## 1 Introduction  
With the continuous development of information technology and the increasing demands for data processing, processors have become an indispensable part of production in information systems [1, 2]. As one of the most important processors, the digital signal processor (DSP) has powerful data processing capabilities and high operating speeds with low energy consumption [3, 4]. Therefore, it is widely used in many fields such as communication [5, 6], remote sensing [7], autopilot [8], medical equipment [9, 10], environmental monitoring [11], Internet of Things (IoT) [12], and consumer electronics, as shown in Figure 1. As reported in [13], the global DSP chip market size is estimated to be USD 3872.6 million in 2022, and it is expected to be USD 5746.9 million by 2028. Such a huge market also attracts attackers to take advantage of the loopholes to achieve their illegal purposes.  
At present, the instruction set which works as an important interface connecting processor hardware units and software is no longer trustworthy [14]. [PERSON]. [15] first found that there are undocumented instructions in processors. Thereafter, increasingly more undocumented instructions have been mined, such as FDIV [16], F00F [17], and VIA C3 [18]. These undocumented instructions may lead to malfunction of the processors, such as change functions [16], stopping working [17], and allowing attackers to obtain illegal privileges [18], endangering the security of tens of millions of devices. With the increasing number of undocumented instruction security incidents, it is necessary to mine potential undocumented instructions from processors as a preventive measure to protect processor security.  
In this paper, we propose an undocumented instruction mining method for DSP that can quickly obtain DSP undocumented instructions within minutes, providing a defense tool for DSP security.  
Our research motivations were as follows:  
1. As an important processor device in network information systems, the research on the security of DSP is relatively weak. Researchers have focused on applying DSP to security devices [19; 20], not the security of DSP itself.
2. There is no undocumented instruction mining method in the current literature that applies to the characteristics of the DSP instruction set. Many researchers have proposed undocumented instruction mining methods mainly for the architecture of general-purpose processors rather than DSP.  
The main contributions of our paper are twofold:  
* We propose an undocumented instruction mining method for the DSP, which can find out the undocumented instructions on a variety of DSP processors within several seconds. It provides a platform for subsequent researchers to study the security of DSP.
* We performed functional analysis and classification on these undocumented instructions. Furthermore, we discuss the affection of these instructions when they are executed, and we find that partially undocumented instructions indeed pose a security threat to the corresponding processors.  
The rest of this paper is organized as follows. In Section 2, we briefly discuss the related work. In Section 3, we detail how we implement the DSPUIM tool. In Section 4, we conduct extensive experiments to demonstrate the effectiveness of our method, and we perform functional analysis and classification for mined undocumented instructions. Finally, we conclude in Section 5.