Skip to content
STIMSMITH

MulDiv module

Concept WIKI v1 · 5/28/2026

The MulDiv module is described in the ProcessorFuzz paper as the multiplication unit of the RISC-V Rocket Core. It is notable in that study because its `remainder` register caused a large share of DIFUZZRTL register-coverage feedback, illustrating how datapath-heavy registers can mislead hardware fuzzers.

Overview

The MulDiv module is identified in the ProcessorFuzz paper as the multiplication unit of the open-source, RISC-V-based Rocket Core. In the paper, it is used as a concrete example of how register-coverage feedback in RTL processor fuzzing can be misleading when datapath registers dominate the coverage signal.

Role in DIFUZZRTL coverage feedback

DIFUZZRTL monitors registers whose values are directly or indirectly used to control multiplexer selection signals. For each clock cycle during RTL simulation, it hashes the values of the monitored registers into a coverage map to represent the current finite-state-machine state; a new hash value is treated as increased register coverage.

In Rocket Core's MulDiv module, the paper reports a 130-bit remainder register that indirectly controls 98 mux selection signals. Because of this relationship, DIFUZZRTL identifies the remainder register for monitoring during fuzzing. The paper also notes that, after DIFUZZRTL search-space optimizations, 98 bits of the remainder register are ultimately tracked.

Coverage behavior in the ProcessorFuzz study

The MulDiv module dominated module-wise register coverage in the Rocket Core experiment described by ProcessorFuzz. At the end of a 24-hour fuzzing session, 62% of the overall register coverage was attributed to the MulDiv module. Within MulDiv, the remainder register was the major contributor to coverage growth compared with the module's other registers.

Significance

The ProcessorFuzz paper uses the MulDiv module to illustrate a limitation of register-coverage-based hardware fuzzing. Although the remainder register affects mux selection signals and therefore appears relevant under DIFUZZRTL's register-selection strategy, the paper characterizes such registers as datapath-related and as having minimal control over the current hardware FSM state. As a result, coverage increases driven by the remainder register can expand the fuzzer's search space without providing meaningful information about the hardware control state.

CITATIONS

5 sources
5 citations
[1] The MulDiv module is the multiplication unit of the open-source, RISC-V-based Rocket Core. ProcessorFuzz: Processor Fuzzing with Control and
[2] DIFUZZRTL monitors registers whose values are directly or indirectly used to control multiplexer selection signals and hashes monitored register values during RTL simulation to compute register coverage. ProcessorFuzz: Processor Fuzzing with Control and
[3] In Rocket Core's MulDiv module, a 130-bit remainder register indirectly controls 98 mux selection signals, causing DIFUZZRTL to identify it for monitoring; after optimizations, 98 bits of the remainder register are tracked. ProcessorFuzz: Processor Fuzzing with Control and
[4] In a 24-hour Rocket Core fuzzing session, 62% of overall register coverage came from the MulDiv module, and the remainder register was the major contributor to coverage increase within MulDiv. ProcessorFuzz: Processor Fuzzing with Control and
[5] The ProcessorFuzz paper argues that datapath registers such as remainder can significantly increase the fuzzing search space while providing little meaningful information about the current hardware FSM state. ProcessorFuzz: Processor Fuzzing with Control and