Skip to content
STIMSMITH

register coverage

Technique

Register coverage is a coverage metric introduced by DifuzzRTL for processor (CPU RTL) fuzzing. It instruments three extra registers (regstate, covmap, covsum) into each RTL module, hashes control-register values into regstate every clock cycle, and marks the corresponding slot in covmap; new slots increment covsum, with module-level sums aggregated into a final coverage value. DifuzzRTL applies the metric through automatic FIRRTL-based instrumentation and uses it as feedback for coverage-guided fuzzing, cross-checking RTL outputs against an ISA simulator. The ProcessorFuzz paper analyzes register coverage alongside a `reg-cov-difuzzrtl` configuration and highlights a case (a 130-bit remainder register in a division module) where it can produce misleading coverage, motivating the alternative CSR-transition coverage metric.

First seen 5/28/2026
Last seen 6/24/2026
Evidence 15 chunks
Wiki v3

WIKI

Overview

Register coverage (sometimes spelled register-coverage) is a CPU RTL coverage metric introduced by DifuzzRTL for processor fuzzing. It is designed to comprehensively capture RTL design state and to guide input generation during fuzzing; DifuzzRTL applies it as automatic instrumentation inside target RTL designs and pairs it with differential checking against an ISA reference simulator.[C1][C2]

How register coverage works

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

10 connections
DiFuzzRTL ← implements 100% 7e
DifuzzRTL provides automatic instrumentation to realize the register-coverage technique in RTL, indicating it implements the metric.
Finite State Machine uses → 95% 5e
Register coverage aims to track FSM states in the processor by monitoring register values.
CSR-transition coverage ← compares with 100% 4e
CSR transition coverage was introduced to address misleading cases in register coverage.
multiplexer toggle coverage uses → 90% 2e
Register coverage monitors registers that control multiplexer selection signals.
DiFuzzRTL ← introduces 95% 1e
The framework presents a new coverage metric, register-coverage, as part of its design for guiding input generation in CPU verification.
remainder register mentions → 95% 1e
Register coverage is shown to be misled by the remainder register in the MulDiv module.
DiFuzzRTL Paper ← introduces 97% 1e
The DiFuzzRTL paper introduces register coverage as an alternative to mux coverage.
DiFuzzRTL ← uses 98% 1e
DiFuzzRTL uses register coverage as its coverage metric.
Mux Coverage Instrumentation ← compares with 92% 1e
Register coverage was introduced as a more scalable alternative to mux coverage instrumentation.
Coverage-Guided Fuzzing ← uses 68% 1e
Register-coverage is presented as the coverage signal that steers fuzzing, aligning with the coverage-guided fuzzing technique employed by DifuzzRTL.

LINKED ENTITIES

2 links
DiFuzzRTL INTRODUCES Extracted graph relationship
Coverage-Guided Fuzzing USES Extracted graph relationship

CITATIONS

7 sources
7 citations — click to expand
[1] DifuzzRTL introduces a novel coverage metric called register-coverage that comprehensively captures RTL design states, automatically instruments it into target RTL designs, and uses it to guide fuzzing input generation alongside differential checking against an ISA simulator. DifuzzRTL — CPU RTL Differential Fuzzer | Open Awesome
[2] Register coverage is based on control registers; it injects three registers (regstate, covmap, covsum) into each RTL module, hashes control-register values into regstate each clock cycle, writes 1 into the covmap slot determined by regstate, increments covsum on new slots, and sums covsum across modules into a final coverage value. Fuzzing IPv4 modules on FPGAs - Search for publications in DiVA
[3] Mux coverage has two main limitations: it is clock-insensitive and can merge distinct FSM states, and its instrumentation resources scale quadratically with the number of muxes, which motivated DifuzzRTL's switch to control-register-based register coverage as a more scalable alternative. Fuzzing IPv4 modules on FPGAs - Search for publications in DiVA
[4] Register coverage can be misleading: a 130-bit remainder register in a division module (which qualifies as a control register and controls multiple mux signals) can dominate coverage increase even though it belongs to the data path and does not control the FSM, motivating ProcessorFuzz's CSR-transition coverage. Fuzzing IPv4 modules on FPGAs - Search for publications in DiVA
[5] The ProcessorFuzz evaluation compares no-cov-difuzzrtl (black-box DIFUZZRTL) and reg-cov-difuzzrtl (DIFUZZRTL guided by register coverage); reg-cov-difuzzrtl applies to Rocket and BOOM cores but not BlackParrot because the register-coverage passes target FIRRTL (Chisel HDL) rather than SystemVerilog. ProcessorFuzz: Processor Fuzzing with Control and Status ...
[6] Reported geometric-mean TTE values are 3182.9 (no-cov-difuzzrtl), 3245.1 (reg-cov-difuzzrtl), and 2630.7 (ProcessorFuzz selected); ProcessorFuzz achieves 1.21x and 1.23x geometric-mean speedups over the two DIFUZZRTL settings (up to 2.1x and 2.32x respectively); a 'Register coverage progress during fuzzing' plot compares all three configurations. ProcessorFuzz: Processor Fuzzing with Control and Status ...
[7] ProcessorFuzz selected only 33% of generated test inputs as interesting, launched RTL simulation only for those inputs, and used fast ISA simulation to quickly discard inputs that do not produce a new FSM state, contrasting with using register coverage as the main feedback. ProcessorFuzz: Processor Fuzzing with Control and Status ...