Stateful Embedded Fuzzing with Peripheral-Accurate SystemC Virtual Prototypes

1. Problem Statement

The increasing complexity of embedded software has rendered manual testing impractical, necessitating automated techniques like fuzzing. While coverage-guided fuzzers (e.g., AFL++) are highly effective for conventional software, their application to embedded systems faces significant challenges:

• Peripheral Realism: Embedded software relies heavily on interactions with hardware peripherals (interrupts, FIFOs, registers).
• Limitations of Existing Approaches:
  • Stateless/User-Mode Simulators: Tools like Fuzzware and P2IM use user-mode simulators that forward system calls to the host OS. They lack peripheral models, treating Memory-Mapped I/O (MMIO) as simple inputs. This leads to unrealistic execution traces (e.g., consecutive register reads returning random, unrelated values) and a high rate of false positives (crashes caused by simulation artifacts rather than actual bugs).
  • Full-System Simulators: Existing full-system approaches often require manual instrumentation of the firmware or modification of peripheral models to inject fuzz data. This limits scalability, especially for closed-source or complex proprietary software.

2. Methodology

The authors propose a novel framework that integrates AFL++ with a Stateful SystemC-TLM (Transaction-Level Modeling) Virtual Prototype (VP). The core innovation is a non-intrusive injection mechanism that allows peripherals to trigger natural side effects without modifying the source code.

Key Components:

• Virtual Prototype (VP): The framework utilizes SIM-A, a proprietary ARM-based SystemC-TLM functional simulator. It uses the open-source VCML library for peripheral models, ensuring realistic behavior (interrupts, FIFO updates, register states) without cycle-accurate overhead.
• Fuzzing Workflow:
  1. Handshake: AFL++ forks the VP process. They communicate via shared memory and pipes.
  2. Configuration: The VP is configured with exit/error symbols.
  3. Execution: The PUT (Program Under Test) runs on the VP.
  4. Injection: Injector modules periodically read fuzz data from shared memory and inject it into virtual peripherals.
  5. Feedback: The VP reports code coverage and crash status back to AFL++.

The Injection Mechanism (The Core Contribution):

Instead of modifying firmware, the framework employs Injectors connected to peripherals via TLM sockets.

• Trigger Detection: A lightweight Probe component sits between the CPU and the bus, monitoring register accesses. It detects specific "trigger events" defined in a JSON configuration file (e.g., enabling an interrupt, writing to an ENABLE register).
• Dynamic Activation: Once a trigger is detected, the Injector spawns a SystemC thread (SC_THREAD) to begin sending fuzz data.
• Protocol Support: The design supports different communication styles:
  • Peer-to-Peer (e.g., UART, CAN): Injectors send data periodically.
  • Initiator-Target (e.g., I2C): Injectors respond to read requests from the firmware.
• Non-Intrusive: No changes to the firmware or peripheral models are required. The framework works with unmodified, closed-source binaries.

3. Key Contributions

1. Stateful Fuzzing Framework: A novel integration of AFL++ with full-system SystemC-TLM simulation that preserves peripheral state causality (e.g., ensuring FIFOs fill correctly and interrupts fire only when conditions are met).
2. Generic, Non-Intrusive Injection: A mechanism that intercepts MMIO accesses to inject data into peripherals without requiring firmware instrumentation or source code modification.
3. Realistic Side Effects: By using accurate peripheral models, the framework allows peripherals to generate natural side effects (interrupts, FIFO updates) that drive the software into realistic execution paths.
4. Elimination of False Positives: The approach significantly reduces false positives caused by unrealistic peripheral behavior, a common issue in stateless fuzzing.

4. Experimental Results

The framework was evaluated on four embedded workloads: two bare-metal firmwares (Drone, Robot) and two Zephyr OS applications (Passthrough, Babbling), utilizing peripherals like I2C, UART, CAN, and Timers.

• Bug Detection (RQ2):
  • Successfully detected injected bugs: Out-of-bounds reads, invalid memory accesses, and divide-by-zero faults.
  • Discovered unknown bugs in the unmodified firmware, including a hang caused by a missing compile-time macro and a CAN driver defect where frames with payloads >8 bytes were incorrectly dropped.
• Comparison with State-of-the-Art (RQ3):
  • False Positives: The proposed framework achieved zero false positives. In contrast, Fuzzware and P2IM reported significantly more crashes (e.g., P2IM reported 4 hangs in the Robot experiment due to missing UART TXE flags; Fuzzware reported 876 crashes in the CAN experiment).
  • Code Coverage: The framework achieved coverage comparable to Fuzzware for most targets. In the UART Passthrough target (Target C), it achieved 60% higher coverage because Fuzzware lacked a UART model to simulate data transfers between instances.
  • Performance: The full-system simulation is approximately 2x slower than user-mode simulators (Fuzzware/P2IM). However, the trade-off is justified by the elimination of false positives and the ability to test closed-source software without instrumentation.

5. Significance

This work bridges the gap between fuzz testing and full-system simulation, offering a critical advancement for pre-silicon validation of embedded systems.

• Reliability: By eliminating false positives, engineers can trust crash reports as genuine software defects rather than simulation artifacts.
• Applicability: The non-intrusive nature allows for the testing of proprietary, closed-source firmware and complex OS stacks (like Zephyr) which were previously difficult to fuzz effectively.
• Realism: It enables the discovery of bugs that only manifest under specific hardware conditions (e.g., interrupt timing, FIFO overflows), which stateless approaches miss.

The paper concludes that while the execution speed is lower than stateless approaches, the increased diagnostic accuracy and realism make this framework a superior choice for ensuring the safety and reliability of complex embedded software before hardware fabrication.