Skip to content
STIMSMITH

RTL Fuzzing

Technique

RTL Fuzzing is a hardware verification technique that applies software-style fuzz testing—random or mutation-driven input generation—to designs expressed at the Register-Transfer Level (RTL). It encompasses coverage-guided graybox fuzzing (CGF), directed graybox fuzzing (DGF), and differential fuzzing against a golden reference model (e.g., an ISA simulator). Frameworks such as RFuzz, DirectFuzz, DiFuzzRTL, ProcessorFuzz, and INSTILLER illustrate different trade-offs in coverage metrics, simulation backends, and input-generation strategies for exposing hardware bugs before deployment.

First seen 5/24/2026
Last seen 9/1/2026
Evidence 14 chunks
Wiki v2

WIKI

RTL Fuzzing

Overview

RTL Fuzzing is a hardware verification technique in which a fuzzer generates and mutates inputs to a Register-Transfer Level (RTL) hardware design in order to expose bugs, unexpected behaviors, or security vulnerabilities. It is part of the broader field of Hardware Fuzzing, adapting software-style automated testing methods—originally devised for software bug finding—to digital designs expressed in HDLs such as Verilog or SystemVerilog.

READ FULL ARTICLE →

NEIGHBORHOOD

4 nodes · 5 edges
graph · RTL Fuzzing · depth=1

RELATIONSHIPS

15 connections
RTL uses → 100% 7e
RTL fuzzing targets RTL designs for verification.
INSTILLER ← implements 100% 6e
Instiller is an RTL fuzzer that implements the RTL fuzzing technique for CPU bug detection.
Instruction Sequence uses → 96% 4e
RTL fuzzing uses instruction sequences as the basic structure of its input.
DiFuzzRTL ← implements 95% 3e
DiFuzzRTL implements RTL fuzzing for CPU designs.
post-silicon fuzzing ← compares with 100% 2e
Post-silicon fuzzing is compared to RTL fuzzing as complementary approaches to finding CPU vulnerabilities.
fuzz testing uses → 2e
RTL fuzzing is an application of fuzz testing to hardware verification.
Coverage uses → 2e
RTL fuzzing uses coverage as a key metric for evaluating fuzzing effectiveness.
Coverage-guided Fuzzing uses → 90% 2e
RTL fuzzing employs coverage-guided fuzzing principles to drive test generation.
RFUZZ ← implements 97% 2e
RFuzz implements RTL fuzzing for hardware designs.
ProcessorFuzz ← implements 95% 1e
ProcessorFuzz implements RTL fuzzing for processor designs.
hardware fuzzing part of → 68% 1e
Classifies RTL-level fuzzing as a sub-technique used in hardware fuzzing verification efforts.
Profuzz ← implements 93% 1e
Profuzz simulates directly at RTL level rather than using software abstraction.
Seed Selection uses → 1e
RTL fuzzing relies on seed selection as a critical step in the fuzzing process.
program transformation mentions → 1e
Program transformation is mentioned as a software-oriented fuzzing technique not directly applicable to RTL fuzzing.
process tracing mentions → 1e
Process tracing is mentioned as a software-oriented fuzzing technique not directly applicable to RTL fuzzing.

LINKED ENTITIES

1 links
hardware fuzzing PART_OF Extracted graph relationship

CITATIONS

10 sources
10 citations — click to expand
[1] Coverage-Guided Graybox Fuzzing (CGF) is foundational for RTL-level fuzzing, with input generation driven by real-time code-coverage feedback to prioritize mutations that reveal unexplored paths. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[2] Directed Graybox Fuzzing (DGF) steers test generation toward specific regions of interest, useful for patch validation, bug localization, and module-specific testing in incremental hardware development flows. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[3] DirectFuzz is a DGF-based RTL fuzzer that focuses fuzzing on specific submodules (e.g., newly added components) rather than unchanged parts of the design. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[4] RFuzz uses mux-coverage as a replacement for code coverage, provides both Verilator simulation and FPGA-accelerated execution paths, and uses high-bandwidth DMA between the fuzzer and a synthesized DUT on a SoC. Fuzzing IPv4 modules on FPGAs
[5] DiFuzzRTL applies differential fuzzing at the RTL level by comparing an RTL simulation against an ISA simulation acting as a golden reference model, using register coverage instead of mux coverage. Fuzzing IPv4 modules on FPGAs
[6] ProcessorFuzz improves on DiFuzzRTL by using Control and Status Register (CSR) coverage and running the ISA simulation first to filter interesting inputs before invoking the slower RTL simulation. Fuzzing IPv4 modules on FPGAs
[7] Profuzz simulates directly at the RTL level to preserve hardware-specific characteristics such as concurrency and signal interactions, instead of using a Verilator software abstraction. Fuzzing IPv4 modules on FPGAs
[8] TurboFuzz runs the entire fuzzer, including the DUT, on an FPGA, supports random and mutation modes, performs differential testing against an ISA software emulator on the SoC CPU, and uses FPGA hardware snapshots for debugging mismatches. Fuzzing IPv4 modules on FPGAs
[9] INSTILLER is an RTL fuzzer based on ant colony optimization that distills input instructions with a VACO variant, simulates realistic interruptions/exceptions, and applies hardware-based seed selection and mutation strategies. INSTILLER: Towards Efficient and Realistic RTL Fuzzing
[10] Empirically, INSTILLER achieves 29.4% more coverage, 17.0% more mismatches, 79.3% shorter input instructions, and a 6.7% average execution-speed increase compared with DiFuzzRTL on real-world CPU cores. INSTILLER: Towards Efficient and Realistic RTL Fuzzing