paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Signal Breaker: Fuzzing Digital Signal Processors

Signal Breaker:面向数字信号处理器的模糊测试
ASPLOS Proceedings of the 31st ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 22026匹配度 2/10 · 该论文研究DSP软件的模糊测试,属于动态测试而非静态分析,且未涉及LLM/Agent、浮点程序分析或贝叶斯程序分析等用户核心方向,与用户研究画像匹配度低。引用 0 inbox
Cameron Santiago Garcia, Matthew Hicks
crossref: 2026-09-12dblp: 2026-09-12

AI 速览

一句话:提出面向DSP软件的覆盖率引导模糊测试器SBFUZZ,通过DSP自主执行与主机协同提升吞吐和覆盖率并发现大量缺陷。

模糊测试已广泛用于软件测试,但在数字信号处理器(DSP)软件上应用有限。DSP处于软硬件边界,接口受限、架构特殊,并可能产生崩溃类软件缺陷和执行发散却继续运行的硬件式缺陷。作者提出覆盖引导的DSP模糊测试器SBFUZZ:采用以DSP为中心的任务分解,让DSP自主执行大部分模糊测试任务,并周期性借助主机协调、分析和存储,支持单主机并发测试多台设备以及物理/模拟DSP。作者在TI TMS320C5515上用15个基准评估。相比已有方法,吞吐率提高17.4倍、覆盖率提高2.6倍,发现2491个唯一崩溃和34个唯一缺陷。

问题
DSP软件缺乏有效模糊测试:DSP接口受限且延迟高、架构特殊,并可能同时出现崩溃式软件缺陷和执行发散式硬件缺陷。
方法
提出SBFUZZ,一种覆盖引导的DSP模糊测试器;采用DSP中心的任务分解,让DSP自主执行大部分模糊任务,主机周期性协调、分析与存储,支持物理/模拟DSP及单主机多设备并发。
评估
在TI TMS320C5515和15个DSP基准程序上评估,相较已有嵌入式模糊测试方法吞吐率提高17.4倍、覆盖率提高2.6倍,发现2491个唯一崩溃和34个唯一缺陷。
原文摘要(Abstract)

Fuzzing is one of the most effective techniques for discovering software vulnerabilities. Fuzzers use feedback from prior executions to generate new test cases via random mutation,executing these inputs to uncover bugs. Fuzzing has been successfully applied to applications, operating systems, processors, and network protocols, making it one of the most widely adopted software testing methodologies. Despite this success, fuzzing has seen little adoption for Digital Signal Processor (DSP) software. DSPs occupy a unique position at the boundary of hardware and software: they ingest signals from the physical world, execute software instructions, and are tightly integrated into data-processing pipelines. Many safety- and security-critical domains, including telecommunications, transportation, and defense, rely heavily on DSPs, making robust DSP testing essential. To address this gap, we introduce SBFUZZ, a coverage-guided fuzzer designed specifically for DSP software. SBFUZZ is driven by three key observations: (1) DSPs expose limited and high-latency execution control and communication interfaces, and (2) DSPs have unique architectures that necessitate new instrumentation and mutation routines, and (3) DSP fuzzing must detect both traditional software bugs manifested as crashes and hardware-style bugs manifested as divergent yet continuing execution. Based on these insights, SBFUZZ advocates a DSP-centric fuzzer decomposition, where the DSP executes most fuzzing tasks autonomously while periodically leveraging a more powerful host for coordination, analysis, and storage. This design allows a single host to concurrently fuzz multiple end devices and supports both physical DSPs and simulated DSPs for re-hosted fuzzing. We implement SBFUZZ on a Texas Instruments TMS320C5515 DSP and evaluate it on 15 DSP benchmark programs.Our results show that SBFUZZ achieves 17.4x higher throughput and 2.6x greater code coverage than prior embedded fuzzing approaches applied to DSPs, uncovering 2491 unique crashes, yielding 34 unique bugs

链接与引用

DOI 原文 · PDF(开放获取) · DBLP

BibTeX
@inproceedings{GarciaH26,
  title = {Signal Breaker: Fuzzing Digital Signal Processors},
  author = {Cameron Santiago Garcia and Matthew Hicks},
  booktitle = {ASPLOS},
  year = {2026},
  doi = {10.1145/3779212.3790220}
}