DIFUZZRTL

DIFUZZRTL is a CPU RTL fuzzing tool introduced in the paper DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs. The paper abstract describes it as an RTL fuzzer for automatically discovering unknown bugs in CPU RTL implementations. [C1][C2]

Core ideas

The available evidence attributes the following techniques to DIFUZZRTL: [C3][C4]

• Register-coverage-guided fuzzing to efficiently identify state transitions in RTL finite-state behavior. [C3]
• Cycle-sensitive register-coverage guiding. [C3]
• Asynchronous interrupt event handling. [C3]
• A unified CPU input format with Tilelink protocols. [C4]
• Drop-in-replacement designs intended to support multiple CPU RTL targets. [C4]

Reported evaluation results

According to the cited abstract, DIFUZZRTL was evaluated on three real-world open-source CPU RTLs: OpenRISC Mor1kx Cappuccino, RISC-V Rocket Core, and RISC-V Boom Core. The reported evaluation says the tool found 16 new bugs, all confirmed by the corresponding development communities and vendors. [C5]

The same source states that six of those bugs were assigned CVE numbers, and the authors describe this as including, to the best of their knowledge, the first and only CVE of RISC-V cores at that time. [C6]

Role in later work

Later processor-fuzzing work uses DIFUZZRTL as a comparison point. The ProcessorFuzz evaluation reports that ProcessorFuzz triggered a set of ground-truth bugs 1.23× faster on average than DIFUZZRTL when evaluated on Rocket, BOOM, and BlackParrot. [C7]

The available evidence also shows DIFUZZRTL appearing in later experimental tooling around simulator-based comparison. The Cascade artifacts document a workflow that generates ELF files for DifuzzRTL and Cascade, then runs do_compare_cascade_difuzzrtl_modelsim.py with CASCADE_PATH_TO_DIFUZZRTL_ELFS_FOR_MODELSIM set to the ELF location; the reported output figure is modelsim.png. [C8]

Evidence-backed scope

From the supplied evidence, DIFUZZRTL is best described as a CPU RTL fuzzing system centered on register-coverage guidance and RTL-specific execution support, with published bug-finding results on Mor1kx, Rocket, and BOOM, and a later role as a baseline in processor-fuzzing comparisons. [C1][C3][C5][C7]