Overview

Cascade is presented in the paper "Cascade: CPU Fuzzing via Intricate Program Generation" by Flavien Solt, Katharina Ceesay-Seitz, and Kaveh Razavi. USENIX lists it as a paper in the 33rd USENIX Security Symposium (USENIX Security 24), published in August 2024, on pages 5341-5358.[C1] The paper title itself directly characterizes Cascade in terms of CPU fuzzing and intricate program generation.[C2]

Artifact-documented Questasim workflow

The available artifact README documents a Questasim-based experiment. It instructs users to build the Rocket core for Questasim simulation with the following commands, after sourcing cascade-meta:[C3]

source /path/to/cascade-meta && cd /path/to/cascade-chipyard/cascade && make build_vanilla_notrace_modelsim && make rerun_vanilla_notrace_modelsim

The same instructions note that the local rocket entry in cascade_meta/design_processing/design_repos.json may need to be adapted for the experiment.[C3]

To run the Questasim experiment, the README next directs users to start a container and generate ELF files for DifuzzRTL and Cascade. It states that this step may take hours and recommends mounting a local directory for the ELFs, or alternatively copying them out of the container.[C4]

DIFUZZRTL_FUZZER_DIR_PATH_CANDIDATE=<path_to_the_Fuzzer> docker run -v /path/to/some/mount/directory:/cascade-mountdir -it cascade-artifacts bash -c "source /cascade-meta/env.sh && python3 /cascade-meta/fuzzer/do_genelfs_for_questa.py"

The README also says that host-side Python requirements may need to be installed, giving matplotlib, numpy, tqdm, and filelock as examples.[C4]

pip3 install matplotlib numpy tqdm filelock

Finally, the documented workflow exports CASCADE_PATH_TO_DIFUZZRTL_ELFS_FOR_MODELSIM and runs do_compare_cascade_difuzzrtl_modelsim.py from the fuzzer directory.[C5]

export CASCADE_PATH_TO_DIFUZZRTL_ELFS_FOR_MODELSIM=/path/to/some/mount/directory
cd <path_to_cascade_meta>/fuzzer && python3 do_compare_cascade_difuzzrtl_modelsim.py

According to the README, the experiment may take many hours and is divided into two phases: running the fuzzer in parallel, and merging coverage results sequentially. The resulting output is stored as modelsim.png in the local cascade-meta/figures directory.[C5]

Additional repository notes

The artifact repository states that step_descriptions.md provides a mapping for the overview figure from the paper (Figure 3).[C6] It also includes a minimal running example that begins by adapting descriptor in cascade-meta/fuzzer/do_fuzzsingle.py.[C7]