Overview

In MorFuzz, the fuzzing execution environment is the runtime context in which fuzzing payloads execute during processor fuzzing. MorFuzz extends the testing environment provided by the official RISC-V testing repository and uses it as the fuzzing execution environment.[C1]

Responsibilities

The fuzzing execution environment initializes the processor and configures the environment, including:

• the available instruction extensions,
• the address translation mode,
• the page table configuration, and
• the runtime privilege level.[C2]

During simulation, the fuzzing execution environment is placed in a non-morphable physical area and is responsible for handling exceptions and interrupts with the highest privilege level.[C3]

Exception handling and the fuzzing-payload boundary

When the device under test (DUT) triggers an exception while executing morphed instructions, the exception handler in the fuzzing execution environment attempts to handle the exception. Whether or not the exception is successfully handled, the handler redirects the DUT back to the fuzzing payload.[C4]

A unique system call is triggered when the DUT reaches the boundary of the fuzzing payload, notifying the fuzzer to collect the current coverage and fix the program counter. By evaluating the coverage, if the fuzzer is interested in the input, it controls the DUT to return to the fuzzing payload again; otherwise, the fuzzer terminates the simulation and generates a new stimulus template.[C5]

To avoid the DUT falling into dead loops, the fuzzer also monitors coverage. If the coverage does not increase for a period of time, the fuzzer raises an interrupt to stop the simulation.[C6] In this way the fuzzer can control the DUT to continuously execute diverse and meaningful instruction streams in a loop without additional initialization, significantly improving fuzzing performance.[C7]

System-environment fuzzing interfaces

In addition to managing the execution environment, the fuzzing execution environment also provides interfaces to fuzz the system environment. The MorFuzz implementation includes a series of page-table randomization functions that mutate page table entries and evict mapped pages.[C8]

Related entities

• MorFuzz uses the fuzzing execution environment as part of its processor-fuzzing workflow.[C1]
• The Stimulus Template is the testing program that runs inside the fuzzing execution environment and is regenerated by the fuzzer when coverage evaluation decides the current input is not interesting or when an exception cannot be recovered.[C5]