Test instruction generation method and device for processor fuzz testing, equipment and medium

Abstract

The invention relates to the technical field of computers, and provides a test instruction generation method and device for processor fuzzy testing, equipment and a medium, and the method comprises the steps: generating an initial test instruction file based on a test template and a first test instruction corresponding to a test environment of the test template; executing the initial test instruction file through an instruction simulator to obtain an execution result; and determining a target test instruction of the fuzzy test of the to-be-tested processor based on a comparison result of the execution result and a historical execution result of the historical instruction. According to the method, repeatability and singleness of randomly generated test instructions are avoided, the fuzzy test efficiency and accuracy of the processor are improved, and deep vulnerabilities in processor design are further detected.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a test instruction generation method, device, equipment and medium for processor fuzzy testing. Background Art

[0002] In processor fuzz testing, "seeds" refer to specific binary files or test instructions that are input to the processor under test. When the processor executes these seeds, its actual architectural state is captured and compared with the expected state obtained when the software simulator of the instruction executes the same seed, thereby determining whether the processor has design errors or vulnerabilities.

[0003] At present, seed generation in processor fuzz testing mainly relies on a purely random seed generation method. The seeds generated by this random generation method have a high test instruction repetition rate and uneven coverage, resulting in a single test instruction, further reducing the efficiency and accuracy of processor fuzz testing and failing to detect deep-seated vulnerabilities in processor design. Summary of the invention

[0004] The present invention provides a test instruction generation method, device, equipment and medium for processor fuzz testing, which are used to solve the defect in the prior art that the efficiency and accuracy of processor fuzz testing are reduced due to the single test instruction, and to achieve targeted determination of target test instructions based on the comparison results of execution results and historical execution results, avoid the repetitiveness and singleness of randomly generated test instructions, improve the efficiency and accuracy of processor fuzz testing, and further detect deep-level vulnerabilities in processor design.

[0005] The present invention provides a test instruction generation method for a processor fuzzy test, comprising: Generate an initial test instruction file based on a test template and a first test instruction corresponding to a test environment of the test template; the test template is used to initialize parameter information of the test environment required by the test instruction; Executing the initial test instruction file through an instruction simulator to obtain an execution result; the instruction simulator is used to simulate the operating environment of the processor to be tested to execute the initial test instruction file; Based on the comparison result between the execution result and the historical execution result of the historical instruction, the target test instruction of the fuzzy test of the processor under test is determined; the target test instruction is used to test whether the processor under test has design defects and / or security holes.

[0006] According to a test instruction generation method for processor fuzzy testing provided by the present invention, the target test instruction of the fuzzy test of the processor to be tested is determined based on the comparison result between the execution result and the historical execution result of the historical instruction, including: in the case that the architecture state of the execution result is the same as the architecture state of the historical execution result in the comparison result, the first test instruction is reconstructed to obtain the second test instruction; based on the second test instruction and the test template, the target test instruction is determined; and in the case that the architecture state of the execution result is not the same as the architecture state of the historical execution result in the comparison result, the first test instruction is determined as the target test instruction.

[0007] According to a test instruction generation method for processor fuzzy testing provided by the present invention, the first test instruction includes a first operation code and a first operand, the first operand includes a first destination register queue and a first source register queue; the first destination register queue and the first source register queue do not overlap; the reconstructing the first test instruction to obtain the second test instruction includes: determining the second destination register queue based on the first source register queue; determining the second source register queue based on the first destination register queue; reconstructing the operand in the first test instruction based on the second destination register queue and the second source register queue to obtain the second operand; determining the second test instruction based on the first operation code and the second operand.

[0008] According to a test instruction generation method for processor fuzzy testing provided by the present invention, determining the first test instruction includes: selecting an instruction to be tested corresponding to the test template from a preset instruction template library; determining a first operand corresponding to the instruction to be tested based on the format of the instruction to be tested and the first operation code of the instruction to be tested; and concatenating the first operation code and the first operand to form the first test instruction.

[0009] According to a test instruction generation method for processor fuzz testing provided by the present invention, after determining the target test instruction of the fuzz test of the processor to be tested based on the comparison result of the execution result and the historical execution results of the historical instructions, the method also includes: reselecting a new instruction to be tested from the preset instruction template library; determining the next target test instruction based on the new instruction to be tested; obtaining a target test instruction stream after all the instructions to be tested that match the test template in the preset instruction template library have determined the corresponding target test instructions; generating a target test instruction file based on the target test instruction stream and the test template; inputting the target test instruction file into the processor to be tested to obtain a processing result; when the architecture state of the execution result and the architecture state of the processing result are different, marking the processing result with a different architecture state as a candidate vulnerability; the candidate vulnerability is used by the user to analyze whether the processor to be tested has design defects and / or security vulnerabilities.

[0010] According to a test instruction generation method for processor fuzz testing provided by the present invention, after marking the processing results with different architecture states as candidate vulnerabilities, the method further includes: analyzing the frequency of executing each instruction in the target test instruction stream by the processor to be tested to obtain a first instruction set with an execution frequency lower than a reference frequency and a second instruction set with an execution frequency higher than the reference frequency; determining the mutation probability corresponding to each instruction to be mutated based on the deviation value of each instruction to be mutated from the reference frequency; the instruction to be mutated is any instruction in the first instruction set or the second instruction set; mutating the instruction to be mutated based on the set to which the instruction to be mutated belongs and the mutation probability corresponding to the instruction to be mutated to obtain a mutated test instruction; the mutated test instruction is used to adjust the test intensity of each test instruction.

[0011] According to a test instruction generation method for processor fuzz testing provided by the present invention, the instruction to be mutated is mutated based on the set to which the instruction to be mutated belongs and the mutation probability corresponding to the instruction to be mutated to obtain a mutation test instruction, including: generating a simulated mutation probability of the instruction to be mutated by a random number generator; when the instruction to be mutated belongs to an instruction in the first instruction set and the simulated mutation probability is less than the mutation probability corresponding to the instruction to be mutated, keeping the operation code of the instruction to be mutated unchanged and changing the operand to obtain the mutation test instruction; when the instruction to be mutated belongs to an instruction in the second instruction set and the simulated mutation probability is less than the mutation probability corresponding to the instruction to be mutated, changing the operation code of the instruction to be mutated and the operand of the instruction to be mutated to obtain the mutation test instruction.

[0012] The present invention also provides a test instruction generating device for processor fuzzy testing, comprising: A generating module, configured to generate an initial test instruction file based on a test template and a first test instruction corresponding to a test environment of the test template; the test template is used to initialize parameter information of the test environment required for the test instruction; An execution module, used for executing the initial test instruction file through an instruction simulator to obtain an execution result; the instruction simulator is used for simulating the operating environment of the processor to be tested to execute the initial test instruction file; A comparison module is used to determine the target test instruction of the fuzzy test of the processor under test based on the comparison result of the execution result and the historical execution result of the historical instruction; the target test instruction is used to test whether the processor under test has design defects and / or security vulnerabilities.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, a test instruction generation method for the processor fuzzy test as described in any one of the above is implemented.

[0014] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the test instruction generation method for the processor fuzzy test as described in any of the above is implemented.

[0015] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the test instruction generation method for the processor fuzzy test as described above is implemented.

[0016] The test instruction generation method, device, equipment and medium for processor fuzzy testing provided by the present invention generate an initial test instruction file through a test template and a first test instruction corresponding to the test environment of the test template; execute the initial test instruction file through an instruction simulator to obtain an execution result; and determine the target test instruction of the fuzzy test of the processor to be tested based on the comparison result between the execution result and the historical execution result of the historical instruction. In this way, the target test instruction is determined in a targeted manner through the comparison result between the execution result and the historical execution result, and the repetitiveness and singleness of the generated test instructions are avoided with the random generation method, the diversity of the test instructions is improved, and the efficiency and accuracy of the processor fuzzy testing are further improved, and the deep-level vulnerabilities in the processor design are further detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 It is a flow chart of the test instruction generation method for processor fuzzy testing provided by the present invention.

[0019] Figure 2 It is a test structure diagram of the processor fuzzy test provided by the present invention.

[0020] Figure 3 It is a structural schematic diagram of a test instruction generating device for processor fuzzy testing provided by the present invention.

[0021] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention.

[0022] Reference numerals: 200: test structure; 201: test template set; 202: instruction template set; 203: instruction construction module; 204: instruction simulator; 205: historical execution result storage module; 206: reconstruction module; 207: queue module to be tested; 208: test file generation module; 209: processor under test; 210: vulnerability storage module. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] In processor fuzz testing, the test instruction file usually contains a series of test instructions and test templates to simulate various possible execution scenarios. When the processor executes these seeds, its actual architectural state is captured and compared with the expected state obtained when the software simulator of the instruction executes the same seeds, thereby identifying potential design errors or vulnerabilities. Therefore, the quality and complexity of the test seeds directly determine the coverage breadth and depth of the fuzz test, which in turn affects the final effect of the test.

[0025] At present, seed generation and mutation in processor fuzz testing mainly rely on completely random and uncontrollable methods to construct the instructions to be tested. During the test preparation phase, the test engineer defines one or more instruction templates. The process of generating seeds first involves randomly selecting instructions from these templates, and then randomly specifying the required source registers, destination registers, immediate values ​​and other parameters to generate instruction sequences that meet standard specifications. These sequences will form the core part of the seed. In addition, the seed also includes some fixed elements, such as the initialization settings of the test environment and the pre-defined data stack. Finally, these two parts of information are combined and compiled into a complete binary file that can be executed by the processor or run by the software simulator. Similarly, the mutation of the seed also adopts a similar random method, almost completely randomly adjusting the various instructions and parameters in the existing seed, which makes the seed mutation not much different from the original random seed generation process, lacking pertinence and efficiency. In the process of generating seeds, the selection of various components of the instruction (such as opcodes, registers, immediate values) is completely random and not subject to preset constraints.

[0026] However, the seeds generated by the random generation method have a high repetition rate of test instructions and uneven coverage, resulting in a single test instruction, which further reduces the efficiency and accuracy of processor fuzz testing. In addition, randomly generated seeds may lead to uneven test coverage, causing some key vulnerabilities to remain undetected. At the same time, the test depth is insufficient, making it difficult to touch the complex aspects of the processor architecture. Although some strategies attempt to introduce more changes by mutating the seeds, current seed mutation methods usually use a nearly completely random approach, which means that the advantages of mutation are limited compared to pure random seed generation. Since the randomness of seed mutation is still high, it cannot significantly improve the diversity and coverage of test cases. Another disadvantage of this method is the low resource utilization. Repeated and similar test cases consume a lot of valuable resources, extend the test cycle and increase the test cost.

[0027] In view of the above problems, the present invention proposes a test instruction generation method for processor fuzz testing, which determines the target test instructions in a targeted manner by comparing the execution results with the historical execution results, and uses a random generation method to avoid the repetitiveness and uniqueness of the generated test instructions, thereby improving the diversity of the test instructions, further improving the efficiency and accuracy of the processor fuzz testing, and further detecting deep-seated vulnerabilities in the processor design.

[0028] Combine the following Figure 1-Figure 2 The test instruction generation method for processor fuzz testing of the present invention is described. The execution subject of the method can be an electronic device, or it can be a test instruction generation method for processor fuzz testing set in the electronic device. The test instruction generation device for processor fuzz testing can be implemented by software, hardware or a combination of both.

[0029] Figure 1 FIG. 1 is a flow chart of a method for generating test instructions for a processor fuzzy test provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 101: Generate an initial test instruction file based on a test template and a first test instruction corresponding to a test environment of the test template.

[0030] The test template is used to initialize the parameter information of the test environment required by the test instruction.

[0031] Here, the test template may be randomly selected or may be selected according to a preset rule, which is not limited in the present invention.

[0032] The first test instruction may be an instruction instance that complies with the specification, wherein the instruction instance needs to be a testable and legal instruction corresponding to the environment context of the test template.

[0033] The test template is responsible for initializing various parameters of the test environment, such as setting the privilege level of the test, whether to enable the virtual address translation mechanism, the processing address of interrupts and exceptions, etc. The first test instruction is placed in the position of the sub-test template to obtain an initial test instruction file.

[0034] Further, determining the first test instruction includes: Selecting an instruction to be tested corresponding to the test template from a preset instruction template library; determining a first operand corresponding to the instruction to be tested based on a format of the instruction to be tested and a first operation code of the instruction to be tested; and concatenating the first operation code and the first operand to form the first test instruction.

[0035] Here, the preset instruction template library can be defined according to the probability of the instruction types existing in different instruction extensions. For example, if extension A has three instructions and extension B has only one, the probability of selecting the instruction of extension A is 75%. The extension can be a floating point extension or an integer extension, and the types of integer extension include addition, multiplication, data movement and the like.

[0036] Here, the format of the instruction to be tested may include an operation code and the number of operands. For example, if the operation code is addition add and it includes three operands, then the format of the instruction to be tested is add A1 A2 A3.

[0037] Here, the opcode may include operations such as addition, subtraction, multiplication, and division, and the operand may include parameters such as a source register, a destination register, and an immediate value.

[0038] It should be noted that the operands in a test instruction may include multiple destination registers and multiple source registers.

[0039] Specifically, a test template is first randomly selected, and an instruction to be tested corresponding to the test template is selected from a predefined instruction template library. Then, the number of operands is determined according to the format of the instruction to be tested, and specific registers, immediate numbers and other parameters are selected for the operands according to the operation code. The operation code and operands are concatenated to obtain a first test instruction to ensure the legality and executability of the first test instruction.

[0040] Step 102: Execute the initial test instruction file through an instruction simulator to obtain an execution result.

[0041] The instruction simulator is used to simulate the operating environment of the processor to be tested to execute the initial test instruction file.

[0042] It should be noted that the instruction simulator can execute the compiled initial test instruction file to obtain the execution result corresponding to the initial test instruction file.

[0043] Step 103: Determine a target test instruction for the fuzzy test of the processor to be tested based on a comparison result between the execution result and the historical execution results of the historical instructions.

[0044] The target test instruction is used to test whether the processor to be tested has design defects and / or security holes.

[0045] Here, the comparison result is substantially used to characterize whether the initial test instruction has repeated instructions with the historical instructions, and the target test instruction is determined according to whether there is a repeated test instruction.

[0046] In an embodiment of the present invention, by comparing the execution results with the historical execution results, the target test instructions are determined in a targeted manner, and the repetitiveness and uniqueness of the generated test instructions are avoided with a random generation method, thereby improving the diversity of the test instructions, further improving the efficiency and accuracy of the processor fuzz testing, and further detecting deep-seated vulnerabilities in the processor design.

[0047] The following is an implementation method for determining a target test instruction based on whether there are repeated test instructions.

[0048] Exemplarily, the determining the target test instruction of the fuzzy test of the processor to be tested based on the comparison result between the execution result and the historical execution result of the historical instruction includes: if there is a case in the comparison result that the architecture state of the execution result is the same as the architecture state of the historical execution result, reconstructing the first test instruction to obtain a second test instruction; determining the target test instruction based on the second test instruction and the test template; If the comparison result does not show that the architecture state of the execution result is the same as the architecture state of the historical execution result, the first test instruction is determined as the target test instruction.

[0049] Here, the architecture state may include: write-back data, source register value, destination register value or immediate value. If the architecture state of the execution result and the architecture state of the historical execution result have one or more identical values, the first test instruction is repeated with the historical instruction, and the first test instruction needs to be reconstructed to obtain the second test instruction, and the execution result corresponding to the second test instruction is continuously compared with the historical instruction result until the comparison result does not have the same architecture state, the corresponding test instruction is retained, and the test instruction is stored in the queue to be tested that the subsequent processor actually wants to test; if the architecture state of the execution result and the architecture state of the historical execution result do not have the same value, it means that the first test instruction is not repeated with the historical instruction, and the first test instruction is stored in the queue to be tested that the subsequent processor actually wants to test.

[0050] Here, the number of times to reconstruct the instruction can be preset. If the number of reconstructions does not exceed the preset number, when the test instruction and the historical instruction are repeated, the test instruction will continue to be reconstructed; if the number of reconstructions exceeds the preset number, when the test instruction and the historical instruction are repeated, the test instruction will be saved and the next instruction to be tested will be selected to avoid entering an infinite loop and keep constructing a test instruction for a certain opcode.

[0051] In an embodiment of the present invention, an instruction software simulator is used to record the changes in the architecture state after each instruction is executed, and the changes are analyzed with the architecture state in the historical execution results. If the architecture state caused by a test instruction is the same as an architecture state in the historical execution instruction, it is regenerated until a unique test instruction is formed. In this way, it is possible to generate instruction combinations that cause under-explored state changes, increase the coverage and depth of the test, reduce the test cycle, reduce costs, and increase the probability of discovering potential design defects and security vulnerabilities.

[0052] Further, the first test instruction includes a first operation code and a first operand, the first operand includes a first destination register queue and a first source register queue; the first destination register queue and the first source register queue do not overlap; the reconstructing the first test instruction to obtain the second test instruction includes: determining the second destination register queue based on the first source register queue; determining the second source register queue based on the first destination register queue; reconstructing the operand in the first test instruction based on the second destination register queue and the second source register queue to obtain the second operand; determining the second test instruction based on the first operation code and the second operand.

[0053] Here, the first destination register queue and the first source register queue do not overlap, which means that the registers in the first destination register queue and the registers in the first source register queue will not be repeated.

[0054] It should be noted that the first operand also includes information such as an address and an immediate value.

[0055] It should be noted that reconstructing the test instruction is essentially changing the operand of the test instruction, and the changed operand is to reselect the register for the test instruction. For example, the destination register and the source register are maintained when constructing each test instruction. When constructing the next test instruction, the destination register and the source register need to be reselected for the next test instruction. Moreover, the destination register needs to be selected from the source register in the previous test instruction, and the source register needs to be selected from the destination register of the previous test instruction. In this way, the register of the previous test instruction is prevented from being updated.

[0056] Specifically, after selecting a new destination register queue and a new source register queue for the next test instruction, the new destination register queue and the new source register queue are used as operands of the next test instruction, and the operation code of the previous operation instruction and the operand of the next operation instruction are used to construct the next test instruction.

[0057] It should be noted that after constructing a certain number of test instructions, the destination register queue and the source register queue need to be cleared to avoid repeated selection of registers, which will cause the uniqueness of the test instructions and uneven coverage.

[0058] In an embodiment of the present invention, the usage frequency of historical instructions and the usage records of registers are taken into consideration when constructing test instructions, the register selection process is optimized, the number of registers that are immediately updated is reduced, and the impact of each instruction is improved, thereby significantly improving the quality and efficiency of the test and significantly improving the economic efficiency of resource utilization.

[0059] In an embodiment of the present invention, after determining the target test instruction, the target test instruction is used to perform a fuzzy test on the processor to be tested to determine whether the processor to be tested has design defects and / or security holes.

[0060] Exemplarily, after determining the target test instruction of the fuzzy test of the processor under test based on the comparison result of the execution result and the historical execution results of the historical instructions, the method also includes: reselecting a new instruction to be tested from the preset instruction template library; determining the next target test instruction based on the new instruction to be tested; obtaining a target test instruction stream after all the instructions to be tested that match the test template in the preset instruction template library have determined the corresponding target test instructions; generating a target test instruction file based on the target test instruction stream and the test template; inputting the target test instruction file into the processor under test to obtain a processing result; when the architecture state of the execution result and the architecture state of the processing result are different, marking the processing result with a different architecture state as a candidate vulnerability; the candidate vulnerability is used by the user to analyze whether the processor under test has design defects and / or security vulnerabilities.

[0061] It should be noted that there are multiple test instructions corresponding to the test template, and all test instructions corresponding to the test template can be selected from the preset instruction library, and then the target test instruction corresponding to each test instruction is determined.

[0062] Here, the target test instruction stream may be a queue to be tested that is actually to be tested by the processor to be tested.

[0063] The target test instruction file is obtained by compiling the file consisting of the target test instruction stream and the test template.

[0064] Here, the candidate vulnerability can be understood as a suspected BUG, ​​which means that the processor under test may or may not have an error. The user can determine whether the processor under test has an error after analyzing the candidate vulnerability, and can then perform error repair.

[0065] In an embodiment of the present invention, by comparing the execution results of the instruction simulator with previous historical execution data, the test queue that the processor under test actually wants to test is obtained, thereby improving the diversity and coverage of test instructions, thereby more effectively revealing potential design defects and security vulnerabilities.

[0066] It should be noted that the pre-constructed test instructions are different from the actually executed instructions. There are some instruction decoding optimizations, fused instructions and branch jumps, which lead to an imbalance between the pre-constructed instructions and the executed instructions. Therefore, after each round of testing, that is, after the candidate vulnerabilities are determined, in order to avoid the imbalance between the pre-constructed instructions and the executed instructions, the test instructions need to be mutated.

[0067] The following explains how to mutate the test instruction.

[0068] Exemplarily, the frequency of executing each instruction in the target test instruction stream by the processor to be tested is analyzed to obtain a first instruction set whose execution frequency is lower than a reference frequency and a second instruction set whose execution frequency is higher than the reference frequency; based on the deviation value of each instruction to be mutated from the reference frequency, the mutation probability corresponding to each instruction to be mutated is determined; the instruction to be mutated is any instruction in the first instruction set or the second instruction set; based on the set to which the instruction to be mutated belongs and the mutation probability corresponding to the instruction to be mutated, the instruction to be mutated is mutated to obtain a mutated test instruction; the mutated test instruction is used to adjust the test intensity of each test instruction.

[0069] The reference frequency is a preset frequency of executing instructions. Here, the reference frequency can be any appropriate value, such as 50 times, 45 times, etc.

[0070] Here, the method for determining the mutation probability may be any appropriate method, for example, determining the mutation probability according to a mapping relationship between the deviation value and the mutation probability, or calculating the mutation probability by substituting the deviation value into a formula.

[0071] Exemplarily, the deviation value is first substituted into the standardized formula to obtain the specific value (Z score) of each test instruction, and then the logistic function is used to map the Z score to a probability range of 0-1 to obtain the mutation probability corresponding to each instruction to be mutated.

[0072] It should be noted that the instructions in the first instruction set are instructions with an execution frequency lower than the baseline frequency (BelowBaseline Frequency Instructions, BLBF). For BLBF, the mutation probability is a probability that needs to be increased; the second instruction set is instructions with an execution frequency higher than the baseline frequency (AboveBaseline Frequency Instructions, ABBF). For ABBF, the mutation probability is a probability that needs to be reduced.

[0073] In the embodiment of the present invention, historical execution data is used to guide the mutation strategy, and by dynamically adjusting the parameter selection in the mutation, it is ensured that the test not only avoids duplication but also systematically explores new potential error spaces, thereby greatly improving the effect and efficiency of the test.

[0074] Exemplarily, the method of mutating the instruction to be mutated based on the set to which the instruction to be mutated belongs and the mutation probability corresponding to the instruction to be mutated to obtain a mutation test instruction includes: generating a simulated mutation probability of the instruction to be mutated by using a random number generator; when the instruction to be mutated belongs to an instruction in the first instruction set and the simulated mutation probability is less than the mutation probability corresponding to the instruction to be mutated, keeping the operation code of the instruction to be mutated unchanged and replacing the operand to obtain the mutation test instruction; when the instruction to be mutated belongs to an instruction in the second instruction set and the simulated mutation probability is less than the mutation probability corresponding to the instruction to be mutated, changing the operation code of the instruction to be mutated and the operand of the instruction to be mutated to obtain the mutation test instruction.

[0075] Here, the simulated mutation probability can be understood as the mutation probability threshold. The random number generator is built into the compiler and is used to generate the mutation probability threshold.

[0076] When the mutation probability corresponding to the instruction to be mutated is greater than the mutation probability threshold, it means that the instruction to be mutated needs to be mutated, and the instruction to be mutated is mutated; when the mutation threshold corresponding to the instruction to be mutated is less than the mutation probability threshold, it means that the instruction to be mutated does not need to be mutated.

[0077] Here, when the instruction to be mutated belongs to the instruction in the second instruction set, the opcode can be selected according to the probability in BLBF. It should be noted that BLBF is a set of opcodes that need to be added, and ABBF is a set of opcodes that need to be reduced. The opcode that needs to be reduced can be replaced with the opcode that needs to be added to select the opcode.

[0078] Here, the method of replacing the operand may be to change the value of a source register, a destination register, or an immediate value.

[0079] In an embodiment of the present invention, the test strategy is adjusted in a targeted manner, the test intensity of low-frequency instructions is increased, the repeated testing of high-frequency instructions is reduced, resource allocation is optimized, the test coverage and efficiency are improved, and repeated execution is reduced, ensuring that the test more comprehensively explores new and potential fault points.

[0080] The following is an application scenario of the test instruction generation method for processor fuzzy testing provided by the present invention.

[0081] Figure 2 : is a schematic diagram of the test structure of the processor fuzzy test provided by the present invention, such as Figure 2As shown, the test structure 200 includes a test template set instruction template set 201, an instruction template set 202, an instruction construction module 203, an instruction simulator 204, a historical execution result storage module 205, a reconstruction module 206, a queue module 207, a test file generation module 208, a processor under test 209, and a vulnerability (BUG) storage module 210. Specifically, a test template is randomly selected from the test template set 201, and then a first instruction to be tested corresponding to the test template is selected from the instruction template set 202, and a detailed format of the first instruction to be tested is obtained; the instruction construction module 203 generates a first instruction instance according to the detailed format of the first instruction to be tested, The first instruction instance is embedded in the test template to obtain an initial test instruction file, and the initial test instruction file is executed by the instruction simulator 204 to obtain an execution result, and the execution result is compared with the historical execution result in the historical execution result storage module 205. If the same architecture state exists, a new instruction instance is constructed by the reconstruction module 206, and the new instruction instance is embedded in the test template to obtain a new test instruction file. The new test instruction file is continuously executed by the instruction simulator 204 and compared until the same architecture state does not exist, and the corresponding instruction instance is stored in the queue module to be tested 207; if the same architecture state does not exist, the corresponding instruction instance is stored in the queue module to be tested 207. With the same architecture state, the first instruction instance is stored in the queue module to be tested 207, all instruction instances of the queue module to be tested 207 are integrated to obtain a target test instruction stream, the target test instruction stream and the test template are compiled into a target test instruction file using the test file generation module 208, the target test instruction file is input into the processor under test 209 to obtain a processing result, the processing result is compared with the execution result in the instruction simulator 204, if the architecture state of the processing result and the execution result are inconsistent, the processing result is stored in the vulnerability saving module 210, and the relevant test files are saved for subsequent detailed analysis and error repair.

[0082] After each round of testing, the test instructions are mutated. Specifically, all historical execution instructions are summarized and frequency analyzed, and two sets are obtained by analysis: instructions with execution frequency lower than the base frequency (Below BaselineFrequency Instructions, BLBF) and instructions with execution frequency higher than the base frequency (Above BaselineFrequency Instructions, ABBF). For BLBF, the present invention uses formula constraints to obtain the probability that needs to be increased through its deviation value from the base frequency. Similarly, for ABBF, the probability that needs to be reduced is calculated. In the subsequent mutation seed process, when the BLBF instruction is traversed and the instruction needs to be mutated, the opcode is kept unchanged, its operands, etc. are replaced, and it is ensured that there is no repeated instruction in the historical execution after the replacement; when the ABBF instruction is traversed and the instruction needs to be mutated, its opcode needs to be replaced, and the instruction is selected according to the probability in the BLBF. After the opcode is selected, its operands, source registers, etc. are replaced, and it is ensured that there is no repeated instruction in the historical execution after the replacement.

[0083] The present invention significantly improves the effect of processor fuzz testing through innovative seed generation and mutation strategies. First, by analyzing historical execution data and optimizing the generation process of test instructions, repeated test cases in the test process are significantly reduced, the diversity of instruction execution is increased, and the utilization efficiency of test resources is improved. The diversity of test instructions increases the test coverage, ensuring that the test can more deeply touch the complex and edge cases in the processor design, and improve the probability of discovering potential design defects and security vulnerabilities; secondly, by optimizing instruction selection and register allocation strategies, the targetedness of the test is enhanced, while maintaining the logical consistency of register use, the actual operating environment can be more effectively simulated, and the practical application value of the test is improved; finally, the test instruction mutation strategy dynamically adjusts the test instructions and parameter configurations according to historical data, which not only avoids frequent and repeated state updates, but also significantly enhances the ability to explore new test paths, further reducing system fatigue and potential errors caused by excessive testing, thereby improving the reliability of the test.

[0084] The test instruction generating device for the processor fuzzy test provided by the present invention is described below. The test instruction generating device for the processor fuzzy test described below and the test instruction generating method for the processor fuzzy test described above can be referenced to each other.

[0085] Figure 3 Schematic diagram of the structure of the test instruction generating device for processor fuzzy testing provided by the present invention. Figure 3 As shown, the test instruction generating device 300 for processor fuzzy testing includes: A generating module 301, configured to generate an initial test instruction file based on a test template and a first test instruction corresponding to a test environment of the test template; the test template is used to initialize parameter information of the test environment required by the test instruction; An execution module 302 is used to execute the initial test instruction file through an instruction simulator to obtain an execution result; the instruction simulator is used to simulate the operating environment of the processor to be tested to execute the initial test instruction file; The comparison module 303 is used to determine the target test instruction of the fuzzy test of the processor under test based on the comparison result of the execution result and the historical execution result of the historical instruction; the target test instruction is used to test whether the processor under test has design defects and / or security vulnerabilities.

[0086] In some embodiments, the comparison module 303 is specifically used to: reconstruct the first test instruction to obtain the second test instruction when the comparison result shows that the architecture state of the execution result is the same as the architecture state of the historical execution result; determine the target test instruction based on the second test instruction and the test template; and determine the first test instruction as the target test instruction when the comparison result does not show that the architecture state of the execution result is the same as the architecture state of the historical execution result.

[0087] In some embodiments, the first test instruction includes a first operation code and a first operand, the first operand includes a first destination register queue and a first source register queue; the first destination register queue and the first source register queue do not overlap; the comparison module 303 is further specifically used to: determine the second destination register queue based on the first source register queue; determine the second source register queue based on the first destination register queue; reconstruct the operand in the first test instruction based on the second destination register queue and the second source register queue to obtain a second operand; determine the second test instruction based on the first operation code and the second operand.

[0088] In some embodiments, a generation module 301 is used to select an instruction to be tested corresponding to the test template from a preset instruction template library; determine a first operand corresponding to the instruction to be tested based on the format of the instruction to be tested and the first operation code of the instruction to be tested; and concatenate the first operation code and the first operand to form the first test instruction.

[0089] In some embodiments, after determining the target test instruction of the fuzzy test of the processor to be tested based on the comparison result of the execution result and the historical execution results of the historical instructions, the test instruction generation device for the processor fuzzy test also includes a candidate vulnerability determination module, which is specifically used to: reselect a new instruction to be tested from the preset instruction template library; determine the next target test instruction based on the new instruction to be tested; until all the instructions to be tested in the preset instruction template library that match the test template have determined the corresponding target test instructions, a target test instruction stream is obtained; based on the target test instruction stream and the test template, a target test instruction file is generated; the target test instruction file is input into the processor to be tested to obtain a processing result; when the architecture state of the execution result and the architecture state of the processing result are different, the processing result with a different architecture state is marked as a candidate vulnerability; the candidate vulnerability is used by the user to analyze whether the processor to be tested has design defects and / or security vulnerabilities.

[0090] In some embodiments, after marking the processing results with different architecture states as candidate vulnerabilities, the test instruction generation device for processor fuzz testing also includes a mutation module, which is specifically used to: analyze the frequency of executing each instruction in the target test instruction stream by the processor to be tested to obtain a first instruction set with an execution frequency lower than a reference frequency and a second instruction set with an execution frequency higher than the reference frequency; determine the mutation probability corresponding to each instruction to be mutated based on the deviation value of each instruction to be mutated from the reference frequency; the instruction to be mutated is any instruction in the first instruction set or the second instruction set; mutate the instruction to be mutated based on the set to which the instruction to be mutated belongs and the mutation probability corresponding to the instruction to be mutated to obtain a mutated test instruction; the mutated test instruction is used to adjust the test intensity of each test instruction.

[0091] In some embodiments, the mutation module is further specifically used to: generate a simulated mutation probability of the instruction to be mutated through a random number generator; when the instruction to be mutated belongs to the instructions in the first instruction set and the simulated mutation probability is less than the mutation probability corresponding to the instruction to be mutated, keep the operation code of the instruction to be mutated unchanged, replace the operand, and obtain the mutation test instruction; when the instruction to be mutated belongs to the instructions in the second instruction set and the simulated mutation probability is less than the mutation probability corresponding to the instruction to be mutated, change the operation code of the instruction to be mutated and the operand of the instruction to be mutated to obtain the mutation test instruction.

[0092] Figure 4 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 4As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute a test instruction generation method for a processor fuzzy test, the method comprising: determining a test template and a first test instruction corresponding to a test environment of the test template; the test template is used to initialize parameter information of the test environment required for the test instruction; based on the test template and the first test instruction, an initial test instruction file is generated; the initial test instruction file is executed by an instruction simulator to obtain an execution result; the instruction simulator is used to simulate the operating environment of the processor to be tested to execute the initial test instruction file; based on the comparison result of the execution result and the historical execution result of the historical instruction, a target test instruction of the fuzzy test of the processor to be tested is determined; the target test instruction is used to test whether the processor to be tested has design defects and / or security vulnerabilities.

[0093] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0094] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the test instruction generation method for processor fuzz testing provided by the above-mentioned methods, the method including: determining a test template and a first test instruction corresponding to the test environment of the test template; the test template is used to initialize parameter information of the test environment required for the test instruction; based on the test template and the first test instruction, an initial test instruction file is generated; the initial test instruction file is executed by an instruction simulator to obtain an execution result; the instruction simulator is used to simulate the operating environment of the processor to be tested to execute the initial test instruction file; based on the comparison result of the execution result and the historical execution result of the historical instructions, the target test instruction of the fuzzy test of the processor to be tested is determined; the target test instruction is used to test whether the processor to be tested has design defects and / or security vulnerabilities.

[0095] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a test instruction generation method for executing the processor fuzz test provided by the above-mentioned methods, the method comprising: determining a test template and a first test instruction corresponding to the test environment of the test template; the test template is used to initialize parameter information of the test environment required for the test instruction; based on the test template and the first test instruction, an initial test instruction file is generated; the initial test instruction file is executed by an instruction simulator to obtain an execution result; the instruction simulator is used to simulate the operating environment of the processor to be tested to execute the initial test instruction file; based on the comparison result of the execution result and the historical execution results of historical instructions, a target test instruction for the fuzz test of the processor to be tested is determined; the target test instruction is used to test whether the processor to be tested has design defects and / or security vulnerabilities.

[0096] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0097] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A test instruction generation method for processor fuzz testing, characterized in that: include: generating an initial test instruction file based on a test template and a first test instruction corresponding to a test environment of the test template; The test template is used to initialize the parameter information of the test environment required by the test instruction; Executing the initial test instruction file through an instruction simulator to obtain an execution result; the instruction simulator is used to simulate the operating environment of the processor to be tested to execute the initial test instruction file; Determining a target test instruction of the fuzzy test of the processor to be tested based on a comparison result of the execution result and a historical execution result of the historical instruction; The target test instruction is used to test whether the processor to be tested has design defects and / or security holes.

2. The test instruction generation method for processor fuzz testing according to claim 1, characterized in that: The step of determining a target test instruction of the fuzzy test of the processor to be tested based on a comparison result between the execution result and a historical execution result of the historical instruction comprises: If the comparison result shows that the architecture state of the execution result is the same as the architecture state of the historical execution result, reconstructing the first test instruction to obtain a second test instruction; Determining the target test instruction based on the second test instruction and the test template; If the comparison result does not show that the architecture state of the execution result is the same as the architecture state of the historical execution result, the first test instruction is determined as the target test instruction.

3. The test instruction generation method for processor fuzz testing according to claim 2, characterized in that: The first test instruction includes a first operation code and a first operand, the first operand includes a first destination register queue and a first source register queue; the first destination register queue and the first source register queue do not overlap: The reconstructing the first test instruction to obtain the second test instruction includes: Determining a second destination register queue based on the first source register queue; Determining a second source register queue based on the first destination register queue; reconstructing the operand in the first test instruction based on the second destination register queue and the second source register queue to obtain a second operand; The second test instruction is determined based on the first opcode and the second operand.

4. The test instruction generation method for processor fuzz testing according to claim 3, characterized in that: Determining the first test instruction includes: Selecting the instruction to be tested corresponding to the test template from a preset instruction template library; Determining a first operand corresponding to the instruction to be tested based on a format of the instruction to be tested and a first operation code of the instruction to be tested; The first operation code and the first operand are concatenated to form the first test instruction.

5. The test instruction generation method for processor fuzz testing according to claim 4, characterized in that: After determining the target test instruction of the fuzzy test of the processor to be tested based on the comparison result of the execution result and the historical execution result of the historical instruction, the method further includes: Reselecting a new instruction to be tested from the preset instruction template library; Determine the next target test instruction based on the new instruction to be tested; After all the instructions to be tested in the preset instruction template library that match the test template have all determined corresponding target test instructions, a target test instruction stream is obtained; Based on the target test instruction stream and the test template, generate a target test instruction file; Inputting the target test instruction file into the processor to be tested to obtain a processing result; When the architecture state of the execution result is different from the architecture state of the processing result, the processing result with different architecture state is marked as a candidate vulnerability; the candidate vulnerability is used by the user to analyze whether the processor under test has design defects and / or security vulnerabilities.

6. The test instruction generation method for processor fuzz testing according to claim 5, characterized in that: After marking the processing results with different architecture states as candidate vulnerabilities, the method further includes: Analyzing the frequency of each instruction in the target test instruction stream executed by the processor under test to obtain a first instruction set with an execution frequency lower than a reference frequency and a second instruction set with an execution frequency higher than the reference frequency; Determining a mutation probability corresponding to each instruction to be mutated based on a deviation value between each instruction to be mutated and a reference frequency; the instruction to be mutated is any instruction in the first instruction set or the second instruction set; Based on the set to which the instructions to be mutated belong and the mutation probability corresponding to the instructions to be mutated, the instructions to be mutated are mutated to obtain mutated test instructions; the mutated test instructions are used to adjust the test intensity of each of the test instructions.

7. The test instruction generation method for processor fuzz testing according to claim 6, characterized in that: The step of mutating the instruction to be mutated based on the set to which the instruction to be mutated belongs and the mutation probability corresponding to the instruction to be mutated to obtain a mutation test instruction includes: Generate a simulated mutation probability of the instruction to be mutated by a random number generator; When the instruction to be mutated belongs to the first instruction set and the simulated mutation probability is less than the mutation probability corresponding to the instruction to be mutated, the operation code of the instruction to be mutated is kept unchanged, the operand is replaced, and the mutation test instruction is obtained; When the instruction to be mutated belongs to the second instruction set and the simulated mutation probability is less than the mutation probability corresponding to the instruction to be mutated, the operation code and the operand of the instruction to be mutated are changed to obtain the mutation test instruction.

8. A test instruction generating device for processor fuzzy testing, characterized in that: include: A generating module, configured to generate an initial test instruction file based on a test template and a first test instruction corresponding to a test environment of the test template; The test template is used to initialize the parameter information of the test environment required by the test instruction; An execution module, used for executing the initial test instruction file through an instruction simulator to obtain an execution result; the instruction simulator is used for simulating the operating environment of the processor to be tested to execute the initial test instruction file; A comparison module, configured to determine a target test instruction of the fuzzy test of the processor to be tested based on a comparison result of the execution result and a historical execution result of the historical instruction; The target test instruction is used to test whether the processor to be tested has design defects and / or security holes.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the test instruction generation method for the processor fuzz test as claimed in any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the test instruction generation method for processor fuzz testing as claimed in any one of claims 1 to 7 is implemented.

Images