# Multi-Line Prefetch Covert Channel with Huge Pages
## 1 Introduction  
Covert channels in computer systems exploit shared resources to transmit information covertly between processes. Traditional cache-based covert channels often suffer from low throughput and high error rates due to the unpredictable nature of cache access times and system interference. Covert channels between cross-core sender and receiver processes are noisier and harder to establish because the two processes must rely on shared microarchitectural elements, such as the last-level cache (LLC), to communicate. This setup introduces several challenges, including timing jitter from the cache coherence protocols, interference from concurrent system activity on other cores, and difficulties in tightly synchronizing the sender and the receiver. These factors make it harder to reliably measure timing differences, increasing the likelihood of decoding errors and reducing the overall throughput. Earlier investigations by [1, 2, 3] laid the groundwork for understanding covert channels by analyzing the MESI (Modified, Exclusive, Shared, Invalid) cache coherence protocol's effects on last-level caches (LLCs). Their approaches primarily relied on accessing a single cache line per bit transmission with a normal page size without incorporating huge pages. Building upon this foundational research, our method introduces the use of huge pages and facilitates access to multiple cache lines concurrently. This novel approach isdesigned to enhance both the accuracy and throughput of covert channels, capitalizing on the combined benefits of prefetching and huge pages. For a cross-core covert channel, the sender and receiver processes are on different cores. Only the shared cache between the sender and the receiver is the LLC. Cache coherence events provide a mechanism to signal or encode the data from a receiver to a sender. A sender within a software enclave such as an Intel SGX enclave may have access to private data of value to the receiver. All of the information channels are typically monitored in a secure domain such as a software enclave [4; 5; 6; 7] or a secure world domain of an ARM TrustZone [8; 9]. These covert channels avoid such dynamic information channel monitoring to exfiltrate secret data. How such secret data is acquired in the sender domain is not a focus of this paper. Prefetching plays a critical role in optimizing memory access but serves to activate specific cache coherence events in covert channels. Prefetchers, through instructions such as PREFETCHW, enable data to be proactively loaded into the L1 cache. The PREFETCHW instruction is a software prefetch hint available in x86 architectures that brings a cache line into the processor's cache hierarchy in anticipation of a write [10]. This proactive behavior reduces the memory access latency, improves cache utilization, and interacts with the MESI (Modified, Exclusive, Shared, Invalid) cache coherence protocol to maintain data consistency across cores. For instance, PREFETCHW can transition cache lines to the modified state, preparing them for faster subsequent write operations while maintaining coherence. These operations enable side-channel and covert-channel vulnerabilities through observable changes in cache states. Covert channels, by leveraging the interplay between prefetching and cache coherence protocols, can exploit these microarchitectural optimizations to improve their effectiveness [1]. Huge pages, on the other hand, address memory management challenges by significantly reducing the number of Translation Lookaside Buffer (TLB) entries required for address translation. With larger page sizes such as 2 MB or 1 GB, a TLB entry covers a broader range of memory addresses, minimizing TLB misses and reducing the address translation overhead. This optimization is particularly effective for memory-intensive applications with spatial locality, as it lowers the latency and improves system efficiency by decreasing the frequency of page table walks and translations.