HScheduler: An execution history-based seed scheduling strategy for hardware fuzzing

Abstract

The recent emergence of hardware fuzzing has introduced significant advancements in hardware verification. However, the lack of an efficient seed (input for fuzzing) scheduling mechanism severely affects its performance. In this paper, we propose HScheduler, a novel seed scheduling strategy based on seed execution history. First, HScheduler prioritizes seeds based on the historical coverage points, ensuring that more promising seeds are executed first. Second, it analyzes seed mutation history to guide subsequent mutations, reducing the occurrence of ineffective mutations. Our evaluation demonstrates that HScheduler significantly improves the overall efficiency of hardware fuzzers. We implemented this design on both the state-of-the-art general-purpose hardware fuzzer RFUZZ and the processor-specific fuzzer DifuzzRTL. Experimental results demonstrate that, when fuzzing various real-world hardware designs, our approach achieves up to a $41.4\times$ speed improvement (with an average improvement of $7.4\times$) over RFUZZ, while HScheduler significantly reduces ineffective mutations during fuzzing. Additionally, it boosts coverage speed by 5.6$\times$ in DifuzzRTL, with a notable increase in final coverage, detecting over 1.4 times more mismatch seeds (potential bugs). Moreover, HScheduler introduces only a 0.63% performance overhead.