[Paper Review] SIMF: Single-Instruction Multiple-Flush Mechanism for Processor Temporal Isolation

Tuo Li, Bradley Hopkins+1 more|arXiv (Cornell University)|Nov 20, 2020

Security and Verification in Computing39 references4 citations

TL;DR

This paper proposes SIMF, a single-instruction hardware extension (Flushx) that simultaneously flushes L1 caches, TLBs, branch prediction units, and the register file in a single RISC-V instruction. Evaluated on an FPGA prototype with seL4 and Linux, SIMF reduces dynamic instruction count and execution time by over a factor of two, significantly improving the efficiency of OS-level temporal isolation against microarchitectural timing attacks.

ABSTRACT

Microarchitectural timing attacks are a type of information leakage attack, which exploit the time-shared microarchitectural components, such as caches, translation look-aside buffers (TLBs), branch prediction unit (BPU), and speculative execution, in modern processors to leak critical information from a victim process or thread. To mitigate such attacks, the mechanism for flushing the on-core state is extensively used by operating-system-level solutions, since on-core state is too expensive to partition. In these systems, the flushing operations are implemented in software (using cache maintenance instructions), which severely limit the efficiency of timing attack protection. To bridge this gap, we propose specialized hardware support, a single-instruction multiple-flush (SIMF) mechanism to flush the core-level state, which consists of L1 caches, BPU, TLBs, and register file. We demonstrate SIMF by implementing it as an ISA extension, i.e., flushx instruction, in scalar in-order RISC-V processor. The resultant processor is prototyped on Xilinx ZCU102 FPGA and validated with state-of-art seL4 microkernel, Linux kernel in multi-core scenarios, and a cache timing attack. Our evaluation shows that SIMF significantly alleviates the overhead of flushing by more than a factor of two in execution time and reduces dynamic instruction count by orders-of-magnitude.

Motivation & Objective

• To address the high performance overhead of software-based flushing routines used to mitigate microarchitectural timing attacks.
• To reduce the dynamic instruction count and execution time associated with frequent core-level state flushing in temporal isolation mechanisms.
• To design a hardware-extended instruction set architecture (ISA) that atomically flushes multiple on-core microarchitectural states in one instruction.
• To evaluate the feasibility and performance benefits of a single-instruction multiple-flush (SIMF) mechanism in real-world OS and kernel environments.
• To enable efficient, secure, and portable temporal isolation across diverse processor architectures with minimal hardware modification.

Proposed method

• Design and implement a new ISA extension called Flushx, which performs a single atomic flush of L1 caches, TLBs, branch prediction unit, and register file.
• Integrate the Flushx instruction into a scalar in-order RISC-V processor core, ensuring implicit ordering of flush operations without explicit barriers.
• Prototype the extended processor on an Xilinx ZCU102 FPGA to validate functional correctness and performance.
• Evaluate SIMF using real workloads on seL4 microkernel, Linux kernel, and user-level applications under multi-core conditions.
• Conduct a Prime+Probe cache timing attack to verify that SIMF effectively eliminates timing channels by removing residual microarchitectural states.
• Measure performance improvements via dynamic instruction count and execution time reduction compared to software-based flushing sequences.

Experimental results

Research questions

• RQ1 Can a single hardware instruction effectively and atomically flush multiple core-level microarchitectural states (L1 caches, TLBs, BPU, register file) to improve temporal isolation efficiency?
• RQ2 How does the performance overhead of SIMF compare to traditional software-based flushing routines in terms of dynamic instruction count and execution time?
• RQ3 To what extent does SIMF reduce the number of instructions required to cleanse on-core state across different workloads and operating systems?
• RQ4 Does SIMF effectively eliminate microarchitectural timing channels in practical scenarios, including real kernels and side-channel attacks?
• RQ5 Can SIMF be implemented with minimal hardware changes and remain compatible with existing processor designs and ISAs?

Key findings

• SIMF reduces the dynamic instruction count required for core-level state flushing by orders of magnitude compared to software-based flushing routines.
• Execution time for flushing operations is reduced by more than a factor of two in the SIMF-extended processor compared to baseline software flushing.
• The Flushx instruction successfully eliminates observable timing differences in cache access patterns, as demonstrated by the Prime+Probe attack, confirming effective removal of timing channels.
• The FPGA prototype with the Flushx instruction achieves complete cleansing of residual states in L1 data cache, preventing leakage from prior processes.
• SIMF provides strong atomicity and eliminates the need for explicit synchronization barriers between flush operations, simplifying software implementation.
• The performance gains are consistent across diverse workloads, including the seL4 microkernel, Linux kernel, and user-space programs, demonstrating broad applicability.