ConFluxFuzz: Control-Flow Restructuring and Freshness-Decayed Scheduling for Processor Fuzzing

Modern processors incorporate increasingly complex control logic, making efficient and scalable state-space exploration a long-standing challenge in pre-silicon processor verification. While recent coverage-guided processor fuzzing techniques have shown promise, they still suffer from fundamental limitations that hinder verification efficiency, including execution incompleteness induced by uncontrolled control flows, suboptimal test program scheduling under constrained simulation budgets, and excessive redundant mismatches during differential testing. To address these challenges, we present ConFluxFuzz, a coverage-guided processor fuzzing framework that improves verification efficiency by enhancing execution completeness, accelerating coverage convergence, and reducing mismatch analysis overhead. ConFluxFuzz reconstructs control-flow structure during input program construction to enhance realized execution coverage, and adopts a freshness-decayed priority scheduling strategy that prioritizes test programs based on their sustained coverage effectiveness over time. In addition, it incorporates root-cause-aware mismatch filtering to suppress redundant mismatches and reduce manual analysis overhead. We evaluate ConFluxFuzz on four RISC-V processors and analyze its effectiveness across six coverage metrics. Experimental results show that ConFlux-Fuzz achieves higher coverage, faster coverage convergence, and improved bug detection efficiency compared to state-of-the-art coverage-guided processor fuzzers. Notably, for control register coverage, ConFluxFuzz achieves coverage 13.7× faster than DifuzzRTL, 11.0× faster than ProcessorFuzz, and 5.0× faster than riscv-torture, measured by geometric mean, and discovers six previously unknown bugs in open-source RISC-V processors.