Skip to content

Fuzzing crate#10

Merged
0xddom merged 32 commits into
llzkfrom
dani/rv32im-fuzz
May 11, 2026
Merged

Fuzzing crate#10
0xddom merged 32 commits into
llzkfrom
dani/rv32im-fuzz

Conversation

@0xddom

@0xddom 0xddom commented Mar 10, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

@0xddom
0xddom requested a review from shankarapailoor March 10, 2026 17:50
@0xddom
0xddom force-pushed the dani/rv32im-fuzz branch from ce70f1d to 2e1560c Compare April 1, 2026 13:59
@iangneal

iangneal commented May 7, 2026

Copy link
Copy Markdown
Collaborator

@0xddom the LLZK extractor is already merged into the default llzk branch, if you merge this into that branch then we could do the PR from there.

@0xddom 0xddom changed the title Basic rv32im fuzzer Fuzzing crate May 11, 2026
@0xddom
0xddom force-pushed the dani/rv32im-fuzz branch 4 times, most recently from acd6b45 to 31a96c9 Compare May 11, 2026 14:34
@0xddom
0xddom force-pushed the dani/rv32im-fuzz branch from 31a96c9 to 49c5b01 Compare May 11, 2026 14:46
Comment thread riscv_transpiler/src/ir/mod.rs Outdated
Comment thread riscv_transpiler/src/ir/mod.rs Outdated
Comment thread riscv_transpiler/src/ir/mod.rs Outdated
Comment thread riscv_transpiler/src/ir/mod.rs Outdated
Comment thread riscv_transpiler/src/ir/mod.rs Outdated
Comment thread riscv_transpiler/src/ir/mod.rs Outdated
Comment thread riscv_transpiler/src/ir/mod.rs Outdated
0xddom added 2 commits May 11, 2026 16:52
Co-authored-by: foldr <daniel@veridise.com>
@0xddom
0xddom changed the base branch from picus-extraction-dev to llzk May 11, 2026 14:55
@0xddom
0xddom merged commit 61a7932 into llzk May 11, 2026
2 checks passed
0xddom pushed a commit that referenced this pull request May 11, 2026
* Add some llzk backend scaffolding

* Helper types for lowering

* adding basic picus translation

* adding range check

* adding add_sub_lui

* Add more builder tools, generate empty struct

* Initial end-to-end translation for `add_sub_lui_auipc_mop`

* Remove unused code

* Fixup rebase issues

* Name internal and output members according to source Variable IDs

* Fix negative term generation bug

---------

Co-authored-by: Daniel Dominguez <daniel@veridise.com>
Co-authored-by: shankarapailoor <shankarapailoor@gmail.com>

Reorganize cli for adding more circuits later (#2)

Set field on felt type (#3)

* Set field on felt type

* Update llzk_backend/src/builder.rs

Co-authored-by: Ian Neal <ian.gl.neal@gmail.com>

---------

Co-authored-by: Ian Neal <ian.gl.neal@gmail.com>

Setup pre commit and format files

Update formatting commands

Also format picus/

Run formatter

Reorganize codegen function into separate blocks

Split codegen into more parts using a trait

Remove default specifications

Use veridise-public cache instead

Fix format

Add basic pipeline

Cleanup merge

Update flake

Refactor, need to merge llzk-rs PR to fix current crash

Pull in PCL pass

Override branch for now

Update defunct comments

Add package-level rustfmt

Fix picus formatting

Fixup output formats, setup pcl-mlir to pcl translation

Use exported PCL translation function

adding basic picus translation

adding range check

adding add_sub_lui

adding support for load_store_subword_only and jump_branch_slt

Update llzk-rs

Initial lookup support

Update LLZK

Add package-level rustfmt

Fix picus formatting

Run clippy

Fix lookups to support disjoint case, add missing input variables

Fixup clippy

Basic witness generation runner (#8)

* Basic witness generation runner

* Add constraint system checking and sample collection loop

Add more derivations for struct comparison in core packages

First pass at witness generation

Refactor constrain-specific traits and structs

- Add missing witness.rs file
- translate lookup tables into witness computations

Extend lookup table support

Refactor constraint code, add tests

Simplify constraint gen with new builder function

Make adding equality predicate ops more generic, add docs

Refactor ModuleBuilder -> ModuleEnv, add some shared test utilities

Update tests

Clarify bytecode placeholder in lib

Add in the substitutions

- Also add an argument for different output layouts in main

Cleanup comments in src/lib.rs

Clean up register aliases

Clean up builder.rs

Consistent naming

Clean up codegen comments

Fix line

Cleanup codegen functions

Clarify comments, misleading function names

Move more generic builder methods into to OpsBuilder

Optimize comments, add explanations, refactor a few functions

A bit more function cleanup, remove string-based switch

Cache some more values, tighten function implementations

Clean up remaining builder references

Fixup missing table case

Fixup constraint translation negation error

Update Cargo.toml, add gitignore for the backend

Add remaining lookup translations for remaining unrolled circuits

Model RAM writes as inputs instead of pass-through outputs

Have RAM writes as outputs for all circuits except where not applicable

Add semantic debug locations

Reduce call verbosity

Checkpoint before merge

additional picus extraction annotations

Fixup merge

Add translations for stand-alone circuits and delegations

Fix test failures

Update llzk dependency

Add decoder circuit, AGENTS file

Add bytecode emission, final circuit output

Fix register writes. Add options to CLI for debugging

Fixup warnings

Fuzzing crate (#10)

* Basic rv32im fuzzer

* Change target VM for fuzzing and include example guests written in C

* Write test

* Compliance tests

* Update list of passing tests after run with prover

* Preparations for prover fuzzing

* Beginnings of trace factory abstraction

* Fuzzer scaffold

* Closer to an e2e setup

* More e2e stuff

* Fix hash function

* e2e run with no-op mutator

* Make worker count configurable

* A bit nicer UI

* Add more circuits to the fuzzer

* Add load/store circuits

* Preparations for mutators

* Mutators

* Update doc

* Triage command

* Add logging

* Fix typo

* Polish mutators

* Pending changes

* Adjust setup

* Cleanup

* Add readme instructions

* Remove soft link

* More tweaks

* Rollback changes in client code

* Apply suggestions from code review

Co-authored-by: foldr <daniel@veridise.com>

* Remove script
0xddom pushed a commit that referenced this pull request May 11, 2026
* Add some llzk backend scaffolding

* Helper types for lowering

* adding basic picus translation

* adding range check

* adding add_sub_lui

* Add more builder tools, generate empty struct

* Initial end-to-end translation for `add_sub_lui_auipc_mop`

* Remove unused code

* Fixup rebase issues

* Name internal and output members according to source Variable IDs

* Fix negative term generation bug

---------

Co-authored-by: Daniel Dominguez <daniel@veridise.com>
Co-authored-by: shankarapailoor <shankarapailoor@gmail.com>

Reorganize cli for adding more circuits later (#2)

Set field on felt type (#3)

* Set field on felt type

* Update llzk_backend/src/builder.rs

Co-authored-by: Ian Neal <ian.gl.neal@gmail.com>

---------

Co-authored-by: Ian Neal <ian.gl.neal@gmail.com>

Setup pre commit and format files

Update formatting commands

Also format picus/

Run formatter

Reorganize codegen function into separate blocks

Split codegen into more parts using a trait

Remove default specifications

Use veridise-public cache instead

Fix format

Add basic pipeline

Cleanup merge

Update flake

Refactor, need to merge llzk-rs PR to fix current crash

Pull in PCL pass

Override branch for now

Update defunct comments

Add package-level rustfmt

Fix picus formatting

Fixup output formats, setup pcl-mlir to pcl translation

Use exported PCL translation function

adding basic picus translation

adding range check

adding add_sub_lui

adding support for load_store_subword_only and jump_branch_slt

Update llzk-rs

Initial lookup support

Update LLZK

Add package-level rustfmt

Fix picus formatting

Run clippy

Fix lookups to support disjoint case, add missing input variables

Fixup clippy

Basic witness generation runner (#8)

* Basic witness generation runner

* Add constraint system checking and sample collection loop

Add more derivations for struct comparison in core packages

First pass at witness generation

Refactor constrain-specific traits and structs

- Add missing witness.rs file
- translate lookup tables into witness computations

Extend lookup table support

Refactor constraint code, add tests

Simplify constraint gen with new builder function

Make adding equality predicate ops more generic, add docs

Refactor ModuleBuilder -> ModuleEnv, add some shared test utilities

Update tests

Clarify bytecode placeholder in lib

Add in the substitutions

- Also add an argument for different output layouts in main

Cleanup comments in src/lib.rs

Clean up register aliases

Clean up builder.rs

Consistent naming

Clean up codegen comments

Fix line

Cleanup codegen functions

Clarify comments, misleading function names

Move more generic builder methods into to OpsBuilder

Optimize comments, add explanations, refactor a few functions

A bit more function cleanup, remove string-based switch

Cache some more values, tighten function implementations

Clean up remaining builder references

Fixup missing table case

Fixup constraint translation negation error

Update Cargo.toml, add gitignore for the backend

Add remaining lookup translations for remaining unrolled circuits

Model RAM writes as inputs instead of pass-through outputs

Have RAM writes as outputs for all circuits except where not applicable

Add semantic debug locations

Reduce call verbosity

Checkpoint before merge

additional picus extraction annotations

Fixup merge

Add translations for stand-alone circuits and delegations

Fix test failures

Update llzk dependency

Add decoder circuit, AGENTS file

Add bytecode emission, final circuit output

Fix register writes. Add options to CLI for debugging

Fixup warnings

Fuzzing crate (#10)

* Basic rv32im fuzzer

* Change target VM for fuzzing and include example guests written in C

* Write test

* Compliance tests

* Update list of passing tests after run with prover

* Preparations for prover fuzzing

* Beginnings of trace factory abstraction

* Fuzzer scaffold

* Closer to an e2e setup

* More e2e stuff

* Fix hash function

* e2e run with no-op mutator

* Make worker count configurable

* A bit nicer UI

* Add more circuits to the fuzzer

* Add load/store circuits

* Preparations for mutators

* Mutators

* Update doc

* Triage command

* Add logging

* Fix typo

* Polish mutators

* Pending changes

* Adjust setup

* Cleanup

* Add readme instructions

* Remove soft link

* More tweaks

* Rollback changes in client code

* Apply suggestions from code review

Co-authored-by: foldr <daniel@veridise.com>

* Remove script
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants