IEEE Computer Architecture Letters最新文献

{"title":"Exploiting Decompression Latency for Covert Channels in Inter-Line-Compressed LLCs","authors":"David K. Oh;Hiroshi Sasaki","doi":"10.1109/LCA.2026.3737156","DOIUrl":"https://doi.org/10.1109/LCA.2026.3737156","url":null,"abstract":"The recently proposed XOR cache is an inter-line-compressed last-level cache (LLC) that leverages the data-inclusion relationship between the private caches and the LLC, compressing two cache lines into one by XORing them. The architecture relies on the cache coherence protocol for data decompression. In this paper, we demonstrate that this mechanism—specifically the latency asymmetry between a cache hit on an uncompressed vs. compressed line—introduces microarchitectural vulnerabilities. Based on this observation, we propose a covert channel attack targeting the XOR cache. A colluding sender controls the receiver’s access latency by triggering decompression through targeted write requests to partner cache lines. By exploiting the data-dependent compression behavior of the XOR cache, the sender and receiver establish the channel using pre-agreed data values. The channel achieves higher bandwidth than the Prime+Probe baseline for two reasons: first, each bit is encoded in the compression state of an individual line rather than the occupancy of a cache set, so a single set carries multiple bits; second, each bit is resolved by manipulating coherence-protocol state rather than forcing shared-cache evictions, so it costs fewer LLC accesses and demand misses than Prime+Probe. Full-system simulations show a bandwidth of <inline-formula><tex-math>$2.9 ,{mathrm{Mbps}}$</tex-math></inline-formula> at an observed <inline-formula><tex-math>$0.98 ,%$</tex-math></inline-formula> bit-error rate (BER) over 50,000 transmitted bits, <inline-formula><tex-math>$13.1;times$</tex-math></inline-formula> the bandwidth of Prime+Probe under the same sub-<inline-formula><tex-math>$1 ,%$</tex-math></inline-formula>-BER selection rule.","PeriodicalId":51248,"journal":{"name":"IEEE Computer Architecture Letters","volume":"25 2","pages":"399-402"},"PeriodicalIF":2.0,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149188546","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Pascal: Admission Control for Prefetching in Bandwidth-Constrained Multicore Systems","authors":"Juho Min","doi":"10.1109/LCA.2026.3720239","DOIUrl":"https://doi.org/10.1109/LCA.2026.3720239","url":null,"abstract":"Prefetchers are built and evaluated as <italic>predictors:</i> is this line likely to be used? We argue that on a bandwidth-constrained multicore the operative question is instead one of <italic>admission</i> — is this line worth the shared bandwidth it will consume, given who else is on the bus — and we show the two questions have different answers. Prediction quality alone does not settle the second one: across eight 4-core mixes spanning 14 SPEC CPU2006/2017 traces, the state-of-the-art learned filter PPF (Bhatia et al. 2019) leaves the bandwidth-bound co-runner <italic>28–44% slower than with no prefetching at all</i>, and an accuracy-feedback throttle (FDP (Srinath et al. 2007)) narrows this only to 12–14%. This is not an artifact of how those mixes were assembled: on eight further mixes drawn <italic>at random</i> from the same pool, PPF leaves the worst core below the line in all eight. We then locate the structural reason in the <italic>locality of the control signal</i>: a mechanism driven by a global rate, bandwidth, or accuracy signal still emits at least one prefetch per trigger, and even a global-signal <italic>admission</i> variant — the same gate, keyed on a bandwidth window — cuts traffic to 1.25× yet leaves the victim below the no-prefetch line. Among the mechanisms we evaluate, only <italic>per-candidate demand confirmation</i>(<italic>detect <inline-formula><tex-math>$to$</tex-math><alternatives><mml:math><mml:mo>→</mml:mo></mml:math><inline-graphic></alternatives></inline-formula> admit <inline-formula><tex-math>$to$</tex-math><alternatives><mml:math><mml:mo>→</mml:mo></mml:math><inline-graphic></alternatives></inline-formula> issue</i>) localizes a <italic>zero-prefetch state</i> to exactly the candidates that harm a co-tenant. A 768-byte gate instantiates the idea and carries across three out-of-order detectors, with intervention scaling with over-speculation rather than detector identity. The resulting trade is explicit and tunable rather than free: admission protects the latency-sensitive victim (1.04 versus PPF’s 0.69 in mix A) at 1.10× versus 1.72× DRAM traffic, but it reduces worst-core harm more often than it removes it, and PPF keeps the aggregate-throughput lead. We map when that trade is worth making, and when it is not.","PeriodicalId":51248,"journal":{"name":"IEEE Computer Architecture Letters","volume":"25 2","pages":"315-318"},"PeriodicalIF":2.0,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148837055","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Clover: Storage-Efficient Page Table Replication in Wafer-Scale GPUs","authors":"Sungbin Jang;Yongho Lee;Seokin Hong","doi":"10.1109/LCA.2026.3718473","DOIUrl":"https://doi.org/10.1109/LCA.2026.3718473","url":null,"abstract":"Wafer-scale GPUs integrate many GPU modules (GPMs) on a single wafer, but their distributed organization makes the address translation non-uniform: on an L2 TLB miss, a page table walker may fetch a leaf-level PTE from a remote GPM across the on-wafer mesh. Across 16 irregular applications, ideal full replication reduces execution time by 54.9% but requires <inline-formula><tex-math>$36times$</tex-math></inline-formula> of the storage of an unreplicated page table in a 6 × 6 mesh topology, equivalent to approximately 7.2% of the mapped memory footprint with 4KB pages. To this end, we propose <i>Clover</i>, a storage-efficient page-table replication mechanism that partitions the page table and applies a topology-aware <inline-formula><tex-math>$k$</tex-math></inline-formula>-hop placement. It allows every GPM to reach any partition within a small bounded number of hops while preserving conventional page-walk logic and keeping replicas coherent at low traffic. Clover reduces execution time by 44.9% on average while reducing aggregate page-table storage from <inline-formula><tex-math>$36times$</tex-math></inline-formula> to <inline-formula><tex-math>$7.2times$</tex-math></inline-formula> the unreplicated page-table size.","PeriodicalId":51248,"journal":{"name":"IEEE Computer Architecture Letters","volume":"25 2","pages":"307-310"},"PeriodicalIF":2.0,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148748728","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"ResidualEvil: Exploiting Post-Squash MSHR Contention for Transient Execution Attacks","authors":"Minwoo Jang;Hyosang Kim;Sungju Kim;Daehoon Kim","doi":"10.1109/LCA.2026.3718031","DOIUrl":"https://doi.org/10.1109/LCA.2026.3718031","url":null,"abstract":"Transient execution attacks exploit microarchitectural side effects left by mis-speculated instructions. Existing mitigations largely target leakage through secret-dependent cache residency or constrain when speculative memory effects become observable. We present <monospace>ResidualEvil</monospace>, a Spectre-v1-style disclosure primitive that encodes a secret bit through coalescing and non-coalescing transient miss bursts and decodes it using a fixed, secret-independent post-squash probe. Unlike cache-residency channels such as Flush+Reload, <monospace>ResidualEvil</monospace> exploits short-lived post-squash contention in MSHRs or equivalent miss-tracking resources. Targeted cross-platform controls support this attribution and demonstrate that post-squash leakage extends beyond secret-dependent cache residency. Using session-local calibration and held-out validation, ResidualEvil achieves validation pass rates of 90—100% across platforms and 94.5—100% median bit accuracy among passing sessions. Median calibration and validation latency is 0.66—4.93 s per session, after which extraction proceeds at 51.9—391.9 bit/s on commodity x86 and Arm processors.","PeriodicalId":51248,"journal":{"name":"IEEE Computer Architecture Letters","volume":"25 2","pages":"323-326"},"PeriodicalIF":2.0,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148925332","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"LLM KV Cache Storage Using CXL Memory","authors":"Kwan Huen;Gongjin Sun;Mehdi Nik;Caroline Kahn;Elham Movahedian;Senthil Murugesapandian;Michael Wasef;Shuyu Lyu;Dongyang Li;Edmund Au;Brian Luu;Jason Scott;Ranjitha Gopalakrishna;Namita Kumar;Amir Beygi;Vitorio Cargnini;Ramdas Kachare","doi":"10.1109/LCA.2026.3720952","DOIUrl":"https://doi.org/10.1109/LCA.2026.3720952","url":null,"abstract":"As the memory need for KV cache grows rapidly with the advent of multi-turn inferences and extremely long context requirements, limited GPU memory has become a critical bottleneck. While offloading the KV cache to CPU DRAM or SSDs has been explored, these solutions face limitations in capacity, latency, and scalability. Compute Express Link (CXL) memory offers a promising alternative that provides low-latency, disaggregation, and scalability benefits. In this paper, we evaluate KV cache offloading using various novel CXL memory architectures to compare with existing solutions. We tested memory expanders, CMM-D and CMM-H, and memory pooling solutions, including CMM-B and CMM-MP. For performance evaluation, vLLM, coupled with the LMCache framework, is employed to characterize five offloading targets. This comprehensive study provides insights into KV cache offloading tiers that can be used by end users to optimize their AI data center system architectures. CXL memory devices show significant performance benefits for KV cache offloading, with CMM-MP’s novel memory pooling architecture offering a particularly scalable and cost-efficient solution.","PeriodicalId":51248,"journal":{"name":"IEEE Computer Architecture Letters","volume":"25 2","pages":"319-322"},"PeriodicalIF":2.0,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11642129","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148925530","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Beyond Static Policies: Exploring Dynamic Policy Selection for Single-Thread Performance Optimization","authors":"Yanxin Zhang;Ian McDougall;Junnan Li;Shayne Wadle;Vikas Singh;Karthikeyan Sankaralingam","doi":"10.1109/LCA.2026.3723327","DOIUrl":"https://doi.org/10.1109/LCA.2026.3723327","url":null,"abstract":"For over a decade, processor design has focused on implementing sophisticated policies for various components of the out-of-order pipeline, including cache replacement and prefetching. The prevailing design philosophy has been to build processors with a single, static selection of policies across these different mechanisms. This paper investigates a fundamental question: do different workloads, or even different execution phases within the same workload, benefit from different policy combinations? We present a comprehensive analysis exploring whether a hypothetical processor capable of dynamically selecting from multiple policies could significantly outperform traditional static-policy processors. Using ChampSim-based simulation across 49 benchmarks segmented into 490 execution phases of 20 M instructions each, we evaluate performance across multiple policy combinations for cache replacement and prefetching. Our findings reveal that significant performance headroom exists: the best static policy achieves optimal performance for only 19.18% of execution phases and incurs a mean IPC loss of 1.54% compared to an oracle. Moreover, 85 phases (17.35%), spanning 14 of the 49 applications, exhibit more than 2.5% IPC loss relative to the oracle. Furthermore, we demonstrate that a runtime selector switching between two carefully chosen policies can reduce mean IPC loss from 1.53% for the always-Gaze static baseline to 0.407%, a 3.75× reduction, while achieving a 64.67% exact oracle-action match rate. These results suggest that dynamic policy selection represents a promising avenue for unlocking single-thread performance improvements that have become increasingly difficult to achieve.","PeriodicalId":51248,"journal":{"name":"IEEE Computer Architecture Letters","volume":"25 2","pages":"343-346"},"PeriodicalIF":2.0,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148986129","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Split-GEMM: Mitigating Routing-Induced Imbalance for MoE Serving on 3D-Stacked Near-Memory Processing","authors":"Kyungmo Koo;Hyungju Na;Wonjun Lee;Hyungdeok Lee;Yousub Jung;Ilkon Kim;Euicheol Lim;Jungwook Choi","doi":"10.1109/LCA.2026.3730894","DOIUrl":"https://doi.org/10.1109/LCA.2026.3730894","url":null,"abstract":"Mixture-of-Experts (MoE) LLMs route each token to a few expert FFNs, making decode-time expert execution bandwidth-sensitive and vulnerable to routing imbalance. Logic-die near-memory processing (NMP) provides high memory bandwidth and capacity for expert-weight storage and access, but scaled-out NMP serving with expert-level mappings suffers from routing-induced load imbalance across chips, leaving some chips overloaded while others idle. Increasing Expert Tensor Parallelism (ETP) can reduce imbalance, but exposes intra-/inter-chip communication. We propose Split-GEMM, a fine-grained mapping strategy that decomposes expert FFNs into GEMM-level pipeline stages and schedules expert-local tiles in fixed-size tile groups. By balancing chip-level work and communicating intermediate-activation shards, Split-GEMM achieves up to a 2.58× speedup over the best evaluated EP/ETP baseline.","PeriodicalId":51248,"journal":{"name":"IEEE Computer Architecture Letters","volume":"25 2","pages":"383-386"},"PeriodicalIF":2.0,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149130687","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Making Locality-Aware GEMM Compatible With Page-Granularity Placement on Chiplet GPUs","authors":"Euijun Chung;Jae Hyung Ju;Hyesoon Kim","doi":"10.1109/LCA.2026.3731087","DOIUrl":"https://doi.org/10.1109/LCA.2026.3731087","url":null,"abstract":"Multi-chiplet GPUs serve each memory access either from the chiplet’s nearby HBM stack or from a remote stack across the silicon interposer, and locality-aware data placement is a common way to keep accesses local. We show that this placement is often not achievable on current GPUs, since data is placed at page granularity (4 KB hardware interleaving or 2 MB GPU pages), while the locality-optimal per-chiplet slices are finer than, or not multiples of, the page granularity. For the 67% of representative LLM GEMMs in this regime, adopting the placement on current systems leaves 75% of HBM accesses remote on a four-chiplet GPU. To address this, we propose <italic>Chiplet-Contiguous Layout</i> (CCL), a global memory layout that contiguously stores the data consumed by each chiplet, so that the locality-aware placement becomes realizable with 4 KB placement granularity, without changes to the operating system or hardware. Across representative GEMMs from Qwen 3 30B and Llama 3.1 70B, CCL reduces remote HBM traffic by 9.5 × over 4 KB interleaving and by 2.2 × over coarse locality-aware placement, improving energy efficiency by 17% and 9%, respectively.","PeriodicalId":51248,"journal":{"name":"IEEE Computer Architecture Letters","volume":"25 2","pages":"387-390"},"PeriodicalIF":2.0,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149130689","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Fingerprinting Attacks on Machine Learning-Based Hardware Prefetchers","authors":"Jingren Wei;Radu Teodorescu","doi":"10.1109/LCA.2026.3704926","DOIUrl":"https://doi.org/10.1109/LCA.2026.3704926","url":null,"abstract":"Machine learning-based hardware prefetchers have emerged as a promising solution for capturing irregular memory access patterns more effectively than traditional rule-based prefetchers. Many such prefetchers train and update their models periodically, causing the deployed model to retain information from prior execution intervals. In this paper, we show that this persistent model state can be exploited to fingerprint previously executed applications. Using two representative ML-based prefetchers, we show that an attacker can identify applications that executed on a system tens of millions of cycles earlier, with 76% to 95% accuracy.","PeriodicalId":51248,"journal":{"name":"IEEE Computer Architecture Letters","volume":"25 2","pages":"247-250"},"PeriodicalIF":2.0,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148442780","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Reducing Metadata and Page Migration Overheads in CXL-Based Secure Tiered Memory","authors":"Juyoung Seok;Sungbin Jang;Yongho Lee;Osang Kwon;Seokin Hong","doi":"10.1109/LCA.2026.3715816","DOIUrl":"https://doi.org/10.1109/LCA.2026.3715816","url":null,"abstract":"Securing CXL-based tiered memory introduces substantial overhead. To ensure the confidentiality, integrity, and freshness of data stored in CXL memory, transmitting security metadata over the CXL link consumes link bandwidth and increases memory access latency. In addition, re-encrypting migrated pages makes page migration more expensive. To address these challenges, we propose two mechanisms. First, <italic>Self-Protective CXL Memory (SPCM)</i> secures memory by offloading the cryptographic hardware components and decoupling BMTs across memory tiers, eliminating the need to fetch security metadata over the CXL link. Second, <italic>Temporary Seed Encryption (TSE)</i> removes migration overhead by assigning a dynamic page-level temporary seed to each migrated page. Our evaluation demonstrates that the proposed mechanisms reduce the total execution time by 65.4% compared to the baseline system.","PeriodicalId":51248,"journal":{"name":"IEEE Computer Architecture Letters","volume":"25 2","pages":"291-294"},"PeriodicalIF":2.0,"publicationDate":"2026-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148746874","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}