table mutator

Technique

A table mutator is a Logic Fuzzer technique for mutating RTL memory-like structures, such as branch-predictor tables, cache tag arrays, valid bits, and TLB entries, during processor verification. It is used to create hard-to-reach microarchitectural states, stress cache-bank utilization, and inject random instructions onto mispredicted paths via DPI-backed fuzzer tables.

First seen 5/28/2026

Last seen 5/28/2026

Evidence 4 chunks

Wiki v1

WIKI

Overview

A table mutator is a Logic Fuzzer technique that allows RTL memories to be mutated during verification. The MICRO-54 Logic Fuzzer paper describes table mutators as a way to fuzz memory-like microarchitectural structures such as branch-predictor tables, cache entries, and TLB entries. Examples include random invalidation of cache or TLB entries, fuzzing values in already-invalid entries, and freely fuzzing branch-predictor tables when their contents must not affect architectural correctness.

Table mutators are intended to expose behavior that ordinary program execution may not reach. The paper notes that Logic Fuzzer can create microarchitectural states that no program could reach, so failures found by fuzzing are treated as potential bugs that must be proved or disproved by engineers.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

5 connections

Logic Fuzzer ← implements 100% 2e

The Logic Fuzzer implements table mutators to fuzz RTL memories.

branch predictor uses → 95% 2e

Table mutators fuzz branch predictor tables during simulation.

cache uses → 95% 2e

Table mutators fuzz cache tag arrays and valid bits to stress cache behavior.

TLB uses → 90% 1e

Table mutators can randomly invalidate TLB entries.

DPI uses → 90% 1e

Table mutators are accessed through DPI from the RTL.

LINKED ENTITIES

5 links

Logic Fuzzer IMPLEMENTS Extracted graph relationship

branch predictor USES Extracted graph relationship

cache USES Extracted graph relationship

TLB USES Extracted graph relationship

DPI USES Extracted graph relationship

CITATIONS

8 sources

8 citations — click to expand

[1] Table mutators allow RTL memories to be mutated, including branch-predictor tables, cache entries, and TLB entries. [PDF] Effective Processor Verification with Logic Fuzzer Enhanced Co ...

[2] A fuzzer object can allocate a table the same size as a branch predictor, and the implementation accesses the fuzzer table through DPI while fuzzing entries randomly or with specific patterns. [PDF] Effective Processor Verification with Logic Fuzzer Enhanced Co ...

[3] Cache tag arrays and valid bits can be mutated to steer cache accesses toward a bank of interest with relatively small RTL and Table Mutator implementation changes. [PDF] Effective Processor Verification with Logic Fuzzer Enhanced Co ...

[4] To insert random instructions into a mispredicted path, the described flow replaces instruction-cache tag and data arrays with table mutators accessed through DPI, forces a taken BHT prediction and a BTB target with a specific tag, and programs the fuzzer tables to return a random instruction stream for that tag. [PDF] Effective Processor Verification with Logic Fuzzer Enhanced Co ...

[5] Fuzzing BTB entries can provide falsely predicted or random addresses at runtime and can potentially create iTLB page faults on the mispredicted path; the same technique can be applied to a Return Address Stack. [PDF] Effective Processor Verification with Logic Fuzzer Enhanced Co ...

[6] High branch-prediction accuracy can leave the mispredicted path under-tested; in the CVA6 example, more than 200 tests did not reach 60% instruction coverage on the mispredicted path, while fuzzing can insert arbitrary instructions regardless of the binary. [PDF] Effective Processor Verification with Logic Fuzzer Enhanced Co ...

[7] Logic Fuzzer table mutators can partially close the checkpoint-reset-state gap by pre-populating or randomizing tables such as caches, TLBs, and other memory elements. [PDF] Effective Processor Verification with Logic Fuzzer Enhanced Co ...

[8] Logic Fuzzer can create microarchitectural states that no program could reach, so co-simulation failures exposed by fuzzing are potential bugs that engineers must prove or disprove. [PDF] Effective Processor Verification with Logic Fuzzer Enhanced Co ...