Modern computing systems heavily rely on hardware as the root of trust.
However, their increasing complexity has given rise to security-critical
vulnerabilities that cross-layer at-tacks can exploit. Traditional hardware
vulnerability detection methods, such as random regression and formal
verification, have limitations. Random regression, while scalable, is slow in
exploring hardware, and formal verification techniques are often concerned with
manual effort and state explosions. Hardware fuzzing has emerged as an
effective approach to exploring and detecting security vulnerabilities in
large-scale designs like modern processors. They outperform traditional methods
regarding coverage, scalability, and efficiency. However, state-of-the-art
fuzzers struggle to achieve comprehensive coverage of intricate hardware
designs within a practical timeframe, often falling short of a 70% coverage
threshold. We propose a novel ML-based hardware fuzzer, ChatFuzz, to address
this challenge. Ourapproach leverages LLMs like ChatGPT to understand processor
language, focusing on machine codes and generating assembly code sequences. RL
is integrated to guide the input generation process by rewarding the inputs
using code coverage metrics. We use the open-source RISCV-based RocketCore
processor as our testbed. ChatFuzz achieves condition coverage rate of 75% in
just 52 minutes compared to a state-of-the-art fuzzer, which requires a lengthy
30-hour window to reach a similar condition coverage. Furthermore, our fuzzer
can attain 80% coverage when provided with a limited pool of 10 simulation
instances/licenses within a 130-hour window. During this time, it conducted a
total of 199K test cases, of which 6K produced discrepancies with the
processor's golden model. Our analysis identified more than 10 unique
mismatches, including two new bugs in the RocketCore and discrepancies from the
RISC-V ISA Simulator.

现代计算系统在硬件作为信任根基上依赖较重。然而，不断增加的复杂性导致了跨层攻击可以利用的安全关键弱点。我们提出了一种新颖的基于 ML 的硬件模糊测试工具 ChatFuzz，它利用类似 ChatGPT 的 LLMs 来理解处理器语言，并通过代码覆盖度度量指标引导输入生成，以此解决现有工具在实际时间范围内无法全面覆盖复杂硬件设计的问题。在测试中，与最先进的模糊测试工具相比，ChatFuzz 在仅 52 分钟内达到了 75% 的条件覆盖率，而后者需要 30 个小时的时间窗口才能达到类似的覆盖率。此外，我们的工具在 130 个小时的时间范围内，仅提供有限的 10 个模拟实例 / 许可证情况下即可达到 80% 的覆盖率。在此期间，共进行了 19.9 万个测试用例，其中 6 千个测试用例与处理器的黄金模型产生了差异。我们的分析发现了 10 多个独特的不匹配之处，包括 RocketCore 中的两个新 bug 和与 RISC-V ISA 模拟器的差异。