TLB Probing Prevention via Fault Reporting Delay

Solution Overview

Problem

Hackers attempt to access privileged code by probing memory pages and measuring the time it takes to receive a privilege violation fault, which can reveal the location of the kernel within the translation lookaside buffer (TLB).

Innovation Solution

Implementing fault circuitry that delays the reporting of privilege violation faults to match the time frame of a long page table walk, thereby obscuring the real processing time associated with memory requests and preventing attackers from determining the location of privileged code.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the processor immediately reports privilege violation faults upon detecting unauthorized memory access, then the system responds quickly to faults, but attackers can probe memory pages and measure fault timing to reveal the location of privileged code in the TLB

Engineering Contradiction:

ImprovesecurityVSAvoidfault reporting delay

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system pre-calculates and stores timing characteristics of normal page table walks before security probing occurs. When a privilege violation fault is detected, the system artificially delays the fault reporting to match the timing distribution of normal page table walk operations, making it difficult for attackers to distinguish probing responses from normal operations through timing measurements

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

An intermediary timing adjustment mechanism is introduced between the fault detection unit and the fault reporting unit. This intermediary component adds controlled delays to fault reports, transforming the immediate fault response into a timing-obfuscated response that matches normal page table walk timing characteristics, thereby preventing timing-based probing attacks

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If the processor delays fault reporting to prevent TLB probing, then security is enhanced, but the system response time to actual faults increases

Engineering Contradiction:

ImprovesecurityVSAvoidfault response speed

Core Design Contradiction:

ReliabilityVSSpeed

Solution Approach 1:

The system pre-calculates and stores timing characteristics of normal page table walks before security probing occurs. When a privilege violation fault is detected, the system artificially delays the fault reporting to match the timing distribution of normal page table walk operations, making it difficult for attackers to distinguish probing responses from normal operations through timing measurements

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system dynamically adjusts the fault reporting timing parameter based on the type of memory access. For suspected probing operations, the fault reporting is delayed to match normal page table walk timing characteristics. For legitimate operations, the timing remains optimized, thus changing the timing parameter conditionally to maintain both security and performance

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12204458B1Translation lookaside buffer probing prevention

Publication Date: 2025.01.21 SIFIVE INC

AI summary

Described are methods, logic, and circuitry which prevent translation lookaside buffer probing. Reporting a privilege violation fault is delayed for a defined period of time. The defined period of time can be a time frame needed to perform a long page table walk, which can be at least hundreds of clock cycles. A counter or a forced page table walk corresponding to the defined period of time can be used to implement the delay.