DIFUZZRTL
ToolDIFUZZRTL is a CPU RTL fuzzing tool presented as a differential fuzz-testing approach for finding processor bugs. The published abstract describes register-coverage-guided fuzzing and several RTL-specific mechanisms, and reports evaluation on Mor1kx Cappuccino, Rocket, and BOOM with 16 confirmed bugs. Later work uses DIFUZZRTL as a comparison baseline, including ProcessorFuzz and a Questasim/ModelSim comparison workflow in Cascade artifacts.
First seen 5/24/2026
Last seen 9/1/2026
Evidence 172 chunks
Wiki v7
WIKI
DIFUZZRTL
DIFUZZRTL is a CPU RTL fuzzing tool introduced in the paper DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs. The paper abstract describes it as an RTL fuzzer for automatically discovering unknown bugs in CPU RTL implementations. [C1][C2]
Core ideas
NEIGHBORHOOD
14 nodes · 36 edgesgraph · DiFuzzRTL · depth=1
RELATIONSHIPS
50 connectionsDifuzzRTL and ProcessorFuzz are compared in terms of bug-finding ability and coverage metrics.
DifuzzRTL and Cascade are compared in terms of bug detection performance.
Instiller is experimentally compared against DiFuzzRTL, showing improvements in coverage, mismatch detection, and instruction length.
DifuzzRTL uses differential fuzz testing to find CPU bugs.
DifuzzRTL relies on control register coverage as its coverage metric.
DifuzzRTL provides automatic instrumentation to realize the register-coverage technique in RTL, indicating it implements the metric.
MorFuzz is compared against DifuzzRTL in terms of coverage and performance.
DifuzzRTL uses differential fuzzing by comparing CPU output with an ISS.
DIFUZZRTL adapts CGF to capture FSM state transitions during RTL simulation.
Performance comparison between TheHuzz and DifuzzRTL.
DifuzzRTL implements mutation-based fuzzing as its core approach.
GenHuzz is benchmarked against DifuzzRTL on coverage metrics.
DIFUZZRTL runs RTL simulation alongside ISA simulation for differential testing.
DifuzzRTL cross-checks results against an ISA simulator to detect bugs.
DifuzzRTL uses an ISA simulator as a reference model for bug detection.
DIFUZZRTL is a differential fuzz testing tool for CPU RTLs.
DiFuzzRTL implements RTL fuzzing for CPU designs.
DIFUZZRTL is compared against RFuzz, the state-of-the-art RTL fuzzer, showing 40x faster execution and 6.4x faster state exploration.
DIFUZZRTL evaluates the OpenRISC Mor1kx Cappuccino as one of its real-world CPU RTL targets.
DIFUZZRTL incorporates a register-coverage guided fuzzing technique.
DIFUZZRTL evaluates the RISC-V BOOM Core as one of its real-world CPU RTL targets.
It relies on coverage feedback to steer mutations.
DifuzzRTL uses register-coverage as its coverage metric to guide input generation.
DIFUZZRTL relies on RTL simulation to evaluate test inputs.
HiFuzz was compared against DifuzzRTL as a mutation-based fuzzing baseline.
GoldenFuzz is compared against DifuzzRTL, achieving 3.33× speedup over it.
DifuzzRTL uses control register coverage as its feedback signal.
DifuzzRTL introduced the register coverage metric used by Lyra.
DifuzzRTL was previously used to evaluate the Rocket Core processor.
DifuzzRTL is a processor fuzzing tool.
The paper evaluates INSTILLER against DiFuzzRTL as a state-of-the-art baseline.
DifuzzRTL is a state-of-the-art CPU fuzzer.
DifuzzRTL applies differential fuzzing to find CPU bugs.
DIFUZZRTL monitors FSM state transitions via register coverage.
DIFUZZRTL is evaluated on the BOOM processor.
DIFUZZRTL implements asynchronous interrupt handling to manage interrupt events in RTL simulation.
DIFUZZRTL implements cycle-sensitive register coverage as a key feature of its coverage metric.
DIFUZZRTL is evaluated on the RISC-V Rocket Core processor.
Lyra is empirically compared against DifuzzRTL in coverage and throughput.
DIFUZZRTL considers SoC design when fuzzing CPU RTL designs, while providing a more direct input approach.
DIFUZZRTL uses a pseudo interrupt controller in both ISA and RTL simulations.
DIFUZZRTL monitors registers controlling multiplexer selection signals as its coverage metric.
DIFUZZRTL evaluates the RISC-V Rocket Core as one of its real-world CPU RTL targets.
DIFUZZRTL was used to evaluate the BOOM Core processor.
DIFUZZRTL provides an open-source mutation engine that ProcessorFuzz also uses.
DIFUZZRTL generates input stimuli for RTL simulation based on SimInput.
DIFUZZRTL implements CGF adapted for processor hardware fuzzing.
DIFUZZRTL uses control registers as the basis for its register-coverage metric.
DIFUZZRTL uses backward data-flow analysis to identify control registers in RTL designs.
DIFUZZRTL implements the register coverage metric for hardware fuzzing guidance.
CITATIONS
8 sources8 citations — click to expand
[1] The work presents DIFUZZRTL as 'Differential Fuzz Testing to Find CPU Bugs.' DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[2] The abstract describes DIFUZZRTL as an RTL fuzzer to automatically discover unknown bugs in CPU RTLs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[3] DIFUZZRTL develops register-coverage-guided fuzzing, cycle-sensitive register coverage guiding, and asynchronous interrupt event handling. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[4] The abstract also lists a unified CPU input format with Tilelink protocols and drop-in-replacement designs to support various CPU RTLs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[5] DIFUZZRTL was evaluated on OpenRISC Mor1kx Cappuccino, RISC-V Rocket Core, and RISC-V Boom Core, and the evaluation reported 16 new confirmed bugs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[6] Six reported bugs were assigned CVE numbers, and the authors state this included the first and only CVE of RISC-V cores to their knowledge. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[7] ProcessorFuzz reports triggering ground-truth bugs 1.23× faster on average than DIFUZZRTL on Rocket, BOOM, and BlackParrot. ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers | DeepAI
[8] Cascade artifacts document a Questasim/ModelSim workflow that generates ELF files for DifuzzRTL and compares Cascade and DifuzzRTL, storing the result as modelsim.png. comsec-group/cascade-artifacts