Skip to content
STIMSMITH

ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance

Paper WIKI v2 · 6/28/2026

ProcessorFuzz is a HOST 2023 paper that presents a processor fuzzer for RTL verification. Its core idea is CSR-transition coverage, which treats new transitions in Control and Status Registers as coverage-increasing events that correspond to new processor states. The design also uses ISA simulation to quickly identify interesting inputs, reducing reliance on slower RTL simulation for fuzzing guidance. In evaluation on Rocket, BOOM, and BlackParrot RISC-V processors, the paper reports triggering bugs found by DIFUZZRTL 1.23× faster on average and finding eight new bugs in open-source processors plus one new bug in a reference model.

Overview

ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance is a 2023 paper by Sadullah Canakci, Chathura Rajapaksha, Leila Delshadtehrani, Anoop Mysore Nataraja, Michael Bedford Taylor, Manuel Egele, and Ajay Joshi. It appeared at the IEEE International Symposium on Hardware Oriented Security and Trust (HOST 2023).[C1]

The paper presents ProcessorFuzz, a processor fuzzer for RTL verification. The work is motivated by a mismatch between conventional fuzzing feedback and processor verification needs: hardware is not directly executable on a host machine, and standard software coverage notions do not directly capture meaningful processor-state exploration.[C2][C3]

Main ideas

ProcessorFuzz contributes two central mechanisms.[C2]

  1. CSR-transition coverage. The fuzzer uses a coverage metric based on transitions in Control and Status Registers (CSRs). The paper argues that CSRs are central to the architectural specification and that some ISA-defined CSRs directly expose processor finite-state-machine state, such as current privilege mode or the event that caused a floating-point exception. Under this view, a new CSR transition indicates exploration of a new processor state.[C2][C4]
  2. ISA-simulation-based input triage. ProcessorFuzz uses ISA simulation to determine whether a test input is interesting before spending more effort on it. The paper states that prior work used RTL simulation for that purpose, which is more time-consuming, and that ISA simulation is significantly faster. This helps eliminate repetitive inputs and concentrate fuzzing on qualitatively distinct test patterns.[C2]

A design overview presented in supporting slides further states that ProcessorFuzz uses an ISA simulator to collect CSR-transition coverage, making coverage collection more efficient and HDL-agnostic.[C5]

Context in processor fuzzing

The paper frames ProcessorFuzz as an adaptation of coverage-guided fuzzing to processors. In software fuzzing, the program under test can be executed directly on the host machine. For processors, however, the design is implemented at the RTL level and must be evaluated through RTL simulation.[C3]

Within this setting, ProcessorFuzz uses architectural state feedback rather than low-level implementation activity as its primary guidance signal. Its emphasis is on reaching new architecturally meaningful processor states through CSR transitions.[C2][C4]

Evaluation

ProcessorFuzz is evaluated on three open-source RISC-V processors: Rocket, BOOM, and BlackParrot. The paper describes these designs as spanning different HDLs, including Chisel and SystemVerilog, and different microarchitectural styles, including in-order and out-of-order execution.[C2][C6]

Against DIFUZZRTL, the paper reports that for bugs found by DIFUZZRTL, ProcessorFuzz triggers them 1.23× faster on average.[C2][C7]

The evaluation also reports 8 new bugs in open-source processors and 1 new bug in a reference model.[C2][C8] Supporting slides summarize this as 9 new bugs total, broken down as 6 in BlackParrot, 2 in Rocket and BOOM, and 1 in the Dromajo ISA simulator.[C6]

Significance

The paper's key contribution is a processor-fuzzing guidance signal based on CSR state transitions rather than generic software-style coverage or purely RTL-level activity. Combined with fast ISA-simulation-based triage, ProcessorFuzz aims to improve the efficiency of RTL processor fuzzing and speed up bug discovery.[C2][C5]

Publication details

  • Venue: IEEE International Symposium on Hardware Oriented Security and Trust (HOST 2023)[C1]
  • Pages: 1-12[C1]
  • DOI: 10.1109/HOST55118.2023.10133714[C1]

Citation key

  • [C1] Bibliographic metadata
  • [C2] Paper excerpt describing contributions, motivation, and evaluation summary
  • [C3] Paper excerpt on adapting coverage-guided fuzzing to processor verification
  • [C4] Paper excerpt defining CSR-transition coverage intuition
  • [C5] Slide deck design overview
  • [C6] Slide deck evaluation summary
  • [C7] Paper excerpt reporting 1.23× faster bug triggering
  • [C8] Paper excerpt reporting 8 processor bugs plus 1 reference-model bug

LINKED ENTITIES

3 links
ProcessorFuzz INTRODUCES
CSR-guided processor fuzzing INTRODUCES
Control and Status Registers (CSR) USES

CITATIONS

8 sources
8 citations
[1] Paper metadata: title, authors, HOST 2023 venue, pages 1-12, and DOI. ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance - researchr publication
[2] ProcessorFuzz presents two main features: CSR-transition coverage for guiding exploration of unique processor states and ISA-simulation-based determination of interesting inputs; it also summarizes evaluation and bug-finding results. ProcessorFuzz: Processor Fuzzing with Control and
[3] When adapting coverage-guided fuzzing to processors, hardware is not directly executable on a host machine and must be evaluated via RTL simulation. ProcessorFuzz: Processor Fuzzing with Control and
[4] CSR-transition coverage monitors transitions in Control and Status Registers, with some ISA-defined CSRs exposing processor FSM state such as privilege mode or floating-point exception cause. ProcessorFuzz: Processor Fuzzing with Control and
[5] Supporting slides describe ProcessorFuzz as using an ISA simulator to collect CSR-transition coverage, making collection more efficient and HDL agnostic. [PDF] Fuzzing for Discovering Bugs and Side Channels in Processors
[6] Evaluation targets Rocket, BOOM, and BlackParrot; supporting slides summarize 9 new bugs total, with 6 in BlackParrot, 2 in Rocket and BOOM, and 1 in the Dromajo ISA simulator. [PDF] Fuzzing for Discovering Bugs and Side Channels in Processors
[7] Compared with DIFUZZRTL, ProcessorFuzz triggers the bugs found by DIFUZZRTL 1.23× faster on average. ProcessorFuzz: Processor Fuzzing with Control and
[8] The paper reports 8 new bugs in open-source processors and 1 new bug in a reference model. ProcessorFuzz: Processor Fuzzing with Control and

VERSION HISTORY

v2 · 6/28/2026 · gpt-5.4 (current)
v1 · 5/28/2026 · gpt-5.5