Abstract:Modern processors make use of optimization techniques such as cache and speculation mechanisms to greatly improve performance. But recent research has found that these techniques can also be exploited by attackers to perform powerful side-channel attacks. A large number of powerful cache-based attacks have been replicated and enhanced over Intel X86- and ARM-based architectures, but there is a relative lack of research on RISC-V-based architectures. Xuantie-910 and BOOM are both RISC-V-based processors. So far, cache-side channels in the unprivileged case of Xuantie-910 have not been proven, while cache attacks against BOOM are proliferating. There are two types of caches, including physically-indexed physically-tagged (PIPT) cache (adopted by Xuantie-910) and virtually-indexed physically-tagged (VIPT) cache (adopted by BOOM), corresponding to two different cache addressing forms. VIPT has higher addressing performance than PIPT, since it can directly obtain cache line index from virtual address. In this paper, we study Xuantie-910 and BOOM to explore the impact of cache design on the security of RISC-V-based microarchitecture. Specifically, we compare the impact of their cache addressing forms on precise flushing of cache lines at specified locations, which plays an important role in cache side-channel attacks. Experimental results show that for the VIPT cache in BOOM, the location-specified cache lines can be accurately flushed, and Spectre attack can be successfully carried out by using the cache side-channel. On the other hand, for the PIPT cache in Xuantie-910, it is impossible for attackers to directly and accurately flush the specified location of cache without affecting performance, which hinders the success of cache side-channel attacks. This provides us with an insight that one can adopt a VIPT-based cache with a mechanism similar to PIPT for preventing the accurate access of cache line index, which can not only keep the advantage of high-performance addressing in VIPT but also improve chip security.

SmokeBomb

Cache Design Effect on Microarchitecture Security: A Contrast Between Xuantie-910 and BOOM

MeshUp: Stateless Cache Side-channel Attack on CPU Mesh

Volcano: Stateless Cache Side-channel Attack by Exploiting Mesh Interconnect

CacheLight: Defeating the CacheKit Attack.

CacheOut: Leaking Data on Intel CPUs via Cache Evictions

Microarchitectural Leakage Templates and Their Application to Cache-Based Side Channels

SMoTherSpectre: exploiting speculative execution through port contention

Janus: An Uncertain Cache Architecture to Cope with Side Channel Attacks

Efficient Flush-Reload Cache Attack on Scalar Multiplication Based Signature Algorithm

SoC It to EM: ElectroMagnetic Side-Channel Attacks on a Complex System-on-Chip

Shesha: Multi-head Microarchitectural Leakage Discovery in new-generation Intel Processors

Hot Pixels: Frequency, Power, and Temperature Attacks on GPUs and ARM SoCs

CacheHawkeye: Detecting Cache Side Channel Attacks Based on Memory Events.

Osiris: Automated Discovery of Microarchitectural Side Channels

Adversarial Prefetch: New Cross-Core Cache Side Channel Attacks

Dynamic Frequency-Based Fingerprinting Attacks against Modern Sandbox Environments

Mayhem: Targeted Corruption of Register and Stack Variables

Connecting the Dots: Privacy Leakage via Write-Access Patterns to the Main Memory

A Survey of Side-Channel Attacks in Context of Cache -- Taxonomies, Analysis and Mitigation

CacheZoom: How SGX Amplifies The Power of Cache Attacks