Speculative taint tracking (STT)

Speculative execution attacks present an enormous security threat, capable of reading arbitrary program data under malicious speculation, and later exfiltrating that over microarchitectural covert channels. This paper proposes speculative taint tracking (STT), a high performance hardware mechanism to block these attacks. The main idea is it safe execute selectively forward the results instructions read secrets, as long we can prove forwarded do not reach potential technical core new abstraction help identify all micro-architectural channels, architecture quickly when channel no longer threat. We further conduct detailed formal analysis on scheme in companion document. When evaluated SPEC06 workloads, STT incurs 8.5% or 14.5% overhead relative insecure machine.