# Inferring TLB Configuration with Performance Tools
## 4 Conclusions  
In this study, we explored how the drive for efficiency in computer systems can inadvertently create vulnerabilities. While cache side-channel analysis has traditionally been the focus of both academic and industry research, other shared hardware components, such as the TLB, also present opportunities for extracting information from computer systems. The cybersecurity community understands that micro-architecture is susceptible to attacks, and in recent years, there has been a small but growing interest in TLBs. This study contributes to raising awareness within the security community by collecting microarchitectural data, analyzing it with different techniques, inferring TLB configurations, and identifying the main obstacles to transferring the methodology across different systems. A critical aspect of implementing a TLB side-channel analysis involves understanding its architecture. However, since detailed TLB configurations are typically not open-sourced, our study developed a new methodology using gradient plots to infer these configurations. Our findings indicate that HPCs are effective in monitoring CPU performance and analyzing the resulting data to deduce TLB configurations. We used methodologies from [14, 15] to confirm our tested gradient plot method. This methodology provided additional insights for Intel CPUs and proved reliable as a standalone technique; however, in some cases, it needed supporting information, specifically the TLB size. The study also examined whether the methodology used for Intel CPUs could be applied to the IBM Power9. Although the methodology did not succeed in reverse engineering the TLB configuration for the IBM Power9, it re  
Figure 10: Power9 tablewalk heatmap and gradient plots. Figures (**a,b**) do not provide the specific configuration. However, the patterns observed in the heatmaps suggest that further modifications to the mapping function and counter-selection could yield improved results. vealed some patterns that hint at the possibility of success with further adjustments to the experiment, particularly the code for data collection and the events used. Looking ahead, several avenues for future research appear promising. One direction is to extend the IBM Power9 analysis and explore other architectures. The mapping function remains a significant obstacle when working with a new ISA. A process for addressing this with a new ISA would involve experimenting with common mapping functions used by specific vendors and determining their effectiveness. However, this approach can be hit or miss, and without proper documentation, it would be extremely difficult to infer the TLB configuration, especially since some vendors implement complex mapping functions involving multiple operations (e.g., multiple XOR-N operations). Another challenge is the availability of event counters. Their accessibility must be assessed, and it is necessary to identify equivalent counters--similar to those in Intel systems, where this methodology has proven effective--if they exist. Implementing this methodology in a Field Programmable Gate Array (FPGA), for example, with a RISC-V ISA, is an intriguing endeavor. The main challenge in this effort is gaining user access to the counters. Since TLB events are disabled, an alternative technique would need to be employed. Additionally, once the TLB configuration is ascertained, the next logical step in side-channel analysis would be to explore methods for accessing the TLB in a manner similar to that of a potential attacker (referred to as 'the victim' in side-channel parlance). This could provide further insights into potential vulnerabilities and defensive strategies. Ultimately, this study emphasizes the importance of considering security implications in the design of efficient systems. While enhancing efficiency is a key goal in computer system design, our research highlights the need for a balanced approach that also prioritizes security to protect against potential vulnerabilities in shared hardware components like the TLB.