[WIP] processorfuzz

fuzzers/cva6-vcs-processorfuzz/Cargo.toml

@@ -0,0 +1,43 @@
+[package]
+name = "cva6_vcs_processorfuzz"
+version = "0.0.1"
+edition = "2021"
+authors = ["Nassim Corteggiani <[email protected]>"]
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[features]
+debug = []
+
+[profile.release]
+panic = "abort"
+lto = true
+codegen-units = 1
+opt-level = 3
+debug = false
+
+[profile.dev]
+opt-level = 0
+strip = "debuginfo"
+lto = false
+debug = true
+panic = "unwind"
+
+[dependencies]
+libpresifuzz_riscv = { path = "../../libpresifuzz_riscv"}
+libpresifuzz_ec = { path = "../../libpresifuzz_ec", features=["debug"]}
+libpresifuzz_mutators = {path="../../libpresifuzz_mutators"}
+libpresifuzz_observers = { path = "../../libpresifuzz_observers"}
+libpresifuzz_feedbacks = { path = "../../libpresifuzz_feedbacks"}
+libpresifuzz_stages = { path = "../../libpresifuzz_stages"}
+libafl = { version = "0.11.2"}
+libafl_bolts = { version = "0.11.2"}
+yaml-rust = "0.4.5"
+rand = "0.8.5"
+serde_yaml = "0.9.27"
+tempdir = "0.3.7"
+serde = { version = "1.0", default-features = false, features = ["alloc"] } # serialization lib
+clap = { version = "3.2", features = ["default"] }
+fs_extra = "1.2.0"
+wait-timeout = "0.1.5"
+color-print = "0.3.6"

fuzzers/cva6-vcs-processorfuzz/README.md

@@ -0,0 +1,97 @@
+# Fuzzer Overview
+
+This documentation outlines the process of setting up and using an RTL fuzzer for CVA6 architecture using libAFL and PreSiFuzz. 
+This setup demonstrates feedback-guided fuzzing using hardware code coverage reported by commercial simulator.
+
+# Prerequisites
+
+The following tools need to be installed on your own.
+
+* Latest version of [Spike](https://github.com/riscv-software-src/riscv-isa-sim), the RISC-V ISA simulator, installed. 
+Follow the installation instructions from the Spike GitHub repository.
+
+* Synopsys VCS (Verilog Compiler Simulator) installed and properly initialized. VCS is a widely used Verilog simulator.
+ Ensure it is configured and ready for simulation tasks.
+
+* [RISC-V GNU Compiler Toolchain] (https://github.com/riscv-collab/riscv-gnu-toolchain)
+
+* [ProcessorFuzz riscv-isa-sim] (https://github.com/sammy17/riscv-isa-sim.git)
+
+With everything properly installed, please make sure to set the right environment variables in your `bashrc` or equivalent file. The fuzzer expects the following configuration in bash:
+
+Please, find below an example of configuratio
+```bash
+export RISCV=$HOME/riscv
+export VERDI_HOME=/usr/synopsys/verdi/U-2023.03-SP2
+export VCS_HOME=/usr/synopsys/vcs/U-2023.03-SP2
+export [email protected]
+export LD_LIBRARY_PATH=$VERDI_HOME/share/NPI/lib/linux64
+```
+
+## Building
+
+The build.rs script performs the following tasks:
+
+* Initially, it downloads the `cva6` mainstream, initializes submodules, and applies the `cva6.patch` patch.
+* Next, it downloads the source code for `libfesvr` and builds it.
+* Finally, it compiles the `./src/testcase.S` file and builds the simv self-contained simulator. Generated files are then copied into the `build` folder.
+
+To complete the steps above, simply run:
+```sh
+$ cargo build
+```
+## Troubleshooting
+
+It may happened that some environement variables are not properly define and the build script may fail.
+Please, check `./cva6/verif/simv/setup-env.sh` and make sure that settings are valid.
+
+## Running the fuzzer
+
+When starting, the fuzzer creates a work directory where it saves intermediates files such as mutants, and symbolic links to the `simv` and its dependencies in `./build`.
+Work directory are saved into `TMPDIR` with a unique directory per fuzzer instance. Naming follows `presifuzz_<id>`.
+Synchronization information are saved into the `sync` directory, it includes `testcase` and associated `coverage map`.
+
+```
+$ cp ../../target/debug/cva6_vcs_fuzzer .
+$ mkdir sync
+```
+
+To run a single fuzzer instance:
+```
+$ AFL_LAUNCHER_CLIENT=1 ./cva6_vcs_fuzzer
+```
+
+To run multiple fuzzer instances:
+```
+for i in {1..10}; do AFL_LAUNCHER_CLIENT=$i ./cva6_vcs_fuzzer & done
+```
+
+# Customizing
+
+The fuzzer is bootstraped using the seed files into the `seeds` folder. Feel free to customize the content of this file with any interesting seed.
+When starting the fuzzer loads the initial inputs (i.e., the seeds), and only keep interesting ones in the corpus (i.e., coverage novelty).
+Coverage novelty consider any changes for all supported code coverage metrics on vcs, i.e., branch, conditional, line, toggle, and FSM.
+
+Then, starts the fuzzer loop that iteratively calls the different stages. 
+StdMutationalStage is responsible for generating new mutant by applying mutation to the existing testcase in the corpus. 
+The mutations work at the ISA level by first deserializing the binary testcase into stream of instruction, then different mutations might be applied (e.g., adding instruction, removing instruction, changing opcode, ..). 
+The mutation can easily be customized by changing `../../libpresifuzz_mutators/src/riscv_isa.rs`. 
+
+The generated testcase is then inserted into a template ELF file by simplify injecting the code after the `payload` label. 
+This template contains epilogue and prologue code. 
+The current version is very simple. We first init registers to some known values, and we change the `mtvec` to points to our own trap handler.
+The trap handler is there to stop earlier the testcase execution if we trop too often. Otherwise, it always try to return to the instruction after the failing one.
+This version is a naive implementation, better performance could be achieved with some changes on the testharness (e.g., early simulation stop, irq support).
+
+
+# Ploting data
+
+The fuzzer saves statistics into the `sync`directory.
+It is possible to plot coverage over time using the `plot.py`:
+
+```python
+python3 ./plot.py -m branch -d ./sync
+```
+
+The `-m` option is there to provide the coverage metric that is either tgl, cond, branch, line, fsm.
+The `-d` points to the directory where stats are saved.

fuzzers/cva6-vcs-processorfuzz/build.rs

@@ -0,0 +1,160 @@
+// SPDX-FileCopyrightText: 2022 Intel Corporation
+//
+// SPDX-License-Identifier: Apache-2.0
+
+use std::path::{Path};
+use std::env;
+use std::path::PathBuf;
+use std::process::{Command, Stdio};
+use std::fs;
+
+fn main() {
+    println!("cargo:warning=MESSAGE");
+
+    // if Path::new("./build").is_dir() {
+        // assert!(fs::remove_dir_all("./build").is_ok());
+    // }
+    // assert!(fs::create_dir("./build").is_ok());
+
+    let rtl_dir = PathBuf::from("cva6");
+    if !rtl_dir.exists() {
+
+        println!("INFO: Cloning cva6 repository..");
+
+        assert!(Command::new("git")
+            .arg("clone")
+            .arg("https://github.com/openhwgroup/cva6.git")
+            .arg(rtl_dir.as_os_str())
+            .status()
+            .unwrap()
+            .success());
+
+        let popd = env::current_dir().unwrap();
+
+        let cva6_dir = PathBuf::from("./cva6".to_string());
+        let cva6_dir = cva6_dir.as_os_str().to_str().unwrap().to_string();
+        std::env::set_current_dir(&cva6_dir).expect("Unable to change into cva6 directory");
+
+        println!("INFO: cheking out good commit");
+
+        assert!(Command::new("git")
+            .arg("checkout")
+            .arg("b401ab3868d053a00779add51ea37cf3b8c98b21")
+            .status()
+            .unwrap()
+            .success());
+
+        println!("INFO: updating submodules");
+
+        assert!(Command::new("git")
+                .arg("submodule")
+                .arg("update")
+                .arg("--init")
+                .arg("--recursive")
+                .status()
+                .unwrap()
+                .success());
+
+        assert!(Command::new("git")
+            .arg("apply")
+            .arg("../cva6.patch")
+            .status()
+            .unwrap()
+            .success());
+
+        let popd = popd.as_os_str().to_str().unwrap().to_string();
+        std::env::set_current_dir(&popd).expect("Unable to change into cva6-vcs-fuzzer directory");
+    }
+
+
+    let binding = env::current_dir().unwrap();
+    let cur_dir = binding.to_str().unwrap();
+    let mut cur_dir = String::from(cur_dir);
+    cur_dir.push_str("/cva6");
+
+    env::set_var("CVA6_HOME_DIR", cur_dir.clone());
+
+    if !Path::new("./cva6/tools/spike/lib/libfesvr.so").exists() {
+        println!("INFO: building fesvr..");
+
+        assert!(Command::new("mkdir")
+            .arg("-p")
+            .arg("./cva6/tools/spike/lib/")
+            .status()
+            .unwrap()
+            .success());
+    }
+
+    if !Path::new("./cva6/tmp").is_dir() {
+        assert!(Command::new("mkdir")
+            .arg("./cva6/tmp")
+            .status()
+            .unwrap()
+            .success());
+
+        assert!(Command::new("bash")
+                    .arg("-c")
+                    .arg("cd ./cva6 \
+                    && RISCV=$CVA6_HOME_DIR/tools/spike source ./ci/install-fesvr.sh")
+                    .env("CVA6_HOME_DIR", cur_dir.clone())
+                    .status()
+                    .unwrap()
+                    .success());
+    }
+
+
+    if !Path::new("./build/simv").is_file() {
+        println!("INFO: building cva6..");
+
+        assert!(Command::new("bash")
+                    .arg("-c")
+                    .arg("echo $CVA6_HOME_DIR && cd ./cva6/verif/sim/ && source ./setup-env.sh && python3 ./cva6.py --target cv32a60x --iss=vcs-testharness --iss_yaml=cva6.yaml \
+                        --asm_tests $CVA6_HOME_DIR/../src/testcase.S \
+                        --linker=$CVA6_HOME_DIR/../src/testcase.ld \
+                        --gcc_opts='-static -mcmodel=medany -fvisibility=hidden -nostdlib -nostartfiles -g -lgcc'")
+                    .stdout(Stdio::inherit())
+                    .env("CVA6_HOME_DIR", cur_dir)
+                    .status()
+                    .unwrap()
+                    .success());
+    }
+
+    println!("cargo:rerun-if-changed=cva6_project");
+    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-changed=build");
+
+    println!("INFO: creating build dir..");
+
+    assert!(Command::new("bash")
+                .arg("-c")
+                .arg("cp -r ./cva6/work-vcs/* ./build")
+                .status()
+                .unwrap()
+                .success());
+
+    assert!(Command::new("bash")
+                .arg("-c")
+                .arg("cp ./cva6/verif/sim/out_*/directed_asm_tests/testcase.o ./build/iram.elf")
+                .status()
+                .unwrap()
+                .success());
+
+
+    let key = "VERDI_HOME";
+    let mut verdi_lib = match env::var(key) {
+        Ok(val) => val,
+        Err(_e) => "".to_string(),
+    };
+
+    if verdi_lib.is_empty() {
+        println!("The env variable 'VERDI_HOME' is not set");
+        return;
+    }
+
+    verdi_lib.push_str("/share/NPI/lib/linux64");
+
+    println!("cargo:rustc-link-search=native=./build");
+    println!("cargo:rustc-link-search=native={}", verdi_lib);
+
+}
+

fuzzers/cva6-vcs-processorfuzz/config.yml

@@ -0,0 +1,11 @@
+fuzzer:
+  max_testcase_size: 128
+simv:
+  vcs_args: "+permissive +tohost_addr=80001000 +elf_file=./testcase.elf +permissive-off ++./testcase.elf +debug_disable=1 +ntb_random_seed=1 -sv_lib ~/riscv/lib/libfesvr"
+  plus_args:
+  cov_enable: true
+  coverage_metrics: "line+fsm+cond+tgl+branch"
+  coverage_directory: "Coverage.vdb"
+  system_timeout_s: 180
+  vcs_timeout: "30us"
+  multi_seed: 0