How to reproduce PathFuzz?

[ha0lyu]

Describe the question
As mentioned in the paper PathFuzz Chapter 6:

PATHFUZZ has been open-sourced¹ and ......

¹Available at this repo.

However, as described in difftest readme:

Footprint inputs are supported by the run-time argument --as-footprints.

So, xfuzz does not support footprint directly, right?

What you expect us to do for you
How to reproduce PathFuzz?

Additional context
Add any other context about the problem here.

[poemonsense]

PathFuzz is a fuzzing paper built upon this xfuzz repo, including its fuzzer wrapper, coverage instrumentation, and analysis scripts.

However, this xfuzz repo is not only for PathFuzz. Instead, we expect this repo to be a good starting point for paper readers to get all open-source resources required for reproducing PathFuzz. The overall workflow may involve multiple open-source projects, including but not limited to xfuzz, DiffTest, riscv-dv, force-riscv, riscv-tests, riscv-arch-test, Spike, NutShell, rocket-chip, ... This is how open-source works.

Therefore, to reproduce PathFuzz, you only need to follow the README file and build the fuzzer. We have open-sourced everything and there are CI tests in both xfuzz (https://github.com/OpenXiangShan/xfuzz/blob/main/.github/workflows/release.yml) and DiffTest (https://github.com/OpenXiangShan/difftest/blob/master/.github/workflows/nightly.yml#L9) ensuring that they work for the latest version. The only thing we cannot open-source is the SPEC CPU2006. You need a commerical license to obtain its source code from the SPEC org. For all other resources mentioned in the PathFuzz paper, they are open-sourced, and you can freely use them as you want.

I believe to reproduce the PathFuzz workflow should take less than 1 hour.

Hope the above addresses your concerns.

To add more details here:

As we introduce in the README file, this xfuzz library requires a list of APIs from the simulation environment for fuzzing inputs and feedback. Based on these standard APIs, we have implemented the corresponding functions in the DiffTest simulation framework.

As you may read from Figure 2 in the PathFuzz paper, we do not change anything in the coverage-guided fuzzing part. Instead, we expect this part to be generic. That's why we are releasing this xfuzz repo as a wrapper of the LibAFL framework for fuzzing hardware designs. We explicitly acknowledge this in the second paragraph in Section 3 (Design). Specifically, regarding the footprint memory you mentioned, it does not need to be implemented in this xfuzz repo.

[ha0lyu]

Hi @poemonsense, thanks your detailed and quick response.
Yes, we have built xfuzz in rocket-chip successfully by following your great README instructions.
We found xfuzz can not convert Linear Memory into Footprint Memory when running ./build/fuzzer, so we have this question. Your explanation is detailed, I checked the workflows and didn't see any memory conversion.
Do we need to convert the memory before running fuzzer, and how?

Thank you again for your patient and detailed explanation.

[poemonsense]

Do we need to convert the memory before running fuzzer, and how?

Yes. fuzzer -- --help will show DiffTest arguments. You may use --dump-footprints to dump the footprint memories and --as-footprint to accept footprint inputs.