Nighthawk: Zero-Copy Cache Quarantine for Invisible Speculation

Abstract

Out-of-order execution enhances processor performance but introduces transient execution vulnerabilities that leak confidential data via microarchitectural side effects. Existing defenses often necessitate invasive hardware modifications—such as dedicated buffers or complex forwarding logic—resulting in prohibitive performance degradation. We propose Nighthawk, a lightweight defense that repurposes existing cache ways to isolate speculative loads without the area overhead of auxiliary structures. Nighthawk introduces an in-cache quarantine mechanism that dynamically allocates a specific cache way to buffer speculative data, effectively eliminating the data-copy latency inherent in decoupled buffer designs. By integrating this mechanism with Speculative Taint Tracking (STT), we transform STT’s restrictive stall policy into a prefetch-but-quarantine strategy. This approach recovers memory-level parallelism by allowing speculative misses to proceed into the quarantined way while blocking microarchitectural propagation until resolution. Evaluation using gem5 on SPEC CPU2006/2017 benchmarks demonstrates that Nighthawk reclaims performance lost to STT, reducing execution time by 6.2% on average and up to 28.8% for memory-intensive workloads, offering a more practical design point for secure high-performance processors.