TargetFuzz: Enabling Directed Graybox Fuzzing via SAT-Guided Seed Generation

The ever-increasing complexity of design specifications for processors and intellectual property (IP) presents a formidable challenge for early bug detection in the modern IC design cycle. The recent advancements in hardware fuzzing have proven effective in the design verification of complex hardware designs. The modern IC design flow involves incremental updates and modifications to the hardware designs, necessitating rigorous verification and extending the overall verification period. A major challenge lies in generating high-quality seeds that maximize coverage and verification efficiency. While Coverage-Guided Fuzzing (CGF) enhances overall exploration, it lacks precision when targeting specific sites. DirectFuzz addresses this with directed test generation but suffers from key limitations, including limited HDL support, abstraction mismatches, and poor scalability for large target regions. In this work, to overcome these challenges, we propose TargetFuzz, a Directed Graybox Fuzzing (DGF) framework that integrates SAT (Boolean satisfiability) engines for precise and scalable seed generation. Our experimental results demonstrate its capability to effectively scale 30x greater in terms of handling target sites, achieving 100% state coverage and $1.5 x$ faster in terms of site coverage, and show 90x improvement in target state coverage compared to Coverage-Guided Fuzzing, demonstrating its potential to advance the state-of-the-art in directed hardware fuzzing.