Verification remains a key bottleneck in the design of modern RISC-V processors, particularly for deep corner cases that are difficult to reach with conventional verification techniques. Coverage-guided hardware fuzzing provides fast exploration, but often relies on coarse-grained coverage feedback and blind mutation, leading to shallow exploration. Symbolic and concolic methods offer control path reasoning, but their practicality is limited by path explosion and high solver cost on realistic RTL processor designs.
We present a concolic execution guided hybrid whitebox fuzzing framework for RISC-V processors with FPGA acceleration. The framework combines RTL instrumentation, selective concolic execution, and hardware fuzzing to balance exploration of hard-to-trigger behaviors with fuzzing efficiency. It extracts the processor control-flow graph from RTL, instruments synthesizable control path monitoring, and prioritizes high-value unexplored paths. We further provide FPGA implementation to accelerate the hybrid whitebox fuzzing process through an end-to-end heterogeneous architecture.
We evaluate the approach on open-source RISC-V processors, including Ibex, CVA6, and PicoRV32. Results show that our approach can achieve 1.33x higher coverage than SOTA fuzzers and explore deep corner coverage points that are difficult to trigger with existing approaches.