Instruction-Stream Fuzzing

Technique

Instruction-stream fuzzing is a class of hardware-fuzzing techniques that generate random sequences of test instructions adhering to a target Instruction Set Architecture (ISA) to drive processor state transitions and uncover functional bugs. In contrast to software fuzzers that produce data streams conforming to file or protocol formats, hardware instruction-stream fuzzers produce ISA-compliant instruction streams and typically rely on differential testing against a Golden Reference Model for bug detection. This article focuses on the adaptation of instruction-stream fuzzing to GPU hardware, including the FuzzGPU generator, which extends the paradigm with SIMT-aware warp-level generation, a generation stack modeled on the hardware SIMT stack, and a barrier planner to coordinate multi-warp concurrency.

First seen 9/29/2026

Last seen 9/29/2026

Evidence 3 chunks

Wiki v1

WIKI

Instruction-Stream Fuzzing

Overview

Instruction-stream fuzzing is a hardware-verification technique that automatically generates random sequences of instructions conforming to a target Instruction Set Architecture (ISA) and feeds them into a Design Under Test (DUT). Unlike software fuzzing, which exercises data parsers, instruction-stream fuzzing must produce instruction sequences that are legally encoded under the ISA and that exercise the architectural state transitions of the processor.

READ FULL ARTICLE →

NEIGHBORHOOD

4 nodes · 5 edges

graph · Instruction-Stream Fuzzing · depth=1

RELATIONSHIPS

3 connections

FuzzGPU ← implements 66% 2e

FuzzGPU generates per-warp instruction streams as its fuzzing target.

Ported-DiveFuzz ← implements 87% 1e

The port generates per-warp random instruction sequences for GPU testing.

Ported-Cascade ← implements 87% 1e

The port generates per-warp random instruction sequences for GPU testing.

LINKED ENTITIES

3 links

FuzzGPU IMPLEMENTS Extracted graph relationship

Ported-DiveFuzz IMPLEMENTS Extracted graph relationship

Ported-Cascade IMPLEMENTS Extracted graph relationship

CITATIONS

11 sources

11 citations — click to expand

[1] Instruction-stream fuzzing generates random sequences of test instructions adhering to a target ISA to drive hardware state transitions, in contrast to software fuzzers that exercise data streams. Fuzzing Open-Source GPU Hardware with SIMT Program Generation (USENIX Security '26)

[2] Differential testing compares the DUT against a Golden Reference Model at program or instruction granularity; instruction-level checking improves localization and reduces false negatives compared to program-level checking. Fuzzing Open-Source GPU Hardware with SIMT Program Generation (USENIX Security '26)

[3] When ported to GPUs, DiveFuzz and Cascade suffer from low instruction completion rates because of GPU-specific unmodeled behavior; for DiveFuzz, 61% of rejections are SIMT-stack or WMMA errors and 4% are barriers, while for Cascade 79% of rejections are invalid control flow from multi-thread non-determinism. Fuzzing Open-Source GPU Hardware with SIMT Program Generation (USENIX Security '26)

[4] FuzzGPU's per-warp generator emits basic blocks with disjoint memory regions and entry addresses, sampling instruction sequences subject to data-flow and control-flow constraints, and connects blocks into a CFG. Fuzzing Open-Source GPU Hardware with SIMT Program Generation (USENIX Security '26)

[5] FuzzGPU's generation stack, inspired by the hardware SIMT stack, tracks divergence and reconvergence via per-entry branch PC and thread mask, resolves branch outcomes via an ISS, and emits both branch directions while keeping a single GPC. Fuzzing Open-Source GPU Hardware with SIMT Program Generation (USENIX Security '26)

[6] The linearized order induced by the generation stack avoids path explosion, provides sound program order for barrier planning and memory-consistency checking, and contains no dead code. Fuzzing Open-Source GPU Hardware with SIMT Program Generation (USENIX Security '26)

[7] FuzzGPU's top-level loop coordinates multi-warp execution by placing synchronization barriers via a barrier planner (using a cursor into a named barrier set with scopes) and interleaving memory operations to track cross-thread/cross-warp conflicts. Fuzzing Open-Source GPU Hardware with SIMT Program Generation (USENIX Security '26)

[8] The instruction pool covers RV32I/RV64I, RV32M/RV64M, RV32A/RV64A, RV32F/RV64F, RV32D/RV64D, Ventus-RVV, and Vortex-customized instructions. Fuzzing Open-Source GPU Hardware with SIMT Program Generation (USENIX Security '26)

[9] FuzzGPU achieves a median instruction completion rate of 100% and a mean of 99.8% on 5,000 test programs, significantly outperforming CPU-derived baselines. Fuzzing Open-Source GPU Hardware with SIMT Program Generation (USENIX Security '26)

[10] FuzzGPU achieves significantly higher generation throughput than Ported-DiveFuzz and Ported-Cascade; throughput initially rises with instruction count before plateauing. Fuzzing Open-Source GPU Hardware with SIMT Program Generation (USENIX Security '26)

[11] Ported-DiveFuzz and Ported-Cascade are minimal CPU-to-GPU ports following a minimality principle: only ISA encoding and toolchain backends are replaced, plus minimum warp-launch initialization. Fuzzing Open-Source GPU Hardware with SIMT Program Generation (USENIX Security '26)