Shared caches in modern processors are vulnerable to conflict-based attacks, whereby an attacker monitors the access pattern of a victim by engineering cache-set conflicts. Recent mitigations propose a randomized mapping of addresses to cache locations to obfuscate addresses that can conflict with a target address. Unfortunately, such designs continue to select eviction candidates from a small subset of the resident cache lines, which makes such designs vulnerable to algorithms that can quickly identify the conflicting addresses. This paper presents Mirage, a practical design for a fully associative cache, wherein eviction candidates are selected randomly from among all the lines resident in the cache, to be immune to set-conflicts. A key challenge in naively adopting such designs for large shared caches (containing tens of thousands of lines) is the complexity of cache-lookup, as that can require searching through all the lines resident in the cache in such designs. Mirage practically enables a fully-associative design, while maintaining the access latency similar to a traditional set-associative cache using: (1) Pointer-based indirection from the tag-store to the data-store, which allows a newly installed address to evict data of any resident line, (2) Skewed-associative tag-store with extra invalid tags, wherein incoming addresses can be installed without set-conflicts, and (3) Load-aware placement that maximizes the availability of sets with invalid tags, to eliminate set-conflicts. Our analysis shows Mirage provides the global-eviction property of a fully-associative cache throughout the system lifetime (violations of full-associativity, i.e set-conflicts, occur less than once in 10^4 to 10^17 years), offering a principled defense against set-conflict based attacks. Mirage incurs negligible slowdown (0.3%) and 12-15% extra storage compared to the recently proposed Scatter-Cache.

中文翻译：

---

MIRAGE：使用实用的全关联设计缓解基于冲突的缓存攻击

现代处理器中的共享缓存容易受到基于冲突的攻击，攻击者通过设计缓存集冲突来监控受害者的访问模式。最近的缓解措施提出了地址到缓存位置的随机映射，以混淆可能与目标地址冲突的地址。不幸的是，这样的设计继续从常驻缓存行的一个小子集中选择驱逐候选者，这使得这样的设计容易受到可以快速识别冲突地址的算法的影响。本文介绍了 Mirage，一种完全关联缓存的实用设计，其中从驻留在缓存中的所有行中随机选择驱逐候选者，以免受设置冲突的影响。为大型共享缓存（包含数万行）天真地采用此类设计的一个关键挑战是缓存查找的复杂性，因为这可能需要在此类设计中搜索驻留在缓存中的所有行。Mirage 实际上实现了完全关联的设计，同时使用以下方法保持了类似于传统集关联缓存的访问延迟：(1) 从标记存储到数据存储的基于指针的间接访问，这允许驱逐新安装的地址任何驻留线路的数据，(2) 带有额外无效标签的倾斜关联标签存储，其中传入地址可以在没有设置冲突的情况下安装，以及 (3) 负载感知放置，最大限度地提高具有无效标签的集合的可用性，以消除集合冲突。我们的分析表明 Mirage 在整个系统生命周期内提供了完全关联缓存的全局驱逐属性（违反完全关联性，即设置冲突，在 10^4 到 10^17 年中发生的次数少于一次），提供了一个原则性的防御基于集合冲突的攻击。与最近提出的 Scatter-Cache 相比，Mirage 产生的减速可以忽略不计（0.3%）和 12-15% 的额外存储。