naturally Aligned Power-of-2 (NAPOT) Naturally Aligned Four-byte (NA4) Top of Range (TOR) Lock Bit Mechanism XWR Permissions Universal Verification Methodology (UVM) RTL Device Under Test (DUT) Instruction Cache Program Counter Trap Handler CPU Fuzzing Continuous Integration (CI) Functional Testing Coverage Testing Randomized Stimulus Generation Scoreboard-based Verification Reference Prediction Model pyUVM Verilator RISCOF riscv-dv Cascade VeeR EL2 Core PMP Module RTL Implementation xwr_access Test Region Boundaries Sequence Configuration Sequence Software Execution Test (pmp/main.c) Region Boundaries Sequence