Instruction Set Architecture eXtensions (ISAX) are one of the key methods to improve the performance of software-programmable processors. However, adding them into processor cores is cumbersome and becomes even more challenging if the ISAX needs to be portable among multiple different cores. Existing extension interfaces aim to alleviate these difficulties. However, they lack an abstraction layer that encapsulates commonly used adaptation mechanisms for mediating between the base core and the ISAX. Typical adaptation issues include latency matching, shared resource management, or hazard handling. For this purpose, we propose the Scalable Core Adaptation Layer (SCAL), which builds on an existing open-source interface, SCAIE-V. By using SCAL, we show that for ISAXes reading and returning a result, their interface width and semantics remain unchanged independent of their latency, number, or base core. We demonstrate this for four cores with different microarchitectures. Moreover, the ISAX is agnostic of its execution mode (in-pipeline or in parallel to the main pipeline), and its datapath does not change even if the result is written to the memory, program counter, or a new internal state element. This brings us closer to fast ISAX development and integration into multiple cores.

In the RISC-V ecosystem, custom instruction set architecture extensions (ISAX) are an energy-efficient and cost-effective way to accelerate modern embedded workloads. However, exploring different combinations of base cores and ISAXes for a specific application requires automation and a level of portability across microarchitectures that is not provided by existing approaches.

Fuzz testing serves as a key technique in software security aimed at identifying unexpected program behaviors by repeatedly executing the target program with auto-generated random inputs. Testing is integral to IoT device security but is hampered by the minimal observability features of typical in-market IoT devices. Moreover, the slow nature of a RISC-V software emulation on x86 host CPUs and the inaccuracies introduced by compiling IoT applications to a different ISA for execution on host systems pose significant challenges. Our software-hardware co-design surmounts these hurdles. Fuzzing jobs are prepared and evaluated on a host computer, while the actual execution with high-throughput tracing is performed on an FPGA. Advances in the host-to-FPGA interface together with an accelerated reset procedure between Fuzzer jobs effectively hide the costly host-FPGA communication, increasing the single-thread fuzzing performance by up to factor 11.7x that of the leading QEMU-based fuzzer AFL++ running on a very fast x86 CPU. We demonstrate practical usability by evaluating our framework on a collection of applications in a bare-metal environment.