# A Survey of of Side-Channel Attacks and Mitigation for Processor Interconnects
## 3 Microarchitectural Side Channel  
CPU microarchitectural side-channel attacks are techniques for obtaining sensitive information by monitoring and analyzing the physical implementation of computer processors. These attacks exploit side channels generated by the processor during instruction execution and memory access, such as timing, power consumption, electromagnetic radiation, etc., to infer internal operations and data of the processor. Most microarchitectural channels can be categorized into attacks based on sharing (also known as persistent state or residual state) and attacks based on contention (also known as transient state). Sharing-based side channels, also referred to as stateful side channels, operate on the basis of sharing microarchitectural resources between attackers and victims. Typically, attackers proactively adjust and configure these resources shared with the victim, deliberately inducing the resources into a known state, and then await changes in the shared resource state resulting from the victim's normal operation. Subsequently, attackers can reevaluate the state of the shared resources to infer secrets about the victim's execution. Despite strict isolation of data and code at the software and hardware levels, side effects of victim code execution still leave traces observable by attackers from different security domains. The fundamental reason behind these attacks lies in the sharing of limited microarchitectural resources across different security domains, such as private caches [34], TLB [35], Branch Target Buffer (BTB) [36; 37], and last-level caches (LLCs) [15; 38]. Contention-based channels, also known as stateless side channels, also require attackers and victims to share certain microarchitectural resources, but the construction of these channels does not rely on traceable side effects of victim execution in the microarchitectural state. Instead, these attacks necessitate attackers to passively monitor the latency of their access to shared resources and infer secrets about the victim's execution based on changes in the latency. Therefore, in these attacks, the side effects of victim execution are observable by attackers only while the victim is actively executing. In contrast to stateful side channels, stateless side channels shift the focus from \"sharing\" resources to their \"limited\" availability. Typical resources used for contention-based channels include functional units [39], execution ports [40; 41], cache banks [42], memory buses [43], and random number generators [44]. From the perspective of information leakage scope, attacks can be classified into preemptive scheduling attacks, Simultaneous Multithreading (SMT) attacks, and cross-core attacks. Preemptive scheduling attacks (also known as time-sharing attacks) [16; 37; 45] involve attackers and victims having their programs reside on the same core and executing alternately in time, with the aim of disrupting temporal boundaries. SMT attacks [34; 35; 39], similar to preemptive scheduling attacks, require victims and attackers to execute concurrently on different logical cores within the same physical core. Cross-core attacks [38; 46; 47], being the most general, involve victims and attackers running on different physical cores. Numerous defense mechanisms against microarchitectural side channels have been proposed, primarily focusing on two main strategies: isolation and decoupling. **Isolation** aims to mitigate information leakage by disrupting the sharing of resources and components within the microarchitecture that side channels depend on. For instance, attacks targeting SMT can be mitigated by disabling SMT, which is currently the most prevalent approach adopted by cloud providers and end-users [48]. Additionally, a primary strategy involves eliminating \"sharing\" by partitioning and isolating shared resources to  
Figure 2: The control flow transmission sequence of a load instruction in an NoC. ensure attackers cannot observe the usage of victim resources [49; 50; 51].