Cache partitioning is among the strongest structural defenses against eviction-based cache side channels, yet a decade-old design issue has blocked its widespread deployment in secure shared-OS settings. The issue is that write-shared coherence collapses under strict partitioning. We present SCP (Secure and Coherent Partitioning), which combines strict eviction isolation with write-shared coherence by partitioning only the tags, sharing a single data pool, and sizing the data pool so capacity-driven cross-partition eviction cannot occur. Timing obfuscation extends protections to the inter-partition lookup path. Coherence-based leakage on shared-writeable lines is mitigated by routing those writes through to the LLC once a leakage threshold is crossed, which makes attacker write probe latency independent of victim activity. Using gem5 for implementation, SCP mitigates Prime+Probe and Flush+Reload, which are the basis for more sophisticated cache attacks. We also demonstrate that a shared-writeable-line attack is mitigated. All these attacks yield results no better than random guessing. SCP's hardware cost is a modest +2.8% LLC SRAM. Performance matches DAWG within 0.3% IPC on the SPEC CPU2017 benchmarks that we evaluated. Sharing-intensive microbenchmarks demonstrate a tunable security-performance tradeoff based on a system-specified leakage threshold.

翻译：缓存分区是针对基于驱逐的缓存侧信道攻击的最强结构防御之一，然而一个存在了十年的设计问题阻碍了其在安全共享操作系统环境中的广泛部署。该问题在于写共享一致性在严格分区下会崩溃。我们提出SCP（安全且一致的分区），它通过仅对标签进行分区、共享单一数据池并精心设计数据池容量以避免容量驱动的跨分区驱逐，将严格的驱逐隔离与写共享一致性相结合。时序混淆将保护扩展至跨分区查找路径。针对共享可写行的基于一致性的泄漏，通过一旦泄漏阈值被超过就将这些写操作路由至LLC来缓解，这使得攻击者的写探测延迟与受害者的活动无关。使用gem5进行实现，SCP缓解了Prime+Probe和Flush+Reload（更复杂缓存攻击的基础）。我们还证明了一次共享可写行攻击被缓解。所有这些攻击的结果不优于随机猜测。SCP的硬件成本仅为LLC SRAM增加2.8%。在评估的SPEC CPU2017基准测试上，性能与DAWG在0.3% IPC内匹配。共享密集型微基准测试展示了基于系统指定泄漏阈值的可调安全-性能权衡。