Register-coverage guided fuzzing
TechniqueRegister-coverage guided fuzzing is a feedback-guided fuzzing technique for CPU RTL verification introduced in the DIFUZZRTL work. In the provided evidence, it is described as guiding mutation and selection using register coverage, including cycle-sensitive register coverage, to efficiently and correctly identify finite-state-machine state transitions in RTL designs.
First seen 6/9/2026
Last seen 6/28/2026
Evidence 8 chunks
Wiki v1
WIKI
Overview
Register-coverage guided fuzzing is a technique introduced in the DIFUZZRTL work for fuzzing CPU RTL designs. The paper states that DIFUZZRTL "develops a register-coverage guided fuzzing technique" for RTL fuzzing.[C1]
Purpose
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
8 connectionsDIFUZZRTL incorporates a register-coverage guided fuzzing technique.
Register-coverage guided fuzzing targets FSM state exploration as its coverage goal.
Register-coverage guided fuzzing uses control registers as the basis for measuring coverage.
Per-instruction mutation is part of DIFUZZRTL's overall register-coverage guided fuzzing approach.
SimInput is the input format used within DIFUZZRTL's register-coverage guided fuzzing framework.
Interrupt mutation is part of DIFUZZRTL's overall fuzzing input generation approach.
The paper presents a new register-coverage guided fuzzing technique.
The register-coverage guided fuzzing technique relies on correctly identifying FSM state transitions.
CITATIONS
5 sources5 citations — click to expand
[1] C1: Register-coverage guided fuzzing is introduced in the DIFUZZRTL work as a fuzzing technique for CPU RTL designs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[2] C2: The technique is described as efficiently yet correctly identifying state transitions in the finite state machine of RTL designs. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs
[3] C3: In the described workflow, DIFUZZRTL runs ISA and RTL simulation on the identical SimInput and cross-checks final memory states and architectural registers. DIFUZZRTL: Differential Fuzz Testing to Find
[4] C4: Fuzz iterations repeat while input mutation and selection are guided to increase register-coverage. DIFUZZRTL: Differential Fuzz Testing to Find
[5] C5: DIFUZZRTL includes cycle-sensitive register coverage guiding as an RTL-specific technique. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs