iScanU: A Portable Scanner for Undocumented Instructions on RISC Processors

IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pp. 306–317

Abstract

Undocumented and faulty CPU instructions can cause undefined behavior and system instability, impairing software efforts such as OS crash recovery and resilience, and system security. Although often not considered, the identification of such undocumented instructions is critical. We present a portable RISC instruction scanner that is able to search for undocumented instructions on a wide range of RISC architectures, empowering users to verify the reliable and secure operation of their systems. We propose two methods to look for undocumented instructions. Both attempt to execute a single instruction word in a controlled manner, regaining control afterwards. Subsequently, we determine if the instruction word is considered valid by the processor, comparing this result to the processor's ISA specification. Our prototype scanner can scan multiple ARMv8 and RISC-V systems. Various inconsistencies were discovered in the QEMU emulator and disassemblers used as ground truth. Furthermore, we found an undocumented instruction on a RISC-V chip.

Authors 4

1. Rens Dofferhoff Aachen

   Leiden University

   Affiliation as printed

   LIACS, Leiden University

2. Michael G. Goebel Aachen

   Leiden University

   Affiliation as printed

   Leiden University

3. Kristian F. D. Rietveld Aachen

   Leiden University

   Affiliation as printed

   Leiden University

4. Erik van der Kouwe

   Vrije Universiteit Amsterdam

   Affiliation as printed

   Vrije Universiteit Amsterdam