SPOILER-GUARD: Gating Latency Effects of Memory Accesses through Randomized Dependency Prediction

TL;DR

SPOILER-GUARD is a hardware defense mechanism that reduces speculative dependency-related latency and mitigates vulnerabilities in microprocessors by randomizing address bits during dependency resolution, improving performance and security.

Contribution

It introduces a novel hardware technique that obfuscates dependency resolution to prevent latency amplification and transient execution attacks.

Findings

Reduces misspeculation to 0.0004%

Improves integer performance by 2.12%

Minimal hardware overheads at 14 nm

Abstract

Modern microprocessors depend on speculative execution, creating vulnerabilities that enable transient execution attacks. Prior defenses target speculative data leakage but overlook false dependencies from partial address aliasing, where repeated squash and reissue events increase the load-store latency, which is exploited by the SPOILER attack. We present SPOILER-GUARD, a hardware defense that obfuscates speculative dependency resolution by dynamically randomizing the physical address bits used for load-store comparisons and tagging store entries to prevent latency-amplifying misspeculations. Implemented in gem5 and evaluated with SPEC 2017, SPOILER-GUARD reduces misspeculation to 0.0004 percent and improves integer and floating-point performance by 2.12 and 2.87 percent. HDL synthesis with Synopsys Design Compiler at 14 nm node demonstrates minimal overheads - 69 ps latency in critical path, 0.064 square millimeter in area, and 5.863 mW in power.