Overview
ProcessorFuzz is a processor fuzzer introduced to improve RTL processor verification using fuzzing feedback based on processor Control and Status Registers (CSRs). The paper listing for “ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance” names Sadullah Canakci, Chathura Rajapaksha, Leila Delshadtehrani, Anoop Mysore Nataraja, Michael Bedford Taylor, Manuel Egele, and Ajay Joshi as authors, and lists the work in IEEE HOST 2023, pages 1–12. [publication]
The work is motivated by the increasing difficulty of finding processor bugs before manufacturing. Its abstract notes that undiscovered microarchitectural bugs can become security vulnerabilities, side channels, or functional bugs, and that earlier RTL hardware-fuzzing approaches can suffer from limited HDL support and misleading coverage signals. [motivation]
CSR-transition guidance
ProcessorFuzz’s main technique is a CSR-transition coverage metric. The fuzzer monitors transitions in Control and Status Registers (CSRs), because CSRs control and hold processor state. The paper argues that CSR transitions indicate new processor states, so using those transitions as feedback helps guide fuzzing toward additional processor states. [csr-transition]
The tool is described as HDL-agnostic and as requiring no instrumentation in the processor design, which the abstract says allows support for RTL designs written in different hardware languages. [hdl-agnostic]
Evaluation
ProcessorFuzz was evaluated on three real-world open-source RISC-V processors: Rocket, BOOM, and BlackParrot. [evaluation-targets]
In comparison with DIFUZZRTL, ProcessorFuzz triggered a set of ground-truth bugs 1.23× faster on average. [difuzzrtl-comparison]
The reported experiments exposed eight new bugs across the three RISC-V cores and one new bug in a reference model. All nine bugs were confirmed by developers of the corresponding projects. [bug-results]
Position in hardware fuzzing
Later hardware-fuzzing literature lists ProcessorFuzz among recent approaches that improved hardware fuzzing, specifically summarizing it as guiding fuzzing using control and status registers. [later-context]