Overview
Control Register Coverage is a hardware coverage metric used in simulation-based processor fuzzing. In the MorFuzz paper it is defined as the coverage derived from registers whose values are used for any multiplexer's select signal. Such registers are termed control registers, and the metric measures how many distinct states of these registers are exercised during fuzzing campaigns.
The metric is one of several hardware coverage matrices proposed for processor fuzzing, alongside mux coverage (used by the fuzzer of reference [37] cited in the MorFuzz paper) and hardware behavior coverage (used by TheHuzz).
Adoption by fuzzing tools
Control Register Coverage is explicitly used by two processor-fuzzing frameworks:
- DifuzzRTL — the framework that originally introduced this coverage matrix (cited as reference [30] in MorFuzz).
- MorFuzz — reuses the same control register coverage as DifuzzRTL "to facilitate comparison" of fuzzing effectiveness, and is described as compatible with the coverage matrices proposed by existing designs.
Instrumentation and measurement
Both DifuzzRTL and MorFuzz implement the same FIRRTL compiler pass to instrument all control registers in the design under test (DUT). The instrumentation, applied to the RTL (translated to Verilog and compiled with Synopsys VCS in the MorFuzz workflow), causes the instrumented circuits to:
- observe the states triggered in each module;
- count the different triggered states; and
- sum the per-module counts as the final coverage value.
The metric is described as clock-sensitive, meaning that the values sampled are those that actually propagate through the hardware on a clock edge, which the authors argue reflects the hardware state better than other coverage matrices.
Role in the fuzzing workflow
In the general processor-fuzzing workflow, the metric is collected during the hardware simulation phase: the DUT's RTL is translated into a host executable and the fuzzer relies on hardware instruments to gather coverage of the current input. Coverage values are then used to drive mutation of instruction streams between rounds.
Interpretation and limitations
Control Register Coverage is used solely to evaluate the effect of inputs and mutations; the MorFuzz paper explicitly cautions that achieving high control register coverage in the DUT does not mean that the design is bug-free. The same metric is therefore used as a comparative, not absolute, measure when benchmarking fuzzers such as DifuzzRTL and MorFuzz on the same DUTs.