Abstract:Speculative execution side-channel vulnerabilities such as Spectre reveal that conventional architecture designs lack security consideration. This article proposes a software transparent defense framework, named as Conditional Speculation, against Spectre vulnerabilities found on traditional out-of-order microprocessors. It introduces the concept of security dependence to mark speculative memory instructions which could leak information with potential security risks. More specifically, security-dependent instructions are detected and marked with suspect speculation flags in the Issue Queue. All the instructions can be speculatively issued for execution in accordance with the classic out-of-order pipeline. For those instructions with suspect speculation flags, they are considered as safe instructions if their speculative execution dose not refill new cache lines with unauthorized privilege data. Otherwise, they are considered as unsafe instructions and thus not allowed to execute speculatively. To pursue a balance of performance and security, we investigate two filtering mechanisms, Cache-hit-based Hazard Filter and Trusted Page Buffer-based Hazard Filter to filter out false security hazards. As for true security hazards, we have two approaches to prevent them from changing cache states. One is to block all unsafe access, the other is to fetch them from lower-level caches or memory to a speculative buffer temporarily, and refill them after confirming that they are on the correct execution path. Our design philosophy is to speculatively execute safe instructions to maintain the performance benefits of out-of-order execution while delaying the cache updates for speculative execution of unsafe instructions for security consideration. We evaluate Conditional Speculation in terms of perf-rmance, security, and area. The experimental results show that the hardware overhead is marginal and the performance overhead is minimal.

Do You Even Lift? Strengthening Compiler Security Guarantees Against Spectre Attacks

SoK: Practical Foundations for Software Spectre Defenses

oo7: Low-overhead Defense against Spectre Attacks via Program Analysis

Exploiting Security Dependence for Conditional Speculation Against Spectre Attacks

InSpectre: Breaking and Fixing Microarchitectural Vulnerabilities by Formal Analysis

SNIP: Speculative Execution and Non-Interference Preservation for Compiler Transformations

Beyond Over-Protection: A Targeted Approach to Spectre Mitigation and Performance Optimization

LightSLH: Provable and Low-Overhead Spectre v1 Mitigation through Targeted Instruction Hardening

StatekeepSpec: Securing Speculative Execution Via Forbidding Change-Of-State.

Software Mitigation of RISC-V Spectre Attacks

ProSpeCT: Provably Secure Speculation for the Constant-Time Policy (Extended version)

Mis-speculation-Driven Compiler Framework for Aggressive Loop Automatic Parallelization

An Analysis of Speculative Type Confusion Vulnerabilities in the Wild

Comprehensive Kernel Safety in the Spectre Era: Mitigations and Performance Evaluation (Extended Version)

SpecSafe: detecting cache side channels in a speculative world

DECLASSIFLOW: A Static Analysis for Modeling Non-Speculative Knowledge to Relax Speculative Execution Security Measures (Full Version)

MeltdownPrime and SpectrePrime: Automatically-Synthesized Attacks Exploiting Invalidation-Based Coherence Protocols

Mitigating Speculation-based Attacks through Configurable Hardware/Software Co-design

Uncovering and Exploiting AMD Speculative Memory Access Predictors for Fun and Profit

Specognitor: Identifying Spectre Vulnerabilities via Prediction-Aware Symbolic Execution

RTL Verification for Secure Speculation Using Contract Shadow Logic