Overview
Processor State Coverage describes the coverage-oriented goal of exercising diverse processor architectural states during processor fuzzing. In the MorFuzz evidence, this goal is supported by stimulus templates that include processor state level runtime mutation primitives, along with instruction-field and program-semantic mutation primitives, to explore the processor input space more comprehensively. [Processor-state mutation primitives]
MorFuzz’s architecture ties state exploration to runtime feedback: it dynamically mutates instructions based on runtime information, executes the resulting instruction streams on both a processor under test and a simulator, and compares their architectural states after each instruction. [Runtime feedback and state comparison]
Role in MorFuzz
MorFuzz uses three techniques that are relevant to processor-state coverage:
- Stimulus templates provide multi-level mutation primitives, including processor-state-level primitives, instruction-field-level primitives, and program-semantic-level primitives. These templates are intended to generate diverse and meaningful instruction streams rather than directly emitting plain instruction streams. [Processor-state mutation primitives]
- Instruction morphing mutates instructions that are about to execute, using runtime information to modify opcodes and operands while maintaining valid field formats and meaningful semantics. The evidence states that this makes coverage more effective at guiding the fuzzer. [Instruction morphing and coverage guidance]
- Synchronizable co-simulation compares the architectural state of the device under test and simulator after each instruction. When differences are legal, MorFuzz can synchronize state from the device under test to the simulator, allowing synchronous co-simulation to continue and directing the fuzzer toward deeper states. [Synchronizable co-simulation and deeper states]
Verification context
The cited MorFuzz work focuses on software-triggered architectural functional bugs: combinations of instructions that make processor behavior deviate from the ISA specification. It verifies processor behavior under any privilege level, while excluding behavior that is undefined or unconstrained by the specification and excluding transient-execution bugs caused by microarchitectural mistakes. [MorFuzz verification scope]
Practical meaning
Within this evidence base, Processor State Coverage is best understood as a fuzzing objective and feedback target: tests should not merely generate many instructions, but should drive the processor through meaningful architectural states. MorFuzz operationalizes this by mutating processor state and instructions at runtime, measuring coverage feedback, and maintaining synchronized comparison against a golden simulator model. [Runtime feedback and state comparison]