cloud9_root/src/cloud9/lib/Core/CacheDriver.cpp
// check for bit-level information leak through observing cache-miss count
check for bit-level information leak through observing cache-miss count
check for bit - level information leak through observing cache - miss count
void CacheDriver::checkForBitLeakFromMissCount(ExecutionState& state, TimingSolver* solver) {
	fprintf(stdout, "\n\n##### Number of (input)-independent cache misses = %lu #####\n\n", fixedColdMisses + fixedConflictMisses);
	if (state.symbolicAddrNum == 0) {
		return;
	}
	ExecutionState cState(state);
	if (nassoc == 1)
		addConflictConstraints(cState, conflictConstraintLog);
	else {
		if (strncasecmp(policy, "l", 1) == 0) {
			fprintf(stdout, "\n\n.....set-associative LRU cache detected.....\n\n");
			addConflictConstraints(cState, conflictConstraintLogLRU);
		}
		else
			assert(0 && "fatal: replacement policy is not supported");
	}
	for (int omiss = OBS_START; omiss < OBS_END; omiss++) {
		ref<Expr> missCnstr = CacheChannel::processMissCountCnstr(omiss);
		observedCacheMiss = fixedColdMisses + fixedConflictMisses + omiss;
		bool rs = CacheChannel::sanityCheck(state, fixedColdMisses+fixedConflictMisses, observedCacheMiss);
		if (rs) continue;
		if (missCnstr.isNull()) continue;
		for (int nbit = 0; nbit < SIZE_OF_SECRET * SIZE_OF_BYTE; nbit++) {
			ref<Expr> bitTrueCnstr = constrainOneBit(state, nbit, true);
			ref<Expr> bitFalseCnstr = constrainOneBit(state, nbit, false);
			ref<Expr> trueLeak = AndExpr::create(bitTrueCnstr, missCnstr);
			ref<Expr> falseLeak = AndExpr::create(bitFalseCnstr, missCnstr);
			fprintf(stdout, "\n\n###### checking potential information leak via bit %d\n\n", nbit);
			int nsolutionTrue = CacheChannel::solveAllConstraints(cState, solver, trueLeak, 1);
			int nsolutionFalse = CacheChannel::solveAllConstraints(cState, solver, falseLeak, 1);
			if (nsolutionTrue != nsolutionFalse) {
				fprintf(stdout, "\n\n######## (**) potential information leak via bit %d\n", nbit);
			} else {
				fprintf(stdout, "\n\n######## NO potential information leak via bit %d\n", nbit);
			}
		}
	}
}
void CacheDriver :: checkForBitLeakFromMissCount ( ExecutionState & state , TimingSolver * solver ) { fprintf ( stdout , " \n \n \n \n " , fixedColdMisses + fixedConflictMisses ) ; if ( state . symbolicAddrNum == 0 ) { return ; } ExecutionState cState ( state ) ; if ( nassoc == 1 ) addConflictConstraints ( cState , conflictConstraintLog ) ; else { if ( strncasecmp ( policy , " " , 1 ) == 0 ) { fprintf ( stdout , " \n \n \n \n " ) ; addConflictConstraints ( cState , conflictConstraintLogLRU ) ; } else assert ( 0 && " " ) ; } for ( int omiss = OBS_START ; omiss < OBS_END ; omiss ++ ) { ref < Expr > missCnstr = CacheChannel :: processMissCountCnstr ( omiss ) ; observedCacheMiss = fixedColdMisses + fixedConflictMisses + omiss ; bool rs = CacheChannel :: sanityCheck ( state , fixedColdMisses + fixedConflictMisses , observedCacheMiss ) ; if ( rs ) continue ; if ( missCnstr . isNull ( ) ) continue ; for ( int nbit = 0 ; nbit < SIZE_OF_SECRET * SIZE_OF_BYTE ; nbit ++ ) { ref < Expr > bitTrueCnstr = constrainOneBit ( state , nbit , true ) ; ref < Expr > bitFalseCnstr = constrainOneBit ( state , nbit , false ) ; ref < Expr > trueLeak = AndExpr :: create ( bitTrueCnstr , missCnstr ) ; ref < Expr > falseLeak = AndExpr :: create ( bitFalseCnstr , missCnstr ) ; fprintf ( stdout , " \n \n \n \n " , nbit ) ; int nsolutionTrue = CacheChannel :: solveAllConstraints ( cState , solver , trueLeak , 1 ) ; int nsolutionFalse = CacheChannel :: solveAllConstraints ( cState , solver , falseLeak , 1 ) ; if ( nsolutionTrue != nsolutionFalse ) { fprintf ( stdout , " \n \n \n " , nbit ) ; } else { fprintf ( stdout , " \n \n \n " , nbit ) ; } } } }
check for bit-level information leak through observing cache-miss count
check for bit - level information leak through observing cache - miss count
/* fast path: when all addresses are constant */ /* the constraint log depends on the type of cache (direct-mapped or set-associative) */ /* check for different timing constraints and possible information leaks through them */ /* add observable cache-miss constraint */ /* check satisfiability when the bit is true */ /* check satisfiability when the bit is false */ /* potential leak situation */