MorFuzz: Fuzzing Processor via Runtime Instruction Morphing enhanced Synchronizable Co-simulation

This deposit maintains the inputs generated by DifuzzRTL and MorFuzz binaries. Following is the paper abstract: Modern processors are too complex to be bug free. Recently, a few hardware fuzzing techniques have shown promising results in verifying processor designs. However, due to the complexity of processors, they suffer from complex input grammar, deceptive mutation guidance, and model implementation differences. Therefore, how to effectively and efficiently verify processors is still an open problem. This paper proposes MorFuzz, a novel processor fuzzer that can efficiently discover software triggerable hardware bugs. The core idea behind MorFuzz is to use runtime information to generate instruction streams with valid formats and meaningful semantics. MorFuzz designs a new input structure to provide multi-level runtime mutation primitives and proposes the instruction morphing technique to mutate instruction dynamically. Besides, we also extend the co-simulation framework to various microarchitectures and develop the state synchronization technique to eliminate implementation differences. We evaluate MorFuzz on three popular open-source RISC-V processors: CVA6, Rocket, BOOM, and discover 17 new bugs (with 13 CVEs assigned). Our evaluation shows MorFuzz achieves 4.4× and 1.6× more state coverage than the state-of-the-art fuzzer, DifuzzRTL, and the famous constrained instruction generator, riscv-dv.本数据集存储了DifuzzRTL与MorFuzz二进制程序生成的测试输入。以下为该研究的论文摘要：现代处理器结构日趋复杂，已难以做到完全无漏洞。近年来，若干硬件模糊测试技术在处理器设计验证领域取得了颇具潜力的成果。然而，受处理器复杂性的制约，这类技术仍面临输入语法复杂、变异引导存在迷惑性以及模型实现差异等多重挑战。因此，如何高效且精准地验证处理器设计仍是一项尚未解决的开放性问题。本文提出了一款新型处理器模糊测试工具MorFuzz，可高效发现可由软件触发的硬件漏洞。MorFuzz的核心思路是利用运行时信息生成格式合规且语义合理的指令流。该工具设计了一种新型输入结构，以提供多级运行时变异原语，并提出了指令形态转换技术以实现指令的动态变异。此外，本文还将协同仿真框架拓展至多种微架构，并研发了状态同步技术以消除实现差异。本文在三款主流开源RISC-V处理器CVA6、Rocket、BOOM上对MorFuzz进行了评估，共发现17处全新漏洞，其中13处已被分配通用漏洞与披露（Common Vulnerabilities and Exposures，CVE）编号。评估结果显示，相较于当前最优的模糊测试工具DifuzzRTL以及知名的约束式指令生成器riscv-dv，MorFuzz的状态覆盖率分别提升了4.4倍和1.6倍。