S POILER : Speculative Load Hazards Boost Rowhammer and Cache - - PowerPoint PPT Presentation

▶
s poiler speculative load hazards
SMART_READER_LITE
LIVE PREVIEW

S POILER : Speculative Load Hazards Boost Rowhammer and Cache - - PowerPoint PPT Presentation

Jun 06, 2023 471 likes •1k views

S POILER : Speculative Load Hazards Boost Rowhammer and Cache Attacks Saad Islam, Daniel el Mogh ghimi (@danielmgmi), Ida Bruhns, Moritz Krebbel, Berk Gulmezoglu, Thomas Eisenbarth, Berk Sunar Worcest ster Polytechnic

slide-1
SLIDE 1

SPOILER: Speculative Load Hazards Boost Rowhammer and Cache Attacks

Saad Islam, Daniel el Mogh ghimi (@danielmgmi), Ida Bruhns, Moritz Krebbel, Berk Gulmezoglu, Thomas Eisenbarth, Berk Sunar Worcest ster Polytechnic Institute & Univer ersity

  • f

Lübec eck

1

slide-2
SLIDE 2

CPU Optimization

  • n?
  • Branch

Prediction

  • Cache

and internal buffers

  • Speculate

the Speculations??!

– "speculative prefetching“ – "speculatively scheduled

  • peration“

– "speculative execution event counter“ – "speculative memory accesses“ – "speculative load instruction"

2

slide-3
SLIDE 3

Specula lative Load

store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d

X1 X2 X3 X4 X5 Execute

3

slide-4
SLIDE 4

Specula lative Load

store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d

X1 X2 X3 X4 X5 Execute

4

slide-5
SLIDE 5

Specula lative Load

store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d

X1 X2 X3 X4 X5 Execute

Resource is Busy for Store!

5

slide-6
SLIDE 6

Specula lative Load

store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d

X1 X2 X3 X4 X5 Execute

Whatever, Let’s Load and Compute!!!

6

slide-7
SLIDE 7

Specula lative Load

store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d

X1 X2 X3 X4 X5 Execute

Huum! Was it dependent

  • n

Stores?

7

slide-8
SLIDE 8

Specula lative Load

store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d

X1 X2 X3 X4 X5 Execute

No Clue! Check store ADDRE DRESSES: X, Y, Z?

8

slide-9
SLIDE 9

Specula lative Load

store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d

X1 X2 X3 X4 X5 Execute

How about this

  • ne?

Is W dependent

  • n

Y?

9

slide-10
SLIDE 10

Specula lative Load

store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d

X1 X2 X3 X4 X5 Execute

Or this

  • ne?

W VS. X?

10

slide-11
SLIDE 11

Specula lative Load

store a a → X X store b b → Y Y store c c → Z Z load d d ← W W inc d

X1 X2 X3 X4 X5 Execute

Wrong. Flush it!!!

11

slide-12
SLIDE 12

Virtual & Physical Addresses

What are store and load addresse ses? s?

C

Virtual Address 0

x 4 F E 6 4 1

Page Offset (12 bits) VFN

12

slide-13
SLIDE 13

Virtual & Physical Addresses

What are store and load addresse ses? s?

C

Virtual Address 0

x 4 F E 6 4 1 TLB

Page Offset (12 bits) VFN

13

slide-14
SLIDE 14

Virtual & Physical Addresses

What are store and load addresse ses? s?

C

Virtual Address 0

x 4 F E 6 4 1 TLB PMH

Page Offset (12 bits) VFN

14

slide-15
SLIDE 15

Virtual & Physical Addresses

What are store and load addresse ses? s?

C

Virtual Address 0

x 4 F E 6 4 1

VFN Page Offset (12 bits)

TLB PMH C

Physical address 0

x 5 4 4 2 3

PFN

15

slide-16
SLIDE 16

Virtual & Physical Addresses

What are store and load addresse ses? s?

C

Virtual Address 0

x 4 F E 6 4 1

VFN Page Offset (12 bits)

TLB PMH C

Physical address 0

x 5 4 4 2 3

PFN

16

slide-17
SLIDE 17

Design Chall llenges?

  • Loads

are executed

  • ut-of-order

and speculatively to avoid performance loss.

  • Load

may be dependent

  • n

preceding stores (dependency).

  • Dependency

check is difficult:

– Virtual addresses may be aliased. – Physical addresses are not available immediately. – Stores may stay in-flight for a while.

– We can’t wait for them to succeed. – Can we forward the data from the store to the load?

17

slide-18
SLIDE 18

18

SPOILER

slide-19
SLIDE 19

SPOILER Attack

Dependency Resolu lution

US 7,603,527 B2 RESOLVING

FALSE DEPENDENCIES OF SPECULATIVE LOAD INSTRUCTIONS

“an

  • peration

X may determine whether the lower portion

  • f

the virtual address

  • f

a speculative load instruction matches the lower portion

  • f

virtual addresses

  • f
  • lder

store

  • perations”

LoosnetCheck “an

  • peration

Y may determine whether the upper portion

  • f

the virtual address

  • f

the speculative load matches the upper portion

  • f

virtual addresses

  • f
  • lder

store” “If there is a hit at

  • peration

Y then the load may be blocked” “in an embodiment, the load instruction may have its input data forwarded from the store

  • peration

from which the load instruction depends at

  • peration”

Store Forwarding “If there is a hit at

  • peration

X and a miss at

  • peration

Y, … the physical addresses

  • f

the load and the store may be compared at an

  • peration

Z” “In

  • ne

embodiment, if there is a hit at

  • peration

X and the physical address

  • f

the load

  • r

the store

  • perations

is not valid, the physical address check at

  • peration

Z may be considered as a hit” “In some embodiments, the physical address check at

  • peration

Z may use a partial physical address, e.g., base

  • n

data stored in the

  • SAB. This

makes the checking at

  • peration

Z

  • conservative. Accordingly,

in some embodiments, a match may

  • ccur
  • n a partial

address and block…” FinenetCheck

19

slide-20
SLIDE 20

SPOIL ILER ER Attack

…

Virtual Pages

20

slide-21
SLIDE 21

SPOIL ILER ER Attack

…

Virtual Pages 64 pages

21

slide-22
SLIDE 22

SPOIL ILER ER Attack

…

Virtual Pages 64 pages

Stores

C x 4 F E 2 C x 4 F E 1 … … C x 4 1 2

22

slide-23
SLIDE 23

SPOIL ILER ER Attack

…

Virtual Pages 64 pages

Stores

C x 4 F E 2

Load

C x 4 F E 1 … … C x 4 1 2 C x 4 F 1 2 3 4

23

slide-24
SLIDE 24

SPOIL ILER ER Attack

…

Virtual Pages

Stores

C x 4 F E 3

Load

C x 4 F E 2 … … C x 4 1 2 1 C x 4 F 1 2 3 4

24

slide-25
SLIDE 25

SPOIL ILER ER Attack

…

Virtual Pages

Stores

C x 4 F E 4

Load

C x 4 F E 3 … … C x 4 1 2 2 C x 4 F 1 2 3 4

25

slide-26
SLIDE 26

SPOIL ILER ER Attack

…

Virtual Pages

Stores

C x 4 F E 5

Load

C x 4 F E 4 … … C x 4 1 2 3 C x 4 F 1 2 3 4 C x 6 5 F 3 2 X X X C x 3 2 A C 2 X X X

Virtual Addresses Physical Addresses

26

slide-27
SLIDE 27

SPOIL ILER ER Attack

…

Virtual Pages

27

slide-28
SLIDE 28

28

SPOILER Boosts ts Cache Attack cks

slide-29
SLIDE 29

SPOIL ILER ER Boosts Cache he Attacks ks

Core 1 LLC DRAM Core 2

29

slide-30
SLIDE 30

SPOIL ILER ER Boosts Cache he Attacks ks

Core 1 DRAM Core Victim

Prime+Pr Probe

  • be

Set 1 … Set 2 Set n

30

slide-31
SLIDE 31

SPOIL ILER ER Boosts Cache he Attacks ks

Core 1 DRAM Core Victim

Prime+Pr Probe

  • be

… Set 2 Set n

31

slide-32
SLIDE 32

SPOIL ILER ER Boosts Cache he Attacks ks

Core 1 DRAM Core Victim

Prime+Pr Probe

  • be

… Set 2 Set n C

Virtual Address 0

x 4 F E 6 4 1

Cache Index Byte Offset (6 Bit)

C

Physical address 0

x 5 4 4 2 3

32

slide-33
SLIDE 33

SPOIL ILER ER Boosts Cache he Attacks ks

Core 1 DRAM Core Victim

Prime+Pr Probe

  • be

… Set 2 Set n C

Virtual Address 0

x 4 F E 6 4 1

Cache Index Byte Offset (6 Bit)

C

Physical address 0

x 5 4 4 2 3

L1: 64 Sets, 6 bit Index L2: 1024 Sets, 10 bit Index Skylake Client LLC: 2048 Sets, 11 bit Index, 1-2 bit slices

33

slide-34
SLIDE 34

SPOIL ILER ER – Javascript Eviction

  • n

Sets

  • 1

MB Aliasing Leakage

  • Eviction

Set Finding Comparison

34

slide-35
SLIDE 35

35

SPOILER Boosts ts Rowhammer

slide-36
SLIDE 36

C

Physical address 0

x 5 4 4 2 3

PFN

  • Physical

addresses are used for mapping DRAM banks

– More Banks, More Physical Address Bits

  • Single-Sided

Rowhammer:

– Requirement: Bank Co-location

  • Double-Sided

Rowhammer:

– Contiguous Memory Pages

SPOIL ILER ER Boosts Rowhammer

36

slide-37
SLIDE 37
  • Reverse

Engineering DRAM Banks using DRAMA Tool

  • Rowbuffer Conflict

SPOIL ILER ER Boosts Rowhammer

37

slide-38
SLIDE 38
  • Detecting

Contiguous Memory

  • Rowhammer Bitflips

SPOIL ILER ER Boosts Rowhammer

38

slide-39
SLIDE 39
  • 12/01/2018:

We informed

  • ur

findings to iPSIRT.

  • 12/03/2018:

iPSIRT acknowledged the receipt.

  • 03/01/2018:

We published the paper.

  • 04/09/2019:

iPSIRT released public advisory (INTELSA-00238) (CVE-2019-0162).

  • And

we got some free logos, Thanks to Media !!!

CVE-201 2019-01 0162 62

39

slide-40
SLIDE 40

@danielmgmi

https://github.com/UzL-ITS/Spoiler

Question

  • ns?!

?!

40

slide-41
SLIDE 41

41

slide-42
SLIDE 42

SPOIL ILER ER Attack – HPC Analy lysis

42

slide-43
SLIDE 43

SPOIL ILER ER: 1 MB Aliasing

  • Significant

delay

  • n

Load when it matches with 20 bits

  • f

a store address (1 MB aliasing)

  • The

delay is highest when the store appears later in the store buffer.

  • The

number

  • f

steps has a correlation with the store buffer size.

  • HPC

Analysis:

– STALLS_LDM_PENDING: Direct correlation, confirms that the delay is due to the Load – Ld_Blocks_Partial:Address_Alias: Negative Correlation, confirms that the delay is not due to Loosenet check

43

slide-44
SLIDE 44

SPOIL ILER ER Attack – Affe fected Machines

44

slide-45
SLIDE 45

SPOIL ILER ER Boosts Cache he Attacks ks

Core 1 LLC DRAM Core 2

45

slide-46
SLIDE 46

SPOIL ILER ER Boosts Cache he Attacks ks

Core 1 LLC DRAM Core 2

46

slide-47
SLIDE 47

L1 Data Cache L2 Cache

Line Fill Buffer

D-TLB

Load Buffer SAB SDB

Store Buffer

Remarks ks

47

slide-48
SLIDE 48

L1 Data Cache L2 Cache

Line Fill Buffer

D-TLB

Load Buffer SAB SDB

Store Buffer

Remarks ks

48

slide-49
SLIDE 49

L1 Data Cache L2 Cache

Line Fill Buffer

D-TLB

Load Buffer SAB SDB

Store Buffer

Remarks ks

49

slide-50
SLIDE 50

L1 Data Cache L2 Cache

Line Fill Buffer

D-TLB

Load Buffer SAB SDB

Store Buffer

Remarks ks

50

slide-51
SLIDE 51

L1 Data Cache L2 Cache

Line Fill Buffer

D-TLB

Load Buffer SAB SDB

Store Buffer

Remarks ks

51