A hardware defense keeps prefetchers from scanning secret data
SecDMP: Provably Secure Data Memory-Dependent Prefetching (Extended Version) · arXiv:2610.37454
In plain words
Some processors have data memory-dependent prefetchers (DMPs): hardware that looks at loaded data to guess what to fetch next. That data can include secrets, even when a program does not use them in an observable way.
The paper introduces SecDMP, a hardware defense that lets software mark secret memory and stops the prefetcher from learning from it. In simulations on a research processor, the authors detected no leakage in nine tested programs across four modeled prefetchers.
The research
A data memory-dependent prefetcher uses loaded values to predict what to fetch, and can encode secret data in processor hardware state even when a program does not use it to produce an observable effect. Can a defense block that leakage without disabling useful prefetching altogether?
SecDMP is a hardware defense that keeps data memory-dependent prefetchers from learning from marked secret memory while allowing them to use public data.
Can a processor’s data memory-dependent prefetcher be kept from exposing secrets without turning off its useful predictions? Selective disabling leaves indirect routes open when the prefetcher is active elsewhere, while permanent disabling removes its performance gains.
SecDMP marks secret memory and prevents the prefetcher from learning from it. A formal proof shows it adds no leakage beyond its baseline under the stated assumptions.
In Proteus simulations, the authors detected no leakage in nine programs across four modeled prefetchers, supporting the defense within that tested scope.
The proof assumes secrets are correctly marked in a fixed public and secret memory partition. The empirical results come from simulations of modeled DMPs on the Proteus research processor; they do not establish performance or security on production CPUs, and the Apple model omits an unknown reported leakage mechanism.
The evaluated implementation also uses static memory regions, leaving practical challenges for separating secret data on the heap and stack.
What the evidence shows
- When predictions expose secrets
Data memory-dependent prefetchers (DMPs) use loaded values, along with memory-access patterns, to predict what to fetch. Because their predictions depend on data, a DMP can encode secrets in processor hardware state even when the program does not use those secrets to produce an observable effect.
The question is how to prevent that leakage while allowing the prefetcher to keep using public data.
- Why selective disabling is incomplete
The authors classify possible leakage by the data a DMP scans: ordinary program loads, neighboring values in a cache block, transient loads caused by speculation, and data loaded by prefetchers. Selective disabling switches the DMP off around code that directly accesses secrets, which addresses ordinary-load leakage.
But the DMP remains active elsewhere, where it can scan data through the other routes. Permanent disabling blocks all these routes but gives up the prefetcher’s performance gains.
- A defense based on memory labels
SecDMP is a hardware defense that requires software to mark secret memory. It prevents DMPs from using marked data to update their state or initiate prefetches, while still allowing prefetching based on public data.
The paper’s formal proof shows that, under its fixed public and secret memory partition, SecDMP does not add leakage beyond the baseline hardware semantics it extends.
- What the security tests found
The authors ran nine leakage programs against four DMP implementations modeled on commercial and academic designs in Proteus simulations. Each program had two versions differing only in secret values; a change in monitored signals counted as leakage.
Each program leaked on at least one undefended configuration, while the authors detected no leakage with SecDMP in the tested cases. Selective disabling protected only tests using ordinary program accesses.
ProSpeCT alone did not stop DMP leakage, while ProSpeCT combined with SecDMP prevented leakage in the tested DMP and Spectre-PHT cases.
- Measured cost on Proteus
On the paper’s combined work and cryptographic workloads, SecDMP’s average measured performance overhead was 0.36% against the corresponding DMP-equipped baseline, averaged across DMPs and workload combinations. Its highest reported overhead was 3.3% for one combination at a specified workload share.
In the Proteus hardware evaluation, area increased by at most 0.5% and the critical path remained 12.43 ns. These figures describe the paper’s prototypes and workloads.
Deep
- Original paper authors
- Jens Sprengers, Marton Bognar, Lesly-Ann Daniel, Frank Piessens
- Submitted to arXiv
- License
- CC BY-SA 4.0