specdoctor | RTL testing framework to find transient execution

specdoctor is a C library. specdoctor has no bugs, it has no vulnerabilities and it has low support. You can download it from GitHub.

SpecDoctor is an RTL testing framework to find transient execution vulnerabilities in CPUs. Given the CPU RTL design, SpecDoctor outputs standalone PoCs which run on bare-metal CPUs. Currently SpecDoctor supports RISC-V Boom, and RISC-V NutShell. SpecDoctor is accepted at ACM CCS 2022 (paper). To be specific, SpecDoctor consists of 1) RoB monitor instrumentation, 2) suspicious RTL components instrumentation, and 3) dynamic fuzzing framework. RoB monitor instrumentation has to be manually done to print RoBLog on the detection of RoB rollback. Suspicious RTL components instrumentation is automatically done by SpecDoctor compiler, which finds and instruments suspicious RTL components that can be used as a side channel. Dynamic fuzzing framework consists of 4 steps: i) configuration, ii) transient-trigger, iii) secret-transmit, and iv) secret-receive. In configuration step, SpecDoctor populates the template of the attack model (i.e.., context of transient execution, and privileges of attacker and victim) from the given arguments. In transient-trigger step, SpecDoctor finds instructions triggering a transient execution. In secret-transmit step, SpecDoctor finds instructions transiently changing the u-arch states depending on secret. Finally, in secret-receive step, SpecDoctor finds instructions observing the changed u-arch states. For the detail, please see the paper.