Overview
Dynamic Program Analysis appears in the provided evidence as part of the verification landscape for Instruction Set Simulators (ISSs). The cited paper frames ISSs as software models of processors, often implemented in C++ for high simulation performance, and notes that ISS verification commonly relies on simulation-based methods because complete formal verification does not scale. These simulation-based methods require comprehensive test stimuli, while manual testcase writing is impractical and pure random generation provides only limited coverage. [1]
Use in ISS verification
Because an ISS is a software model, the paper states that semi-formal methods based on dynamic program analysis and constraint solving are applicable to ISS verification. In this setting, their purpose is to provide automatic ways to increase code coverage. [2]
Limitations
The same evidence reports two important limitations for dynamic-program-analysis-and-constraint-solving approaches in ISS verification:
- they can be susceptible to scalability issues; and
- they can impose limitations on the ISS, specifically with respect to modeling memory access and loops. [2]
Relationship to coverage-guided fuzzing
The cited paper positions coverage-guided fuzzing as another automated software-testing approach relevant to ISS verification. It describes libFuzzer as an LLVM-based coverage-guided fuzzing engine that creates binary bytestream inputs to maximize code coverage of an instrumented device under test, with inputs mutated using predefined random mutations. [3]
In the paper's ISS-verification case study, the authors implemented a coverage-guided fuzzing approach on top of libFuzzer, adding functional coverage and a custom mutation procedure tailored for ISS verification. They evaluated it on three publicly available RISC-V ISSs and reported finding new errors in every considered ISS, including one in Spike, the official RISC-V reference simulator. [4]
References
[1] Herdt et al., "Verifying Instruction Set Simulators using Coverage-guided Fuzzing" — ISS verification context.
[2] Herdt et al., "Verifying Instruction Set Simulators using Coverage-guided Fuzzing" — dynamic program analysis and constraint solving applicability and limitations.
[3] Herdt et al., "Verifying Instruction Set Simulators using Coverage-guided Fuzzing" — libFuzzer and coverage-guided fuzzing background.
[4] Herdt et al., "Verifying Instruction Set Simulators using Coverage-guided Fuzzing" — ISS fuzzing approach and reported findings.