Overview
Register-coverage guided fuzzing is a technique introduced in the DIFUZZRTL work for fuzzing CPU RTL designs. The paper states that DIFUZZRTL "develops a register-coverage guided fuzzing technique" for RTL fuzzing.[C1]
Purpose
In the provided abstract, the technique is described as one that "efficiently yet correctly identifies a state transition in the finite state machine of RTL designs." This ties the technique directly to finite-state-machine state-transition identification in RTL verification.[C2]
How it is used in DIFUZZRTL
The provided workflow excerpt describes a repeated fuzzing loop in which DIFUZZRTL:
- randomly generates or mutates an input,
- runs both ISA simulation and RTL simulation on the same input,
- cross-checks the final memory state and architectural registers, and
- repeats the iteration while input mutation and selection are guided to increase register coverage.[C3][C4]
This makes register coverage the feedback signal used to steer ongoing fuzzing iterations in the system described by the paper.[C4]
RTL-specific aspects
The abstract also highlights "cycle-sensitive register coverage guiding" as one of the RTL-specific techniques developed in DIFUZZRTL. This indicates that the guidance is designed to account for cycle-level behavior rather than only end-state outcomes.[C5]
Context
Register-coverage guided fuzzing is presented as part of DIFUZZRTL, a differential fuzzing system for CPU RTLs. In the provided evidence, the same SimInput is supplied to both ISA and RTL simulation before results are compared, with register-coverage guidance used to steer subsequent fuzzing iterations.[C3][C4]