Design, Implementation, and Analysis of a TLB-based Covert Channel on GPUs
Abstract
GPUs are now commonly available in most modern computing platforms. They are increasingly being
adopted in cloud platforms and data centers due to their immense computing capability. In response to
this growth in usage, manufacturers are continuously trying to improve GPU hardware by adding new
features. However, this increase in usage and the addition of utility-improving features can create new,
unexpected attack channels. In this thesis, we show that two such features—unified virtual memory
(UVM) and multi-process service (MPS)—primarily introduced to improve the programmability and
efficiency of GPU kernels have an unexpected consequence—that of creating a novel covert timing
channel via the GPU’s translation lookaside buffer (TLB) hierarchy. To enable this covert channel,
we first perform experiments to understand the characteristics of TLBs present on a GPU. The use
of UVM allows fine-grained management of translations, and helps us discover several idiosyncrasies
of the TLB hierarchy, such as three-levels of TLB, coalesced entries. We use this newly-acquired
understanding to demonstrate a novel covert channel via the shared TLB. We then leverage MPS
to increase the bandwidth of this channel by 40×. Finally, we demonstrate the channel’s utility by
leaking data from a GPU-accelerated database application