ProcessorFuzz

Tool

ProcessorFuzz is a processor fuzzing tool that guides input generation with a CSR-transition coverage metric. It monitors transitions in Control and Status Registers (CSRs), treating CSR changes as signals that execution has reached new processor states. The tool is described as HDL-agnostic and requiring no instrumentation in the processor design. It was evaluated on the Rocket, BOOM, and BlackParrot open-source RISC-V processors, where it triggered ground-truth bugs 1.23× faster on average than DIFUZZRTL and exposed eight new RISC-V core bugs plus one reference-model bug.

First seen 5/28/2026

Last seen 7/15/2026

Evidence 92 chunks

Wiki v5

WIKI

Overview

ProcessorFuzz is a processor fuzzer introduced to improve RTL processor verification using fuzzing feedback based on processor Control and Status Registers (CSRs). The paper listing for “ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance” names Sadullah Canakci, Chathura Rajapaksha, Leila Delshadtehrani, Anoop Mysore Nataraja, Michael Bedford Taylor, Manuel Egele, and Ajay Joshi as authors, and lists the work in IEEE HOST 2023, pages 1–12. [publication]

The work is motivated by the increasing difficulty of finding processor bugs before manufacturing. Its abstract notes that undiscovered microarchitectural bugs can become security vulnerabilities, side channels, or functional bugs, and that earlier RTL hardware-fuzzing approaches can suffer from limited HDL support and misleading coverage signals. [motivation]

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

50 connections

DiFuzzRTL ← compares with 100% 17e

DifuzzRTL and ProcessorFuzz are compared in terms of bug-finding ability and coverage metrics.

Control and Status Registers uses → 100% 11e

ProcessorFuzz monitors CSR transitions to guide fuzzing.

ISA Simulation uses → 100% 9e

ProcessorFuzz uses an ISA simulator to collect CSR transition coverage.

Spike ISA simulator uses → 100% 9e

ProcessorFuzz uses the Spike ISA simulator to capture CSR transitions.

differential testing implements → 97% 7e

ProcessorFuzz uses differential testing with ISA simulation as a reference.

mutation engine uses → 100% 7e

ProcessorFuzz employs a mutation engine to generate new test inputs.

Coverage-based Greybox Fuzzing implements → 95% 6e

ProcessorFuzz implements coverage-based greybox fuzzing adapted for hardware processors.

RTL Simulation uses → 100% 5e

ProcessorFuzz runs RTL simulation to collect extended trace logs for comparison.

Dromajo uses → 100% 4e

ProcessorFuzz uses Dromajo as a reference model for BlackParrot core verification.

Transition Unit uses → 100% 4e

ProcessorFuzz employs a Transition Unit to extract and evaluate CSR transitions.

ISA simulation uses → 100% 4e

ProcessorFuzz uses ISA simulation to rapidly evaluate test inputs for coverage.

ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers ← introduces 100% 4e

The work presents ProcessorFuzz as a new processor fuzzing tool.

CSR-transition coverage implements → 100% 4e

ProcessorFuzz implements the CSR-transition coverage metric to guide fuzzing.

extended ISA trace log uses → 100% 4e

ProcessorFuzz generates and processes extended ISA trace logs containing CSR values.

CSR-transition coverage uses → 100% 4e

ProcessorFuzz uses CSR-transition coverage to monitor processor state changes.

Verilator uses → 100% 4e

ProcessorFuzz uses Verilator for RTL simulation of processor designs.

ProcessorFuzz paper ← introduces 100% 4e

The ProcessorFuzz paper introduces the ProcessorFuzz tool.

Transition Map uses → 100% 3e

ProcessorFuzz uses the Transition Map to store and check CSR transitions.

Physical Memory Protection mentions → 85% 3e

ProcessorFuzz discovered a bug in Dromajo related to Physical Memory Protection checks.

seed corpus uses → 100% 3e

ProcessorFuzz starts with a seed corpus of test programs.

Processor Fuzzing implements → 88% 3e

As a processor fuzzer, ProcessorFuzz embodies the processor fuzzing technique.

ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance ← introduces 100% 3e

The paper presents the ProcessorFuzz tool for processor fuzzing guided by control and status registers.

BOOM evaluates → 100% 3e

ProcessorFuzz is evaluated using the BOOM out-of-order processor.

Differential Testing implements → 100% 3e

ProcessorFuzz uses differential testing by comparing RTL and ISA simulation outputs.

Coverage-based Greybox Fuzzing implements → 95% 3e

ProcessorFuzz uses coverage-guided fuzzing with CSR-transition coverage metric

pre-silicon verification uses → 95% 2e

ProcessorFuzz targets pre-silicon verification of processor designs.

Control and Status Register uses → 100% 2e

ProcessorFuzz uses Control and Status Register transitions to guide fuzzing.

RTL simulation uses → 100% 2e

ProcessorFuzz launches RTL simulation for inputs that pass the ISA simulation filter.

privilege mode mentions → 90% 2e

ProcessorFuzz tracks privilege mode transitions as part of CSR-transition coverage.

CSR-transition coverage implements → 100% 2e

ProcessorFuzz implements the CSR-transition coverage metric as its core feedback mechanism.

golden model uses → 90% 2e

ProcessorFuzz relies on a golden model (ISA simulator) to detect bugs via trace comparison.

Time-to-Exposure uses → 95% 2e

Time-to-Exposure is used as a metric to evaluate ProcessorFuzz

fflags CSR mentions → 100% 2e

ProcessorFuzz monitors fflags CSR transitions for floating-point state tracking.

Processor Fuzzing implements → 98% 2e

ProcessorFuzz is specifically tailored for fuzzing processors

mstatus CSR mentions → 100% 2e

ProcessorFuzz monitors mstatus CSR transitions as part of its coverage metric.

hardware fuzzing implements → 100% 2e

ProcessorFuzz applies processor fuzzing guided by CSR transitions.

Floating-Point Unit Verification evaluates → 90% 2e

ProcessorFuzz can be configured to focus on floating-point unit verification.

BlackParrot Core evaluates → 100% 2e

ProcessorFuzz was evaluated using the BlackParrot Core processor.

Fine-Grained Code Analysis for Processor Fuzzing ← compares with 98% 2e

The paper compares its results against ProcessorFuzz in branch coverage and bug discovery.

Finite State Machine uses → 90% 2e

ProcessorFuzz aims to explore different FSM states of the processor.

RISC-V ISA uses → 95% 2e

ProcessorFuzz targets RISC-V based processors designed in different HDLs.

Sadullah Canakci authored by → 100% 2e

ProcessorFuzz is proposed by Sadullah Canakci as part of his dissertation

BOOM Core evaluates → 100% 2e

ProcessorFuzz was evaluated using the BOOM Core processor.

RISC-V uses → 95% 2e

ProcessorFuzz is evaluated on RISC-V processor implementations

BlackParrot evaluates → 100% 2e

ProcessorFuzz is evaluated using the BlackParrot processor.

Differential Testing uses → 90% 2e

ProcessorFuzz uses differential testing by comparing ISA and RTL simulation traces

Rocket Core evaluates → 100% 2e

ProcessorFuzz was evaluated using the Rocket Core processor.

Seed Scheduling uses → 85% 2e

ProcessorFuzz uses coverage feedback to guide seed scheduling

RISC-V Rocket Core evaluates → 100% 2e

ProcessorFuzz is evaluated using the RISC-V Rocket Core processor.

assembly program test input uses → 100% 2e

ProcessorFuzz uses assembly programs as test inputs for fuzzing.

LINKED ENTITIES

5 links

ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers INTRODUCES Extracted graph relationship

CSR-transition coverage metric USES Extracted graph relationship

CSRs USES Extracted graph relationship

Processor Fuzzing IMPLEMENTS Extracted graph relationship

DiFuzzRTL COMPARES_WITH Extracted graph relationship

CITATIONS

8 sources

8 citations — click to expand

[1] publication ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance - researchr publication

[2] motivation ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers | DeepAI

[3] csr-transition ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers | DeepAI

[4] hdl-agnostic ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers | DeepAI

[5] evaluation-targets ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers | DeepAI

[6] difuzzrtl-comparison ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers | DeepAI

[7] bug-results ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers | DeepAI

[8] later-context FuSS: Coverage-Directed Hardware Fuzzing with Selective Symbolic Execution