Search papers, labs, and topics across Lattice.
This paper introduces CHARGE, an automated framework that utilizes Common Weakness Enumeration (CWE) hierarchies and large language models to generate security properties for unverified RTL modules. By leveraging the hierarchical structure of CWE entries, CHARGE enhances the accuracy of identifying security-critical assets, enabling it to infer expected security behaviors and generate relevant SystemVerilog Assertions (SVAs) without relying on trusted design specifications. The evaluation on multiple open-source SoC designs demonstrates that CHARGE successfully detects 27 out of 42 known bugs and identifies a new bug, outperforming existing manually written properties in accuracy and completeness.
CHARGE uncovers new vulnerabilities in hardware designs while automating the generation of security properties, significantly reducing manual effort.
This paper presents CHARGE, an automated framework for generating security properties for unverified RTL modules using CWEs and large language models (LLMs). The hallmark is a reasoning process that leverages the hierarchical nature of CWE entries to improve accuracy when identifying security-critical assets in unverified RTL modules. As a result, the approach can infer expected security behaviors and generate properties from identified assets and CWE semantics, avoiding the need for trusted design specifications and reducing manual engineering effort. We evaluate the framework on the Hack@DAC18, 19, and 21 open source SoC designs using OpenAI's GPT-4.1. CHARGE detects 27 of 42 known bugs in these designs. For Hack@DAC21 OpenPiton SoC, 89% of the generated SVAs run in Cadence JasperGold FPV, and 92.2% are non-vacuous. We compare to an open-source, manually written set of properties for these designs and find that CHARGE correctly writes properties for three bugs in which the manually written properties were incorrect. In addition, CHARGE-generated properties identify a new bug in the Hack@DAC21 OpenPiton SoC that was not previously identified.
