Grammar-based fuzz testing for microprocessor RTL design

Abstract

Recently, agile hardware design (AHD) methodology has been proposed to alleviate the productivity crisis brought by the growing complexity of modern microprocessor design. One of the key techniques in AHD is the adoption of hardware construction languages (HCLs) which have greatly improved the design productivity. However, the adoption of HCLs arises new challenges to design verification. In this paper, we proposed an enhanced coverage-directed dynamic verification technique for microprocessor RTL designs modeled using PyRTL HCL. The intention of the proposed method is to achieve higher coverage in dynamic verification.The proposed method is a hybrid between symbolic simulation and grammar-based fuzz testing, which offsets the disadvantages of each separate technique. We define Full Multiplexer Toggle Coverage (FMTC) to trace and provide feedback to the verification process. The achievement of high coverage is obtained by interleaving symbolic simulation and grammar-based fuzz testing passes. The symbolic simulation pass is used to generate tests that direct the testing to untouched corners, while the grammar-based fuzz testing pass is used to leverage test generation tasks and to enable the method to deal with microprocessor designs with a specific instruction set architecture (ISA). In addition, to further reduce testing cost, we propose a test compression technique to compress the generated test instructions by dropping redundant instructions.Finally, we implement all the enhancements in a test generation tool, named MPFuzz. Experimental results show that MPFuzz can efficiently generate test instructions for microprocessor RTL designs. The test instructions generated by MPFuzz can achieve higher coverage at least four times than that by the state-of-the-art fuzzing-based RTL test generation tool.