Microarchitectural State Divergence
Microarchitectural state divergence is a security-analysis concept in which differences in the internal microarchitectural state of a processor are used to make information leakage observable during hardware testing. In the context of hardware-software leakage contracts, it is used as the observable signal in a self-compositional fuzzing framework for detecting contract violations in processor designs.[1]
Context
Modern processors may leak information through side channels even when their functional behavior appears correct. Hardware-software leakage contracts have been proposed as a formal way to specify the side-channel security guarantees that processor hardware should provide.[1] However, verifying that a complex hardware implementation complies with such a contract remains difficult: formal verification can provide strong guarantees, but existing verification approaches may not scale well to industrial-sized processor designs.[1]
Traditional hardware fuzzing is widely used to find functional correctness bugs, but such fuzzers are typically not designed to detect information leaks such as Spectre-style leakage.[1] Microarchitectural state divergence addresses this gap by turning leakage into an observable testing target.
Role in Contract Fuzzing
In the described approach, a self-compositional framework is used to compare executions in a way that exposes information leakage as divergence in microarchitectural state.[1] Rather than only checking whether architectural outputs match, the framework looks for differences in microarchitectural behavior that indicate a violation of the intended leakage contract.[1]
This makes microarchitectural state divergence useful as a fuzzing oracle: if two executions that should be indistinguishable under a leakage contract nevertheless produce different microarchitectural states, the divergence can signal a potential side-channel vulnerability.[1]
Self-Composition Deviation
The cited work introduces Self-Composition Deviation (SCD) as a security-oriented coverage metric for guiding fuzzing toward executions likely to violate leakage contracts.[1] SCD is designed to steer the fuzzer toward execution paths where self-composed executions deviate in ways relevant to security, rather than merely maximizing conventional functional coverage.[1]
In this setting, microarchitectural state divergence is not just an observation after fuzzing; it is part of the feedback mechanism that helps guide the fuzzer toward leakage-relevant behavior.[1]
Evaluation Setting
The approach was implemented and evaluated on two open-source RISC-V processors:
- Rocket Core, an in-order RISC-V core.[1]
- BOOM, a more complex out-of-order RISC-V core.[1]
The evaluation found that coverage-guided strategies outperformed unguided fuzzing, and that increased microarchitectural coverage enabled faster discovery of security vulnerabilities in the BOOM core.[1]
Significance
Microarchitectural state divergence is significant because it provides a practical way to observe side-channel-relevant leakage during pre-silicon processor testing. By connecting leakage-contract violations to measurable divergence in processor microarchitectural state, it allows fuzzing techniques to target security properties rather than only functional correctness.[1]
This makes it especially relevant for complex processors where exhaustive formal verification may be difficult to scale, but where side-channel security bugs can remain invisible to conventional hardware fuzzing.[1]
References
[1]: Gideon Geier, Pariya Hajipour, and Jan Reineke, “Coverage-Guided Pre-Silicon Fuzzing of Open-Source Processors based on Leakage Contracts,” arXiv:2511.08443v2 [cs.CR]. DOI: 10.48550/arXiv.2511.08443.