Overview
A bare-metal hypervisor-based fuzzing framework is a specialized execution substrate for fuzzing that combines two design choices:
- Bare-metal execution — the fuzzer and its workload run directly on the target processor without an intervening general-purpose operating system, removing OS-induced nondeterminism and reducing the trusted code base that can interfere with crash detection.
- Hypervisor-based control — a thin virtualization layer is used to isolate the device under test (DUT), govern its environment (interrupts, memory, I/O), and continuously observe execution state.
In the Fuzzilicon system, this framework is built specifically to ensure safe and deterministic execution of fuzzing workloads on a target x86 CPU, isolating the DUT, controlling its environment, and continuously monitoring execution. The framework works alongside a serialization oracle that synthesizes semantically equivalent variants of instruction sequences to improve fuzzing reproducibility and enable reliable detection of vulnerabilities and divergences across microarchitectural implementations.
Role within Fuzzilicon
Within Fuzzilicon's overall design, the bare-metal hypervisor-based fuzzing framework complements Fuzzilicon's microcode (μcode) instrumentation layer (which repurposes the CPU's μcode patch interface as a programmable introspection layer that observes internal μcode execution paths). Where the microcode instrumentation provides visibility into the processor's internal state, the bare-metal hypervisor-based framework provides the containment and control needed to safely drive the CPU through fuzz inputs:
- Isolation of the DUT — the device under test runs inside a controlled environment so that faults, crashes, or unexpected behavior do not compromise the host or the fuzzer harness.
- Environment control — interrupts, peripherals, and other inputs that would introduce nondeterminism are managed or suppressed.
- Continuous monitoring — execution is observed at runtime so that crashes, divergences between semantically equivalent instruction sequences, and other anomalies are captured.
Purpose and Benefits
The framework is what enables feedback-driven fuzzing of real, post-silicon x86 processors with microarchitectural visibility, allowing Fuzzilicon to uncover rare execution paths and vulnerabilities without requiring RTL access or specialized hardware. By combining deterministic execution with continuous monitoring, the framework makes it possible to reliably reproduce bugs found during fuzzing and to detect subtle divergences between microarchitectural implementations.
Relationship to Other Components
- Fuzzilicon uses this framework as its execution substrate, pairing it with μcode-based introspection and a serialization oracle to produce a complete post-silicon CPU fuzzer.
- The framework itself uses the concept of a device under test (DUT) — the target CPU is the system being fuzzed, isolated and monitored by the framework.
Paper Organization (Context)
In the Fuzzilicon paper, the implementation details of this framework are described in Section V ("Implementation"), with the design rationale covered in Section IV ("Design"), and the core technical challenges of applying coverage-guided fuzzing to commercial x86 CPUs discussed in Section III ("Breaking the Post-Silicon Barrier").