dfence: Fine-Grained Speculation Barriers for Efficient and Effective Hardware-Software Protection in the Spectre Era (Extended Version)

2026-08-06

AI Summary

This work addresses critical limitations in existing mitigations for speculative execution attacks such as Spectre-PHT and Spectre-STL, which often suffer from incomplete coverage, high performance overhead, or insufficient granularity. The authors propose dfence, a hardware-software co-designed instruction that annotates and protects sensitive registers in hardware to prevent their transient leakage during speculative execution. Correct usage of dfence is enforced through a static type system, ensuring semantic safety. By generalizing Speculative Load Hardening into a unified defense framework, this approach achieves, for the first time, efficient and fine-grained protection against both Spectre variants. Evaluation on the Proteus processor prototype demonstrates an average performance overhead of less than 1%, substantially outperforming current state-of-the-art defenses.

Abstract

Speculative execution attacks such as Spectre-PHT and Spectre-STL remain a critical security concern in modern processors. While software-based mitigations like Speculative Load Hardening (SLH) offer effective protection against Spectre-PHT, they are limited in scope and require software-managed speculative masks, which can be error-prone and costly. Defenses against Spectre-STL, such as the Speculative Store Bypass Disable bit (SSBD), incur additional performance overhead and lack fine-grained control. In this work, we introduce dfence, a new CPU instruction that generalizes SLH to mitigate both Spectre-PHT and Spectre-STL with minimal hardware support. dfence enables developers to annotate sensitive registers, with the hardware ensuring that these values do not leak transiently. We implement dfence in the Proteus CPU and evaluate its security and performance, demonstrating less than 1% average performance overhead for our benchmarks. In addition, to support easy and secure adoption, we design a type system that statically verifies the correct placement of dfence instructions in code.

Problem

• Speculative execution attacks
• Spectre-PHT
• Spectre-STL
• hardware-software protection
• security mitigation

Innovation

• speculative execution
• Spectre mitigation
• hardware-software co-design
• fine-grained speculation barrier
• transient execution security