Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Reverse Engineering the Apple M1 Conditional Branch Predictor for Out-of-Place Spectre Mistraining

Adam Tuby, Adam Morrison

TL;DR

This work probes whether Apple’s M1 processors remain vulnerable to practical out-of-place Spectre v1 mistraining. It shows brute-force aliasing is costly on M1 due to a TAGE-like BPU, then introduces the Last Provider Component (LPC) primitive to deterministically force mistraining into the longest history component, reducing required attempts by up to $32\times$. The authors reverse engineer the M1 Conditional BPU to expose the BHR structure, update policies, and history lengths, enabling targeted mistraining and enabling tests of hardware mitigations. They find partial userspace/kernel BPU isolation on Icestorm but not Firestorm, and no cross-process isolation on either core, underscoring gaps in hardware defenses and informing mitigation design for Spectre v1. The results illuminate practical attack surfaces while offering a concrete technique (LPC) to study BPU aliasing, contributing to hardware-aware security assessments and policy decisions for Apple silicon.

Abstract

Spectre v1 information disclosure attacks, which exploit CPU conditional branch misprediction, remain unsolved in deployed software. Certain Spectre v1 gadgets can be exploited only by out-of-place mistraining, in which the attacker controls a victim branch's prediction, possibly from another address space, by training a branch that aliases with the victim in the branch predictor unit (BPU) structure. However, constructing a BPU-alias for a victim branch is hard. Consequently, practical out-of-place mistraining attacks use brute-force searches to randomly achieve aliasing. To date, such attacks have been demonstrated only on Intel x86 CPUs. This paper explores the vulnerability of Apple M-Series CPUs to practical out-of-place Spectre v1 mistraining. We show that brute-force out-of-place mistraining fails on the M1. We analytically explain the failure is due to the search space size, assuming (based on Apple patents) that the M1 CPU uses a variant of the TAGE conditional branch predictor. Based on our analysis, we design a new BPU-alias search technique with reduced search space. Our technique requires knowledge of certain M1 BPU parameters and mechanisms, which we reverse engineer. We also use our newfound ability to perform out-of-place Spectre v1 mistraining to test if the M1 CPU implements hardware mitigations against cross-address space out-of-place mistraining -- and find evidence for partial mitigations.

Reverse Engineering the Apple M1 Conditional Branch Predictor for Out-of-Place Spectre Mistraining

TL;DR

This work probes whether Apple’s M1 processors remain vulnerable to practical out-of-place Spectre v1 mistraining. It shows brute-force aliasing is costly on M1 due to a TAGE-like BPU, then introduces the Last Provider Component (LPC) primitive to deterministically force mistraining into the longest history component, reducing required attempts by up to . The authors reverse engineer the M1 Conditional BPU to expose the BHR structure, update policies, and history lengths, enabling targeted mistraining and enabling tests of hardware mitigations. They find partial userspace/kernel BPU isolation on Icestorm but not Firestorm, and no cross-process isolation on either core, underscoring gaps in hardware defenses and informing mitigation design for Spectre v1. The results illuminate practical attack surfaces while offering a concrete technique (LPC) to study BPU aliasing, contributing to hardware-aware security assessments and policy decisions for Apple silicon.

Abstract

Spectre v1 information disclosure attacks, which exploit CPU conditional branch misprediction, remain unsolved in deployed software. Certain Spectre v1 gadgets can be exploited only by out-of-place mistraining, in which the attacker controls a victim branch's prediction, possibly from another address space, by training a branch that aliases with the victim in the branch predictor unit (BPU) structure. However, constructing a BPU-alias for a victim branch is hard. Consequently, practical out-of-place mistraining attacks use brute-force searches to randomly achieve aliasing. To date, such attacks have been demonstrated only on Intel x86 CPUs. This paper explores the vulnerability of Apple M-Series CPUs to practical out-of-place Spectre v1 mistraining. We show that brute-force out-of-place mistraining fails on the M1. We analytically explain the failure is due to the search space size, assuming (based on Apple patents) that the M1 CPU uses a variant of the TAGE conditional branch predictor. Based on our analysis, we design a new BPU-alias search technique with reduced search space. Our technique requires knowledge of certain M1 BPU parameters and mechanisms, which we reverse engineer. We also use our newfound ability to perform out-of-place Spectre v1 mistraining to test if the M1 CPU implements hardware mitigations against cross-address space out-of-place mistraining -- and find evidence for partial mitigations.

Paper Structure

This paper contains 55 sections, 2 equations, 24 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Brute-force mistraining on the M1 is costly (\ref{['sec:motivation']})
  3. Forcing mistraining of the last component (\ref{['sec:LPC Gadget']})
  4. Reverse engineering the M1 conditional BPU (\ref{['sec:RE']})
  5. Conditional branch predictor isolation (\ref{['sec:BPU Isolation']})
  6. Responsible disclosure notice
  7. Background
  8. Apple M1
  9. Branch Prediction
  10. TAGE Branch Predictor
  11. Threat Model
  12. Motivation: Out-of-Place Mistraining
  13. Brute-Force Out-of-Place Mistraining
  14. Brute-Force Mistraining on the M1 is Costly
  15. Experiment: Brute-Force Mistraining on the M1
  16. ...and 40 more sections

Figures (24)

  • Figure 1: Abstract representation of the TAGE predictor.
  • Figure 2: Experiment template.
  • Figure 3: Effect of conditional branch PC address bits on the BHR on the Firestorm cores (results for $H=0$). For bits that have effect, the spy branch's misprediction rate is $\approx 0$%.
  • Figure 4: Effect of indirect branch PC address bits on the BHR on the Firestorm microarchitecture (results for $H=0$). For bits that have effect, the spy branch's misprediction rate is $\approx 0$%.
  • Figure 5: Effect of indirect branch target address bits on the BHR on the Firestorm cores (results for $H=0$). For bits that have effect, the spy branch's misprediction rate is $\approx 0$%.
  • ...and 19 more figures