Reverse Engineering Intel Last-Level Cache Complex Addressing Using Performance Counters

Cache attacks, which exploit differences in timing to perform covert or side channels, are now well understood. Recent works leverage the last level cache to perform cache attacks across cores. This cache is split in slices, with one slice per core. While predicting the slices used by an address is simple in older processors, recent processors are using an undocumented technique called complex addressing. This renders some attacks more difficult and makes other attacks impossible, because of the loss of precision in the prediction of cache collisions. In this paper, we build an automatic and generic method for reverse engineering Intel’s last-level cache complex addressing, consequently rendering the class of cache attacks highly practical. Our method relies on CPU hardware performance counters to determine the cache slice an address is mapped to. We show that our method gives a more precise description of the complex addressing function than previous work. We validated our method b...

• Type: Journal
• Year: 2015
• Where: RAID
• Authors: Clémentine Maurice, Nicolas Le Scouarnec, Christoph Neumann, Olivier Heen, Aurélien Francillon
• Keywords: Computer Networks, RAID 2015