  As the complexity of logic designs increase, new avenues for testing digital
hardware becomes necessary. Fuzz Testing (fuzzing) has recently received
attention as a potential candidate for input vector generation on hardware
designs. Using this technique, a fuzzer is used to generate an input to a logic
design. Using a simulation engine, the logic design is given the generated
stimulus and some metric of feedback is given to the fuzzer to aid in the input
mutation. However, much like software fuzzing, hardware fuzzing uses code
coverage as a metric to find new possible fuzzing paths. Unfortunately, as we
show in this work, this coverage metric falls short of generic on some hardware
designs where designers have taken a more direct approach at expressing a
particular microarchitecture, or implementation, of the desired hardware.
  With this work, we introduce a new coverage metric which employs not code
coverage, but state coverage internal to a design. By observing changes in
signals within the logic circuit under testing, we are able to explore the
state space of the design and provide feedback to a fuzzer engine for input
generation. Our approach, Value-Guided Fuzzing (VGF), provides a generic metric
of coverage which can be applied to any design regardless of its
implementation. In this paper, we introduce our state-based VGF metric as well
as a sample implementation which can be used with any VPI, DPI, VHPI, or FLI
compliant simulator, making it completely HDL agnostic. We demonstrate the
generality of VGF and show how our sample implementation is capable of finding
bugs considerably faster than previous approaches.
