More Like this

1. Abstract interpretation under speculative execution

   https://doi.org/10.1145/3314221.3314647  

   Wu, Meng; Wang, Chao (July 2019, ACM SIGPLAN Conference on Programming Language Design and Implementation)
2. Speculative Execution Attacks and Hardware Defenses

   https://doi.org/10.1145/3474376.3487404  

   Lee, Ruby B. (November 2021, ASHES '21: Proceedings of the 5th Workshop on Attacks and Solutions in Hardware Security)

   Speculative execution attacks like Spectre and Meltdown exploit hardware performance optimization features to illegally access a secret and then leak the secret to an unauthorized recipient. Many variants of speculative execution attacks (also called transient execution attacks) have been proposed in the last few years, and new ones are constantly being discovered. While software mitigations for some attacks have been proposed, they often cause very significant performance degradation. Hardware solutions are also being proposed actively by the research community, especially as these are attacks on hardware microarchitecture. In this talk, we identify the critical steps in a speculative attack, and the root cause of successful attacks. We define the concept of "security dependencies", which should be implemented to prevent data leaks and other security breaches. We propose a taxonomy of defense strategies and show how proposed hardware defenses fall under each defense strategy. We discuss security-performance tradeoffs, which can decrease the performance overhead while still preventing security breaches. We suggest design principles for future security-aware microarchitecture. 

   more » « less
3. Harmonizing Speculative and Non-Speculative Execution in Architectures for Ordered Parallelism

   https://doi.org/10.1109/MICRO.2018.00026  

   Jeffrey, Mark C.; Ying, Victor A.; Subramanian, Suvinay; Lee, Hyun Ryong; Emer, Joel; Sanchez, Daniel (October 2018, Proceedings of the 51st Annual IEEE/ACM International Symposium on Microarchitecture (MICRO-51))

   Multicore systems should support both speculative and non-speculative parallelism. Speculative parallelism is easy to use and is crucial to scale many challenging applications, while non-speculative parallelism is more efficient and allows parallel irrevocable actions (e.g., parallel I/O). Unfortunately, prior techniques are far from this goal. Hardware transactional memory (HTM) systems support speculative (transactional) and non-speculative (non-transactional) work, but lack coordination mechanisms between the two, and are limited to unordered parallelism. Prior work has extended HTMs to avoid the limitations of speculative execution, e.g., through escape actions and open-nested transactions. But these mechanisms are incompatible with systems that exploit ordered parallelism, which parallelize a broader range of applications and are easier to use. We contribute two techniques that enable seamlessly composing and coordinating speculative and non-speculative work in the context of ordered parallelism: (i) a task-based execution model that efficiently coordinates concurrent speculative and non-speculative ordered tasks, allowing them to create tasks of either kind and to operate on shared data; and (ii) a safe way for speculative tasks to invoke software-managed speculative actions that avoid hardware version management and conflict detection. These contributions improve efficiency and enable new capabilities. Across several benchmarks, they allow the system to dynamically choose whether to execute tasks speculatively or non-speculatively, avoid needless conflicts among speculative tasks, and allow speculative tasks to safely invoke irrevocable actions. 

   more » « less
4. SoK: Hardware Defenses Against Speculative Execution Attacks

   https://doi.org/10.1109/SEED51797.2021.00023  

   Hu, Guangyuan; He, Zecheng; Lee, Ruby B. (September 2021, 2021 International Symposium on Secure and Private Execution Environment Design (SEED))

   Speculative execution attacks leverage the speculative and out-of-order execution features in modern computer processors to access secret data or execute code that should not be executed. Secret information can then be leaked through a covert channel. While software patches can be installed for mitigation on existing hardware, these solutions can incur big performance overhead. Hardware mitigation is being studied extensively by the computer architecture community. It has the benefit of preserving software compatibility and the potential for much smaller performance overhead than software solutions. This paper presents a systematization of the hardware defenses against speculative execution attacks that have been proposed. We show that speculative execution attacks consist of 6 critical attack steps. We propose defense strategies, each of which prevents a critical attack step from happening, thus preventing the attack from succeeding. We then summarize 20 hardware defenses and overhead-reducing features that have been proposed. We show that each defense proposed can be classified under one of our defense strategies, which also explains why it can thwart the attack from succeeding. We discuss the scope of the defenses, their performance overhead, and the security-performance trade-offs that can be made. 

   more » « less
5. PACMAN: Attacking ARM Pointer Authentication With Speculative Execution

   https://doi.org/10.1109/MM.2023.3273189  

   Ravichandran, Joseph; Na, Weon Taek; Lang, Jay; Yan, Mengjia (July 2023, IEEE Micro)