Fuzzilicon: A Post-Silicon Microcode-Guided x86 CPU Fuzzer

2025-12-29

AI Summary

Modern CPU microarchitectural flaws are highly elusive; post-silicon, commercial chips lack RTL access, rendering traditional manual analysis and existing automated techniques ineffective for systematic vulnerability discovery. This paper introduces the first post-silicon, microcode-guided fuzzing framework tailored for real-world x86 processors. It reverse-engineers Intel’s microcode update interface to extract microarchitectural feedback, pioneers a novel integration of microcode-level instrumentation with feedback-driven fuzzing, and establishes the first empirically measured microcode coverage baseline. Applied to the Goldmont microarchitecture, our framework automatically discovers five vulnerabilities—including two previously unknown microcode-level speculative execution flaws (reproducing μSpectre-class defects). It reduces coverage instrumentation overhead by 31× and achieves unique coverage of 16.27% of instrumentable microcode locations.

Technology Category

• Machine Learning: Hardware-aware ML
• Cognitive Modeling & Cognitive Systems: Neural Spike Coding
• Search and Optimization: Sampling/Simulation-based Search

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Web Mining and Content Analysis: Web measurements

Abstract

Modern CPUs are black boxes, proprietary, and increasingly characterized by sophisticated microarchitectural flaws that evade traditional analysis. While some of these critical vulnerabilities have been uncovered through cumbersome manual effort, building an automated and systematic vulnerability detection framework for real-world post-silicon processors remains a challenge. In this paper, we present Fuzzilicon, the first post-silicon fuzzing framework for real-world x86 CPUs that brings deep introspection into the microcode and microarchitectural layers. Fuzzilicon automates the discovery of vulnerabilities that were previously only detectable through extensive manual reverse engineering, and bridges the visibility gap by introducing microcode-level instrumentation. At the core of Fuzzilicon is a novel technique for extracting feedback directly from the processor's microarchitecture, enabled by reverse-engineering Intel's proprietary microcode update interface. We develop a minimally intrusive instrumentation method and integrate it with a hypervisor-based fuzzing harness to enable precise, feedback-guided input generation, without access to Register Transfer Level (RTL). Applied to Intel's Goldmont microarchitecture, Fuzzilicon introduces 5 significant findings, including two previously unknown microcode-level speculative-execution vulnerabilities. Besides, the Fuzzilicon framework automatically rediscover the $μ$Spectre class of vulnerabilities, which were detected manually in the previous work. Fuzzilicon reduces coverage collection overhead by up to 31$ imes$ compared to baseline techniques and achieves 16.27% unique microcode coverage of hookable locations, the first empirical baseline of its kind. As a practical, coverage-guided, and scalable approach to post-silicon fuzzing, Fuzzilicon establishes a new foundation to automate the discovery of complex CPU vulnerabilities.

Problem

• Automates vulnerability discovery in x86 CPUs using microcode introspection
• Bridges visibility gap via microcode-level instrumentation without RTL access
• Reduces coverage overhead and establishes empirical baseline for CPU fuzzing

Innovation

• Microcode-guided fuzzing for x86 CPUs
• Microarchitecture feedback via reverse-engineered interface
• Hypervisor-based fuzzing harness without RTL access