DIFUZZRTL
ToolDIFUZZRTL is a CPU RTL fuzzing tool presented as a differential fuzz-testing approach for finding processor bugs. The published abstract describes register-coverage-guided fuzzing and several RTL-specific mechanisms, and reports evaluation on Mor1kx Cappuccino, Rocket, and BOOM with 16 confirmed bugs. Later work uses DIFUZZRTL as a comparison baseline, including ProcessorFuzz and a Questasim/ModelSim comparison workflow in Cascade artifacts.
First seen 5/24/2026
Last seen 7/16/2026
Evidence 159 chunks
Wiki v7
WIKI
DIFUZZRTL
DIFUZZRTL is a CPU RTL fuzzing tool introduced in the paper DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs. The paper abstract describes it as an RTL fuzzer for automatically discovering unknown bugs in CPU RTL implementations. [C1][C2]
Core ideas
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
50 connectionsDifuzzRTL and ProcessorFuzz are compared in terms of bug-finding ability and coverage metrics.
DifuzzRTL and Cascade are compared in terms of bug detection performance.
Instiller is experimentally compared against DiFuzzRTL, showing improvements in coverage, mismatch detection, and instruction length.
DifuzzRTL relies on control register coverage as its coverage metric.
DifuzzRTL provides automatic instrumentation to realize the register-coverage technique in RTL, indicating it implements the metric.
MorFuzz is compared against DifuzzRTL in terms of coverage and performance.
DiFuzzRTL uses differential testing with an ISA simulation as a golden reference.
DifuzzRTL uses differential fuzzing by comparing CPU output with an ISS.
DIFUZZRTL adapts CGF to capture FSM state transitions during RTL simulation.
DIFUZZRTL is a differential fuzz testing tool for CPU RTLs.
Performance comparison between TheHuzz and DifuzzRTL.
DifuzzRTL uses an ISA simulator as a reference model for bug detection.
DIFUZZRTL runs RTL simulation alongside ISA simulation for differential testing.
DiFuzzRTL implements RTL fuzzing for CPU designs.
DiFuzzRTL uses an ISA simulation as a golden reference model for differential testing.
DIFUZZRTL evaluates the RISC-V BOOM Core as one of its real-world CPU RTL targets.
It relies on coverage feedback to steer mutations.
DIFUZZRTL relies on RTL simulation to evaluate test inputs.
DIFUZZRTL evaluates the OpenRISC Mor1kx Cappuccino as one of its real-world CPU RTL targets.
GoldenFuzz is compared against DifuzzRTL, achieving 3.33× speedup over it.
DIFUZZRTL incorporates a register-coverage guided fuzzing technique.
DIFUZZRTL is compared against RFuzz, the state-of-the-art RTL fuzzer, showing 40x faster execution and 6.4x faster state exploration.
DifuzzRTL uses control register coverage as its feedback signal.
The paper evaluates INSTILLER against DiFuzzRTL as a state-of-the-art baseline.
DifuzzRTL is a processor fuzzing tool.
DifuzzRTL was previously used to evaluate the Rocket Core processor.
DifuzzRTL applies differential fuzzing to find CPU bugs.
DIFUZZRTL monitors registers that control multiplexer selection signals as coverage metric
DifuzzRTL introduced the register coverage metric used by Lyra.
DIFUZZRTL monitors FSM state transitions via register coverage.
DIFUZZRTL is evaluated on the BOOM processor.
DIFUZZRTL is evaluated on the RISC-V Rocket Core processor.
Lyra is empirically compared against DifuzzRTL in coverage and throughput.
DIFUZZRTL's paper mentions speculative execution vulnerabilities as motivation for CPU RTL fuzzing.
DifuzzRTL is a state-of-the-art CPU fuzzer.
DIFUZZRTL evaluates the RISC-V Rocket Core as one of its real-world CPU RTL targets.
DIFUZZRTL generates input stimuli for RTL simulation based on SimInput.
DIFUZZRTL provides an open-source mutation engine that ProcessorFuzz also uses.
DIFUZZRTL was used to evaluate the BOOM Core processor.
DIFUZZRTL uses a pseudo interrupt controller in both ISA and RTL simulations.
DIFUZZRTL monitors registers controlling multiplexer selection signals as its coverage metric.
DIFUZZRTL cross-checks execution results from ISA and RTL simulations to identify bugs.
DIFUZZRTL considers SoC design when fuzzing CPU RTL designs, while providing a more direct input approach.
DIFUZZRTL introduces SimInput as a new unified CPU input format for fuzzing.
DIFUZZRTL implements CGF adapted for processor hardware fuzzing.
DIFUZZRTL uses SimInput as input to both ISA and RTL simulators.
DIFUZZRTL implements the register coverage metric for hardware fuzzing guidance.
DIFUZZRTL implements per-instruction mutation to generate valid instruction sequences for fuzzing.
DIFUZZRTL implements cycle-sensitive register coverage as a key feature of its coverage metric.
DIFUZZRTL uses control registers as the basis for its register-coverage metric.
CITATIONS
8 sources8 citations — click to expand
[1] The work presents DIFUZZRTL as 'Differential Fuzz Testing to Find CPU Bugs.' DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[2] The abstract describes DIFUZZRTL as an RTL fuzzer to automatically discover unknown bugs in CPU RTLs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[3] DIFUZZRTL develops register-coverage-guided fuzzing, cycle-sensitive register coverage guiding, and asynchronous interrupt event handling. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[4] The abstract also lists a unified CPU input format with Tilelink protocols and drop-in-replacement designs to support various CPU RTLs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[5] DIFUZZRTL was evaluated on OpenRISC Mor1kx Cappuccino, RISC-V Rocket Core, and RISC-V Boom Core, and the evaluation reported 16 new confirmed bugs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[6] Six reported bugs were assigned CVE numbers, and the authors state this included the first and only CVE of RISC-V cores to their knowledge. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[7] ProcessorFuzz reports triggering ground-truth bugs 1.23× faster on average than DIFUZZRTL on Rocket, BOOM, and BlackParrot. ProcessorFuzz: Guiding Processor Fuzzing using Control and Status Registers | DeepAI
[8] Cascade artifacts document a Questasim/ModelSim workflow that generates ELF files for DifuzzRTL and compares Cascade and DifuzzRTL, storing the result as modelsim.png. comsec-group/cascade-artifacts