# Multi-Line Prefetch Covert Channel with Huge Pages
## 4 The Design of a Multi-Line Prefetch Covert Channel with Huge Pages  
### An Overview of the Multi-Line Prefetch Attack Implementation  
The multi-line prefetch covert channel represents an advanced microarchitectural technique leveraging the timing behavior of the PREFETCHW instruction to establish covert channel communication. This enhanced implementation significantly extends the capabilities of the original attack [1] by introducing multi-line encoding and decoding, enabling a higher bandwidth and more flexible communication compared to the original approach, which could only encode a single bit of information per iteration.  
Our attack model involves two main participants, a sender and a receiver, both implemented as regular user-space (i.e., unprivileged) processes without special permissions, running on separate CPU cores of the same physical processor. These two processes collaborate to establish a covert channel via shared memory and cache coherence effects. The sender and the receiver can be launched on separate physical cores using tools such as taskset. Furthermore, these processes can share data, such as through shared libraries or page deduplication. This setup mirrors prior attacks, ensuring shared memory access while maintaining isolation between processes. Additionally, the sender and the receiver must agree on predefined channel protocols, including synchronization mechanisms, core allocation, data encoding, and error correction protocols. These agreements are critical for maintaining the consistency and accuracy of the covert channel.  
When huge pages are enabled, the multi-line prefetch covert channel gains significant advantages, particularly in scenarios involving \(n\) cache lines. Huge pages reduce TLB misses by mapping larger memory regions with fewer entries, enabling the prefetcher to operate more efficiently. This optimization allows the sender to access multiple cache lines within the same page, reducing latency and improving throughput. The larger contiguous memory provided by huge pages enhances the precision of timing measurements, leading to better accuracy and reduced error rates. Furthermore, the combination of huge pages and multi-line prefetching ensures that more data can be encoded and decoded in fewer iterations, thereby increasing the bandwidth and stealth of the attack.  
We outline below the key assumptions of our threat model that enable this covert channel:  
* **The Shared Last-Level Cache (LLC):** The sender and the receiver share the same LLC (e.g., reside on the same processor or within the same virtual machine), enabling them to observe coherence traffic.
* **Privilege Level and Isolation:** In our primary setup, both the sender and the receiver are unprivileged user-space processes running on separate CPU cores. However, our threat model also supports scenarios where the sender operates within a secure execution environment--such as an AMD SEV-encrypted virtual machine--as long as the sender and the receiver share the same last-level cache (LLC). The shared LLC enables shared cache coherence events, which in turn enable the covert channel. A broader discussion of TEE platforms, including SGX and TrustZone, is provided in Section 6.
* **Access to Huge Pages and Prefetch Instructions:** Both parties are assumed to have access to huge pages (e.g., via mmap() with MAP_HUGETLB) and the ability to invoke prefetch instructions such as __builtin_prefetch(). These capabilities are available in modern Linux systems with the appropriate configuration.