Microarchitectural Timing Channels and their Prevention on an Open-Source 64-bit RISC-V Core
Nils Wistoff1, Moritz Schneider1, Frank K. Gürkaynak2, Luca Benini2 and Gernot Heiser1
1ETH Zurich Zurich, Switzerland
anwistoff@iis.ee.ethz.ch
bmoritz.schneider@inf.ethz.ch
ckgf@iis.ee.ethz.ch
2ETH Zurich and University of Bologna Zurich, Switzerland
lbenini@iis.ee.ethz.ch
3UNSW Sydney and Data61 CSIRO Sydney, Australia
gernot@unsw.edu.au
ABSTRACT
Microarchitectural timing channels use variations in the timing of events, resulting from competition for limited hardware resources, to leak information in violation of the operating system’s security policy. Such channels also exist on a simple in-order RISC-V core, as we demonstrate on the opensource RV64GC Ariane core. Time protection, recently proposed and implemented in the seL4 microkernel, aims to prevent timing channels, but depends on a controlled reset of microarchitectural state. Using Ariane, we show that software techniques for performing such a reset are insufficient and highly inefficient. We demonstrate that adding a single flush instruction is sufficient to close all five evaluated channels at negligible hardware costs, while requiring only minor modifications to the software stack.
Keywords: Covert Channels, Timing Channels, Computer Architecture, Microarchitecture, Operating Systems, System Security, Time Protection.
