Simulating Spectre Attacks Under the RTL Model

Spectre attacks have raised concerns about hardware vulnerabilities. Consequently, clear comprehension of the hardware behavior in the processor is the premise for mitigating these severe security issues. We built a simulation platform that integrated the single-core processor and the cache subsystem. This platform is built with the vulnerabilities of the Speculative execution. And simulations conducted on this platform show that the processor can open the time window of speculative execution, during which the malicious code can be executed without any security checks. The attackers exploit this fact to build the cache-tag-based covert channel. Furthermore, a security litmus test was conducted, which uses the General Purpose Input/Output to probe the private data from the cache-tag-based channel. Therefore, this platform reveals the circuit behavior of the processor under the attacks, which can be viewed as a foundation for further research on the mitigation of Spectre attacks.