DIFUZZRTL
ToolDIFUZZRTL is a CPU RTL fuzzing tool presented as a differential fuzz-testing approach for finding processor bugs. The published abstract describes register-coverage-guided fuzzing and several RTL-specific mechanisms, and reports evaluation on Mor1kx Cappuccino, Rocket, and BOOM with 16 confirmed bugs. Later work uses DIFUZZRTL as a comparison baseline, including ProcessorFuzz and a Questasim/ModelSim comparison workflow in Cascade artifacts.
First seen 5/24/2026
Last seen 9/21/2026
Evidence 182 chunks
Wiki v7
WIKI
DIFUZZRTL
DIFUZZRTL is a CPU RTL fuzzing tool introduced in the paper DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs. The paper abstract describes it as an RTL fuzzer for automatically discovering unknown bugs in CPU RTL implementations. [C1][C2]
Core ideas
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
50 connectionsProcessorFuzz is compared against DIFUZZRTL, showing it triggers bugs 1.23x faster on average.
Cascade is compared to DifuzzRTL in terms of coverage and performance.
Instiller is experimentally compared against DiFuzzRTL, showing improvements in coverage, mismatch detection, and instruction length.
DifuzzRTL uses differential fuzz testing to find CPU bugs.
DifuzzRTL relies on control register coverage as its coverage metric.
DifuzzRTL provides automatic instrumentation to realize the register-coverage technique in RTL, indicating it implements the metric.
MorFuzz is compared against DifuzzRTL in terms of coverage and performance.
DifuzzRTL uses differential fuzzing by comparing register values with an ISS.
DIFUZZRTL adapts CGF to capture FSM state transitions during RTL simulation.
DifuzzRTL was evaluated on the Rocket core.
DifuzzRTL implements mutation-based fuzzing as its core approach.
GenHuzz is benchmarked against DifuzzRTL on coverage metrics.
Performance comparison between TheHuzz and DifuzzRTL.
DIFUZZRTL is a differential fuzz testing tool for CPU RTLs.
DIFUZZRTL runs RTL simulation alongside ISA simulation for differential testing.
The paper evaluates DifuzzRTL as a baseline comparison for Cascade.
DifuzzRTL uses an ISA simulator as a reference model for bug detection.
DifuzzRTL cross-checks results against an ISA simulator to detect bugs.
DiFuzzRTL implements RTL fuzzing for CPU designs.
DifuzzRTL uses control register coverage as its feedback signal.
DIFUZZRTL is compared against RFuzz, the state-of-the-art RTL fuzzer, showing 40x faster execution and 6.4x faster state exploration.
DIFUZZRTL evaluates the RISC-V BOOM Core as one of its real-world CPU RTL targets.
DIFUZZRTL incorporates a register-coverage guided fuzzing technique.
DIFUZZRTL evaluates the OpenRISC Mor1kx Cappuccino as one of its real-world CPU RTL targets.
It relies on coverage feedback to steer mutations.
DifuzzRTL uses register-coverage as its coverage metric to guide input generation.
HiFuzz was compared against DifuzzRTL as a mutation-based fuzzing baseline.
DIFUZZRTL relies on RTL simulation to evaluate test inputs.
GoldenFuzz is compared against DifuzzRTL, achieving 3.33× speedup over it.
DifuzzRTL was previously used to evaluate the Rocket Core processor.
DifuzzRTL introduced the register coverage metric used by Lyra.
DifuzzRTL is a state-of-the-art CPU fuzzer.
The paper evaluates INSTILLER against DiFuzzRTL as a state-of-the-art baseline.
DifuzzRTL is a processor fuzzing tool.
DifuzzRTL applies differential fuzzing to find CPU bugs.
DIFUZZRTL monitors FSM state transitions via register coverage.
DIFUZZRTL is evaluated on the BOOM processor.
DIFUZZRTL implements asynchronous interrupt handling to manage interrupt events in RTL simulation.
DIFUZZRTL is evaluated on the RISC-V Rocket Core processor.
Lyra is empirically compared against DifuzzRTL in coverage and throughput.
The paper evaluates DifuzzRTL using the ENCARSIA framework and EnCorpus.
DIFUZZRTL implements cycle-sensitive register coverage as a key feature of its coverage metric.
DIFUZZRTL considers SoC design when fuzzing CPU RTL designs, while providing a more direct input approach.
DIFUZZRTL evaluates the RISC-V Rocket Core as one of its real-world CPU RTL targets.
DIFUZZRTL monitors registers controlling multiplexer selection signals as its coverage metric.
DIFUZZRTL was used to evaluate the BOOM Core processor.
DIFUZZRTL provides an open-source mutation engine that ProcessorFuzz also uses.
DIFUZZRTL uses backward data-flow analysis to identify control registers in RTL designs.
DIFUZZRTL implements per-instruction mutation to generate valid instruction sequences for fuzzing.
DIFUZZRTL uses a pseudo interrupt controller in both ISA and RTL simulations.
CITATIONS
8 sources8 citations — click to expand
[1] The work presents DIFUZZRTL as 'Differential Fuzz Testing to Find CPU Bugs.' DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[2] The abstract describes DIFUZZRTL as an RTL fuzzer to automatically discover unknown bugs in CPU RTLs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[3] DIFUZZRTL develops register-coverage-guided fuzzing, cycle-sensitive register coverage guiding, and asynchronous interrupt event handling. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[4] The abstract also lists a unified CPU input format with Tilelink protocols and drop-in-replacement designs to support various CPU RTLs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[5] DIFUZZRTL was evaluated on OpenRISC Mor1kx Cappuccino, RISC-V Rocket Core, and RISC-V Boom Core, and the evaluation reported 16 new confirmed bugs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[6] Six reported bugs were assigned CVE numbers, and the authors state this included the first and only CVE of RISC-V cores to their knowledge. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[7] ProcessorFuzz reports triggering ground-truth bugs 1.23× faster on average than DIFUZZRTL on Rocket, BOOM, and BlackParrot. ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers | DeepAI
[8] Cascade artifacts document a Questasim/ModelSim workflow that generates ELF files for DifuzzRTL and compares Cascade and DifuzzRTL, storing the result as modelsim.png. comsec-group/cascade-artifacts