A coverage statistics method based on simulator instruction instrumentation

Abstract

The present invention provides a coverage statistics method based on simulator instruction stubbing, comprising the following steps: step S10, instruction stubbing: selecting a suitable stubbing position in the execution path of the simulator to perform instruction stubbing; step S20, obtaining line information: combining a BFD library and a Capstone library to obtain line information of embedded software running on the simulator; step S30, processing pile carrying information: when the simulator is executed, the pile carrying information of the stubbing position is cached by an execution thread, and a new pile processing thread is opened to be responsible for parsing the cached pile carrying information; step S40, coverage statistics are performed according to the line information and the parsed pile carrying information. The present invention implements instruction stubbing on the basis of the simulator, and obtains line information in combination with a BFD library and a Capstone library, thereby completing coverage statistics, thereby tracking the execution timing of the software without changing the target program.

Description

Technical Field

[0001] The invention relates to a coverage rate statistics method based on simulator instruction plugging. Background Art

[0002] The simulator uses software simulation technology to simulate the physical hardware target system. The embedded software that originally runs on the real target machine can be run directly on the simulator without modification, and its dynamic characteristics are consistent with those on the real target machine. Using the simulator, embedded software development, debugging, testing and verification can be carried out without the target hardware.

[0003] The traditional coverage statistics method in embedded software is to insert stubs into the source code of the target program, which requires the target code to be modified and recompiled, and also causes the expansion of the code volume.

[0004] BFD (binary format descriptor) implements a standard interface for target file operations. Its main functions include segment operations, symbol table processing, etc. It supports file formats such as a.out, coff, and elf. Capstone is a disassembly framework that provides binary disassembly functions for multiple architectures.

[0005] Therefore, a simulator instruction instrumentation method can be studied based on the simulator and combined with the above two tools. The execution timing of the software can be tracked without changing the target program. Summary of the invention

[0006] The present invention aims to provide a coverage statistics method based on simulator instruction plugging to solve the problem that the target code needs to be modified and recompiled in the traditional method.

[0007] The present invention provides a coverage statistics method based on simulator instruction instrumentation, comprising the following steps:

[0008] Step S10, instruction insertion: selecting a suitable insertion position in the execution path of the simulator to perform instruction insertion;

[0009] Step S20, obtaining row information: combining the BFD library and the Capstone library to obtain row information of the embedded software running on the simulator;

[0010] Step S30, processing the pile carrying information: when the simulator is executed, the pile carrying information of the pile insertion position is cached by the execution thread, and a new pile processing thread is opened to parse the cached pile carrying information;

[0011] Step S40: Perform coverage statistics according to the row information and the parsed pile carrying information.

[0012] Furthermore, the stub positions in step S10 include: head stub, tail stub, branch instruction, exception trigger and exception return.

[0013] Furthermore, the pile carrying information at the pile insertion position in step S10 is as follows:

[0014] (1) The information carried by the head stub is the address of the first instruction;

[0015] (2) The information carried by the tail stub is the address of the last instruction;

[0016] (3) The stub of the branch instruction carries information including a jump start address and a jump target address;

[0017] (4) The interrupt exception pile carries information including an exception trigger address and an exception target address;

[0018] (5) The information carried by the abnormal return stub includes the abnormal end address and the return target address.

[0019] Furthermore, step S20 includes the following sub-steps:

[0020] Step S21, obtaining the first address and the last address of all functions in the embedded software running on the simulator;

[0021] Step S22, according to the first address and the last address of the function, use the BFD library to traverse all addresses in each function and obtain the line information corresponding to all addresses; at this time, the line information contains the valid line number, function name and file name; then save the mapping relationship between all addresses and their corresponding line information into a hash table; and when each function is traversed, the total number of instructions, valid lines, functions and files in the embedded software is also counted;

[0022] Step S23, using the capstone library to disassemble the source code of the embedded software, marking the branch instruction during disassembly, and storing the instruction address and the total number of branches of the branch instruction in the row information;

[0023] Step S24, traverse the row information stored in the hash table, scan each valid row in the row information, and when a conditional statement is scanned, save the scanned conditional statement.

[0024] Furthermore, when the mapping relationship between all addresses and their corresponding row information is saved in the hash table in step S22, the row information is saved in the structure of file, function in file, and valid row in function according to the valid row number, function name and file name, so as to be consistent with the source code structure of the embedded software.

[0025] Furthermore, in step S30, the execution thread and the stub processing thread need to be synchronized, and the synchronization process includes:

[0026] (1) installing an access lock to prevent resource access conflicts between the execution thread caching new pile carrying information and the pile processing thread reading the pile carrying information cached in the execution thread;

[0027] (2) The pile processing thread waits for the pile to carry information in the cache and then performs parsing processing;

[0028] (3) Cache new pile-carrying information. If the execution thread's cache is full, wait for the pile processing thread to read the pile-carrying information, parse it, and then release the cache.

[0029] Furthermore, the method for performing coverage statistics in step S40 includes:

[0030] (1) For instructions, valid lines, functions and files: based on the information carried by two consecutive piles, mark the instructions that have been executed between the two piles, use the address of the instruction as the key to obtain the line information from the hash table, and then accumulate the execution times of the valid lines, functions and files in the line information respectively; divide the accumulated execution times of the valid lines, functions and files by the total number of the corresponding valid lines, functions and files respectively to obtain the effective line coverage, function coverage and file coverage respectively; then divide the number of executed instructions by the total number of instructions to obtain the instruction coverage;

[0031] (2) For branch instructions: Based on the number of executed branches and the total number of branches, the branch coverage is calculated by dividing the number of executed branches by the total number of branches.

[0032] (3) For conditional statements: Analyze the conditional statements to obtain the logical relationships in the conditional statements; then use the enumeration method to replace each condition in the logical relationship with a true or false value to obtain all logical states; then combine the logical states with the logic short-circuit rule to obtain the minimum truth table; finally, analyze the conditional statement branch execution process to obtain the items in the minimum truth table that have been executed. According to the MCDC rule, select the minimum test case set from the minimum truth table, and divide the number of executed items in the minimum test case set by the total number to obtain the MCDC coverage.

[0033] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0034] 1. The present invention implements instruction instrumentation based on the simulator, and combines the BFD library and the Capstone library to obtain line information, thereby completing coverage statistics, thereby tracking the execution timing of the software without changing the target program.

[0035] 2. The present invention reduces the impact on the execution efficiency of the simulator to a minimum by creating a new processing thread. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 The present invention is a flowchart of a coverage statistics method based on simulator instruction instrumentation according to an embodiment of the present invention.

[0038] Figure 2 The figure is a schematic diagram of the corresponding storage relationship between addresses and row information in a hash table in an embodiment of the present invention.

[0039] Figure 3 Schematic diagram of the storage structure of valid rows, functions and files according to an embodiment of the present invention.

[0040] Figure 4 This is a diagram showing the effect of an instruction coverage report according to an embodiment of the present invention.

[0041] Figure 5 It is a statistical diagram of instruction, file, function and effective line coverage according to an embodiment of the present invention.

[0042] Figure 6 This is a diagram showing the effect of a source code coverage report according to an embodiment of the present invention.

[0043] Figure 7 This is a flowchart of MCDC coverage statistics according to an embodiment of the present invention.

[0044] Figure 8 1 is a diagram showing the items in the minimum truth table of an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0046] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] Example

[0048] like Figure 1 As shown, this embodiment proposes a coverage statistics method based on simulator instruction instrumentation, comprising the following steps:

[0049] Step S10, instruction insertion: selecting a suitable insertion position in the execution path of the simulator to perform instruction insertion;

[0050] The insertion positions need to ensure that they do not overlap and can fully cover the execution path of the simulator. Therefore, as shown in Table 1, the insertion positions in this embodiment include:

[0051] (1) Header pile: The header pile is inserted when the first instruction is translated, marking the start of the simulator execution. The information carried by the header pile is the address of the first instruction.

[0052] (2) tail stub; the tail stub is inserted when the simulator stops executing, marking the end of the simulator execution, and the stub carries the address of the last instruction;

[0053] (3) a branch instruction; the branch instruction is inserted after the branch instruction during instruction translation, and the stub of the branch instruction carries information including a jump start address and a jump target address, thereby recording the jump information;

[0054] (4) Exception triggering: The exception triggering is to complete the stub insertion when the simulator generates an exception during execution, and the stub of the interrupt exception carries information including the exception triggering address and the exception target address;

[0055] (5) Exception return; the exception return is completed when the simulator translates the exception return instruction, and the stub of the exception return carries information including the exception end address and the return target address;

[0056] Table 1, Stub location:

[0057]

[0058] Step S20, obtaining row information: combining the BFD library and the Capstone library to obtain the row information of the embedded software running on the simulator; specifically including the following sub-steps:

[0059] Step S21, obtain the first address and the last address of all functions in the embedded software running on the simulator; since the function symbols are seamlessly continuous, all function symbols are sorted from small to large, and the last address of the previous function is the last instruction address of the first address (starting address) of the next function, thereby determining the first address and the last address of all functions.

[0060] Step S22, according to the first address and the last address of the function, use the BFD library to traverse all addresses in each function and obtain the line information corresponding to all addresses; at this time, the line information contains the valid line number, function name and file name, such as Figure 2 As shown; the mapping relationship between all addresses and their corresponding row information is saved in a hash table so that the row information can be quickly obtained when processing the information carried by the stub. In addition, after traversing each function, the total number of instructions, valid lines (lines with corresponding instructions), functions and files in the embedded software is also counted;

[0061] Furthermore, when the mapping relationship between all addresses and their corresponding line information is saved in the hash table, the line information is saved in the structure of file, function in file, and valid line in function according to the valid line number, function name and file name, such as Figure 3 As shown, it is consistent with the source code structure of the embedded software.

[0062] Step S23, use the capstone library to disassemble the source code of the embedded software, mark the branch instructions (conditional jump instructions) during disassembly, and store the instruction address of the branch instruction (jump start address and jump target address) and the total number of branches in the row information for branch coverage statistical analysis; wherein, the disassembled string obtained when disassembling the source code of the embedded software is stored in a hash table for use in generating an instruction coverage report.

[0063] Step S24, traverse the row information stored in the hash table, scan each valid row in the row information, and when a conditional statement is scanned, such as if (a&&b||c), save the scanned conditional statement for MCDC (Modified Condition Decision Coverage) coverage statistics analysis. In the process of scanning the row information, the row text of each valid row is saved for use in generating a source code coverage report.

[0064] Step S30, processing the pile carrying information: when the simulator is executed, the pile carrying information of the pile insertion position is cached by the execution thread, and a new pile processing thread is opened to parse the cached pile carrying information;

[0065] If the simulator is directly used to analyze the pile carrying information, it will block the execution thread for a long time, thereby greatly reducing the simulator execution efficiency. Therefore, in the present invention, the simulator execution thread (the thread imitating the CPU execution instruction) only carries out the pile carrying information cache, and a new pile processing thread is opened to be responsible for the analysis of the pile carrying information cache; because both the execution thread and the pile processing thread need to operate the cache, it is necessary to synchronize the execution thread and the pile processing thread, and the synchronization process includes:

[0066] (1) installing an access lock to prevent resource access conflicts between the execution thread caching new pile carrying information and the pile processing thread reading the pile carrying information cached in the execution thread;

[0067] (2) The pile processing thread waits for the pile to carry information in the cache and then performs parsing processing;

[0068] (3) Cache new pile-carrying information. If the execution thread's cache is full, wait for the pile processing thread to read the pile-carrying information, parse it, and then release the cache.

[0069] Step S40, performing coverage statistics according to the row information and the parsed pile carrying information. Specifically, the method for performing coverage statistics in step S40 includes:

[0070] (1) For instructions, valid lines, functions and files: based on the information carried by two consecutive piles, mark the instructions executed between the two piles, use the address of the instruction as the key to obtain the line information from the hash table, and then accumulate the execution times of the valid lines, functions and files in the line information respectively; divide the accumulated execution times of the valid lines, functions and files by the total number of the corresponding valid lines, functions and files respectively to obtain the effective line coverage, function coverage and file coverage respectively; then divide the number of executed instructions by the total number of instructions to obtain the instruction coverage, and generate an instruction coverage report, such as Figure 4 shown.

[0071] like Figure 5 As shown, the instructions executed between the two piles can be determined based on the information carried by two consecutive piles, such as the jump target address of pile 1 and the jump start address of pile 2, and the executed instruction block 2 can be obtained. All addresses of all instructions in instruction block 2 are used as keys, and the execution times of valid lines, functions and files in the corresponding line information can be obtained from the hash table and accumulated. At the same time, the line text of the valid lines of instruction block 2 can also be obtained to generate a source code coverage report, such as Figure 6 shown.

[0072] (2) For branch instructions: Based on the number of executed branches and the total number of branches, the branch coverage is calculated by dividing the number of executed branches by the total number of branches.

[0073] (3) For conditional statements: Figure 7 As shown, the logical relationship in the conditional statement is obtained by analyzing the conditional statement, such as A&&B||C; then the enumeration method is used to replace each condition in the logical relationship with a true or false value, such as T&&T||F (T is true, F is false), so as to obtain all logical states; then the logical state is combined with the logical short-circuit rule to obtain the minimum truth table, such as F&&F||F, because the first condition is false, the next two conditions can be ignored and become F&&X||X (X can be true or false, no effect); the conditional statement branch execution process is analyzed to obtain the items in the executed minimum truth table, such as Figure 8 As shown, according to the MCDC rule, the minimum test case set is selected from the minimum truth table, and the MCDC coverage is obtained by dividing the number of executed items in the minimum test case set by the total number.

[0074] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A coverage statistics method based on simulator instruction instrumentation, characterized in that: The steps include: Step S10, instruction insertion: selecting a suitable insertion position in the execution path of the simulator to perform instruction insertion; Step S20, obtaining row information: combining the BFD library and the Capstone library to obtain row information of the embedded software running on the simulator; Step S30, processing the pile carrying information: when the simulator is executed, the pile carrying information of the pile insertion position is cached by the execution thread, and a new pile processing thread is opened to parse the cached pile carrying information; Step S40: Perform coverage statistics according to the row information and the parsed pile carrying information.

2. The coverage statistics method based on simulator instruction instrumentation according to claim 1 is characterized in that: The stub positions in step S10 include: head stub, tail stub, branch instruction, exception trigger and exception return.

3. The coverage statistics method based on simulator instruction instrumentation according to claim 2 is characterized in that: The pile carrying information at the pile insertion position in step S10 is as follows: (1) The information carried by the head stub is the address of the first instruction; (2) The information carried by the tail stub is the address of the last instruction; (3) the stub of the branch instruction carries information including a jump start address and a jump target address; (4) The abnormal trigger pile carries information including the abnormal trigger address and the abnormal target address; (5) The information carried by the abnormal return stub includes the abnormal end address and the return target address.

4. The coverage statistics method based on simulator instruction instrumentation according to claim 3 is characterized in that: Step S20 includes the following sub-steps: Step S21, obtaining the first address and the last address of all functions in the embedded software running on the simulator; Step S22, according to the first address and the last address of the function, use the BFD library to traverse all addresses in each function and obtain the line information corresponding to all addresses; at this time, the line information contains the valid line number, function name and file name; then save the mapping relationship between all addresses and their corresponding line information into a hash table; and when each function is traversed, the total number of instructions, valid lines, functions and files in the embedded software is also counted; Step S23, using the capstone library to disassemble the source code of the embedded software, marking the branch instruction during disassembly, and storing the instruction address and the total number of branches of the branch instruction in the row information; Step S24, traverse the row information stored in the hash table, scan each valid row in the row information, and when a conditional statement is scanned, save the scanned conditional statement.

5. The coverage statistics method based on simulator instruction instrumentation according to claim 4 is characterized in that: When the mapping relationship between all addresses and their corresponding row information is saved in the hash table in step S22, the row information is saved in the structure of file, function in file, and valid row in function according to the valid row number, function name and file name, so as to be consistent with the source code structure of the embedded software.

6. The coverage statistics method based on simulator instruction instrumentation according to claim 1, characterized in that: In step S30, the execution thread and the stub processing thread need to be synchronized, and the synchronization process includes: (1) installing an access lock to prevent resource access conflicts between the execution thread caching new pile carrying information and the pile processing thread reading the pile carrying information cached in the execution thread; (2) The pile processing thread waits for the pile to carry information in the cache and then performs parsing processing; (3) Cache new pile-carrying information. If the execution thread's cache is full, wait for the pile processing thread to read the pile-carrying information, parse it, and then release the cache.

7. The coverage statistics method based on simulator instruction instrumentation according to claim 4 is characterized in that: The method for performing coverage statistics in step S40 includes: (1) For instructions, valid lines, functions and files: based on the information carried by two consecutive piles, mark the instructions that have been executed between the two piles, use the address of the instruction as the key to obtain the line information from the hash table, and then accumulate the execution times of the valid lines, functions and files in the line information respectively; divide the accumulated execution times of the valid lines, functions and files by the total number of the corresponding valid lines, functions and files respectively to obtain the effective line coverage, function coverage and file coverage respectively; then divide the number of executed instructions by the total number of instructions to obtain the instruction coverage; (2) For branch instructions: Based on the number of executed branches and the total number of branches, the branch coverage is calculated by dividing the number of executed branches by the total number of branches. (3) For conditional statements: Analyze the conditional statements to obtain the logical relationships in the conditional statements; then use the enumeration method to replace each condition in the logical relationship with a true or false value to obtain all logical states; then combine the logical states with the logic short-circuit rule to obtain the minimum truth table; finally, analyze the conditional statement branch execution process to obtain the items in the minimum truth table that have been executed. According to the MCDC rule, select the minimum test case set from the minimum truth table, and divide the number of executed items in the minimum test case set by the total number to obtain the MCDC coverage.

Images