DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs

Security bugs in CPUs have critical security impacts to all the computation related hardware and software components as it is the core of the computation. In spite of the fact that architecture and security communities have explored a vast number of static or dynamic analysis techniques to automatically identify such bugs, the problem remains unsolved and challenging largely due to the complex nature of CPU RTL designs. This paper proposes DIFUZZRTL, an RTL fuzzer to automatically discover unknown bugs in CPU RTLs. DIFUZZRTL develops a register-coverage guided fuzzing technique, which efficiently yet correctly identifies a state transition in the finite state machine of RTL designs. DIFUZZRTL also develops several new techniques in consideration of unique RTL design characteristics, including cycle-sensitive register coverage guiding, asynchronous interrupt events handling, a unified CPU input format with Tilelink protocols, and drop-in-replacement designs to support various CPU RTLs. We implemented DIFUZZRTL, and performed the evaluation with three real-world open source CPU RTLs: OpenRISC Mor1kx Cappuccino, RISC-V Rocket Core, and RISC-V Boom Core. During the evaluation, DIFUZZRTL identified 16 new bugs from these CPU RTLs, all of which were confirmed by the respective development communities and vendors. Six of those are assigned with CVE numbers, and to the best of our knowledge, we reported the first and the only CVE of RISC-V cores, demonstrating its strong practical impacts to the security community. * Corresponding author limitations on the fuzzer: 1) it was not able to correctly capture the states due to cycle-insensitivity; and 2) it has scalability limitations due to complex multiplexer wiring. The second challenge is that DIFUZZRTL needs a systematic way to explore all possible input spaces of RTL designs. Conventional software fuzzing typically assumes the onedimensional input space (i.e., file input space to fuzz user programs, or system call input space to fuzz kernels). However, CPU RTLs accept multi-dimensional inputs in the form of raw bus packets, so called stimuli, which is sent from various controllers-memory controllers (as a response to memory read/write requests), interrupt controllers (raising an interrupt request), etc. Worse yet, these packets are delivered to CPU RTLs in every clock cycle, further complicating the input space that CPU RTLs take. DIFUZZRTL addresses above two challenges with following design features. First, DIFUZZRTL's coverage measurement is based on a control register, which is a register whose value can be used for any muxes' control signal. Then DIFUZZRTL measures the control register value every clock cycle, thereby making it clock-sensitive and correctly capture the explored states by RTL designs. Moreover, since a single control register is connected to multiple muxes' control signals, the number of control registers is far less than the number of wires connected to the mux's control signals, addressing the scalability limitation of mux-based coverage as well. We highlight that DIFUZZRTL was able to fuzz even a complex out-of-order machine which has about twenty thousands of lines of implementation complexity. Second, DIFUZZRTL provides systematic mechanisms to test a newly designed input format for CPU RTLs, SimInput. SimInput includes full-fledged information to run CPU RTLs, from memory address and value pairs to interrupt signals, and it is automatically translated into bus protocols that CPU RTLs are accepting. In order to execute CPU RTLs as specified by SimInput, DIFUZZRTL works as a pseudo SoC for the CPU, which includes a memory unit and an interrupt controller inside. We implemented DIFUZZRTL as a full-fledged fuzzing framework for CPU RTLs. DIFUZZRTL automatically instruments a given CPU RTL to measure the register coverage, then keeps running two simulators, ISA and RTL simulators, while providing an identical input to both simulators. After each run, DIFUZZRTL cross-checks the architectural states, and if it identifies the difference, DIFUZZRTL automatically reports such an input as a potential bug. In order to demonstrate its strong practical aspect, we implemented DIFUZZRTL to support three real-world CPU RTLs: OpenRISC Mor1kx Cappuccino, RISC-V Rocket Core, and RISC-V Boom Core, which are widely used for academic researches as well as industry production. We note these CPU RTLs include not only simple in-order pipelined cores but also complex out-oforder superscalar cores. During the evaluation, DIFUZZRTL identified total of 16 new bugs in those CPU RTLs, all of those are confirmed by the respective development communities or vendors. More importantly, six bugs of those are assigned with CVE numbers,