CPCRFuzz: Adaptive Security-Critical Path and Control-Register Guided Fuzzing for Processor Vulnerability Detection

Abstract

Processor fuzzing is effective for exposing RTL-level bugs, but existing coverage metrics are only weakly aligned with security-relevant processor behaviors. This paper presents CPCRFuzz, an adaptive fuzzing framework guided by two complementary metrics: security-critical path (SCP) coverage and implementation-level control-register (CR) coverage. SCP denotes security-sensitive RTL control paths, while CR follows the RTL control-register abstraction used by DifuzzRTL. CPCRFuzz extracts SCPs from FIRRTL using six auditable predicates covering privilege-state updates, memory-protection checks, exception/interrupt handling, floating-point state transitions, atomic-reservation logic, and pipeline-ordering behavior. During fuzzing, an adaptive controller updates the SCP/CR weight λt from SCP-coverage growth, effective-seed ratio, and residual CR gain, biasing early exploration toward vulnerability-prone RTL regions and later exploration toward implementation-level control state diversity. Under a unified 72-hour, 10-run evaluation on Rocket Core and BOOM Core, CPCRFuzz achieves approximately 4.5×, 3.9×, and 3.6× geometric-mean speedup on bugs also detected by DifuzzRTL, ProcessorFuzz, and TheHuzz, respectively. It also triggers one known vulnerability not triggered by any evaluated baseline within the time budget. Ablation studies indicate that SCP and CR coverage are complementary rather than redundant.