ProcessorFuzz
ToolProcessorFuzz is a processor fuzzing tool presented in the paper “ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance.” The available evidence describes it as a processor fuzzer built in the context of coverage-based greybox fuzzing and differential testing for hardware, where RTL simulation outputs are compared against ISA simulation outputs to find potential processor bugs.
First seen 5/28/2026
Last seen 6/8/2026
Evidence 57 chunks
Wiki v1
WIKI
Overview
ProcessorFuzz is a processor fuzzing tool introduced in the paper “ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance.” The paper positions processor fuzzing as a pre-silicon dynamic verification approach for complex processors, where exhaustive verification is considered unrealistic because processor state spaces are very large and verification resources are limited.
Verification model
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
50 connectionsProcessorFuzz monitors CSR transitions to guide fuzzing.
ProcessorFuzz is compared against DIFUZZRTL in terms of bug-finding speed.
ProcessorFuzz uses the Spike ISA simulator to capture CSR transitions.
ProcessorFuzz uses ISA simulation to get feedback and compare with RTL simulation
ProcessorFuzz implements coverage-based greybox fuzzing adapted for hardware processors.
ProcessorFuzz uses differential testing by comparing ISA simulator output with RTL simulator output.
ProcessorFuzz applies a mutation engine to generate new test inputs from interesting ones.
ProcessorFuzz employs a Transition Unit to extract and evaluate CSR transitions.
ProcessorFuzz uses RTL simulation and trace comparison for bug detection
ProcessorFuzz uses Verilator for RTL simulation of processor designs.
ProcessorFuzz implements the CSR-transition coverage metric to guide fuzzing.
ProcessorFuzz uses Dromajo as a reference model for BlackParrot core verification.
ProcessorFuzz uses ISA simulation to rapidly evaluate test inputs for coverage.
ProcessorFuzz generates and processes extended ISA trace logs containing CSR values.
ProcessorFuzz uses differential testing by comparing RTL and ISA simulation outputs.
ProcessorFuzz is evaluated using the BOOM out-of-order processor.
ProcessorFuzz uses the Transition Map to store and check CSR transitions.
ProcessorFuzz uses coverage-guided fuzzing with CSR-transition coverage metric
ProcessorFuzz discovered a bug in Dromajo related to Physical Memory Protection checks.
ProcessorFuzz implements the CSR-transition coverage metric as its core feedback mechanism.
ProcessorFuzz is evaluated using the RISC-V Rocket Core processor.
ProcessorFuzz is evaluated using the BlackParrot processor.
ProcessorFuzz aims to explore different FSM states of the processor.
ProcessorFuzz can be configured to focus on floating-point unit verification.
Time-to-Exposure is used as a metric to evaluate ProcessorFuzz
ProcessorFuzz is proposed by Sadullah Canakci as part of his dissertation
ProcessorFuzz is specifically tailored for fuzzing processors
ProcessorFuzz uses CSR-transition coverage as its feedback metric
ProcessorFuzz populates and uses a seed corpus of assembly programs.
ProcessorFuzz uses differential testing by comparing ISA and RTL simulation traces
ProcessorFuzz uses assembly programs as test inputs for fuzzing.
ProcessorFuzz is evaluated on RISC-V processor implementations
ProcessorFuzz uses coverage feedback to guide seed scheduling
ProcessorFuzz launches RTL simulation for inputs that pass the ISA simulation filter.
ProcessorFuzz was evaluated on the Rocket Core processor.
ProcessorFuzz was evaluated on the BOOM Core processor.
ProcessorFuzz was evaluated on the BlackParrot Core processor.
ProcessorFuzz was evaluated using the Rocket Core processor.
ProcessorFuzz is a hardware fuzzing tool for processor RTL verification.
ProcessorFuzz was evaluated using the BOOM Core processor.
The ProcessorFuzz paper introduces the ProcessorFuzz tool as a novel processor fuzzer.
ProcessorFuzz was evaluated using the BlackParrot Core processor.
ProcessorFuzz targets RISC-V based processors designed in different HDLs.
ProcessorFuzz monitors mstatus CSR transitions as part of its coverage metric.
ProcessorFuzz monitors fflags CSR transitions for floating-point state tracking.
ProcessorFuzz tracks privilege mode transitions as part of CSR-transition coverage.
ProcessorFuzz targets pre-silicon verification of processor designs.
The paper introduces ProcessorFuzz as a novel processor fuzzing tool.
ProcessorFuzz is described as HDL-agnostic in contrast to RFUZZ which is coupled to Chisel HDL.
ProcessorFuzz implements hardware fuzzing for processor verification.
LINKED ENTITIES
28 linksProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance INTRODUCES Extracted graph relationship
CSR-transition coverage IMPLEMENTS Extracted graph relationship
Coverage-based Greybox Fuzzing IMPLEMENTS Extracted graph relationship
differential testing IMPLEMENTS Extracted graph relationship
ISA simulation USES Extracted graph relationship
RTL simulation USES Extracted graph relationship
Spike ISA simulator USES Extracted graph relationship
Verilator USES Extracted graph relationship
mutation engine USES Extracted graph relationship
seed corpus USES Extracted graph relationship
Transition Unit USES Extracted graph relationship
Transition Map USES Extracted graph relationship
extended ISA trace log USES Extracted graph relationship
assembly program test input USES Extracted graph relationship
Control and Status Registers USES Extracted graph relationship
Rocket Core EVALUATES Extracted graph relationship
BOOM Core EVALUATES Extracted graph relationship
BlackParrot Core EVALUATES Extracted graph relationship
DiFuzzRTL COMPARES_WITH Extracted graph relationship
Dromajo USES Extracted graph relationship
RISC-V ISA USES Extracted graph relationship
mstatus CSR MENTIONS Extracted graph relationship
fflags CSR MENTIONS Extracted graph relationship
mcause CSR MENTIONS Extracted graph relationship
medeleg CSR MENTIONS Extracted graph relationship
privilege mode MENTIONS Extracted graph relationship
Physical Memory Protection MENTIONS Extracted graph relationship
pre-silicon verification USES Extracted graph relationship
CITATIONS
7 sources7 citations — click to expand
[1] ProcessorFuzz is presented in the paper “ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance.” ProcessorFuzz: Processor Fuzzing with Control and
[2] The paper motivates processor fuzzing as part of dynamic processor verification, noting that exhaustive verification is unrealistic for complex processors and that pre-silicon bug discovery is valuable. ProcessorFuzz: Processor Fuzzing with Control and
[3] Hardware-domain differential testing compares RTL-simulation results against ISA-simulation results, and a difference indicates a potential processor bug. ProcessorFuzz: Processor Fuzzing with Control and
[4] The paper criticizes DIFUZZRTL-style register coverage as potentially misleading when datapath registers with little control over processor FSM state are treated as interesting coverage. ProcessorFuzz: Processor Fuzzing with Control and
[5] ProcessorFuzz uses Control and Status Register guidance, and the paper lists CSRs not monitored by ProcessorFuzz with reasons for exclusion. ProcessorFuzz: Processor Fuzzing with Control and
[6] The table of CSRs not monitored by ProcessorFuzz excludes some CSRs because they hold constant values during testing, some because the testing infrastructure lacks relevant support, and some because they mainly assist designers in analyzing bugs rather than revealing the fundamental issue. ProcessorFuzz: Processor Fuzzing with Control and
[7] The excerpt reports eight new bugs found in three processor designs and one new bug in a reference model. ProcessorFuzz: Processor Fuzzing with Control and