Bottom-Up Instruction Space Exploration

Concept

A fuzzing methodology, introduced in the RISCover framework, that gradually expands the set of RISC-V instructions under test by starting with the undocumented / unclaimed portions of the 4-byte instruction space and progressively including more documented instructions. Selection is driven by instruction encodings, instruction-class filtering, and an inverse-frequency weighting derived from real-world binaries, with the goal of maximizing the chance of finding rare or previously-unvalidated architectural CPU bugs.

First seen 6/11/2026

Last seen 6/11/2026

Evidence 4 chunks

Wiki v1

WIKI

Bottom-Up Instruction Space Exploration

Overview

Bottom-Up Instruction Space Exploration is the sequence-generation strategy used by the RISCover fuzzer to test closed-source RISC-V CPUs for user-exploitable architectural security vulnerabilities. Instead of uniformly random instruction selection or coverage-guided mutation (which is unavailable to black-box post-silicon fuzzers), RISCover starts from the smallest, most promising part of the RISC-V encoding space and gradually grows the search space as testing proceeds.

READ FULL ARTICLE →

NEIGHBORHOOD

1 nodes · 0 edges

graph · Bottom-Up Instruction Space Exploration · depth=1

RELATIONSHIPS

1 connections

RISCover ← uses 100% 3e

RISCover uses a bottom-up approach to gradually increase the covered instruction space.

LINKED ENTITIES

1 links

RISCover USES Extracted graph relationship

CITATIONS

8 sources

8 citations — click to expand

[1] Bottom-Up Instruction Space Exploration is the C1 (Sequence Generation) methodology of RISCover, motivated by the absence of coverage feedback in black-box post-silicon fuzzing. RISCover: Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUs

[2] The strategy combines instruction-encoding-based classification with inverse-frequency weighted random selection, gradually increasing the covered instruction space. RISCover: Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUs

[3] The RISC-V 4-byte instruction space is 85.51% known overall (84.03% ratified, plus unratified and vendor extensions), leaving 14.49% unknown or unspecified. RISCover: Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUs

[4] RISCover uses the official RISC-V Opcodes repository to classify and cluster instructions into their respective extensions, and uses encoding-based filtering to exclude CSR-based instructions (except frcsr/fscsr) to avoid false positives. RISCover: Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUs

[5] Instruction frequencies are derived from 1.36 billion disassembled instructions across 84,164 Debian software packages; each instruction is selected inversely proportional to its real-world frequency to prioritize rarely used or undocumented encodings. RISCover: Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUs

[6] Immediate values are drawn from predefined 'interesting' corner cases (e.g., 0, negatives, maximal integers), augmented with random values in 1 of every 5 instructions, and source/target registers are initialized from a 5-register window starting at x0 to create inter-instruction dependencies. RISCover: Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUs

[7] Undocumented encodings are generated as random 4-byte values that cannot be decoded to a valid instruction, with all bits set; sequence length is fixed at runtime, and lengths of 3–5 instructions offer the best trade-off between discovery effectiveness and efficiency. RISCover: Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUs

[8] The 4.3 Server section describes the centralized architecture in which the bottom-up generator runs on the server and ships generated sequences plus input registers to RISC-V CPU clients that report back architectural state changes. RISCover: Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUs