S POILER : Speculative Load Hazards Boost Rowhammer and Cache - PowerPoint PPT Presentation

S POILER : Speculative Load Hazards Boost Rowhammer and Cache Attacks Saad Islam, Daniel el Mogh ghimi (@danielmgmi), Ida Bruhns, Moritz Krebbel, Berk Gulmezoglu, Thomas Eisenbarth, Berk Sunar Worcest ster Polytechnic Institute & Univer ersity of Lübec eck 1

CPU Optimization on? • Branch Prediction • Cache and internal buffers • Speculate the Speculations??! – "speculative prefetching“ – "speculatively scheduled operation“ – "speculative execution event counter“ – "speculative memory accesses“ – "speculative load instruction" 2

Specula lative Load Execute X1 X2 X3 X4 X5 store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d 3

Specula lative Load Execute X1 X2 X3 X4 X5 store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d 4

Resource is Busy Specula lative Load for Store! Execute X1 X2 X3 X4 X5 store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d 5

Whatever, Let’s Load and Specula lative Load Compute!!! Execute X1 X2 X3 X4 X5 store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d 6

Huum! Was it dependent Specula lative Load on Stores? Execute X1 X2 X3 X4 X5 store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d 7

No Clue! Check store ADDRE DRESSES: Specula lative Load X, Y, Z? Execute X1 X2 X3 X4 X5 store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d 8

How about this one? Is W dependent on Specula lative Load Y? Execute X1 X2 X3 X4 X5 store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d 9

Or this one? Specula lative Load W VS. X? Execute X1 X2 X3 X4 X5 store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d 10

Wrong. Specula lative Load Flush it!!! Execute X1 X2 X3 X4 X5 store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d 11

Virtual & Physical Addresses What are store and load addresse ses? s? Address 0 x 0 4 0 F E 6 4 1 0 C 0 Virtual Page Offset VFN (12 bits) 12

Virtual & Physical Addresses What are store and load addresse ses? s? Address 0 x 0 4 0 F E 6 4 1 0 C 0 TLB Virtual Page Offset VFN (12 bits) 13

Virtual & Physical Addresses What are store and load addresse ses? s? Address 0 x 0 4 0 F E 6 4 1 0 C 0 TLB Virtual Page Offset VFN (12 bits) PMH 14

Virtual & Physical Addresses What are store and load addresse ses? s? Address 0 x 0 4 0 F E 6 4 1 0 C 0 TLB Virtual Page Offset VFN (12 bits) PMH address 0 x 5 4 4 0 2 3 0 C 0 Physical PFN 15

Virtual & Physical Addresses What are store and load addresse ses? s? Address 0 x 0 4 0 F E 6 4 1 0 C 0 TLB Virtual Page Offset VFN (12 bits) PMH address 0 x 5 4 4 0 2 3 0 C 0 Physical PFN 16

Design Chall llenges? • Loads are executed out-of-order and speculatively to avoid performance loss. • Load may be dependent on preceding stores (dependency). • Dependency check is difficult: – Virtual addresses may be aliased. – Physical addresses are not available immediately. – Stores may stay in-flight for a while. – We can’t wait for them to succeed. – Can we forward the data from the store to the load? 17

SPOILER 18

US 7,603,527 B2 RESOLVING FALSE DEPENDENCIES OF SPECULATIVE LOAD INSTRUCTIONS “an operation X may determine whether the lower portion of the virtual address of a speculative load instruction matches the lower portion of virtual addresses of older store operations” LoosnetCheck “an operation Y may determine whether the upper portion of the virtual address of the speculative load matches the upper portion of virtual addresses of older store” “If there is a hit at operation Y then the load may be blocked” “in an embodiment, the load instruction may have its input data forwarded SPOILER Attack from the store operation from which the load instruction depends at operation” Store Forwarding Dependency Resolu lution “If there is a hit at operation X and a miss at operation Y, … the physical addresses of the load and the store may be compared at an operation Z” “In one embodiment, if there is a hit at operation X and the physical address of the load or the store operations is not valid, the physical address check at operation Z may be considered as a hit” “In some embodiments, the physical address check at operation Z may use a partial physical address, e.g., base on data stored in the SAB. This makes the checking at operation Z conservative. Accordingly, in some embodiments, 19 a match may occur on a partial address and block …” FinenetCheck

SPOIL ILER ER Attack … Virtual Pages 20

SPOIL ILER ER Attack … Virtual Pages 64 pages 21

SPOIL ILER ER Attack … Virtual Pages 64 pages 0 x 4 0 0 F E 1 0 C 0 Stores 0 x 4 0 0 F E 2 0 C 0 … … 0 x 4 0 1 0 2 0 0 C 0 22

SPOIL ILER ER Attack … Virtual Pages 64 pages 0 x 4 0 0 F E 1 0 C 0 Stores 0 x 4 0 0 F E 2 0 C 0 … … 0 x 4 0 1 0 2 0 0 C 0 Load 0 x 4 F 1 2 3 4 0 C 0 23

SPOIL ILER ER Attack … Virtual Pages 0 x 4 0 0 F E 2 0 C 0 Stores 0 x 4 0 0 F E 3 0 C 0 … … 0 x 4 0 1 0 2 1 0 C 0 Load 0 x 4 F 1 2 3 4 0 C 0 24

SPOIL ILER ER Attack … Virtual Pages 0 x 4 0 0 F E 3 0 C 0 Stores 0 x 4 0 0 F E 4 0 C 0 … … 0 x 4 0 1 0 2 2 0 C 0 Load 0 x 4 F 1 2 3 4 0 C 0 25

SPOIL ILER ER Attack … Virtual Pages Virtual Addresses 0 x 4 0 0 F E 4 0 C 0 Stores 0 x 4 0 0 F E 5 0 C 0 Physical Addresses … … 0 x 4 0 1 0 2 3 0 C 0 0 x 6 5 F 3 2 X X X 0 C 0 Load 0 x 4 F 1 2 3 4 0 C 0 0 x 3 2 A C 2 X X X 0 C 0 26

SPOIL ILER ER Attack … Virtual Pages 27

SPOILER Boosts ts Cache Attack cks 28

SPOIL ILER ER Boosts Cache he Attacks ks Core 1 Core 2 LLC DRAM 29

SPOIL ILER ER Boosts Cache he Attacks ks Core Core 1 Prime+Pr Probe obe Victim Set 1 Set 2 … Set n DRAM 30

SPOIL ILER ER Boosts Cache he Attacks ks Core Core 1 Prime+Pr Probe obe Victim Set 2 … Set n DRAM 31

SPOIL ILER ER Boosts Cache he Attacks ks Core Address 0 x 0 4 0 F E 6 4 1 0 C 0 Core 1 Virtual Prime+Pr Probe obe Victim address 0 x 5 4 4 0 2 3 0 C 0 Physical Cache Index Byte Offset (6 Bit) Set 2 … Set n DRAM 32

SPOIL ILER ER Boosts Cache he Attacks ks Core Address 0 x 0 4 0 F E 6 4 1 0 C 0 Core 1 Virtual Prime+Pr Probe obe Victim address 0 x 5 4 4 0 2 3 0 C 0 Physical Cache Index Byte Offset (6 Bit) Skylake Client L1: 64 Sets, 6 bit Index Set 2 … Set n L2: 1024 Sets, 10 bit Index LLC: 2048 Sets, 11 bit Index, 1-2 bit slices DRAM 33

SPOIL ILER ER – Javascript Eviction on Sets • 1 MB Aliasing Leakage • Eviction Set Finding Comparison 34

SPOILER Boosts ts Rowhammer 35

SPOIL ILER ER Boosts Rowhammer • Physical addresses are used for mapping DRAM banks – More Banks, More Physical Address Bits address 0 x 5 4 4 0 2 3 0 C 0 Physical • Single-Sided Rowhammer: – Requirement: Bank Co-location PFN • Double-Sided Rowhammer: – Contiguous Memory Pages 36

SPOIL ILER ER Boosts Rowhammer • Reverse Engineering DRAM Banks using DRAMA Tool • Rowbuffer Conflict 37

SPOIL ILER ER Boosts Rowhammer • Detecting Contiguous Memory • Rowhammer Bitflips 38

CVE-201 2019-01 0162 62 • 12/01/2018: We informed our findings to iPSIRT. • 12/03/2018: iPSIRT acknowledged the receipt. • 03/01/2018: We published the paper. • 04/09/2019: iPSIRT released public advisory (INTELSA-00238) (CVE-2019-0162). • And we got some free logos, Thanks to Media !!! 39

Question ons?! ?! @danielmgmi https://github.com/UzL-ITS/Spoiler 40

41

SPOIL ILER ER Attack – HPC Analy lysis 42