Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection
summary
Encarsia automatically injects realistic RTL bugs by rerouting wires and mutating multiplexor select logic in an intermediate representation, then formally proves each injected fault propagates to an architectural deviation. It builds Encorpus, a validated set of 177 bugs across three open RISC‑V cores, and uses it to compare fuzzers. Results show coverage guidance often fails, program-generation strategy drives detection, many fuzzers ignore ISA subsets (e.g., missing RISC‑V extensions) or overfilter instructions, and microarchitectural corner cases like an FPU ring‑buffer corruption remain undetected.
AI-written summary · about
chapters (7)
- 0:00CPU fuzzing and Encarsia
- 1:58Flaws in fuzzer metrics
- 3:42Bug injection in Encarsia
- 5:51Evaluating fuzzer effectiveness
- 6:55Fuzzer techniques compared
- 8:41Microarchitectural corner cases
- 10:06Conclusion
related talks
52mStructure aware fuzzing
31m“Fuzz or lose..."
53mThree Colours of Fuzzing: Reflections and Open Challenges
34m1-Click-Fuzz：Systematically Fuzzing the Windows Kernel Driver with Symbolic Execution.
50mWhat the Fuzz
25mHow fuzzing helps to find bugs
19mCAFault: Enhance Fault Injection Technique in Practical Distributed Systems via...
53mFuzzing 101