The frontend of modern Intel processors will decode instructions into $\mu$μops and stream them to the backend by the frontend bus, which is shared between two logical cores to maximize… Click to show full abstract
The frontend of modern Intel processors will decode instructions into $\mu$μops and stream them to the backend by the frontend bus, which is shared between two logical cores to maximize utilization without sharing mechanism fully disclosed. Taking Haswell as an example, we reverse the bus from Decoded ICache to Instruction Decode Queue and the bus from Instruction Decode Queue to backend. We find that they are dynamically shared between two logical cores, which makes it possible for observable timing differences in one another through different instructions. Based on these differences, we propose the Synthetical bus covert channel for LSD-enabled architectures like Haswell and the DI bus covert channel for LSD-disabled architectures like Cometlake. We test our covert channels in physical machines and virtual machines. The bandwidth of Synthetical bus covert channel achieves 870 Kbps with 95.69% accuracy in physical machines and 145 Kbps with 92.83% accuracy in virtual machines. The bandwidth of DI bus covert channel reaches 1450 Kbps with 97.2% accuracy in physical machines and 70.33 Kbps with 92.3% accuracy in virtual machines. We further demonstrate a new Spectre variant. Finally, we propose two possible mitigations against our covert channels due to the limitations of existing protection strategies.
