论文标题
SIMF：用于处理器时间隔离的单一指导多刷子机制
SIMF: Single-Instruction Multiple-Flush Mechanism for Processor Temporal Isolation
论文作者
论文摘要
微体系定时计时攻击是一种信息泄漏攻击，它可以利用时间共享的微体系构件组件，例如caches，Translation Look-Aside缓冲液（TLB），分支预测单元（BPU）和投机性执行，在现代处理器中，以从受害者或线程中泄漏至关重要的信息。为了减轻此类攻击，由于核心状态太昂贵，无法分区，因此可以通过操作系统级别解决方案进行广泛使用的冲洗核心状态的机制。在这些系统中，潮红操作是在软件中实现的（使用缓存维护说明），从而严重限制了定时攻击保护的效率。 为了弥合这一差距，我们提出了专门的硬件支持，单个指导多刷子（SIMF）机制可以冲洗核心级别，该状态由L1缓存，BPU，TLB和注册文件组成。我们通过在标量内RISC-V处理器中将其作为ISA扩展名（即Flushx指令）实现来证明SIMF。在Xilinx ZCU102 FPGA上原型进行了原型处理器，并用最先进的SEL4 Microkernel，Linux内核在多核方案中进行了验证，并进行了缓存正时攻击。我们的评估表明，SIMF在执行时间中大大减轻了潮红的开销超过两个，并通过刻板级减少了动态指导计数。
Microarchitectural timing attacks are a type of information leakage attack, which exploit the time-shared microarchitectural components, such as caches, translation look-aside buffers (TLBs), branch prediction unit (BPU), and speculative execution, in modern processors to leak critical information from a victim process or thread. To mitigate such attacks, the mechanism for flushing the on-core state is extensively used by operating-system-level solutions, since on-core state is too expensive to partition. In these systems, the flushing operations are implemented in software (using cache maintenance instructions), which severely limit the efficiency of timing attack protection. To bridge this gap, we propose specialized hardware support, a single-instruction multiple-flush (SIMF) mechanism to flush the core-level state, which consists of L1 caches, BPU, TLBs, and register file. We demonstrate SIMF by implementing it as an ISA extension, i.e., flushx instruction, in scalar in-order RISC-V processor. The resultant processor is prototyped on Xilinx ZCU102 FPGA and validated with state-of-art seL4 microkernel, Linux kernel in multi-core scenarios, and a cache timing attack. Our evaluation shows that SIMF significantly alleviates the overhead of flushing by more than a factor of two in execution time and reduces dynamic instruction count by orders-of-magnitude.
