Charting the Cache Side-Channel Frontier: A Systematic Study of Eviction Set Construction on Apple Silicon

Eviction sets constitute the fundamental primitive for conflict-based cache side-channel attacks, enabling unprivileged adversaries to induce contention deterministically. However, the security landscape of Apple Silicon remains largely underexplored due to the challenges of constructing these sets. We conduct a systematic reverse engineering study on the Apple M4 to uncover the root causes of these limitations, key microarchitectural impediments: an SLC victim buffer that obscures latency-based verification, a DRAM-to-Cache Prefetcher (DCP) that violates strict LRU replacement, and an opaque SLC allocation policy modulated by L2 Insertion/Promotion Vectors (IPV). Guided by these insights, we optimize construction strategies to overcome these impediments. Our enhanced Prime-Prune-Probe (PPP) achieves 88.2% success rate for L2 eviction sets. Furthermore, we employ a hierarchical filtering strategy to construct the first practical fine-grained SLC eviction sets on Apple Silicon. Our SLC optimal approach achieves a 90% success rate, unlocking fine-grained cross-cluster attack primitives previously deemed infeasible.