A hardware verification method and system combining fuzz testing and model detection
By combining fuzz testing and model detection, snapshots are recorded and value scores are performed to generate new test seeds, optimize the BMC state space, solve the BMC state explosion problem in processor design, and achieve more efficient hardware verification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-05
- Publication Date
- 2026-03-24
AI Technical Summary
Existing technologies suffer from the BMC state explosion problem in processor design, making it difficult to fully verify the properties of complex processors. Furthermore, existing methods combining CGF and BMC fail to fully utilize the information generated during the CGF process to optimize the BMC state space.
A method combining fuzz testing and model detection is adopted. By performing multiple rounds of coverage-guided fuzz testing on the processor, snapshots are recorded and value scores are performed to build a snapshot pool. New test seeds are generated using bounded model detection, and the state space exploration of the BMC is optimized through memory abstraction.
It significantly improves the efficiency and applicability of BMC, enables more comprehensive hardware verification, expands verification depth and coverage without sacrificing verification accuracy, and solves the BMC state explosion problem.
Smart Images
Figure CN121301101B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of hardware testing technology, and in particular relates to a hardware verification method and system that combines fuzz testing and model detection. Background Technology
[0002] RISC-V is an open-source instruction set architecture (ISA) designed based on the Reduced Instruction Set Computing (RISC) principle. Since its inception in 2010 by the University of California, Berkeley, it has rapidly become a widely adopted instruction set standard in academia and industry. Its design goals emphasize modularity, scalability, efficiency, and open-source characteristics. Unlike traditional instruction sets, RISC-V provides a fixed basic instruction set core (RV32I) and supports a wide range of applications, from embedded systems to high-performance servers, through standardized optional extensions.
[0003] Hardware fuzzing is an important method for verifying complex hardware systems (especially processors). Its core idea is to automatically generate high-quality test inputs through feedback-guided methods, comprehensively and efficiently exploring the design state space and discovering potential defects. Unlike traditional random testing, hardware fuzzing typically relies on coverage-guided fuzzing (CGF) to evaluate input quality and mutate and filter seed programs accordingly.
[0004] Model checking is one of the most core formal verification techniques in hardware verification. Its significant advantage lies in its ability to exhaustively analyze all combinations of states and inputs, given a design and assertions, to determine whether the system satisfies specified properties. Although model checking offers advantages such as high automation and comprehensive coverage, the state space explosion problem it faces limits its ability to fully verify large-scale systems. In practical applications, bounded model checking (BMC) is often used as an alternative, exploring only within a given path depth.
[0005] However, the state space of a processor design grows exponentially with the number of registers and memory bits, making it nearly impossible to fully examine the properties of the processor design through exhaustive search. Although the BMC only explores within a given path depth, the number of states still grows exponentially with path depth, limiting its practical coverage.
[0006] Existing hardware verification methods that integrate CGF and BMC all employ a unidirectional hybrid framework where BMC guides CGF. These methods typically only use the BMC output as a supplement to CGF seed generation, failing to fully utilize the information generated during the CGF process for further optimization of the BMC's state space. Summary of the Invention
[0007] This invention discloses a hardware verification method and system that combines fuzz testing and model detection, which can solve the BMC state explosion problem caused by the large-scale physical memory in complex processors, and significantly improve the efficiency and applicability of BMC without sacrificing verification accuracy.
[0008] To achieve the above objectives, the technical solution of the present invention includes the following:
[0009] A hardware verification method combining fuzz testing and model detection, the method comprising:
[0010] On a processor, multiple rounds of coverage-guided fuzzing are performed based on an initial seed set. Snapshots generated during the fuzzing process are recorded, and the snapshots are value-scored to construct a snapshot pool. The processor is generated based on the processor design to be verified.
[0011] Select the best snapshot from the snapshot pool and initialize a processor design based on the best snapshot;
[0012] In cases where there are uncovered points in the processor design, bounded model detection is used to generate new test seeds;
[0013] Based on the new test seed, a fuzz test was performed on the processor design to obtain the verification results of the optimal snapshot;
[0014] By combining the verification results of several best snapshots from the best snapshot set, the hardware verification results of the processor design to be verified are obtained.
[0015] Furthermore, snapshots generated during the fuzzing process are recorded, and each snapshot is value-scored to build a snapshot pool, including:
[0016] Record snapshots when the processor's CSR state changes;
[0017] Based on the scoring criteria, low-scoring redundant snapshots with high similarity are removed to construct a snapshot pool; wherein, the scoring criteria include: privilege level, virtual memory, illegal instruction exception, trap control and exception delegation.
[0018] Furthermore, the best snapshot is selected from the snapshot pool, including:
[0019] Obtain the scoring criteria, which include: privilege level, virtual memory, illegal instruction exception, trap control, and exception delegation;
[0020] Assign an initial weight to each scoring criterion. And corresponding to a variable decay counter d i ;
[0021] Based on weight The scoring criteria are used to score the best snapshot, and when a best snapshot matches a certain scoring criterion, the weight of that scoring criterion is determined. Attenuation to
[0022] Based on the best snapshot scores, select the best snapshot from the snapshot pool.
[0023] Furthermore, the privilege level is used to score the snapshot based on the processor's current privilege level;
[0024] The virtual memory is used to score snapshots based on CSR fields related to virtual memory; wherein, the CSR fields related to virtual memory include: the MXR field, SUM field, MPRV field in the mstatus register and the MODE field in the satp register;
[0025] The illegal instruction exception is scored on the snapshot based on the CSR field that caused the illegal instruction exception; wherein, the CSR field that caused the illegal instruction exception includes: the TVM field, TW field and TSR field in the mstatus register;
[0026] The trap control is based on scoring snapshots using fields related to interrupts / exceptions in the mstatus register; wherein, the fields related to interrupts / exceptions in the mstatus register include: MPP field, SPP field, MPIE field, SPIE field, MIE field, and SIE field;
[0027] The exception delegation scores the snapshot based on all bits of the medeleg register.
[0028] Furthermore, in the case where there are uncovered points in the processor design, a new test seed is generated using bounded model detection, including:
[0029] If there are uncovered points in the processor design, generate a coverage assertion based on the uncovered points;
[0030] Insert the coverage assertion into the source code of the processor design to generate a formal verification model;
[0031] Analyze the reachability of covering assertions in the formal verification model;
[0032] If a coverage assertion is reachable along a certain path in the formal verification model, the seed generator converts that path into a new test seed and records the formal verification rate of that new test seed. Then, the new test seed is added to the seed bank; wherein, the formal verification rate Denote the formal verification rate obtained after k rounds of bounded model checking in an initialized processor. Let n denote the number of reachable points discovered in the (k + 1)-th round of bounded model checking, and t denote the time taken for the (k + 1)-th round of bounded model checking.
[0033] Furthermore, perform fuzz testing on the processor design based on the new test seeds to obtain the verification results of the best snapshot, including:
[0034] Generate new test cases by mutating the new test seeds;
[0035] Execute the simulation of the new test cases on the processor design and the golden reference model respectively, and record the simulation information; where the simulation information includes: defect information and coverage information of the processor design, and the defect information is obtained by comparing the simulation results of the processor design and the golden reference model;
[0036] If new coverage points are found or new CSR states are reached in the coverage information, update the seed library or snapshot pool, and update the fuzz testing rate r CGF (ω); where the fuzz testing rate The set of test case executions K in at most the most recent ω test case executions in a single fuzz testing call ω ={k i ||K|-ω < i ≤ |K|}, where K is the sequence of all executed test cases in the fuzz testing process, k i represents the i-th execution, n(k i ) represents the number of new coverage points covered in the i-th execution, and t CGF (k i ) represents the time taken for the i-th execution;
[0037] When the fuzz testing rate r CGF (ω) is less than the formal verification rate , stop the fuzz testing and re-execute the generation of new test seeds using bounded model checking;
[0038] Integrate the simulation information of each new test case to obtain the verification results of the best snapshot.
[0039] Furthermore, before generating the formal verification model, it also includes:
[0040] Construct a memory abstraction that retains a fixed number of rows N; where each cache line of the memory abstraction contains valid bit fields including: valid bit, tag, and data;
[0041] Replace the memory model in the processor design with this memory abstraction.
[0042] Furthermore, the construction of the memory abstraction also follows the following consistency principles:
[0043] Upon first access to an address, return an arbitrary valid value and populate the corresponding cache line with that valid value;
[0044] If the same address is accessed again without any write operation in between, the value generated during the first call will always be returned;
[0045] If the same address is accessed again and a write operation occurs on that address, the access returns the updated value, and the cache line content is updated accordingly.
[0046] Furthermore, if there are no uncovered points in the processor design, the process of selecting the best snapshot from the snapshot pool is re-executed.
[0047] A hardware verification system combining fuzz testing and model detection, the system comprising:
[0048] A snapshot pool construction module is used to perform multi-round coverage-guided fuzzing on a processor based on an initial seed set, record snapshots generated during the fuzzing process, and score the value of the snapshots to build a snapshot pool; wherein, the processor is generated based on the processor design to be verified;
[0049] The snapshot verification module is used to select an optimal snapshot from the snapshot pool and initialize a processor design based on the optimal snapshot; if there are uncovered points in the processor design, a new test seed is generated using bound model detection; and a fuzz test is performed on the processor design based on the new test seed to obtain the verification result of the optimal snapshot.
[0050] The verification result generation module is used to synthesize the verification results of several best snapshots in the best snapshot set to obtain the hardware verification results of the processor design to be verified.
[0051] Compared with the prior art, the present invention has at least the following beneficial effects.
[0052] The hardware verification framework of the present invention, which is a “double-layer nested loop”, finely integrates fuzz testing and model detection in terms of information flow and control flow, and achieves a closed loop in both aspects of “fuzz testing driving model detection” and “model detection guiding fuzz testing”, thus realizing a true two-way hybrid verification framework.
[0053] The snapshot dynamic priority scoring strategy of this invention encourages the framework to explore more diverse state spaces. This dynamic priority scoring strategy can effectively balance verification depth and state space breadth, taking into account both specificity and diversity, thereby improving overall coverage efficiency.
[0054] The memory abstraction of this invention enables the model checker to significantly reduce the number of Boolean variables being solved while preserving memory access consistency, thereby significantly improving the scalability and deep exploration capabilities of BMC. Attached Figure Description
[0055] Figure 1 A flowchart of a hardware verification method that combines fuzz testing and model checking. Detailed Implementation
[0056] The present invention will now be described in further detail with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.
[0057] The hardware verification method combining fuzz testing and model detection of this invention is based on a novel hardware verification paradigm of "double-nested loops". The outer loop (snapshot loop, such as...) Figure 1 The blue line (shown in the code) is responsible for switching between different circuit-level register states to dynamically expand the verifiable state space. This means that by dynamically acquiring and managing complete circuit-level snapshots of the processor triggered by critical events (such as privilege level switching or CSR field updates), the BMC breaks through the previous limitation of a single initial state. The inner loop (BMC–CGF loop, as shown in the code) is responsible for switching between different circuit-level register states to dynamically expand the verifiable state space. Figure 1 (As shown in red), a closed-loop alternation of BMC and CGF is adopted, continuously comparing their real-time coverage growth rates and dynamically switching them via a scheduler. This allows the precise path analysis of formal methods to complement the random breadth-of-field exploration of fuzz testing. Specifically, on each snapshot-initialized DUT, BMC and CGF are repeatedly switched, forming a complementary closed loop between inaccessible deep states and large-scale random exploration. This closed loop continues to iterate until a global termination condition (coverage saturation or timeout) is reached. Based on this new hardware verification paradigm of "double-nested loop," this invention generates a coverage report and records all test cases that trigger defects, supporting rapid location and remediation of hardware vulnerabilities.
[0058] Specifically, the hardware verification method combining fuzz testing and model detection of the present invention includes the following steps.
[0059] Step S1: Perform multi-round coverage-guided fuzzing on the processor based on the initial seed set, record the snapshots generated during the fuzzing process, and score the snapshots for value to build a snapshot pool; wherein, the processor is generated based on the processor design to be verified.
[0060] In this step, the present invention first loads the processor design to be verified (DUT), the gold reference model (REF), the initial test seed set S0, and the parameter configuration (BMC path depth limit, BMC solver type, coverage type, etc.). Then, CGF is used to perform 3×|S0| rounds of fuzz testing on the initial test seed set. During the process, the test cases generated in each round are not only used for path exploration, but also synchronously drive the snapshot recorder to capture the complete register state at the circuit level, including register files, pipeline registers and related intermediate states, forming a large number of snapshots.
[0061] Subsequently, the snapshot manager of this invention performs feature analysis and value scoring on these snapshots, prioritizes the selection of states with significant differences in path structure and register distribution, removes redundant snapshots and retains a number of high-scoring snapshots to form a diverse initial snapshot pool.
[0062] In the process of feature analysis and value scoring of these snapshots, this invention is based on the RISC-V architecture. It divides the snapshot trigger tags into five dimensions: "privileged level, virtual memory, abnormal delegation, trap control, and illegal instruction". It also introduces an exponential decay mechanism to avoid repeated hits of hot states, thereby prioritizing the selection of high-value snapshots located at the edge or blind zone of the state space.
[0063] In one embodiment, the snapshot selector evaluates the potential value of each snapshot using a dynamic priority scoring strategy and selects the optimal snapshot from the snapshot pool. This strategy incorporates key state transition factors in the RISC-V architecture design and employs an exponential decay mechanism to dynamically adjust the importance of each scoring criterion, achieving a balance between in-depth exploration of the verification path and diversity of the state space. Specifically, the scoring mechanism divides the snapshot trigger tags into five groups according to the key areas of the RISC-V design, referred to as the five scoring criteria C1-C5:
[0064] C1 (privilege level) contains the processor's current privilege level (PLevel), which is divided into Machine, Supervisor, and User. Changes in privilege level are often accompanied by significant shifts in execution permissions and the scope of system resource access, having a critical impact on the reachability of test paths.
[0065] C2 (Virtual Memory) includes CSR fields related to virtual memory: MXR, SUM, MPRV in the mstatus register, and MODE in the satp register. Enabling / disabling virtual memory or changing access policies will alter TLB, page table walkthrough, and other behaviors.
[0066] C3 (Illegal Instruction Exception) involves the CSR fields that may trigger illegal instruction exceptions: TVM, TW, and TSR in the mstatus register. The configuration of these fields determines whether an exception is triggered when executing instructions such as SFENCE.VMA, WFI, or SRET.
[0067] C4 (Trap Control) covers six fields in the mstatus register related to interrupts / exceptions: MPP, SPP, MPIE, SPIE, MIE, and SIE, which are used to control the trap entry and exit process.
[0068] C5 (Exception Delegation) consists of all the bits in the medeleg register and determines which exceptions are handled by Supervisor mode instead of Machine mode.
[0069] During the scoring process, each set of criteria is assigned an initial weight. And corresponding to a variable decay counter d i Whenever a group is hit in a snapshot, its weight decays exponentially. This mechanism dynamically reduces the weight of frequently hit labels in multiple rounds of selection, encouraging the framework to prioritize covering scarce or unexplored combinations of states.
[0070] Step S2: Select the best snapshot from the snapshot pool and initialize a processor design based on the best snapshot.
[0071] After constructing the snapshot pool, the present invention selects the best snapshot from the snapshot pool and initializes a processor design based on the best snapshot.
[0072] The selection of the best snapshot can refer to the process of scoring the value of the snapshot in step S1, or it can be based on other selection methods, which are not limited in this invention.
[0073] In another embodiment, after scoring the value of the snapshot in step S1, the present invention can also construct a mapping table between snapshots and snapshot scores in the snapshot pool, and in step S2, obtain the current best snapshot by querying the mapping table.
[0074] Step S3: If there are uncovered points in the processor design, use bounded model detection to generate new test seeds.
[0075] The execution process of this step can consist of the following steps S31 to S35.
[0076] Step S31: Completely restore the circuit state corresponding to the best snapshot selected by the snapshot manager to the DUT.
[0077] Step S32: The BMC identifies the uncovered points in the initialized DUT through the point selector and inserts corresponding coverage assertions into the RTL design accordingly. If there are no points to be covered, it jumps to Step 2 to load a new snapshot for execution.
[0078] Step S33: The model checking instance generator constructs a formal verification model based on the coverage assertions.
[0079] Step S34: Under the restricted path length, the BMC calls the model checking tool to analyze the reachability of the coverage assertions in the formal verification model.
[0080] Step S35: If a coverage assertion is reachable on a certain path in the formal verification model, the seed generator converts this path into a new test seed and records its formal verification rate (BMC rate), which is the estimated coverage gain brought by the execution of this BMC.
[0081] Among them, the BMC rate is calculated using the moving average method. Assume represents the BMC rate after k rounds of BMC in an initialized processor. In the (k + 1)-th round of BMC, n reachable points are found and the time taken is t. Then the BMC rate in the (k + 1)-th round is
[0082] Step 36: The new test seeds generated by the BMC will be incorporated into the seed bank by the CGF.
[0083] Step S4: Fuzz testing is performed on the processor design based on the new test seeds to obtain the verification result of the best snapshot.
[0084] First, the mutator of the CGF generates new test cases using various methods such as random bit flipping, insertion, or deletion, and re-executes the simulation on the DUT initialized with the current snapshot. The simulator records the coverage information in real time. If new coverage points or states are reached, the seed bank and the snapshot pool are updated, and the corresponding fuzz testing rate (CGF rate) is calculated, which is the coverage improvement ratio brought by each round of CGF.
[0085] Among them, the calculation of the CGF rate uses the sliding window algorithm, which reflects the coverage improvement efficiency in the current CGF stage. Suppose in a CGF call (from the last switch from BMC until the next switch), the set of at most the most recent ω test case executions is K ω ={k i ||K|-ω < i ≤ |K|}, where K is the sequence of all test cases executed during the fuzz testing process, k i represents the i-th execution, and n(k i ) represents the number of new coverage points covered in the i-th execution, and t CGF (k iThe time taken for the i-th execution. Then, in window K... ω The CGF rate on is defined as After each test case is executed, the simulator will recalculate the current CGF rate based on the coverage increment and time taken for that test case, and then report it to the scheduler.
[0086] Then, the scheduler compares the current CGF rate with the previous BMC rate in real time. When the CGF rate is less than the previous BMC rate, it jumps to step S32 to switch to BMC and continue execution.
[0087] Finally, CGF outputs a coverage report in real time during operation and generates a defect report when a defect is found.
[0088] Step S5: Combine the verification results of several best snapshots in the best snapshot set to obtain the hardware verification results of the processor design to be verified.
[0089] Finally, based on the verification results of the best snapshot in step S4 above, the present invention obtains the hardware verification results of the processor design to be verified.
[0090] Furthermore, this invention addresses bounded model detection for large-scale physical memory in SoCs by designing a memory abstraction method that maps several GiB of real memory into a memory abstraction structure with a fixed number of rows, significantly improving the verification depth, coverage, and defect discovery efficiency of complex microarchitectures.
[0091] Specifically, memory abstraction is a technique proposed to address the explosive growth problem caused by the direct participation of full physical memory (typically at the level of several GiB) in state space search during model detection on large-scale SoCs. Drawing inspiration from cache design, this invention constructs an abstract memory structure that retains only a fixed number of rows, b; each cache row contains three fields: valid bit, tag, and data. Since N << the number of rows in the original memory, the total number of state bits can be determined by...
[0092] Total number of bits = N × (1 + |tag| + |data|)
[0093] Significantly reduced, compared to the original 2 34 With 2 GiB of memory, the abstract memory only needs to store a small number of entries, thus significantly reducing the number of Boolean variables in model detection.
[0094] This abstract memory strictly adheres to the following consistency principles: upon the first access to an address, an arbitrary valid value is returned and filled into the corresponding cache line; if the same address is accessed again subsequently without any write operations in between, the value generated during the first access is always returned; if a write operation occurs at the address, subsequent accesses return the updated value, and the cache line content is updated accordingly. This cached abstraction, characterized by "arbitrary first access, consistent subsequent accesses, and update after write," not only ensures the self-consistency of access results to the same address but also eliminates the need for precise modeling of the entire large-capacity physical memory, significantly reducing the state space of the BMC.
[0095] In summary, this invention addresses the unidirectional hybrid problem of combining CGF and BMC in the field of hardware verification by proposing and implementing an original bidirectional collaborative hybrid verification framework. Compared with existing unidirectional guided or loosely coupled hybrid methods, the verification framework in this paper finely integrates fuzz testing and model detection in terms of information flow and control flow, achieving a closed loop in both "fuzz testing drives model detection" and "model detection guides fuzz testing".
[0096] The current snapshot priority of this invention is based on five types of trigger tags and scored using an exponential decay method. Alternatively, a heuristic function based on coverage increment can be used, that is, to calculate the average coverage improvement that each snapshot can bring in historical use as the scoring basis.
[0097] This invention introduces a lightweight memory abstraction that models only the addresses actually accessed by the processor and maintains memory consistency through a cached update mechanism. This abstraction effectively compresses the model size and increases the solution depth, significantly improving the efficiency and applicability of BMC without sacrificing verification accuracy.
[0098] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.
Claims
1. A hardware verification method combining fuzz testing and model checking, characterized in that, The method includes: On a processor, multiple rounds of coverage-guided fuzzing are performed based on an initial seed set. Snapshots generated during the fuzzing process are recorded, and the snapshots are value-scored to construct a snapshot pool. The processor is generated based on the processor design to be verified. Select the best snapshot from the snapshot pool and initialize a processor design based on the best snapshot; In cases where there are uncovered points in the processor design, bounded model detection is used to generate new test seeds; Based on the new test seed, a fuzz test was performed on the processor design to obtain the verification results of the optimal snapshot; By combining the verification results of several best snapshots from the best snapshot set, the hardware verification results of the processor design to be verified are obtained. In cases where there are uncovered points in the processor design, bounded model detection is used to generate new test seeds, including: If there are uncovered points in the processor design, generate a coverage assertion based on the uncovered points; Insert the coverage assertion into the source code of the processor design to generate a formal verification model; Analyze the reachability of covering assertions in the formal verification model; If a coverage assertion is reachable along a certain path in the formal verification model, the seed generator converts that path into a new test seed and records the formal verification rate of that new test seed. Then, the new test seed is added to the seed bank; wherein, the formal verification rate , This indicates that it is performed in an initialized processor. The formal verification rate obtained after wheel bounding model testing. Indicates the first The number of reachable points detected by the wheel boundary model. Indicates the first The time spent on wheel boundary model detection.
2. The method according to claim 1, characterized in that, Record snapshots generated during fuzz testing and assign value scores to these snapshots to build a snapshot pool, including: Record snapshots when the processor's CSR state changes; Based on the scoring criteria, low-scoring redundant snapshots with high similarity are removed to construct a snapshot pool; wherein, the scoring criteria include: privilege level, virtual memory, illegal instruction exception, trap control and exception delegation.
3. The method according to claim 1, characterized in that, Select the best snapshot from the snapshot pool, including: Obtain the scoring criteria, which include: privilege level, virtual memory, illegal instruction exception, trap control, and exception delegation; Assign an initial weight to each scoring criterion. And corresponding to a variable decay counter. ; Based on weight The scoring criteria are used to score the best snapshot, and when a best snapshot matches a certain scoring criterion, the weight of that scoring criterion is determined. Attenuation to ; Based on the best snapshot scores, select the best snapshot from the snapshot pool.
4. The method according to claim 3, characterized in that, The privilege level is used to score snapshots based on the processor's current privilege level; The virtual memory is used to score snapshots based on CSR fields related to virtual memory; wherein, the CSR fields related to virtual memory include: the MXR field, SUM field, MPRV field in the mstatus register and the MODE field in the satp register; The illegal instruction exception is scored on the snapshot based on the CSR field that caused the illegal instruction exception; wherein, the CSR field that caused the illegal instruction exception includes: the TVM field, TW field and TSR field in the mstatus register; The trap control is based on scoring snapshots using fields related to interrupts / exceptions in the mstatus register; wherein, the fields related to interrupts / exceptions in the mstatus register include: MPP field, SPP field, MPIE field, SPIE field, MIE field, and SIE field; The exception delegation scores the snapshot based on all bits of the medeleg register.
5. The method according to claim 1, characterized in that, Based on the new test seed, fuzz testing was performed on the processor design to obtain the verification results of the optimal snapshot, including: New test cases are generated based on mutations of the new test seed; Simulations of new test cases are executed on the processor design and the gold reference model, respectively, and simulation information is recorded. The simulation information includes: defect information and coverage information of the processor design. The defect information is obtained by comparing the simulation results of the processor design and the gold reference model. If the coverage information detects new coverage points or new CSR statuses, the seed library or snapshot pool is updated, and the fuzz test rate is updated according to the coverage situation. Wherein, the fuzz test rate In a single fuzz test call, at most the most recent The set of test cases executed. , This is the sequence of all test cases executed during the fuzzing process. Indicates the first The next execution, Indicates the first The number of new coverage points covered in the next execution No. Time taken for each execution; When fuzz test rate Less than the formal verification rate If necessary, stop the fuzz test and re-execute the method of using the bounded model to generate a new test seed; The verification result of the optimal snapshot is obtained by combining the simulation information of each new test case.
6. The method according to claim 1, characterized in that, Before generating the formal verification model, the following steps are also included: Construct a system that retains a fixed number of rows The memory abstraction; wherein, each cache line of the memory abstraction contains a valid bit field including: valid bit, tag, and data; Use this memory abstraction to replace the memory model in the processor design.
7. The method according to claim 6, characterized in that, The construction of the memory abstraction also follows the following consistency principle: Upon first access to an address, return an arbitrary valid value and populate the corresponding cache line with that valid value; If the same address is accessed again without any write operation in between, the value generated during the first call will always be returned; If the same address is accessed again and a write operation occurs on that address, the access returns the updated value, and the cache line content is updated accordingly.
8. The method according to any one of claims 1 to 7, characterized in that, If there are no uncovered points in the processor design, the process of selecting the best snapshot from the snapshot pool is re-executed.
9. A hardware verification system combining fuzz testing and model checking, characterized in that, The system includes: A snapshot pool construction module is used to perform multi-round coverage-guided fuzzing on a processor based on an initial seed set, record snapshots generated during the fuzzing process, and score the value of the snapshots to build a snapshot pool; wherein, the processor is generated based on the processor design to be verified; The snapshot verification module is used to select an optimal snapshot from the snapshot pool and initialize a processor design based on the optimal snapshot; if there are uncovered points in the processor design, a new test seed is generated using bound model detection; and a fuzz test is performed on the processor design based on the new test seed to obtain the verification result of the optimal snapshot. The verification result generation module is used to synthesize the verification results of several best snapshots in the best snapshot set to obtain the hardware verification results of the processor design to be verified. In cases where there are uncovered points in the processor design, bounded model detection is used to generate new test seeds, including: If there are uncovered points in the processor design, generate a coverage assertion based on the uncovered points; Insert the coverage assertion into the source code of the processor design to generate a formal verification model; Analyze the reachability of covering assertions in the formal verification model; If a coverage assertion is reachable along a certain path in the formal verification model, the seed generator converts that path into a new test seed and records the formal verification rate of that new test seed. Then, the new test seed is added to the seed bank; wherein, the formal verification rate , This indicates that it is performed in an initialized processor. The formal verification rate obtained after wheel bounding model testing. Indicates the first The number of reachable points detected by the wheel boundary model. Indicates the first The time spent on wheel boundary model detection.