Overview
The ProcessorFuzz paper introduces ProcessorFuzz, a processor fuzzing mechanism for dynamic hardware verification. The work adapts coverage-guided fuzzing to processor designs, where hardware cannot be executed directly on a host machine and is instead evaluated through RTL simulation.
Core ideas
ProcessorFuzz has two main technical features:
- CSR-transition coverage: ProcessorFuzz introduces a coverage metric that monitors transitions in Control and Status Registers (CSRs). The paper argues that ISA-defined CSRs can expose aspects of the current processor finite-state-machine state, such as privilege mode or floating-point exception causes, so transitions in these registers help guide fuzzing toward distinct processor states.
- ISA-simulation-based feedback: ProcessorFuzz uses ISA simulation as part of its coverage feedback mechanism to quickly determine whether a generated input is interesting. The paper contrasts this with prior approaches that rely on RTL simulation for the same purpose, which is more time-consuming. As a reference point, the paper reports ISA simulation as 79× faster than RTL simulation for the open-source RISC-V BOOM processor.
Bug detection model
The paper describes processor fuzzing as using differential testing: the same input is run against both an RTL simulator and a reference model, where the reference model is an ISA simulator that implements ISA-level behavior. Inconsistencies between these executions indicate a potential processor bug.
Evaluation
The paper evaluates ProcessorFuzz on three open-source RISC-V processors implemented in different HDLs, including Chisel and SystemVerilog. The evaluated processors vary in microarchitectural characteristics such as pipeline depth and execution style, including in-order and out-of-order designs.
Compared with the register-coverage-guided processor fuzzer DIFUZZRTL, ProcessorFuzz triggered the bugs found by DIFUZZRTL 1.23× faster on average. The paper also reports that ProcessorFuzz found 8 new bugs in widely used open-source processors and 1 new bug in a reference model.