iScanU: A Portable Scanner for Undocumented Instructions on RISC Processors

Abstract

Undocumented and faulty CPU instructions can cause undefined behavior and system instability, impairing software efforts such as OS crash recovery and resilience, and system security. Although often not considered, the identification of such undocumented instructions is critical. We present a portable RISC instruction scanner that is able to search for undocumented instructions on a wide range of RISC architectures, empowering users to verify the reliable and secure operation of their systems. We propose two methods to look for undocumented instructions. Both attempt to execute a single instruction word in a controlled manner, regaining control afterwards. Subsequently, we determine if the instruction word is considered valid by the processor, comparing this result to the processor's ISA specification. Our prototype scanner can scan multiple ARMv8 and RISC-V systems. Various inconsistencies were discovered in the QEMU emulator and disassemblers used as ground truth. Furthermore, we found an undocumented instruction on a RISC-V chip.

An efficient mining method for DSP undocumented instruction

“…In 2016, Reid [11] converted the ARM-v8 instruction set into a machine-readable format for formal verification of ARM processors. In 2020, Dofferhoff et al [12] proposed an undocumented instruction search tool named iScan, which they used to discover undocumented instructions in multiple ARM-v8 and RISC-V processors. And, Strupe et al [13] proposed an undocumented instruction search tool specifically for ARM-v8 processors named Armshaker, and made it publicly available as open-source software to enable users to audit their own systems for undocumented instructions.…”

A Survey of the RISC-V Architecture Software Support

“…The proposal on Bloom Filters (BF), which guarantees no false alarms and a small configurable percentage of undetected alarms, resulting in a 99% detection rate of possible hardware trojans activation. Similarly, [95] investigates undocumented instructions on RISC-V and ARM ISAs and propose two methods to look for undocumented instructions. Both methods execute a single instruction in a controlled manner, allowing the processor to determine if the instruction word is valid by comparing the results to the processor ISA specification.…”

IMSC: Instruction set architecture monitor and secure cache for protecting processor systems from undocumented instructions

“…In response to the serious security concern over the fact that an undocumented instruction may actually exist in a commercially available off-the-shelf processor, a fuzzing test method targeting the x86 processors was proposed [2], and a later work used an improved algorithm with better performance and reduced overhead [10]. Dofferhoff et al [11] presented a reduced instruction set computer (RISC) instruction scanner that is used to search for undocumented instructions on RISC architectures implemented on emulators. Our previous work with a system-level consistency testing approach also dealt with undocumented instruction defects in RISC processor chips [12].…”

“…Dofferhoff et al. [11] presented a reduced instruction set computer (RISC) instruction scanner that is used to search for undocumented instructions on RISC architectures implemented on emulators. Our previous work with a system‐level consistency testing approach also dealt with undocumented instruction defects in RISC processor chips [12].…”