Designing and implementing malicious hardware

Onur: Why not add an additional instruction to the ISA that triggers the “evil” hardware?
Michael: If they reserve an entire way of the caches isn't this easily detectable by software the verifies the number of cache ways?
Eric: Fabs usually receive masks and not HDL. It's hard to make these “evil” modifications.
Michael/Eric: Shadow cache space is only used during attack. Rest of the time all ways are used by regular SW.
Once the trigger is used, then everyone can use it (not only the attackers).
Onur: How do they avoid detection through power analysis? Peter: very few gates added. There is also inherent variation in the fab process.