An Exhaustive Approach to Detecting Transient Execution Side Channels in RTL Designs of Processors

Hardware (HW) security issues have been emerging at an alarming rate in recent years. Transient execution attacks, particular, pose a genuine threat to the of modern computing systems. Despite advances, understanding intricate implications microarchitectural design decisions on processor remains great challenge and has caused number update cycles past. This papers addresses need for new approach HW sign-off verification which guarantees processors Register Transfer Level (RTL). To this end, we introduce formal definition with respect transient formulated as property. We present proof methodology based Unique Program Execution Checking (UPEC) can be used systematically detect all vulnerabilities attacks RTL designs. UPEC does not exploit any priori knowledge known therefore also new, so far unknown, types channels. is demonstrated by two attack scenarios discovered our experiments UPEC. scales wide range designs, including in-order (RocketChip), pipelines out-of-order writeback (Ariane), deep speculative (BOOM). best knowledge, first technique that exhaustively covers side channels realistic complexity.