cloud9_root/src/cloud9/lib/Core/CacheDriver.cpp
// checker to detect timing-based side-channel attack
checker to detect timing-based side-channel attack
checker to detect timing - based side - channel attack
void CacheDriver::checkForTimingAttack(ExecutionState& state, TimingSolver* solver) {
	fprintf(stdout, "\n\n##### Number of (input)-independent cache misses = %lu #####\n\n", fixedColdMisses + fixedConflictMisses);
	if (state.symbolicAddrNum == 0) {
		return;
	}
	ExecutionState cState(state);
	addConflictConstraints(cState, conflictConstraintLog);
	for(int omiss = OBS_START; omiss < OBS_END; omiss++) {
		ref<Expr> missCnstr = CacheChannel::processMissCountCnstr(omiss);
		observedCacheMiss = fixedColdMisses + fixedConflictMisses + omiss;
		bool rs = CacheChannel::sanityCheck(state, fixedColdMisses+fixedConflictMisses, observedCacheMiss);
		if (rs) continue;
		if (missCnstr.isNull()) continue;
		int nsolution = CacheChannel::solveAllConstraints(cState, solver, missCnstr, SOL_THRESHOLD);
		fprintf(stdout, "\n\n..... #solutions for %lu cache misses = %d .....\n", observedCacheMiss, nsolution);
		fprintf(stdout, "..... probability to infer input = (1/%d) .....\n\n", nsolution);
	}
	fprintf(stdout, "\n\n########## Solver terminates, we are done here ##########\n\n");
	fflush(stdout);
}
void CacheDriver :: checkForTimingAttack ( ExecutionState & state , TimingSolver * solver ) { fprintf ( stdout , " \n \n \n \n " , fixedColdMisses + fixedConflictMisses ) ; if ( state . symbolicAddrNum == 0 ) { return ; } ExecutionState cState ( state ) ; addConflictConstraints ( cState , conflictConstraintLog ) ; for ( int omiss = OBS_START ; omiss < OBS_END ; omiss ++ ) { ref < Expr > missCnstr = CacheChannel :: processMissCountCnstr ( omiss ) ; observedCacheMiss = fixedColdMisses + fixedConflictMisses + omiss ; bool rs = CacheChannel :: sanityCheck ( state , fixedColdMisses + fixedConflictMisses , observedCacheMiss ) ; if ( rs ) continue ; if ( missCnstr . isNull ( ) ) continue ; int nsolution = CacheChannel :: solveAllConstraints ( cState , solver , missCnstr , SOL_THRESHOLD ) ; fprintf ( stdout , " \n \n \n " , observedCacheMiss , nsolution ) ; fprintf ( stdout , " \n \n " , nsolution ) ; } fprintf ( stdout , " \n \n \n \n " ) ; fflush ( stdout ) ; }
checker to detect timing-based side-channel attack
checker to detect timing - based side - channel attack
/* fast path: when all addresses are constant */ /* add cache-conflict and/or cold-miss related constraints */ /* check for different timing constraints */ /* add miss count constraint */ /* we come here if there exists, at least one symbolic address */