Scholarlink

<p>Despite the wide availability of automated testing techniques such as fuzzing, little attention has been devoted to testing computer architecture simulators. We propose a fully automated approach for this task. Our approach uses large language models (LLM) to generate input programs, including information about their parameters and types, as test cases for the simulators. The LLM’s output becomes the initial seed for an existing fuzzer, <Emphasis FontCategory="NonProportional">AFL++</Emphasis>, which has been enhanced with three mutation operators, targeting both the input binary program and its parameters. We implement our approach in a tool called <Emphasis FontCategory="NonProportional">SearchSYS</Emphasis> . We use it to test the <Emphasis FontCategory="NonProportional">gem5</Emphasis> system simulator. <Emphasis FontCategory="NonProportional">SearchSYS</Emphasis> discovered 21 new bugs in <Emphasis FontCategory="NonProportional">gem5</Emphasis> , 14 where <Emphasis FontCategory="NonProportional">gem5</Emphasis> ’s software prediction differs from the real behaviour on actual hardware, and 7 where it crashed. New defects were uncovered with each of the 6 LLMs used.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Enhancing search-based testing with LLMs for finding bugs in system simulators

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年7月10日

查看全文
  • Aidan Dakhama,
  • Karine Even-Mendoza,
  • W. B Langdon,
  • Héctor D. Menéndez,
  • Justyna Petke

摘要

Despite the wide availability of automated testing techniques such as fuzzing, little attention has been devoted to testing computer architecture simulators. We propose a fully automated approach for this task. Our approach uses large language models (LLM) to generate input programs, including information about their parameters and types, as test cases for the simulators. The LLM’s output becomes the initial seed for an existing fuzzer, AFL++, which has been enhanced with three mutation operators, targeting both the input binary program and its parameters. We implement our approach in a tool called SearchSYS . We use it to test the gem5 system simulator. SearchSYS discovered 21 new bugs in gem5 , 14 where gem5 ’s software prediction differs from the real behaviour on actual hardware, and 7 where it crashed. New defects were uncovered with each of the 6 LLMs used.