# A Survey of of Side-Channel Attacks and Mitigation for Processor Interconnects
## 4 Interconnect Contention Side Channel
### Mesh Interconnect Contention  
Due to the proximity to physical limits, improving chip manufacturing processes has become increasingly challenging, making the integration of more cores on a single CPU chip the only reliable option for manufacturers seeking higher-performing processors. However, the further increase in processor cores poses challenges for ring interconnects due to their scalability and routing scheme limitations. In ring interconnect architectures, the latency between cores may linearly increase with the number of cores, as communication between two cores may need to route through all other cores. To address this issue, Intel introduced mesh interconnect as an alternative to ring interconnect in the Skylake-SP server CPU family released in 2017 [33], which has since been widely adopted in Intel processors and holds promising prospects for the future. In addition to Intel CPUs, processors from other manufacturers also employ mesh interconnect, such as tile processors [67,68] and ARM server CPUs (United Kingdom) [69]. Essentially, mesh interconnect involves organizing the chip on a plane into a two-dimensional matrix consisting of several tiles. Each tile is either composed of a core along with an LLC slice or a non-core component such as an IMC (integrated memory controller), UPI (Ultra Path Interconnect) controller, or I/O unit, as illustrated in Figure 1. Each tile is equipped with a mesh stop and is connected to its vertical and horizontal neighbors, with the mesh stop responsible for managing traffic in each direction. In mesh interconnects, the number of hops between any two tiles is proportional to the square root of the tile count, effectively limiting the core-to-core latency on modern processors with rapidly increasing core counts. Similar to contention side-channel attacks on the ring interconnect, contention side-channel attacks on the mesh interconnect also exploit contention on the same mesh route, as shown in Figure 4. As data movement on the mesh constantly occurs during various program activities, if an attacker's and victim's programs happen to share a mesh route, the victim's activities, including cache access, may be inferred. During this process, the attacker can only access their own resources. **Covert Channel. ** In the scenario of covert channels, the receiver anchors itself to a given core and accesses addresses mapped to a given LLC slice to monitor the interconnect. These accesses travel through the mesh interconnect and may experience delays due to interconnect contention from other applications. The receiver can then time these accesses to determine if contention has occurred. To generate reliable accesses to a given LLC slice, the receiver's accesses need to miss in L2 and hit in LLC while avoiding L2 hits and DRAM accesses. The sender's configuration is similar to the receiver's, avoiding or causing interconnect contention by alternating accesses to its own LLC slice and the target LLC slice to encode messages. When the sender sends a bit \"1\", it creates accesses through the mesh interconnect to the given LLC by evicting entries from the private L2 cache, which will contend with the receiver's accesses, resulting in higher latency observed by the receiver; conversely, when the receiver does not observe higher latency, indicating that the sender has not accessed the distant LLC, the receiver decodes the signal in that time slice as a bit \"0\". **Side Channel. ** Similarly, side-channel attacks on the mesh interconnect also exploit the characteristic of encryption algorithms executing paths dependent on key bits. Unlike side-channel attacks on the ring interconnect, in the mesh interconnect, the victim's memory accesses are typically evenly distributed across all LLC slices due to the design of slice hash functions. Therefore, attackers need to select an optimal position to maximize observable contention and send probing loads to multiple mesh routes as much as possible.