Lyra: A Hardware-Accelerated RISC-V Verification Framework with Generative Model-Based Processor Fuzzing

This paper presents Lyra, a heterogeneous RISC-V verification framework that combines FPGA-based hardware acceleration with a domain-specialized, ISA-aware generative model to overcome the limitations of software simulation and random fuzzing, achieving significantly higher coverage and up to 3343× faster verification speeds.

The Gist

Imagine you are building a brand-new, incredibly complex car engine (a computer processor). Before you can sell it, you have to make sure it doesn't explode, stall, or run backward. This process is called verification.

For a long time, verifying these engines has been like testing a car by pushing it very slowly down a dirt road with a stopwatch. It's safe, but it's agonizingly slow. Worse, the people testing it often just throw darts at the engine, hoping to hit a weak spot. They might hit a few dents, but they miss the deep, hidden cracks that only appear under very specific, weird conditions.

This paper introduces Lyra, a new way to test these engines that is like swapping that dirt road for a Formula 1 racetrack and replacing the dart-throwers with a super-smart AI coach.

Here is how Lyra works, broken down into simple concepts:

1. The Problem: The "Blind Dart" and the "Slow Turtle"

Traditional testing has two big flaws:

• The Slow Turtle: Most testing happens on regular computer software. It's like watching a movie in slow motion. You can see everything clearly, but it takes forever to get through the story.
• The Blind Dart: To find bugs, testers usually use "fuzzing." This is like throwing random instructions at the processor to see what breaks. The problem is, these instructions are often nonsense (like telling a car to "fly" or "drink water"). Real bugs happen when you give the engine a very specific, complex sequence of commands. Random darts rarely hit those specific targets.

2. The Solution: Lyra's Two Superpowers

Lyra fixes both problems by combining AI and Hardware.

Superpower A: The "Smart Coach" (LyraGen)

Instead of throwing random darts, Lyra uses a specialized AI (called LyraGen) that has studied the "language" of the processor.

• The Analogy: Imagine a driving instructor who knows exactly how a car engine works. Instead of telling the driver to "press random pedals," the instructor says, "Okay, to test the brakes on a wet hill, we need to go 40mph, turn left, and then slam the brakes."
• How it works: The AI understands the rules of the processor (the RISC-V language). It generates instructions that are guaranteed to make sense and are designed to hit those tricky, hidden corners where bugs hide. It's not guessing; it's strategizing.

Superpower B: The "Formula 1 Track" (FPGA)

Once the AI generates the test commands, Lyra doesn't run them on a slow computer. It loads them onto a special chip called an FPGA (Field-Programmable Gate Array).

• The Analogy: Running a test on a normal computer is like driving a Ferrari in a school parking lot. Running it on an FPGA is like driving that same Ferrari on a 200mph racetrack.
• How it works: The FPGA acts like a physical, real-time version of the processor. It runs the tests thousands of times faster than software. It also has a built-in "referee" that instantly checks if the processor did what it was supposed to do. If there's a mismatch, the referee blows the whistle immediately.

3. The "Safety Net" (The Filter)

Since the AI is creative, it might occasionally try to write a command that is grammatically correct but physically impossible (like trying to drive a car into a wall).

• Lyra has a Safety Filter that acts like a grammar teacher and a traffic cop combined. Before the test runs, the filter checks: "Is this command legal? Does it point to a memory address that exists?" If the answer is no, the filter fixes it or throws it away. This ensures the test never crashes the system due to a silly mistake.

4. The Results: Speed and Smarts

The paper tested Lyra against the best existing methods and found:

• Speed: Lyra is 100 to 3,000 times faster than the old software methods. A test that used to take weeks now takes hours (or even minutes).
• Quality: Because the AI understands the processor's "language," it finds more bugs and covers more ground with fewer tests. It found 27% more potential issues than the previous best methods.
• Efficiency: It gets "stuck" less often. Traditional methods get stuck trying to find the next bug, but Lyra's AI knows exactly where to look next.

Summary

Lyra is a verification framework that replaces the slow, random testing of the past with a smart, AI-driven coach running tests on a super-fast, hardware racetrack. It doesn't just throw darts in the dark; it shines a flashlight on the exact spots where the engine is likely to fail, doing it thousands of times faster than ever before.

Technical Summary

Here is a detailed technical summary of the paper "Lyra: A Hardware-Accelerated RISC-V Verification Framework with Generative Model-Based Processor Fuzzing."

1. Problem Statement

As processor designs (particularly RISC-V) become increasingly complex, verification has become a critical bottleneck, consuming up to 70% of development effort. The paper identifies two primary limitations in current verification methodologies:

• Performance Bottlenecks: Traditional verification relies heavily on software simulation (CPU-based), which is extremely slow (typically tens of kHz). This includes stimulus generation, test execution, and coverage collection, making end-to-end verification prohibitively time-consuming.
• Semantic Blindness in Fuzzing: While software fuzzers have been adopted to improve coverage over constrained-random testing, they rely on "blind" random mutations (e.g., bit flips). These methods lack an understanding of Instruction Set Architecture (ISA) semantics. Consequently, they struggle to generate the logically precise, semantically coherent instruction sequences required to trigger deep corner cases, leading to slow coverage convergence and high verification costs.

2. Methodology: The Lyra Framework

Lyra is a heterogeneous verification framework that integrates FPGA hardware acceleration with a domain-specialized generative model (LyraGen). The framework operates in two distinct phases:

A. The Training Phase (Offline)

• Goal: Train LyraGen to understand RISC-V semantics and the relationship between instructions and coverage.
• Data Generation: A hybrid system generates a dataset of <instruction, coverage> pairs. A software fuzzer runs on a CPU to generate instructions, which are executed on an FPGA testbed containing both the Design Under Test (DUT) and a Reference Model (REF).
• Novel Encoding: The authors redesigned RISC-V instruction representation. Instead of raw binary, instructions are tokenized into sequences of integers based on their fields (Opcode, Funct3, Registers, Immediates, etc.). This allows the model to learn structural patterns.
• Model Architecture: Based on OPT-125M, the model is retrained from scratch (not fine-tuned) to accept numerical coverage vectors as input and predict the next instruction tokens. It uses a custom RVTokenizer to handle variable-width instruction fields without vocabulary explosion.

B. The Inference Phase (Online)

• Instruction Generation: LyraGen generates instruction sequences conditioned on the current coverage state to drive the system toward unexplored states.
• Legality & Address Correction: Since generative models can produce invalid instructions or out-of-bounds memory addresses, Lyra employs two critical filters:
  1. Instruction Legality Checker: Validates syntax and semantics, repairing invalid instructions by mapping tokens to the closest valid RISC-V encoding or discarding them.
  2. Address Sanitization: Uses a fast ISA emulator to detect and correct memory access violations (misalignment or out-of-bounds) by adjusting offsets or inserting auxiliary instructions (e.g., auipc + addi) to fix high-order address bits.
• Hardware Execution & Differential Checking: Validated instructions are fed into an FPGA SoC.
  • The DUT runs on the Programmable Logic (PL).
  • The Reference Model runs on the hardened ARM processors within the same FPGA.
  • Differential Checking: Hardware checkers compare execution results (I/O and registers) between the DUT and REF in real-time.
• Coverage Feedback: Coverage points are instrumented directly on the FPGA (Register Coverage metric). This data is fed back to LyraGen to guide the next round of instruction generation, creating a closed-loop verification system.

3. Key Contributions

1. First Heterogeneous GPU-CPU-FPGA Co-Verification Framework: Lyra offloads the most time-consuming tasks (test execution, differential checking, and coverage collection) to hardware (FPGA), while utilizing a GPU for high-throughput generative model inference.
2. LyraGen (Domain-Specialized Generative Model): A 125M-parameter model trained with a novel RISC-V tokenization scheme and supervised coverage-conditioned training. It produces semantically rich instruction sequences, overcoming the "semantic blindness" of traditional fuzzers.
3. Hardware-Accelerated Verification Loop: By implementing coverage instrumentation and differential checking directly on the FPGA, Lyra eliminates the software simulation bottleneck, enabling execution speeds orders of magnitude faster than CPU-based simulators.
4. Robust Instruction Filtering: The introduction of legality and address-correction modules ensures that the generative model's output is executable and safe, preventing processor stalls due to illegal instructions or memory faults.

4. Experimental Results

The authors evaluated Lyra against state-of-the-art software fuzzers (DifuzzRTL and Cascade) using the open-source RocketCore RISC-V processor.

• Coverage Convergence:
  • Lyra achieved 1.27× higher coverage than the best existing software fuzzer (Cascade) at convergence.
  • With address correction enabled, Lyra achieved up to 1.96× higher coverage at specific instruction counts compared to systems without correction.
• End-to-End Performance:
  • Lyra accelerated the verification process by 107× to 3343× compared to software-based approaches.
  • Specifically, reaching 40,000 coverage points took 115.2 seconds with Lyra, compared to 6,610.9 seconds (Cascade) and 207,048.2 seconds (DifuzzRTL).
  • Throughput reached 11,990.5 instructions/sec (with FP16 inference), compared to ~1,385 for Cascade.
• Convergence Difficulty:
  • Using a metric $DCV = \Delta Inst / \Delta Cov$ (instructions needed per unit of coverage gain), Lyra demonstrated significantly lower difficulty. At 40K coverage, Lyra's DCV was 291.5, whereas Cascade and DifuzzRTL were 2,947.0 and 5,607.6, respectively. This indicates Lyra maintains high efficiency even in deep, hard-to-reach states.

5. Significance

Lyra represents a paradigm shift in hardware verification by bridging the gap between AI-driven stimulus generation and hardware-accelerated execution.

• Scalability: It solves the performance bottleneck of software simulation, making it feasible to verify complex, modern processor cores within reasonable timeframes.
• Intelligence: By moving beyond random mutation to semantic-aware generation, it effectively targets deep corner cases that traditional methods miss.
• Reproducibility & Openness: Unlike some ML-based approaches relying on closed-source LLMs, Lyra uses a transparent, retrained open-source model with custom tokenization, ensuring reproducibility.
• Future Impact: The framework demonstrates that combining generative AI with FPGA acceleration is a viable and highly effective path forward for the verification of next-generation open-source and proprietary hardware.