## 4 Elements of the Attacks
### First Condition: Be Able to Differentiating a Cache Miss and Hit from the Programmable Logic Part  
The method presented in this section uses the AXI bus signals connecting the master interface and the ACP to measure the access time and then distinguishes between a cache miss and hit. The rest of this section presents the AXI bus channels that leak information about the presence or absence of data in the cache and the method used to measure the access time.  
In most SoC-FPGA, the AXI bus uses five channels to connect a master interface and a slave interface. These five channels are the read address channel, the read data channel, the write address channel, the write data channel, and the write response channel. Each channel uses a _VALID_ and _READY_ handshake signal pair to signal when the receiver is ready to process data, and to signal when valid data are ready on the bus. The scenarios for a coherency request issued by a master interface are as follows:  
* For a coherency write request, the master interface starts by sending the targeted address in the write address channel followed by the data to be written in the write data channel. Once the data are received by the ACP, this port sends back a response to the master interface using the write response channel.  
* For a coherency read request, the master interface starts by sending the address to be read in the read address channel. Then, the ACP sends the data back to the master interface using the read data channel. In order to find out which AXI bus channels to use, we performed the following experiment. We issued some read and write requests from the master interface to measure the time elapsed between the launch of the request and the reception of the response. From time to time, we evicted the address targeted by the request. As a result, we observed that for a write request, the time elapsed between two handshakes of the write address channel and the write response channel does not vary with the presence or absence of the data in the L1 or L2 cache. Therefore, it is not possible to distinguish a failure from success during a write request. For a read request, we observed that the time elapsed between two handshakes of the read address channel and the read data channel depends on whether or not the data are present in the L1 or L2 cache. In order to validate our observation, we used Xilinx Vivado hardware debug tools. Figure 6 shows that the time elapsed between the handshake of the read address channel (_AXI_ARVALID_ == '_' &_AXI_ARREADY_ == '0', blue line in Figure 6) and the handshake of the read data channel (_AXI_RVALID_ == '_' &_AXI_RREADY_ == '1', purple vertical line in Figure 6) is shorter, if the data are present in the cache, and is otherwise longer.  
Figure 7 is a histogram of a number of read requests when the targeted address is evicted one time out of two. The histogram shows that we can set a threshold that distinguishes the access time of a cache miss and the access time of a cache hit from the programmable logic part using our method. The histogram includes no errors because we used a standalone application for our experiments that did not cause a big miss rate.  
Figure 6: Read request, cache miss followed by a cache hit captured using Xilinx Vivado hardware debug tools.  
Figure 7: Histogram of cache miss and hit of a consistent read request (master interface frequency = 250 MHz).  
To sum up, to distinguish between a cache miss and hit in the programmable logic part, an attacker issues a read request and measures the time that elapses between two handshakes of the read address channel and the read data channel.