  MicroScope, and microarchitectural replay attacks in general, take advantage
of the characteristics of speculative execution to trap the execution of the
victim application in an infinite loop, enabling the attacker to amplify a
side-channel attack by executing it indefinitely. Due to the nature of the
replay, it can be used to effectively attack security critical trusted
execution environments (secure enclaves), even under conditions where a
side-channel attack would not be possible. At the same time, unlike speculative
side-channel attacks, MicroScope can be used to amplify the correct path of
execution, rendering many existing speculative side-channel defences
ineffective.
  In this work, we generalize microarchitectural replay attacks beyond
MicroScope and present an efficient defence against them. We make the
observation that such attacks rely on repeated squashes of so-called "replay
handles" and that the instructions causing the side-channel must reside in the
same reorder buffer window as the handles. We propose Delay-on-Squash, a
technique for tracking squashed instructions and preventing them from being
replayed by speculative replay handles. Our evaluation shows that it is
possible to achieve full security against microarchitectural replay attacks
with very modest hardware requirements, while still maintaining 97% of the
insecure baseline performance.
