Cascade: CPU fuzzing via intricate program generation
The key results:> Cascade discovered 12 bugs that produce wrong computations under certain microarchitectural conditions (Uarchvals) in Kronos and VexRiscv> Cascade discovered 3 bugs that cause hangs in Kro- nos, PicoRV32 and VexRiscvThese are the hard bugs to find in the implementation of the CPU> Cascade discovered 4 bugs in BOOM and CVA6 that produce wrong output val- ues regardless of the microarchitectural stateThese are unacceptable bugs, showing a lack of architectural tests. It means no one ever ran those instructions and checked the result. The community should be able to fix this.