  The increasing complexity of modern processors poses many challenges to
existing hardware verification tools and methodologies for detecting
security-critical bugs. Recent attacks on processors have shown the fatal
consequences of uncovering and exploiting hardware vulnerabilities.
  Fuzzing has emerged as a promising technique for detecting software
vulnerabilities. Recently, a few hardware fuzzing techniques have been
proposed. However, they suffer from several limitations, including
non-applicability to commonly used Hardware Description Languages (HDLs) like
Verilog and VHDL, the need for significant human intervention, and inability to
capture many intrinsic hardware behaviors, such as signal transitions and
floating wires.
  In this paper, we present the design and implementation of a novel hardware
fuzzer, TheHuzz, that overcomes the aforementioned limitations and
significantly improves the state of the art. We analyze the intrinsic behaviors
of hardware designs in HDLs and then measure the coverage metrics that model
such behaviors. TheHuzz generates assembly-level instructions to increase the
desired coverage values, thereby finding many hardware bugs that are
exploitable from software. We evaluate TheHuzz on four popular open-source
processors and achieve 1.98x and 3.33x the speed compared to the
industry-standard random regression approach and the state-of-the-art hardware
fuzzer, DiffuzRTL, respectively. Using TheHuzz, we detected 11 bugs in these
processors, including 8 new vulnerabilities, and we demonstrate exploits using
the detected bugs. We also show that TheHuzz overcomes the limitations of
formal verification tools from the semiconductor industry by comparing its
findings to those discovered by the Cadence JasperGold tool.
