  Attacks like Spectre abuse speculative execution, one of the key performance
optimizations of modern CPUs. Recently, several testing tools have emerged to
automatically detect speculative leaks in commercial (black-box) CPUs. However,
the testing process is still slow, which has hindered in-depth testing
campaigns, and so far prevented the discovery of new classes of leakage.
  In this paper, we identify the root causes of the performance limitations in
existing approaches, and propose techniques to overcome these limitations. With
these techniques, we improve the testing speed over the state-of-the-art by up
to two orders of magnitude.
  These improvements enable us to run a testing campaign of unprecedented depth
on Intel and AMD CPUs. As a highlight, we discover two types of previously
unknown speculative leaks (affecting string comparison and division) that have
escaped previous manual and automatic analyses.
