Guillaume Vanderhaegen

Corentin Naveau

Pascal Szriftgiser

Alexandre Kudlinski

Matteo Conforti

Arnaud Mussot

Miguel Onorato

Stefano Trillo

Amin Chabchoub

Nail Akhmediev

"Extraordinary" modulation instability in optics and hydrodynamics

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

Well-known Bespalov-Talanov (BT) [START_REF] Bespalov | Filamentary Structure of Light Beams in Nonlinear Liquids[END_REF] and Benjamin-Feir (BF) [START_REF] Benjamin | The disintegration of wave trains on deep water Part 1. Theory[END_REF][START_REF] Benjamin | Instability of periodic wavetrains in nonlinear dispersive systems[END_REF] instabilities discovered more than 60 years ago (1966 and 1967, respectively) played a significant role in understanding nonlinear phenomena in optics and hydrodynamics [START_REF] Lake | A note on some nonlinear water-wave experiments and the comparison of data with theory[END_REF][START_REF] Yuen | Nonlinear dynamics of deepwater gravity waves[END_REF][START_REF] Tulin | Laboratory observations of wave group evolution, including breaking effects[END_REF][START_REF] Kimmoun | Modulation instability and phase-shifted Fermi-Pasta-Ulam recurrence[END_REF][START_REF] Tai | Observation of modulational instability in optical fibers[END_REF][START_REF] Mussot | Fermi-Pasta-Ulam recurrence in nonlinear fiber optics: the role of reversible and irreversible losses[END_REF][START_REF] Mussot | Fibre multi-wave mixing combs reveal the broken symmetry of Fermi-Pasta-Ulam recurrence[END_REF][START_REF] Pierangeli | Observation of Fermi-Pasta-Ulam-Tsingou recurrence and its exact dynamics[END_REF]. The detailed description of these fundamental results can be found in any common book in nonlinear optics [START_REF] Remoissenet | Waves called solitons: concepts and experiments[END_REF][START_REF]Nonlinear Fiber Optics[END_REF], ocean waves [START_REF] Mei | The applied dynamics of ocean surface waves[END_REF][START_REF] Osborne | Nonlinear Ocean Waves & the Inverse Scattering Transform[END_REF], and more generally, in nonlinear dynamics book literature [START_REF] Daniel | Nonlinear Dynamics[END_REF]. The theory tells us that a plane wave or a constant amplitude wave (CW) is unstable relative to small amplitude perturbations with frequencies within certain deterministic and finite range. These perturbations are unstable and can grow exponentially, thus, leading to modulated waves with infinitely high amplitude. Clearly, such growth is unphysical and has to be reconsidered using an approach beyond linear theory.

Indeed, the accurate nonlinear theory [START_REF] Akhmediev | Modulation instability and periodic solutions of the nonlinear Schrödinger equation[END_REF] predicts saturation and the maximal amplitude of periodic waves excited due to modulation instability (MI). This prediction is in accordance with conventional wisdom: "what goes up must come down". In fact, this nonlinear stage of MI predicted not only the exponential growth but the following exponential decay back to the constant amplitude wave [START_REF] Akhmediev | Modulation instability and periodic solutions of the nonlinear Schrödinger equation[END_REF]. The latter was not obvious and required many years before this seemingly simple principle "must come down" has been confirmed, first with the observation of growth saturation in water waves [START_REF] Lake | A note on some nonlinear water-wave experiments and the comparison of data with theory[END_REF], and then with the demonstration of the full recursive behavior in optical experiments [START_REF] Van Simaeys | Experimental demonstration of the Fermi-Pasta-Ulam recurrence in a modulationally unstable optical wave[END_REF][START_REF] Van Simaeys | Experimental study of the reversible behavior of modulational instability in optical fibers[END_REF]. If translated to the frequency domain, this principle is, essentially, the Fermi-Pasta-Ulam recurrence [START_REF] Fermi | Studies of nonlinear problems[END_REF] (see also [START_REF] Lake | A note on some nonlinear water-wave experiments and the comparison of data with theory[END_REF][START_REF] Yuen | Nonlinear dynamics of deepwater gravity waves[END_REF][START_REF] Mussot | Fermi-Pasta-Ulam recurrence in nonlinear fiber optics: the role of reversible and irreversible losses[END_REF][START_REF] Mussot | Fibre multi-wave mixing combs reveal the broken symmetry of Fermi-Pasta-Ulam recurrence[END_REF][START_REF] Pierangeli | Observation of Fermi-Pasta-Ulam-Tsingou recurrence and its exact dynamics[END_REF][START_REF] Akhmediev | Pseudo-recurrence in Two-Dimensional Modulation Instability with a Saturable Self-Focusing Nonlinearity[END_REF]) .

Despite these achievements, it has been recently demonstrated that not all secrets of modulation instabil-ity concealed by the linear approach have been revealed so far [START_REF] Conforti | Doubly periodic solutions of the focusing nonlinear Schrödinger equation: Recurrence, period doubling, and amplification outside the conventional modulation-instability band[END_REF]. The results obtained in [START_REF] Conforti | Doubly periodic solutions of the focusing nonlinear Schrödinger equation: Recurrence, period doubling, and amplification outside the conventional modulation-instability band[END_REF] demonstrate that the linear theory does not accurately predict the range of unstable frequencies. This fact is, once again, not obvious. An exact nonlinear theory is essential for revealing the full range of frequencies that are unstable due to the modulation. Exact solutions of the nonlinear Schrödinger equation (NLSE) that describe the nonlinear stage of modulation instability are presently known as Akhmediev breathers (AB) [START_REF] Mahnke | Possibility of an Akhmediev breather decaying into solitons[END_REF][START_REF] Priya | Akhmediev breathers, Ma solitons, and general breathers from rogue waves: A case study in the Manakov system[END_REF][START_REF] Varlot | Akhmediev breathers as ultra-wideband pulses[END_REF][START_REF] Hammani | Spectral dynamics of modulation instability described using Akhmediev breather theory[END_REF][START_REF] Bendahmane | Optimal frequency conversion in the nonlinear stage of modulation instability[END_REF][START_REF] Yang | Optical amplification and transmission of attenuated multi-soliton based on spectral characteristics of Akhmediev breather[END_REF][START_REF] Andral | Akhmediev breather signatures from dispersive propagation of a periodically phase-modulated continuous[END_REF]. The latter form a family of solutions with a free parameter that is directly related to the whole interval of unstable frequencies in the BT and BF theories. However, even the AB solutions do not cover the whole range of unstable frequencies. The family of ABs is actually a particular case of more general family of solutions that have been found in [START_REF] Akhmediev | Exact solutions of the first order of nonlinear Schrödinger equation[END_REF] and refined recently in [START_REF] Conforti | Doubly periodic solutions of the focusing nonlinear Schrödinger equation: Recurrence, period doubling, and amplification outside the conventional modulation-instability band[END_REF]. This extension expands the range of unstable frequencies predicted in the the BT and BF theories. It has important ramifications for theory, experiment and applications [START_REF] Dudley | Rogue waves and analogies in optics and oceanography[END_REF]. It means, that periodic perturbations of a plane wave (or CW) can grow in the situations when we would not expect them to do so.

Presenting simultaneously optical and hydrodynamic experiments confirming this exceptional feature of modulation instability in a single work has far reaching consequences. Observing the same effect at nearly opposite ends of spatial and time scales of MI in physics is a convincing argument confirming the validity of the new finding. It means that similar phenomena at other scales such as MI in plasma [START_REF] Ghosh | Modulation Instability of Ion-Acoustic Waves in Plasma with Nonthermal Electrons[END_REF] or in Bose-Einstein condensate [START_REF] Li | Modulational instability of Bose-Einstein condensates with helicoidal spin-orbit coupling[END_REF] must also be re-examined. In optics, the extension of the range of frequencies leading to MI might have multiple applications for generating frequency combs [START_REF]Femtosecond Optical Frequency Comb Technology: Principle, Operation, and Application[END_REF], periodic pulse trains [START_REF] Greer | Generation of 2 THz repetition rate pulse trains through induced modulational instability[END_REF] and supercontinuum radiation [START_REF] Dudley | Supercontinuum generation in optical fibers[END_REF]. In hydrodynamics, the new findings might result in reconsidering conditions leading to formation of rogue waves in the ocean [START_REF] Kharif | Rogue waves in the ocean[END_REF].

THEORETICAL BACKGROUND

We start with the NLSE written in the normalised form:

iψ z + 1 2 ψ tt + |ψ| 2 ψ = 0 ( 1
)
where ψ is the wave envelope function, z is the longitudinal co-ordinate, and t is the time in a frame moving with group velocity. We are interested in doubly periodic waves, e.g., in solutions of Eq.( 1) that are periodic both in space and in time [START_REF] Conforti | Doubly periodic solutions of the focusing nonlinear Schrödinger equation: Recurrence, period doubling, and amplification outside the conventional modulation-instability band[END_REF]. They comprise the threeparameter family of solutions with a single period along each axis, z and t. This family contains as particular cases other 'elementary' solutions and families [START_REF] Conforti | Doubly periodic solutions of the focusing nonlinear Schrödinger equation: Recurrence, period doubling, and amplification outside the conventional modulation-instability band[END_REF]. To be specific, doubly periodic solutions of Eq. ( 1) can be presented in general form:

ψ(t, z) = [Q(t, z) + iδ(z)]e iφ(z) , (2)
with the functions Q(t, z), δ(z) and φ(z) that can be found by a direct substitution of ( 2) into (1) [START_REF] Akhmediev | Exact solutions of the first order of nonlinear Schrödinger equation[END_REF]. There are two forms of such solutions, classified as A-and Btypes depending on the parameters of the family. Each type contains MI as the limiting case. However, the limiting case of B-type solutions is the standard MI while the limiting case of A-type solutions is more general. This apparently puzzling asymmetry between the two families finds its physical justification in the fact that A-type solutions can be considered as the full nonlinear dressing of solutions of the NLSE obtained in the linear limit (when dispersion dominates over nonlinearity). As discussed in more details in [START_REF] Conforti | Doubly periodic solutions of the focusing nonlinear Schrödinger equation: Recurrence, period doubling, and amplification outside the conventional modulation-instability band[END_REF], for very high modulation frequencies, the deformation introduced by the nonlinearity is small and essentially the modulation experiences, upon evolution, only a periodic phase shift [START_REF] Trillo | Dynamics of the nonlinear modulational instability in optical fibers[END_REF]. However, when the frequency is reduced to sufficiently small values, the deformation due to the nonlinearity becomes strong, thereby inducing a net amplification of the input sidebands even outside the conventional MI bandwidth. Conversely, B-type solutions start to appear only at frequencies below the conventional band-edge of MI, as a result of the symmetry breaking nature of the onset of conventional MI [START_REF] Mussot | Fibre multi-wave mixing combs reveal the broken symmetry of Fermi-Pasta-Ulam recurrence[END_REF][START_REF] Conforti | Doubly periodic solutions of the focusing nonlinear Schrödinger equation: Recurrence, period doubling, and amplification outside the conventional modulation-instability band[END_REF]. Therefore, B-type solutions cannot be responsible for any unconventional MI.

Thus, our point of interest in this work is the A-type solutions. Then, the three functions in (2) are defined as follows. Namely, for the function δ(z), we have the following expression:

δ(z) = α 3 2 (1 -ν) 1 + dn(µz, k) 1 + νcn(µz, k) sn(µz/2, k), (3)
where

m = k 2 = 1 2 1 - η 2 + ρ(ρ -α 3 ) AB , A 2 = (α 3 - ρ) 2 + η 2 , B 2 = ρ 2 + η 2 , ν = A -B A + B
, and µ = 4 √ AB. The function δ varies within the interval 0 < δ 2 < α 3 . The phase φ(z) is given by:

φ(z) = 2ρ + α 3 ν z-α3 νµ Π(am(µz, k), n, k) - -νσ tan -1 sd(µz,k) σ (4)
where In contrast to δ and φ, the function Q depends on two variables t and z. It is given by:

n = ν 2 ν 2 -1 , σ = 1-ν 2 k 2 +(1-k 2 )ν 2 ,
Q(t, z) = sb -c + r + cn(pt, k q ) 1 + rcn(pt, k q ) , (5)
where

s(z) = sign [cn(µz/2, k)], r = M -N M +N , p = √ M N = 2 4 (α 3 -ρ) 2 + η 2 , k 2 q = 1 2 + 2 ρ -α 3 p 2 , b = √ α 3 -y, y(z) = δ 2 (z), c ± = 2 (y -ρ) 2 + η 2 ± (ρ -y) , M 2 = (2sb + c + ) 2 + c 2 -, and
N 2 = (2sb -c + ) 2 + c 2 -.
These functions and, consequently, the whole family of solutions, depend on three arbitrary real parameters α 3 , ρ, η [START_REF] Conforti | Doubly periodic solutions of the focusing nonlinear Schrödinger equation: Recurrence, period doubling, and amplification outside the conventional modulation-instability band[END_REF][START_REF] Akhmediev | Exact solutions of the first order of nonlinear Schrödinger equation[END_REF]. The periods in z and t also depend on these parameters. They are given by: Z = 8K(k)/µ, T = 4K(k q )/p, respectively, where K(k) is the complete elliptic integral of the first kind. These free parameters provide us with the possibility of accurately controlling the wave evolution with periodic initial conditions and particularly the development of modulation instability.

INSTABILITY OUTSIDE THE CONVENTIONAL MI BAND

Equations above provide an exact wave dynamics with two frequencies. Thus, the MI which is periodic along the t-axis is a particular case of these solutions. Indeed, there is a range of parameters ρ and η when the solution represents the growth of a periodic perturbation on top of a continuous wave. This happens when 0 < ρ < 1 and η → 0. This range corresponds to exact conditions of modulation instability with the exponential growth of periodic perturbation with a frequency defined by ρ. On the other hand, for parameters ρ and η beyond this range, the evolution has all features of modulation instability but the growth of the perturbation takes different form.

This more general evolution is periodic in z. The solution is closest to the continuous wave when the evolution variable z = ±Z/4. Starting from one of these values of z leads to the growth of modulations on the background CW. One example is given in Fig. 1(a) that shows wave intensity profiles at z = -Z/4 when the modulation is small (red curve) and at z = 0 when the modulation is maximal (blue curve). Pulses within this periodic pulse train are maximally compressed. The wave intensity profile returns back to the initial condition at z = +Z/4. The amplification of the periodic component of the solution calculated numerically from the exact solution is shown in Fig. 1(b). Here, the frequency range [0, 2] is the standard band of modulation instability. Amplification within this range is not surprising. However, the amplification is not zero when the frequency ω > 2. The amplification here might seem smaller than within the band [0,2]. However, the amplitudes of the pulse trains reached due to the growth are of the same order of magnitude as within the band. Thus, the effect is easily measurable in experiments. Moreover, the frequency range shown in Fig. 1(b) is nearly 1.5 times the conventional MI bandwidth ω ∈ [0, 2]. In reality, it is much wider than in this figure. Even from this point of view, the effect is easily observable. As can be seen from Fig. 1(b), the value of amplification depends on the parameter η. For larger values of η, the amplification within the standard MI band is smaller. However, the amplification outside of this band does not depend on η. Thus, at larger values of η, the MI effect is nearly the same order of magnitude within and outside of the standard band.

Another remarkable feature of the MI visible in Fig. 1(a) is the period of the pulse train which is twice the period of the initial modulation. Every second maxima of the periodic perturbation grows while the juxtaposing maxima decay. This feature adds flexibility to potential applications of the effect. The red curve in Fig. 1(a) and analogous curves calculated for other values of parameters have been used as initial conditions in the optical and water wave experiments as well as in numerical simulations presented below.

OPTICAL EXPERIMENTS

For optical experiment, we used a setup similar to the one used in [START_REF] Mussot | Fibre multi-wave mixing combs reveal the broken symmetry of Fermi-Pasta-Ulam recurrence[END_REF][START_REF] Vanderhaegen | Observation of doubly periodic solutions of the nonlinear Schrödinger equation in optical fibers[END_REF] and devoted to investigate nonlinear stage of MI within its conventional bandwidth. Its schematic is shown in Fig. 2 Here fm is the input modulation frequency (pump frequency at f1, input sideband frequencies at f1 ± fm). The backscattered signal from the SMF-28 fiber goes through a circulator to be analysed via heterodyning (beating with the local oscillator) and then filtered (waveshaper) to isolate the power and phase evolutions of the pump and the first-order side-band pair in the MI spectral comb; OSA -optical spectrum analyzer.

CW f f 1 f f f f f f 1 f 2 f 2 f 1 -f m f 1 +f m f 2 +f m f 2 -f m ∆f = f 2 -
continuous wave with periodic perturbation is created by CW laser 1. The intensity and the phase of the pump and the sidebands are precisely controlled. The resulting 3wave input is injected into a L = 18.28 km long SMF-28 fiber (group velocity dispersion

β 2 = -21 × 10 -27 s 2 m -1 , nonlinear coefficient γ = 1.3 × 10 -3 W -1 m -1
). The loss is actively compensated by using a counter-propagating Raman pump emulating an almost fully transparent optical fiber [START_REF] Mussot | Fibre multi-wave mixing combs reveal the broken symmetry of Fermi-Pasta-Ulam recurrence[END_REF]. Power and phase distributions of the pump and the first order sideband (signal) are obtained using a multi-heterodyning technique between the backscattered signal and the local oscillator [START_REF] Mussot | Fibre multi-wave mixing combs reveal the broken symmetry of Fermi-Pasta-Ulam recurrence[END_REF].

In order to apply the theory in the previous section to optical fibers, the variables must be renormalized. To this end, the dimensional distance Z, time T (in the frame traveling at light group-velocity), and field Ψ (with |Ψ| 2 giving directly the power in Watts) are obtained by the following rescaling

Z = (z -z 0 )L N L , T = t T s , Ψ = ψ P P , (6)
L N L = (γP P ) -1 , T s = |β 2 |L N L , (7)
where L N L is the characteristic nonlinear length scale associated with CW power P p , and T s is the relative temporal scale associated with dispersion. Here z 0 is a suitable shift that accounts for the fact the input Z = 0 corresponds to a point of weak modulation in the solution (whereas z = 0 is the point of maximum amplification in the solution). For practical purposes, we can approximate z 0 ≈ Z/4, valid for weak enough input modulation. In this scaling, the MI cutoff frequency is f C = 2/(2πT s ) = 1/(π |β 2 | L N L ). The pump power P P in experiments is set to 180 mW leading t.o a cutoff frequency of the conventional MI gain band at f C = 33.6 GHz. In all our experiments, the modulation frequency f m is located outside the MI gain band i.e. f m > f C . The intensity of the sidebands is set at 5.3 dB below the pump power. The experimental spectra of the 3-wave input and the spectrum of spontaneous MI, i.e. conventional MI gain band profile, are plotted in Fig. 3. The initial relative phase between the pump and the signal is π 2 in order to excite the A-type waves. The first recurrence to the initial power profile occurs at 5 km, and then successive cycles of growth and decay are repeated. Overall, more than three periods of such oscillatory evolution can be seen in Fig. 4(a). Deviation from perfect periodic dynamics is due to an imperfect compensation of loss by the active compensation system. The consequence of this inaccuracy is over amplification of the signal around 10 km mark. shows the nearly linear evolution of the pump-signal relative phase (∆Φ) over the fiber length. The experimental curve fits the theory almost perfectly. Importantly, the initial phase is recovered after two cycles of power evolution (around Z = 10 km), whereas successive maximum amplification stages turn out to be mutually out of phase (sidebands shifted by π), which is a unique feature of Atype solutions [START_REF] Conforti | Doubly periodic solutions of the focusing nonlinear Schrödinger equation: Recurrence, period doubling, and amplification outside the conventional modulation-instability band[END_REF].

It is also very convenient to illustrate the dynamics of the process in the phase space (µ cos(∆Φ), µ sin(∆Φ)) where µ is the signal power normalised to its maximum value. Such trajectories are shown in Fig. 4(c). The theoretical curve shown by the dashed line is strictly periodic and corresponds to the A-type solution. The quantitative agreement is also pretty good if we focus on the locations of the curve maxima. Figure 4(c) also gives a pictorial view of the fact that the sidebands amplification is connected to the nonlinear deformation of the orbit with respect to circular orbits (characteristic of the purely linear limit ω → ∞, not shown). The net gain indeed arises, in the figure-of-eight-shaped orbit, from the ratio of the signal at the maximum elongation (horizontal axis, ∆Φ = 0, π) and at the maximum orbital squeezing (input, ∆Φ = -π/2).

Figures 4(d) and (f) show the spatio-temporal evolutions of the power (Fig. 4(d)) and phase (Fig. 4(f)) of the electric field calculated from the inverse Fourier transform of the 3 main spectral components (see Figs. 4(a)-4(c)). We used a procedure similar to that in Ref. [START_REF] Naveau | Full-field characterization of breather dynamics over the whole length of an optical fiber[END_REF]. Characteristic chess-board-like pattern are obtained which is a clear signature of A-type solutions. The agreement with the analytical solution (Fig. 4(e) and (g)) is very good. We notice, once again, that the input phase is recovered after two grow-decay cycles of power evolution, whereas successive maximal amplification profiles are shifted by half of the transverse period.

Figure 5 shows two additional spatio-temporal evolutions of the signal power from experimental measurements (left panels) and from analytics (right panels). The two signal frequency shifts (f m = 34 and 37 GHz respectively) are still outside of the MI band but located closer to the cutt-off frequency. Again, the chess-board like pattern of these plots confirms the A-type nature of these solutions. We can also notice that when approaching the cut-off frequency, the spatial periods (along z) increase, as can be seen from Figs.4 (d) and 5 (a) and (c). Impor-tantly, maximal wave amplitudes reached at the points of maximal compression are of the same order of magnitude for all cases shown in these figures.

As mentioned, the spatial (longitudinal) period depends on the shift between the modulation and the pump frequencies. When the modulation frequency is outside of the MI band, this period decreases with the modulation frequency moving away from the pump. Experimental verification of this behaviour is shown in Fig. 6(a). the frequency shift increases from 34 GHz to 41 GHz, the number of longitudinal periods along the same distance ≈ 18 km changes from 3 to 3.8. This means that each longitudinal period decreases from ≈ 6 km to ≈ 4.73 km. Agreement between the experimental data and the theory is also good as the two plots in Fig. 6 demonstrate. Thus, our optical experiments confirm, clearly, the fact of existence of modulation instability outside of the conventional instability band. The measurements are in good agreement with the theoretical predictions based on the exact solutions of the NLSE.

WATER WAVE EXPERIMENTS

The hydrodynamic experiments have been performed in a uni-directional wave tank, installed at the University of Sydney and shown in Fig. 7. Its dimensions are 1 m FIG. 7. Sketch of the L=30 meters long water tank at the University of Sydney. In red the locations of the gauges.

× 1 m × 30 m. The tank was filled with fresh water to the height of 0.7 m in order to satisfy the deep water conditions for waves generated at the peak frequencies between 1.5 and 2.0 Hz. The piston wave maker with oscillation frequency range of 0.4 < f < 2 Hz is installed at the right end of the tank. A wave absorbing beach was located at the opposite end to eliminate any influence from reflected waves. The piston is activated by an electric actuator, controlled by a pre-processed signal, which allows the seeding of a modulated surface elevation profile, according to mathematical expressions given above.

Eight wave gauges with a sampling rate of 32 Hz each are placed along the tank to collect the water wave elevation data. Due to repeatability of experiments, all eight wave gauges have been repositioned five times along the facility to ensure high resolution of the data acquisition both in time and in space. The gauges locations measured from the mean position of piston in these experiments are represented in red in Fig. 7. This gave us sufficient resolution in z for plotting the experimental patterns, as shown below. The wave envelopes have been computed using the Hilbert transform while the spectral data have been calculated using the fast Fourier transform of the water surface elevation data.

Although the water wave envelope obeys the same dimensionless focusing NLSE as the normalized optical field in optical fiber, the spatial and time scales turn out to be extremely different. We start from dimensional deep-water time-NLSE [START_REF] Osborne | Nonlinear Ocean Waves & the Inverse Scattering Transform[END_REF] characterized by the secondorder dispersion coefficient β 2 = -2/g (g = 9.81 m/s 2 is the gravitational acceleration) and the nonlinear coefficient γ = -κ 3 (γβ 2 > 0, focusing regime), where κ is the wavenumber of the carrier, with the carrier frequency fixed through the dispersion relation ω = √ gκ. In order to introduce a normalization akin to Eqs. (6-7), the dimensional distance along the tank Z, the dimensional time T , and the envelope of water wave elevation Ψ, can be expressed in terms of nonlinear length L N L and temporal scale T s , fixed by the input envelope elevation a, as follows (see also [START_REF] Koussaifi | Spontaneous emergence of rogue waves in partially coherent waves: A quantitative experimental comparison between hydrodynamics and optics[END_REF])

Z = (z -z 0 ) L N L , T = t T s , Ψ = ψ a, (8)
where

L N L = 1 κ 3 a 2 , T s = 2 gκ 3 a 2 ,
and z 0 is a suitable shift for which considerations analogous to those made in optics are still valid. It is worth mentioning that in this case, the time T is also measured in the frame moving with the group velocity c g = ω 2κ . Obviously, this scaling is not unique. An equivalent choice often employed in the case of water waves can be written in terms of the wavenumber κ and the wave steepness ε = aκ: Z = z/(κε 2 ), T = √ 2t/(ωε), Ψ = ψε/κ. Operating with the scaling in Eq. ( 8 2 , turns out to be several orders of magnitude lower than the one in optics. For instance, with κ = 10 m -1 and a = 0.01 m (case of Fig. 8), we obtain f C = 0.22 Hz. The envelope evolution as predicted by theory takes into account the second-order Stokes correction to the water surface elevation [START_REF] Dudley | Rogue waves and analogies in optics and oceanography[END_REF]. These spatio-temporal patterns are very similar to those obtained in optical experiments. Remarkably, our maxima (two periods) have been achieved within the length of the tank as can be seen from Fig. 8. The resulting chessboard structure of this pattern corresponding to the A-type doubly periodic wave is also clearly seen. Three recurrences to a nearly constant amplitude wave are clearly visible despite unavoidable dissipation elements, always present when performing laboratory experiments. Note that for the given carrier wave parameters, it would not be possible to observe more than one cycle of MI-growth-decay or AB within the given effective propagation distance of 25 m.

In order to reaffirm the observation, two more examples of the spatio-temporal pattern are shown in Fig. 9. These plots contain less then one period of evolution that includes one full recurrence to initial conditions at around 15 meters mark in (a) and around 19 meters mark in (c). In each case, the carrier steepness ε has been adjusted to be just below the threshold of wave breaking. The latter happens due to the excessive wave amplitude amplification.

One essential difference of experimental patterns in Figs. 8(a) and 9(a) from the optical ones is slightly tilted vertical stripes. The reason is the asymmetry of the water wave profiles, which is the result of significant breather amplification of a factor of three and above. The con- sequence is the nonlinear Stokes contributions that are always present in water waves at these scales [42,[START_REF] Waseda | On the Asymmetric Spectral Broadening of a Hydrodynamic Modulated Wave Train in the Optical Regime[END_REF]. Despite these deviations, the patterns in Figs. 8(a) and 9(a) clearly confirm the presence of the modulation instability and its nonlinear evolution beyond the standard unstable frequencies of MI in the BF theory. Generally, when increasing the amplification factor of the breather, the steepness has to be decreased in order to avoid wave breaking. The latter violates the condition of the flow to be irrotational and thus, prohibits applicability of the Euler equations and subsequently, the validity of the NLSE [START_REF] Mei | The applied dynamics of ocean surface waves[END_REF]. Indeed, when this threshold of wave breaking is exceeded, spilling as well as recurrent breaking occurs and the pattern changes significantly and does not follow the theoretical NLSE predictions. One example is shown in Fig. 10. Here, the value of the breather parameter ρ is increased in comparison to the previous cases. Modulation instability still develops but there is no obvious recurrence back to initial conditions as can be seen from Fig. 10(a).

CONCLUSIONS

In conclusion, we have experimentally confirmed that modulation instability is more complex phenomenon than the one predicted by the simplified linear stability analysis. The most striking difference that the more ac- curate nonlinear analysis using exact breather framework reveals is the fact that periodically perturbed continuous waves develop the growth of perturbation not only within the standard modulation instability band described by the BF and BT theories but also outside of it. To be more accurate, the frequency range of unstable growth of the perturbation extends beyond the standard MI threshold. Another dramatic difference from the standard theory can be seen when observing the nonlinear stage of MI. The subsequent evolution beyond the initial growth creates a specific chess-board like periodic spatio-temporal pattern of wave propagation. Temporal maxima of the generated pulse trains change position every half period of spatial evolution. The effect tightly related to this phenomenon is the fact that the frequency of the pulse train at the point of maximum compression is half of the frequency of initial modulation. Such phenomenon may find applications in frequency comb devices facilitating the atomic clock synchronisation when the frequencies differ by an octave [START_REF] Newbury | Searching for applications with a finetooth comb[END_REF].

Having these unusual features revealed in nonlinear analysis, we can call the effect 'extended' or 'extraordinary' modulation instability. Importantly, we were able to track and confirm this 'extraordinary' modulation instability in two different physical media, namely, in optics and in hydrodynamics, proving the interdisciplinary significance of the extended MI. In fact, these are the two areas of physics where the wavelength differs by four orders of magnitude, and the modulation frequencies by ten orders of magnitude. This twofold confirmation of the effect shows that it is ubiquitous and does not depend on the scale of the physical system that we operate with. The effects should be also observable in other areas of physics such as astrophysics [START_REF] Haar | Modulation instabilities in astrophysics[END_REF], plasma [START_REF] Ichikawa | Modulation Instability of Electron Plasma Wave[END_REF][START_REF] Thornhill | Langmuir turbulence and modulational instability[END_REF], metamaterials [START_REF] Xu | Spacetime evolution of optical breathers and modulation instability patterns in metamaterial waveguides[END_REF] and in Bose-Einstein condensate [START_REF] Nguyen | Formation of matter-wave soliton trains by modulational instability[END_REF][START_REF] Everitt | Observation of a modulational instability in Bose-Einstein condensates[END_REF]. We envisage that the new phenomenon can be useful in applications such as generation of optical frequency combs and pulse trains with prescribed parameters: periods, amplitudes and duty cycles. Moreover, we anticipate novel modelling approaches for extreme events in nonlinear dispersive media.

  FIG. 1. (a) Transformation of a periodic perturbation on top of the CW (red curve) into a train of pulses (blue curve). Parameters of the solution here are: ρ = 0, η = 1, α3 = 1. Modulation frequency ω = 2.287 > 2 is outside of the instability band. (b) Amplification of periodic component of the solution vs frequency. Frequency ω depends on the parameter ρ that changes in the interval [-3, 1]. Grey area beyond dashed black line marks the frequency range ω > 2, located outside the conventional MI gain band (ω ≤ 2).

  FIG.2. Experimental setup: f1,2 are the frequencies of the main laser and the local oscillator laser, respectively. Here fm is the input modulation frequency (pump frequency at f1, input sideband frequencies at f1 ± fm). The backscattered signal from the SMF-28 fiber goes through a circulator to be analysed via heterodyning (beating with the local oscillator) and then filtered (waveshaper) to isolate the power and phase evolutions of the pump and the first-order side-band pair in the MI spectral comb; OSA -optical spectrum analyzer.

  FIG. 3. Experimental 3-wave input spectrum (purple solid line) compared with the spontaneous MI spectrum (yellow dotted line). The two grey areas beyond dashed black lines mark the range of frequencies f > fC , located outside of the conventional MI gain band (f ≤ fC ).

Fig. 4 FIG. 4 .

 44 FIG. 4. Three waves evolution along the fiber when the sideband detuning fm = 40 GHz (ωm = 2.3809) is outside the conventional MI band. (a) Evolution of the pump power (blue curves) and signal power (red curves). The solid curves in (a),(b) and (c) correspond to the experimental data while dashed curves are theoretical. (b) Relative phase vs distance. (c) The phase-plane representation of the evolution. (d) and (e) Spatio-temporal false-colour plots of the power profile. (f) and (g) The phase profiles. The panels (d) and (f) show the experimental data while (e) and (g) are theoretical. The following parameters have been used to prepare the initial conditions in the experiment and to plot the analytical solution: η = 1.2420, ρ = 0.0317, α3 = 1.0.

FIG. 5 .

 5 FIG. 5. Spatio-temporal power evolution for two other values of the pump-signal frequency shift. (a),(b) fm = 34 GHz (ωm = 2.0238); (c),(d) fm = 37 GHz (ωm = 2.2023). Left panels: experimental data, right panels: analytical solution. The following parameters have been used to prepare the initial conditions in the experiment and to plot the analytical solution: (a),(b) η = 1.0385, ρ = 0.4275, α3 = 1.0; and (c),(d) η = 1.1407, ρ = 0.2374, α3 = 1.0.

Fig. 6 (FIG. 6

 66 FIG. 6. 2-D plot of the signal power as a function of distance Z (vertical axis) and pump-signal frequency shift (horizontal axis). (a) experiment and (b) numerics.

  ), we obtained the theoretical spatio-temporal patterns shown in Figs. 8-10 [see right panels (b)], which we compare with experimental data [left panels (a) in the same figures]. The choice of the parameters of the NLSE solution used for generating these patterns is given in the figure captions. In our water waves experiment, typically, L N L ≈ 10 m and T s ≈ 1.4 s, compared with L N L ≈ 4 km and T s ≈ 10 ps of the optical experiment. Accordingly, also the MI cut-off frequency, which reads, in this case, f C = 1 π gκ 3 a 2

FIG. 8 .

 8 FIG. 8. (a) Experimental and (b) theoretical plots of spatiotemporal wave evolution that start with extraordinary modulation instability. The values of parameters in the NLSE solution used to prepare the initial conditions in the experiment are: η = 1.9, ρ = -0.9 and α3 = 1.0. Wave amplitude a = 0.01 m, the carrier wavenumber κ = 10 m -1 , the corresponding wave steepness ε = 0.1, and the modulation frequency fm = 0.37 Hz is well above the cut-off fC = 0.22 Hz.

FIG. 9 .

 9 FIG. 9. (a,c) Experimental and (b,d) theoretical plots of spatio-temporal wave evolution that start with modulation instability. The values of parameters in the NLSE solution used to prepare the initial conditions in the experiment are: (a,b) η = 1.03, ρ = 0.355, α3 = 1.0; and (c,d) η = 1.0, ρ = 2.0, α3 = 1.0. Wave amplitude a = 0.01 m in each case. The wavenumber of the carrier is (a) κ = 10 m -1 and (c) κ = 8 m -1 . The corresponding wave steepness ε = 0.1 with cut-off frequency fC = 0.22 Hz in (a) and aκ = 0.08 with cut-off frequency fC = 0.15 in (c). The modulation frequency is fm = 0.25 Hz in (a) and fm = 0.16 Hz in (c).

FIG. 10 .

 10 FIG. 10. (a) Experimental and (b) theoretical plots of spatiotemporal wave evolution that start with modulation instability. The values of parameters in the NLSE solution used to prepare the initial conditions in the experiment are: η = 1.9, ρ = 2.9 and α3 = 1.0. Wave amplitude a = 0.01 m. The wavenumber of the carrier in (a) is κ = 8 m -1 , consequently the wave steepness ε = 0.08. The modulation frequency here fm = 0.2 Hz is once again above the cut-off frequency fC = 0.15 Hz. Modulation instability develops but wave breaking prevents the recurrence back to initial conditions.

  . The input in the form of

	SMF -28
		OSA
	Pulse ,
	sideb ands,
	phase
	proce ssor	Oscill o.
	sideb ands proce ssor

ACKNOWLEDGMENTS

Agence Nationale de la Recherche (Programme Investissements dAvenir); Ministry of Higher Education and Research; Hauts de France Council; European Regional Development Fund (Photonics for Society P4S, FUHNKC, EXAT).


Pierre Ayoub
email: pierre.ayoub@eurecom.fr

Clémentine Maurice
email: clementine.maurice@inria.fr

Reproducing Spectre Attack with gem5 How To Do It Right?

Keywords: Security and privacy → Hardware attacks and countermeasures; Hardware security implementation Reproducibility, Micro-architecture, Branch Predictor, Cache Side-Channel, Flush+Reload, Transient Execution Attack, Spectre, Simulation, gem5

As processors become more and more complex due to performance optimizations and energy savings, new attack surfaces raise. We know that the micro-architecture of a processor leaks some information into the architectural domain. Moreover, some mechanisms like speculative execution can be exploited to execute malicious instructions. As a consequence, it allows a process to spy another process or to steal data. These attacks are consequences of fundamental design issues, thus they are complicated to fix and reproduce. Simulation would be of a great help for scientific research for microarchitectural security, but it also leads to new challenges. We try to address the first challenges to demonstrate that simulation could be useful in research and an interesting technique to develop in the future.

INTRODUCTION

Modern processors use various micro-architectural mechanisms to increase their performance. Attacks that exploit these mechanisms are called micro-architectural attacks. Caches, which are used to store recently accessed data for quick accesses, have been extensively studied for their timing leakage like in the Flush+Reload attack [START_REF] Yarom | Flush+Reload: A High Resolution, Low Noise, L3 Cache Side-Channel Attack[END_REF]. By differentiating cached and uncached data through timing measurements, an attacker can spy another process. Speculative execution is used to speculate on the next instruction to execute when the instruction flow is uncertain, particularly on branch instruction for branch prediction [START_REF] Mittal | A Survey of Techniques for Dynamic Branch Prediction[END_REF] [START_REF] Smith | A Study of Branch Prediction Strategies (ISCA)[END_REF]. In 2018, a new class of attacks has been released, namely Spectre [START_REF] Kocher | Spectre Attacks: Exploiting Speculative Execution (S&P)[END_REF], which is able to steal protected data by exploiting the speculative execution mechanism of a processor.

Since its disclosure, many variants of the Spectre attack have been discovered and various countermeasures have been developed, both software or hardware-based [START_REF] Canella | A Systematic Evaluation of Transient Execution Attacks and Defenses[END_REF]. Unfortunately, currently none of them have been widely adopted, mainly due to their performance overhead or the implementation difficulty.

In this paper, we investigate a novel approach in the field of micro-architectural attack development, which is to use the state-ofthe-art simulator gem5 to reproduce and study the Spectre attack. These attacks are closely tied to the hardware implementation, thus, their reproducibility on a simulator is not trivial. We are also interested in the accuracy of the simulation. Our goal is to explore the benefits of the simulation for security researchers. The main contributions of our paper are:

• From our experiments, we provide several guidelines that we deem important for micro-architectural security research, in both attack development and reproduction (Section 4). • We demonstrate the usage of gem5 to develop new techniques for helping attack development and understanding, like visualizing the micro-architectural state of a processor under attack (Section 5). • We demonstrate the reproducibility of Spectre on a cycleaccurate simulator and evaluate its accuracy by comparing it to experiments on real hardware (Section 7). • We discuss the requirements of gem5 to simulate those attacks and the parameters that affect their efficiency (Section 8).

BACKGROUND 2.1 Caches

The latency when loading a word from the main memory is too high compared to the computation speed of the processor, thus the memory is organized into a hierarchy, with smaller but faster memories close to the processor. A cache memory is a small, fast, and expensive memory which aims at keeping more often used data close and quickly accessible. A cache hit happens when the processor finds the requested data in the cache, otherwise it is called a cache miss. The hierarchy is divided into several levels, often between 2 and 4 -denoted L1 to L4. The Last-Level-Cache (LLC) is the closest level to the main memory. Caches are organized into multiple lines, which are the smallest unit to load or flush data from the cache, often equal to 64 consecutive bytes. A fixed number of lines are grouped into cache sets, which corresponds to the cache associativity. A cache can be accessible from only one core, called a private cache, or from multiple cores of the processor, called a shared cache. In multi-core processors, the LLC is often shared between cores. Caches can be inclusive, which means that a level 𝑛 of cache contains all the data and instructions of level 𝑚 < 𝑛, in addition to its own exclusive content since it is larger.

Branch Prediction

When the processor does not know which instructions it needs to execute next, it may use an optimization called speculative execution, which consists in speculatively executing one of the possible instruction streams. If the speculation was wrong, then the pipeline is flushed, and we say that these instructions have been squashed. Branch prediction is one form of speculative execution, where the processor speculates on the result of encountered branches [START_REF] Mittal | A Survey of Techniques for Dynamic Branch Prediction[END_REF] [START_REF] Smith | A Study of Branch Prediction Strategies (ISCA)[END_REF]. The branch predictor, which is an internal component of the processor, guesses the outcome of a branch instruction, e.g., if the outcome of a conditional branch is taken or not taken, even before the evaluation of the condition. Different branch types exist (unconditional and indirect branches) as well as different prediction types (instruction prediction, outcome prediction and target prediction).

The branch predictor uses some structures, the important one in this paper being the Pattern History Table (PHT). First, a history pattern is a sequence of 𝑛 bits indicating, for each bit, the taken or not taken direction for the last 𝑛 executed branches in fetch order [START_REF] Yeh | Two-Level Adaptive Training Branch Prediction[END_REF]. A saturating counter is a bit sequence -between 2 and 4 bits -incremented (resp. decremented) when a branch is taken (resp. not taken). The counter's uppermost bit is used as the prediction -set to 1 means that the branch was previously taken at least 1 2 time. The PHT is an array indexed by a bit sequence identifying a scenario -a history pattern -, where each entry stores a saturating counter used as the prediction for the outcome of the branch.

There are many algorithms and architectures for branch predictors. We briefly present the two architectures used in the remainder of this paper. The two-level global history-based predictor performs two steps for each branch prediction: (1) Indexing the PHT according to the current history pattern, which gives the outcome of the branch. (2) Predicting the address based on the predicted outcome. "Global history-based" means that the PHT is indexed by a unique history pattern stored in a shift register, which includes all encountered branches, being the simplest form of two-level predictors. The Bi-Mode branch predictor [START_REF] Lee | The Bi-Mode Branch Predictor[END_REF] is identical to the previous one except that it separates mostly-taken and mostly-not-taken branches into two different PHTs to increase prediction's efficiency.

Spectre

A transient instruction refers to an instruction partially or completely executed by the processor. It can affect the processor's microarchitectural state, but leaves its architectural state without any trace of its execution. The Spectre variant we studied (Spectre-v1, a.k.a. Spectre-PHT-SA-IP) [START_REF] Kocher | Spectre Attacks: Exploiting Speculative Execution (S&P)[END_REF] exploits speculative execution, more precisely, it tricks the branch predictor on a conditional branch's outcome. It uses the PHT of the branch predictor to induce a victim executing a conditional branch with a malicious and unauthorized parameter. The unauthorized instructions modify the microarchitectural state in a way that is dependent of the targeted value

if (x < array1_size) y = array2[array1[x]];
Listing 1: Conditional branch targeted by Spectre.

-the secret to recover. After the transient execution, the attacker probes the micro-architectural domain using a covert channel and infers the targeted value from it. The covert channel can exploit any primitive, however, Spectre is frequently exploited with cache covert channels for their efficiency, particularly Flush+Reload [START_REF] Yarom | Flush+Reload: A High Resolution, Low Noise, L3 Cache Side-Channel Attack[END_REF]. Consider the branch in Listing 1, where the attacker is able to make the victim execute the snippet, control the x parameter and have access to array2. Several steps are needed to exploit the PHT:

(1) Setup. Setup the covert channel by flushing all elements of array2 from the cache for Flush+Reload. [START_REF] Canella | TransientFail Repository[END_REF] Training. Execute the branch a lot of time with a valid x, thus increasing the PHT's saturating counters at their maximum for this branch. (3) Encoding. Send a malicious x, such as x = &secret -array1, so the processor will execute transiently the array2[array1[x]] memory access. (4) Recovering. Recover the value from the covert channel. For Flush+Reload, load every value of array2 and measure the induced latency with a timer. When a cache hit is detected for index i, i = secret because it has been cached during the transient execution.

gem5

gem5 is a state-of-the-art cycle-accurate computer simulator [START_REF] Binkert | The Gem5 Simulator[END_REF], meaning that it simulates hardware components on a cycle-by-cycle basis, instead of simulating the instruction-set of an architecture. It is used both in the academic and industry world for research and development of new hardware technologies, and ARM is a well-supported architecture. It is made of two parts: [START_REF] Binkert | The Gem5 Simulator[END_REF] The C++ core where the logic of the components is programmed; (2) The Python interface linked to the C++ objects in order to interconnect and easily configure these elements. Each object has "ports" to send or receive packets from other object.

To the best of our knowledge, there is no systematic review that compares simulators applied to security research. However, gem5 meets our requirements to simulate our attack -cycle-accurate, modular, ARM architecture, caches, out-of-order execution, branch prediction -and is widely used.

RELATED WORK

To the best of our knowledge, there is little to no existing literature that highlights the best practices in micro-architectural security research in terms of reproducibility, neither in native environments or with simulators like gem5. The closest to our simulation work is a Low-Power's blog post [START_REF] Lowe-Power | Visualizing Spectre with gem5[END_REF] that reproduces the Spectre attack on gem5. It demonstrates that Spectre works on the simulator, with a quick discussion on branch predictors and compilers effects. In this paper, we try to go deeper by proposing new research techniques and evaluating the accuracy of the simulation. While the attack side is not well-studied on gem5, the countermeasure side already benefits from simulators, as many papers use gem5 to develop and validate their countermeasures [START_REF] Loughlin | DOLMA: Securing Speculation with the Principle of Transient Non-Observability[END_REF]. To choose our gem5 processor in our simulation, we follow Endo et al. [START_REF] Fernando A Endo | Micro-Architectural Simulation of In-Order and Out-Of-Order ARM Microprocessors with Gem5 (SAMOS XIV)[END_REF] who simulated an ARM Cortex-A8 and an ARM Cortex-A9 processors with gem5 and an out-of-order processor, as well as Gutierrez et al. [START_REF] Gutierrez | Sources of Error in Full-System Simulation[END_REF] who simulated an ARM Cortex-A15 processor with gem5 and the same processor in a survey of errors categorization using gem5.

GUIDELINES ON MICRO-ARCHITECTURAL ATTACK DEVELOPMENT AND REPRODUCTION

During our study, we were confronted to some proof-of-concept implementations with reproducibility problems, that might have been avoided with more "best practices" in security research. We encourage any security researcher to follow our generic guidelines, both for helping other researchers to reproduce their work and to reproduce the work of others.

Development

These general guidelines apply during the development of an attack, to improve reproducibility in the end. At the end, we also provide two additional guidelines specific to the development of timing covert channels and transient execution attacks.

Compiler version. Two versions of the same compiler can produce very different machine code from the same source code. Generally, the reason lies into all the optimization mechanisms that are implemented. As a good research practice, we suggest to always specify the compiler version, and to use the same version as the author(s) of the original work if a problem arises.

Compiler optimizations. Even more than compiler versions, compilation flags could completely change the outcome of an both increasing or decreasing efficiency. After having experimented with attacks working with a flag and not with another, working on a system and not another because of an optimization, we consider compilers optimizations harmful for security research and reproducibility. We suggest to always disable most of the optimizations mechanisms of the compiler in a research perspective, except when the goal is to maximize the throughput on a specific implementation for a specific architecture. If a researcher observes that a particular optimization of GCC is required to make an attack work, we strongly suggest using the -fopt-info compilation flag to understand and isolate this optimization.

Manual optimizations. Manual optimizations are important for some attacks. For instance, a Spectre version targets the Return Stack Buffer (RSB) of the branch predictor, a structure used to hold and predict the address for a return instruction based on the jump for the function call. Thus, inlining some functions allows to unload the RSB and hence the branch predictor, leading to a more efficient manipulation of the RSB. In those cases, we prefer to manually optimize the code instead of having the compiler doing it. Such manual optimizations have to be found via experimentation.

Prefetcher. The prefetcher is a processor's component used to load memory elements into the cache even before they are used by a program. Prefetching un-accessed elements in the cache can skew the result of the cache covert channel. Disabling the prefetcher is generally difficult as it requires special privileges during boot time. Instead, the best method is to use a mixed-up access pattern to prevent the prefetcher to detect the next memory element that will be accessed, e.g., for i from 0 to 255, index a table with the index i_mix = ((i * 167) + 13) & 255 [START_REF] Kocher | Spectre Attacks: Exploiting Speculative Execution (S&P)[END_REF].

Re-ordering. An instruction, if no precaution is taken, can be delayed or moved into the instruction flow both by the compiler and the processor -statically at compilation time or dynamically at runtime, respectively. Therefore, it is important to ensure that instructions are executed at the right moment, especially for flush instructions that are critical for the covert channel. In order to verify this at runtime, gem5 can be a great help (Section 5). For the compiler step, the developer should take precautions by using barriers if one instruction is absolutely dependent of a previous one inside the micro-architectural domain (like cache state): [START_REF] Binkert | The Gem5 Simulator[END_REF] The dsb instruction on ARM, equivalent of the Intel mfence instruction, which is a memory barrier; [START_REF] Canella | TransientFail Repository[END_REF] The isb instruction on ARM, which is an instruction barrier.

Timer for covert channel. The timing method corresponds to the technique used to measure the latency between two memory accesses for the cache side-channel part. We independently found the same results as Moritz Lipp et al. [START_REF] Lipp | ARMageddon: Cache Attacks on Mobile Devices[END_REF] and recommend approaches (1) and ( 2): (1) The POSIX clock_gettime() function provides a nanosecond resolution timer and is the easiest method to use. (2) A counter thread [START_REF] Lipp | ARMageddon: Cache Attacks on Mobile Devices[END_REF], where we create a dedicated parallel thread incrementing a counter indefinitely, provides an approximation of a cycle-accurate timer while being more complex to use. (3) The PMCCNTR_EL0 register, an ARMv8 PMC, provides a cycle-accurate timer, but its usage is unrealistic as it needs a special kernel module, thus, root permissions. (4) The perf_event interface, a Linux API [START_REF] Vincent | Linux perf event Features and Overhead[END_REF], should provide a cycle-accurate timer, but it was the worst method experimentally -we suppose that the overhead was too heavy for our cache side-channel.

Transient execution window. It corresponds to the time slice -or more precisely, the number of cycles -where (potentially malicious) instructions are executed in the transient domain, i.e., executed speculatively then discarded when the speculation was wrong. For instance, in Spectre-PHT, this time depends on the time taken to compute the condition of the targeted branch. To make the computation of the attacked branch condition as long as possible, we can use slow operations like a division. It will increase the reproducibility of the attack across different systems. Note that in a real attack scenario, we do not choose explicitly the instructions of the targeted branch.

Reproducibility by Environment Control

These guidelines apply to maximize the chances of reproducing an attack by controlling the attack's environment.

Pinning. This technique prevents the scheduler of the operating system to change the execution core of one process (using the taskset command on Unix systems). By default, executed processes switch from one core to another during their life-time. For instance, pinning the Spectre process can improve the efficiency of the covert channel part, because if one process performing a cache attack is switched to another core, depending on the processor micro-architecture and the attacked level of cache, the targeted cache can be changed without the process noticing.

Page size. The cache side-channel implementation (Flush+Reload in our case) tries to spread its probe array over multiples pages in order to defeat the cache prefetcher, since many do not look further than the page size in memory. Page size depends on the kernel and the processor architecture, but 4 kB is very common, thus the size is often hard-coded in the implementation -but it could be different. However, a functionality called Huge Page allows the usage of pages larger than 1 MB or 1 GB, and could be enabled transparently in the system. 1 If our cache side-channel rely on a specific page size to work, to avoid impacting its efficiency we should disable this functionally by modifying the kernel's parameters. 2Frequency. All modern processors adapt their frequencies to the current workload in real time, which corresponds to frequency scaling -often referenced as DVFS. If the frequency changes between two latency measurements, the latter could become irrelevant if the frequency value is correlated to the latency. This feature should be disabled using cpupower3 in Linux.

Mitigations. Software or hardware mitigations can be deployed on a system. In our case, since there is currently no hardware tion to defeat Spectre, Linux kernel developers have implemented software mitigations to defeat a Spectre attack against the kernel. These mitigations should not interfere with an attack against a user process. Verifying enabled mitigations can be achieved by a lookup into some files exposed by sysfs. 4 In our system, a mitigation called __user pointer sanitization was enabled, which consists in disabling speculative execution for some sensitive pointers that are passed to the kernel by the user during a system call, which could be an attempt of a speculative bound check bypass [START_REF] Torvalds | Spectre Side Channels[END_REF].

BENEFITS OF (PIPELINE) VISUALIZATION

Some simulation techniques can enhance micro-architectural security research. Section 3 presents papers that successfully used gem5 to develop and validate countermeasures. For offensive security, simulation offers full control and monitoring over each element of the system. For example, the pipeline visualization is a simulator feature which aims to record all instructions that flowed into the pipeline of the simulated processor. Using an external program named Konata [START_REF] Shioya | Visualizing the out-of-order CPU model[END_REF], we can graphically visualize all the instructions. For each of them, we can identify the cycle of each processing step and see if an instruction has been fetched and committed, flushed or speculatively executed. Using this, we have been able to observe multiple Spectre attack scenarios:

(1) The attack works as expected, we can visually see the malicious transient memory read happening, allowing to have a better understanding of how the attack works. [START_REF] Canella | TransientFail Repository[END_REF] The training of the branch predictor is not successful, which leads to no transient instruction executed. Being able to observe that is a strong clue for a researcher, since this fact is normally completely hidden from the programmer. This is useful to understand why the attack could fail and identify one reason from the multiple possible ones. (3) Konata also allows to visualize the order in which instructions are executed. It can be used to identify then solve the re-ordering problem mentioned in Section 4.1.

This pipeline visualization is an easy-to-use tool to obtain advice about the micro-architectural behavior of the attack. gem5 is able to record everything and output the state of any component in the system, e.g., the structures of the branch predictor or the cache.

SETUP

The first phase of our work is the implementation of Spectre on a native system. The goal is to have an attack that works correctly and meets special requirements for gem5. We had to do this because the reference implementation [START_REF] Canella | TransientFail Repository[END_REF] was not working properly on our native system. The second phase is the replication of the attack on a simulated system using gem5, which involved the development of our own simulation. We call a gem5 model faithful when the number of simulated component and mechanisms matches the real hardware, and call accurate a simulation run when some metrics on the simulation matches the same metrics on the real hardware.

For the first phase with the native system, we work on a Raspberry Pi powered by an ARM processor. We chose this board because it is inexpensive and representative of what we can find in the wild. We chose an ARM processor because this architecture is well-supported on our simulator (better supported than x86). More precisely, we used: (1) Raspberry Pi v4 Model B Rev 1.1 as our main board; (2) ARM Cortex-A72 processor, implemented in the Broadcom BCM2711 SoC, as an ARMv8-A processor with an inclusive LLC; (3) Kali Linux (stable v2020.2a) in the 64-bit flavor as operating system; (4) Linux v4.19.118-Re4son-v8l+ as a kernel;

(5) GCC v9.3 as a compiler.

The second phase was under our own simulation, with a system simulated by gem5 v20.0 with the ARM64 Linux kernel v4.18.0 and the 64-bit Linaro Minimal v7.4.0 (based on Ubuntu) images, both provided by gem5's developers.

IMPLEMENTATION

In this section, we explain our implementation and design choices during our work. The implementation details, screenshots of visualization, code and experiments are available. 5

Implementing the Spectre Attack on ARM

The reference implementation -which do not follows our guidelines -of Spectre for ARM [START_REF] Canella | TransientFail Repository[END_REF] was not working properly on our hardware. Indeed, it was relying on compiler optimizations to work correctly. Moreover, towards the goal of reproducibility, we need a specific implementation to fit our requirements, which are: (1) Stable results, meaning that the number of retrieved bytes should be comprised between a reasonable interval; (2) An implementation that follows of our guidelines, in particular no advanced compiler flags as we do not want to rely on a particular compiler mechanism for our attack to work, unlike the other implementations we tried;

(3) Customizable attack parameters at runtime, allowing parameter exploration for efficiency; (4) Usable in the same way both on native hardware and on gem5 to compare them; (5) Metrics output, which are numbers used to compare simulation accuracy (Section 8).

Conceptually, we used the same algorithm implemented in the original Spectre-PHT proof-of-concept [START_REF] Kocher | Spectre Attacks: Exploiting Speculative Execution (S&P)[END_REF], which is an x86 implementation, and we ported it to ARM. Then, we applied all our guidelines of Section 4.1, which was a critical point of our implementation to make it work. To ensure the cache miss threshold calibration for Flush+Reload, i.e., the number of cycles where we distinguish the latency of a cache hit from a cache miss, we used the code developed for the Cache Template Attacks [START_REF] Gruss | Cache Template Attacks: Automating Attacks on Inclusive Last-Level Caches[END_REF] which allows to obtain the distribution of latencies for cache hits and misses. We used the clock_gettime() function as a timer for its efficiency and availability. To measure our metrics, we used counters incremented during our attack as well as the perf_event Linux kernel interface for micro-architectural counters. This interface provides access to the Performance Monitoring Unit (PMU) of processor from the user land. This implementation works properly both under the native ARM system and gem5.

Implementing an ARM gem5 System

In order to reproduce the attack, we need a processor with at least: (1) A speculative execution mechanism with a branch predictor to execute transient instruction; (2) A cache to observe a timing difference when accessing the data.

We derive the DerivO3CPU class for our simulated processor. This is an out-of-order processor with a 7-stage pipeline (fetch, decode, rename, issue/execute/writeback, commit). It allows using several caches and a branch predictor. We disqualified the HPI class which is a high-performance in-order processor, since transient execution attacks target modern out-of-order processors.

gem5 supports multiple simulation modes. We use the full-system simulation mode, which is the more faithful and demanding in computational power. We define all the simulated hardware objects to simulate a complete and working operating system via Python scripts. System-call emulation, where system calls are implemented by gem5 itself and not by a native kernel, is not suitable for a faithful experiment. We derive the Cache class for our caches and ArmDTB / ArmITB for the TLB. We derive the ArmSystem class as a system class to handle the ARMv8 architecture and extensions. We use the VExpress_GEM5_V1 class (simulate the RealView VExpress platform) to handle memory mapping, interrupts and GIC, and two PciVirtIO to handle operating system and workload images as VirtIO PCI block device.

We use perf_event to collect metrics. To reproduce it on the gem5 system, we had to patch the gem5 source code to handle this Linux interface. This patch has been included in gem5 such that the latest release handles perf_event correctly. We use the ArmPMU class configured with an ArmPPI interrupt to access the PMU's counters.

We analyzed gem5's implementation of 5 branch predictors, but in the remainder we only describe our configuration. To match as closely as possible our native processor's branch predictor, we choose to use the gem5's two-level global history-based bi-mode predictor. Despite the fact that the Bi-Mode predictor separates mostlytaken and mostly-not-taken branches into two different PHTs, the 41 attack trains the attacked branch as a mostly-taken branch. Consequently, this branch should only be predicted from the mostly-taken PHT, hence, our Bi-Mode predictor acts mostly like the two-level global history-based branch predictor of our native processor. We verify this experimentally in Section 8.

After configuring several parameters -caches, branch predictor, TLB, pipeline -, we obtain a system that reproduces broadly our Raspberry Pi with a 4-core processor and two levels of caches -private L1D and L1I and shared L2. Moreover, our simulated processor should perform similarly to our native one for our attack.

Workflow. We prepare 3 images: (1) Kernel image; (2) Operating system image; (3) Workload image, dynamically generated with a script, containing the binary of the attack and experiment scripts. We boot-up the system once with a fast and unfaithful processor (AtomicSimpleCPU). Then, we take a snapshot of the system state and stop the simulation. This snapshot can be then used at any time. We restore the simulation at the previous point with a detailed and slow processor (DerivO3CPU), this is called a fast-forwarding. We connect to the simulated system using telnet, mount the workload image, and launch the experiment script. Results are then displayed on the terminal.

EVALUATION

Reproducing an attack is a first step, but the main question is: "How much is the reproduced attack accurate to the original one?". Indeed, to be useful in security research, the simulation has to be accurate.

Metrics are numbers used to compare runs between the native hardware and the gem5 simulation. They are also useful to understand the attack behavior, e.g. allowing to understand if an under-efficiency of the attack is caused by the cache or the branch predictor. Note that the choice is limited, both in terms of number and nature, mainly due to micro-architectural constraints. We choose to monitor: (1) Number of correctly retrieved bytes by the attack; (2) Number of iterations to retrieve the given number of bytes; (3) Number of cycles taken (quantifying the time taken); (4) Number of cache misses occurred during the attack; (5) Number of mispredicted branches. The last two are micro-architectural counters monitored during the core of the attack -flushing, speculative execution, covert-channel -, while the others are user-land counters. For each run of an attack, 5 metrics are monitored and collected. We performed 497 runs on the Raspberry Pi and 10 runs on the gem5 system. This difference can be explained by the time it takes for one run on each system: a few minutes on the Raspberry Pi, between 1 and 5 hours on gem5, depending on the configuration.

Table 1 describes our results. The ratio of each metric is computed by dividing the mean or the standard deviation observed on the gem5 system by the one observed on the Raspberry Pi system. The distribution of our metrics is more disparate on the gem5 system (higher standard deviation), surely due to the low number of runs.

Retrieved Bytes Since the attack retrieved every bytes for each run on the gem5 system (40 bytes per run), the standard deviation was equal to 0, hence the NaN notation. The efficiency of the attack on gem5 is close to the reality, with less noise in the system and more predictable results. Iterations and Cycles The attack on gem5 performs nearly 2 times fewer iterations and approximately 3 times fewer cycles than the native system. Cache Misses We observe many more cache misses on gem5 than on our native system. We believe that this is an internal problem of communication between the real number of cache misses in gem5 and the number exposed via perf_event, but this needs more investigation to determine if the observation is correct or if the tool is faulty. Mispredicted Branches Mispredicted branches are the most important metric. We see that gem5 has nearly exactly (0.99) the same number of mispredicted branches than our native system, in average. It means that our configuration for the gem5 branch predictor successfully represents the branch predictor of our ARM processor -at least, for this attack.

DISCUSSION

Simulation is successfully applied in numerous scientific fields, after addressing the challenges of usability and accuracy. If simulation becomes widely used, thus it would be easy to reproduce older attacks and to study them, e.g. for countermeasures development. Indeed, when hardware countermeasures and newer processor architectures will be released, it could become impossible to reproduce an attack. Moreover, not only the replication side will benefit of it but also the offensive side. With faithful models, a researcher could explore and discover new vulnerabilities with a simulated model, then apply them to the real world. We imagine several useful application, for instance it could be powerful to apply parameters enumeration: supposing that we develop a new attack idea that could work only under specific hardware conditions, then we can try different hardware parameters to discover the vulnerable ones.

There are still some limitations, as our work remains to be generalized on other kind of hardware. Moreover, the runs on gem5 for an attack are very slow, and there is still less noise on the gem5 system than the native one, which impacts the practicability and the fidelity of the system.

CONCLUSION

In this paper, we first described how to increase reproducibility in security research, further we believe that fully reproducible builds are a promising way of doing it [START_REF] Lamb | Reproducible Builds[END_REF]. We have shown how to start micro-architectural security research with a cycle-accurate simulator, namely gem5. We saw that it is possible to simulate micro-architectural attacks, moreover, that it could be accurate comparing it to a native machine.

We can imagine several ways to use gem5 in order to find new attacks and countermeasures, but also to help in attack and countermeasure implementation and understanding. We can identify three future directions on gem5 for security research: (1) Visualization is a very powerful technique to understand the micro-architectural behavior, and this knowledge can be directly applied to security. Currently, we can conveniently observe the pipeline, but being able to visualize the state and history of the branch predictor or the caches would also be very effective. [START_REF] Canella | TransientFail Repository[END_REF] We can improve model's faithfulness by implementing missing components to make a specific attack work. These components are still to identify by future research. [START_REF] Canella | A Systematic Evaluation of Transient Execution Attacks and Defenses[END_REF] We can improve the possibilities given by a gem5 simulated system by fixing -just like we did with perf_event -or implementing missing security features. For instance, TrustZone and SGX are still unsupported, but studying the micro-architecture impact on these features under gem5 could be a great advantage. This work benefited from the support of the DGA and the project ANR-19-CE39-0008 ARCHI-SEC.

Table 1 :

 1 Ratio between gem5 and Raspberry Pi runs for each metric. A value below 1 means that gem5's metric is lower than the Raspberry Pi's metric.

	Metric	Mean Standard Deviation
	Retrieved Bytes	1.05	NaN
	Iterations	0.57	3.81
	Cycles	0.31	2.12
	Cache Misses	584.08	4581.02
	Mispredicted Branches	0.99	2.

Huge page check on a Raspberry Pi: sudo modprobe configs && zcat /proc/config.gz | grep -i k_page

Huge page disabling on a Linux kernel: add transparent_hugepage=never in /boot/cmdline.txt

With root permissions, DVFS can be disabled issuing the following command: cpupower frequency-set -g performance

The path of the file being /sys/devices/system/cpu/vulnerabilities/spectre_v{1,2}

https://pierreay.github.io/reproduce-spectre-gem5/