Cascade
ToolCascade is the subject of the 2024 USENIX Security paper "Cascade: CPU Fuzzing via Intricate Program Generation" by Flavien Solt, Katharina Ceesay-Seitz, and Kaveh Razavi. The available evidence also documents an artifact workflow centered on Questasim experiments, including building the Rocket core, generating ELF files for DifuzzRTL and Cascade, and running a comparison script that produces `modelsim.png`.
First seen 6/10/2026
Last seen 9/29/2026
Evidence 144 chunks
Wiki v3
WIKI
Overview
Cascade is presented in the paper "Cascade: CPU Fuzzing via Intricate Program Generation" by Flavien Solt, Katharina Ceesay-Seitz, and Kaveh Razavi. USENIX lists it as a paper in the 33rd USENIX Security Symposium (USENIX Security 24), published in August 2024, on pages 5341-5358.[C1] The paper title itself directly characterizes Cascade in terms of CPU fuzzing and intricate program generation.[C2]
Artifact-documented Questasim workflow
NEIGHBORHOOD
3 nodes · 2 edgesgraph · Cascade · depth=1
RELATIONSHIPS
50 connectionsCascade is compared to DifuzzRTL in terms of coverage and performance.
The paper presents and introduces Cascade as a new CPU fuzzer.
Cascade is compared to TheHuzz in terms of coverage and performance.
Cascade constructs programs as sequences of basic blocks.
Cascade is compared to RFUZZ in terms of multiplexer select coverage.
Cascade uses an ISS to execute intermediate programs and collect data-flow dependent values.
Cascade found a critical bug in the Yosys synthesizer.
Cascade is evaluated on BOOM as one of the RISC-V CPUs.
Cascade identifies and handles cf-ambiguous instructions during program generation.
Cascade uses Spike as the ISS for asymmetric ISA pre-simulation.
Cascade implements asymmetric ISA pre-simulation to entangle control and data flows.
Cascade is evaluated on Kronos as one of the RISC-V CPUs.
Cascade generates programs with complex FPU operations.
Cascade is evaluated on Rocket core as one of the RISC-V CPUs.
Cascade executes programs on RTL simulations of CPUs under test
Cascade is evaluated on PicoRV32 as one of the RISC-V CPUs.
Cascade is evaluated on VexRiscv as one of the RISC-V CPUs.
Cascade implements an analysis method to reduce programs to a minimal form for bug reporting.
Cascade constructs intermediate programs as part of its fuzzing pipeline.
Cascade is a CPU fuzzer implementing CPU fuzzing techniques.
Cascade entangles control flows with data flows to improve fuzzing and bug detection.
Cascade uses progressive and strong memory allocation strategies during program generation
Cascade is evaluated on CVA6 as one of the RISC-V CPUs.
HiFuzz was compared against Cascade as a constructive fuzzing baseline.
Cascade is used to evaluate the openC906 RTL.
Cascade is used to evaluate the openC910 RTL.
Cascade supports data flow-dependent privilege transitions in generated programs
GoldenFuzz is compared against Cascade as a prior state-of-the-art hardware fuzzer.
Cascade is compared to HypFuzz in terms of bug discovery.
Cascade uses program non-termination as a design-agnostic bug detection mechanism
Cascade generates programs that operate under randomized CSRs exploring different operational states.
Cascade uses asymmetric ISA pre-simulation to entangle control and data flows
RISCover is compared to Cascade for bug-finding efficacy on open-source RISC-V cores.
Cascade is designed to generate programs that complete execution, with non-completion indicating a bug
Cascade generates RISC-V programs targeting the RISC-V ISA.
Cascade is designed to achieve high fuzzing prevalence compared to prior work
RISCSmith is directly compared with Cascade in experiments, outperforming it in bugs found and coverage.
Cascade uses an ISA simulator as a reference model for bug detection.
GenHuzz is benchmarked against Cascade on coverage metrics across three RISC-V cores.
Cascade is a CPU fuzzing tool.
Cascade entangles data and control flows to detect bugs via non-termination
Cascade includes an automated program reduction technique for minimizing bug-triggering programs
Cascade measures and reports program completion rates as a key metric.
Cascade evaluates simulator-based coverage in comparison with TheHuzz.
Cascade evaluates multiplexer select coverage against RFUZZ.
Cascade evaluates control register coverage against DifuzzRTL.
The README specifies an optional QuestaSim-based experiment for coverage comparison.
The paper introduces CASCADE, a framework for automated SCA evaluations at design time.
Cascade uses Spike as the ISS for RISC-V program pre-simulation.
Cascade uses offset register construction to entangle data and control flows.
CITATIONS
7 sources7 citations — click to expand
[1] C1 - Cascade is presented in a USENIX Security 2024 paper by Flavien Solt, Katharina Ceesay-Seitz, and Kaveh Razavi, with pages 5341-5358. Cascade: CPU Fuzzing via Intricate Program Generation - USENIX
[2] C2 - The paper title directly characterizes Cascade as CPU fuzzing via intricate program generation. Cascade: CPU Fuzzing via Intricate Program Generation - USENIX
[3] C3 - The artifact README documents building the Rocket core for Questasim simulation and notes that the local `rocket` entry in `cascade_meta/design_processing/design_repos.json` may need adaptation. comsec-group/cascade-artifacts
[4] C4 - The README documents generating ELF files for DifuzzRTL and Cascade in a container, warns this may take hours, recommends mounting or copying out a local ELF directory, and lists example host Python requirements. comsec-group/cascade-artifacts
[5] C5 - The README documents running `do_compare_cascade_difuzzrtl_modelsim.py`, states that the experiment may take many hours, describes parallel fuzzing and sequential coverage merging phases, and says the result is stored as `modelsim.png` in `cascade-meta/figures`. comsec-group/cascade-artifacts
[6] C6 - The artifact repository says `step_descriptions.md` maps the paper's overview figure (Figure 3). comsec-group/cascade-artifacts
[7] C7 - The artifact repository includes a minimal running example that begins by adapting `descriptor` in `cascade-meta/fuzzer/do_fuzzsingle.py`. comsec-group/cascade-artifacts