HWFuzz: An FPGA-Accelerated Fuzzing
                                                                                                  Framework for Efficient RISC-V Verification

                                                                                           Yang Zhong1,2, Haoran Wu3∗, Yungang Bao1,2 and Kan Shi1,2

                                                                          1State Key Lab of Processors, Institute of Computing Technology, Chinese Academy of Sciences
                                                                                                   2University of Chinese Academy of Sciences
                                                                                                            3University of Cambridge
                                                                                                                    Abstract
                                                                    We introduce HWFuzz, a high-performance fuzzing-based verification framework that automatically detects
  potential vulnerabilities in RISC-V processors. The framework tackles the challenge of lengthy verification
  cycles required to achieve hard-to-reach coverage points, particularly in complex processors.  Our solution
  enhances verification efficiency through two key components.     First, we implement a hardware fuzzer that
                                                                  rapidly generates large-scale RISC-V instruction sequences. Instead of simply using random instructions, the
                                                              fuzzing-based instructions are specifically designed to achieve better coverage while exploring hard-to-reach states
  during RISC-V processor verification. Second, we develop an end-to-end verification framework that iteratively
                                                                  generates coverage-directed stimuli using the hardware fuzzer, applies them to the design-under-test (DUT),
                                                               collects coverage data, and identifies uncovered states for further fuzzing iterations. Through FPGA acceleration,
  our framework achieves 2.03× speedup against conventional software approaches.

      Introduction                                               ploring corner cases. Third, we fully automated the

Fuzzing has traditionally served as software testing hardware verification process. The system iteratively tools [1, 2, 3] that identify security vulnerabilities collects coverage data from the DUT to enhance stim- and bugs by generating large volumes of random and ulus quality while automatically detecting potential often invalid input data to trigger unexpected behav- vulnerabilities by comparing the execution results from ior. Recently, this approach has been adapted to both the DUT and its software reference model based verify hardware circuits [4], with modifications to en- on the ENCORE framework with FPGA acceleration. hance verification effectiveness. For example, several The HWFuzz Framework fuzzing methods have emerged specifically for proces- sor verification. To our knowledge, RFuzz[5] was the Overview The overall workflow of the HWFuzz first tool to apply fuzzing methods to RTL functional framework is shown in Figure 1. We take advantage verification, but only limited to small-scale design. of the Zynq UltraScale+ architecture that consists of DifuzzRTL[6] brought improved fuzzing performance Programmable Logic (PL) and Processing System (PS) and more efficient coverage exploration, introducing on the same FPGA to implement and accelerate the a cycle-accurate, scalable coverage metric designed overall verification process. Specifically, PL is used to specifically for RTL design. Other research such as deploy the hardware fuzzer IP and the RISC-V pro- TheHuzz [7] and Cascade [8] have since developed in- cessor DUT. The corresponding software model of the novative methods to optimize instruction generation DUT is running simultaneously on the PS. We reuse and enhance overall efficiency. the differential checking capability from ENCORE However, existing hardware fuzzing techniques still to automatically compare the execution results from require the fuzzer to run in software, creating a per- DUT and the reference model dynamically. formance bottleneck that results in slower stimulus HWFuzz can automatically instrument fine-grained generation and a longer verification period. synthesizable coverpoints into the DUT during compi- To address the above issue, we propose HWFuzz, lation. This allows coverage information to be collected an FPGA-accelerated fuzzing framework for RISC-V directly from the FPGA during runtime, which feeds processor verification. Our work makes three novel back to the fuzzer to improve stimulus generation. contributions: First, we developed a synthesizable and Coverage-Directed Generation The hardware highly configurable hardware fuzzer IP that enables fuzzer IP operates in two modes: random and mu- rapid generation of RISC-V coverage-directed instruc- tation. The random mode selects instructions purely tion stimuli. Second, instead of simply using ran- at random, while the mutation mode modifies the dom instructions, we enhanced the fuzzing algorithm previously generated stimuli in the random mode by to improve stimulus quality, maximizing executable adjusting their operands and context. During each instructions and achieving better coverage while ex- fuzzing iteration, the system stores the generated stim- ∗Haoran Wu finish this work during their internship at Institute uli and their corresponding DUT coverage data col- of Computing Technology, Chinese Academy of Sciences. lected in the hardware in a corpus. The mutation

RISC-V Summit Europe, Paris, 12-15th May 2025 1

             Il        =               EE                                                   |
            |      ETT                  Injector  Context          BE                |      ||!      Contribution
            I     5                                                 choking
                                            ei                     Ed                       ||

                                        Figure 1: The HWFuzz architecture.

mode then selectively modifies the most promising
stimuli—those with the highest probability of maxi-
mizing coverage. This targeted approach increases the              1200
chances of generating instructions that expand DUT              g
coverage and enhance verification effectiveness.                g   800
Stimuli Packing           The fuzzer generates two types of     s   100
stimuli: instructions and data. Both are stored in a            §
designated DDR region that serves as the testing envi-          Zo
ronment for DUT verification. While data generation                             1      28                 4
follows a simple random approach—creating random               mm Total       Num of Fuzzing Iteration
data values that Load/Store instructions can interact          Figure 2:ᴳᵉⁿᵉʳᵃᵗᵉᵈ                         BEE    Control Flo
with—instruction generation involves a more sophisti-          instruction typesThe comparison of instruction counts for three
cated, multi-stage process, as shown in Figure 1.              RV64G ISA. As seen in Figure 3, HWFuzz with G
           In the initial stage, Random and Mutation gener-    extension achieves 2.03× coverage growth over soft-
ate a set of instructions with opcodes only.          Next,    ware fuzzer after 100 fuzzing iterations, while also
the system automatically creates a context for these           demonstrating a more significant increase in coverage

instructions by adding address-related information. over time. Meanwhile, HWFuzz with only the I exten- Meanwhile, the instruction injector works in parallel ~~ sion reaches more than half the coverage points of the to insert auxiliary instructions that provide register software fuzzer with the G extension. values, improving verification effectiveness. Finally, a processing unit assigns operands to each instruction 25000 based on its generated context. 2 20000 ha ok i Stimuli Constraints Beyond performance issues, = | HWFuzzG previous fuzzing methods face another key limitation 2 15000 that many generated instructions cannot be fully exe- 10000 cuted. Control flow instructions comprise a significant 8 5000 portion of generated instructions, particularly when in- struction set extensions are not fully enabled. Without proper jump range restrictions, many of these instruc- 0 Py 100 tions miss execution opportunities, as Figure 2 illus- um of Fuzzing fteration trates. An unrestricted jump range fails to improve Figure 3: Coverage comparison coverage. While Cascade addressed this through a software-based approach of reconstructing basic blocks, Table 1 shows the resource utilization. Compared we opted for implementing hardware constraints on to an instrumented RISC-V core, the fuzzer IP incurs control flow instruction jump ranges. This method a small area overhead. significantly increases the proportion of instructions Table 1: Resource Usages that can be executed. Resource Fuzzer Infra DUT Evaluation and Results LUTs 68377 8217 209865 We implemented HWFuzz on a Fidus Sidewinder board (13.08%) (1.57%) (40.15%) equipped with an AMD Zynq UltraScale+ XCZU19EG Block RAMs 192.5 325 20 FPGA. We used Rocket Core—a 64-bit RISC-V single- (19.56%) (33.03%) (2.03%) issue processor as the DUT. Registers 92407 12749 118683 We configure HWFuzz to support RV64I and RV64G (8.84%) (1.22%) (11.35%) extensions, whereas the software fuzzer supports

2                                                                                                     RISC-V Summit Europe, Paris, 12-15th May 2025

  References

[1] Michał Zalewski. American Fuzzy Lop - Whitepaper. https: / / lcamtuf . coredump . cx / afl / technical _ details . txt. Accessed: 2025-04-12. 2016. [2] Ella Bounimova, Patrice Godefroid, and David Molnar. “Billions and billions of constraints: Whitebox fuzz testing in production”. In: 2013 35th International Conference on Software Engineering (ICSE). 2013, pp. 122–131. doi: 10.1109/ICSE.2013.6606558. [3] A. Geralis. Libfuzzer. 2023. url: https://github.com/ planetis-m/libfuzzer (visited on 11/18/2023). [4] Raghul Saravanan and Sai Manoj Pudukotai Dinakarrao. “The Fuzz Odyssey: A Survey on Hardware Fuzzing Frame- works for Hardware Design Verification”. In: Proceedings of the Great Lakes Symposium on VLSI 2024. GLSVLSI ’24. Clearwater, FL, USA: Association for Computing Ma- chinery, 2024, pp. 192–197. isbn: 9798400706059. doi: 10. 1145/3649476.3658697. url: https://doi.org/10.1145/ 3649476.3658697. [5] Kevin Laeufer et al. “RFUZZ: Coverage-Directed Fuzz Test- ing of RTL on FPGAs”. In: 2018 IEEE/ACM International Conference on Computer-Aided Design (ICCAD). 2018, pp. 1–8. doi: 10.1145/3240765.3240842. [6] Jaewon Hur et al. “DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs”. In: 2021 IEEE Symposium on Security and Privacy (SP). 2021, pp. 1286–1303. doi: 10. 1109/ SP40001.2021.00103. [7] Rahul Kande et al. “TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities”. In: 31st USENIX Security Symposium (USENIX Security 22). Boston, MA: USENIX Association, Aug. 2022, pp. 3219–3236. isbn: 978-1-939133-31-1. url: https : / / www . usenix . org / conference/usenixsecurity22/presentation/kande. [8] Flavien Solt, Katharina Ceesay-Seitz, and Kaveh Razavi. “Cascade: CPU Fuzzing via Intricate Program Genera- tion”. In: 33rd USENIX Security Symposium (USENIX Security 24). Philadelphia, PA: USENIX Association, Aug. 2024, pp. 5341–5358. isbn: 978-1-939133-44-1. url: https: / / www . usenix . org / conference / usenixsecurity24 / presentation/solt.

RISC-V Summit Europe, Paris, 12-15th May 2025 3