Speculative taint tracking (STT) is a hardware defense mechanism for blocking all types of speculative execution attacks in modern processors. All details can be found in our MICRO'19 paper here. Here is a sample format for citing our work:
@inproceedings{yu2019stt,
title={Speculative Taint Tracking (STT) A Comprehensive Protection for Speculatively Accessed Data},
author={Yu, Jiyong and Yan, Mengjia and Khyzha, Artem and Morrison, Adam and Torrellas, Josep and Fletcher, Christopher W},
booktitle={Proceedings of the 52nd Annual IEEE/ACM International Symposium on Microarchitecture},
pages={954--968},
year={2019}
}
We implement STT using Gem5 simulator. This is built on an early version of Gem5 (commit:38a1e23). To make the simulation close to a commodity processor, we use Gem5's o3 processor. The major changes are:
How to use Gem5 can be found here.
--threat_model [string]: different threat models
--needsTSO [bool]: configure the consistency model
--STT [int]: configure STT
--implicit_channel [int]: configure implicit channel protection
We have a few sample scripts in './sample_scripts'.