# Critical field measure for topological superconductivity

Noah F. Q. Yuan1,† and Xiao-Jia Chen1,2,⋆

###### Abstract

A promising direction for harnessing the laws of quantum mechanics to perform
quantum computation[1] is the topological quantum computation[2, 3], for which
topological superconductivity is one of the physical platforms. Intensive
theoretical studies[14, 4, 5, 6, 8, 10, 7, 9, 11, 12, 13] have been carried
out and followed by tremendous experimental efforts[15, 16, 17, 18, 21, 22,
23, 24, 25, 26, 19, 27, 20, 29, 28] in the realization of topological
superconductivity, though debates remain mainly because of the inadequacy of
the convincing detection techniques[32, 30, 31, 33, 34, 35]. Here we report a
theoretical finding in a superconductor with surface or edge states, where the
critical field is found to obey the unique power-law temperature dependence
$B_{c3}\sim(T_{c}-T)^{\gamma}$ with $T_{c}$ being the onset critical
temperature of superconductivity and the fractional exponent $\gamma=2/3$,
differing from the conventional values of $\gamma=1/2$ and $1$. The
topological surface superconductivity is hence expected in the three-
dimensional (3D) system and the topological edge superconductivity in the two-
dimensional (2D) system. The application of this measure to the intrinsic
topological superconductors FeTe1-xSex ($x\sim 0.5$) supports the validity of
such an accessible, convenient, and reliable transport technique for the
identification of topological superconductivity. The new form of theory on
topological superconductivity together with the developed identification
technique is expected to guide the search of topological superconductors in
future.

School of Science, Harbin Institute of Technology, Shenzhen 518055, China

Center for High Pressure Science and Technology Advanced Research, Shanghai
201203, China †e-mail<EMAIL_ADDRESS>⋆e-mail<EMAIL_ADDRESS>
At the dawn of the 21st century, Alexei Yu Kitaev proposed a one-dimensional
(1D) theoretical model of unconventional $p$-wave superconductor[4], where
exotic topological excitations known as Majorana zero modes could arise at its
two ends. During the same period of time, N. Read and Dmitry Green found the
2D counterpart model of $p$-wave superconductor[5], which could host Majorana
zero modes at the vortex cores. Majorana zero modes in such topological
superconductors are robust against disorders and obey the non-Abelian
statistics, thus can be used in topological quantum computations[6, 7]. Both
the Kitaev chain model and the Read-Green model require $p$-wave
superconductivity, which is rare in nature. For a long time, Sr2RuO4 had been
considered as the only candidate of $p$-wave superconductor[36, 37]. However,
recent data of nuclear magnetic resonance has ruled out the possibility of
$p$-wave pairing in Sr2RuO4[38].

Inspired by the Kitaev chain model and the Read-Green model, more theoretical
models of topological superconductivity are developed in conventional $s$-wave
superconducting systems[8, 9, 10, 7]. In 3D, the heterostructure formed by an
$s$-wave superconductor (SC) and a topological insulator (TI) was proposed by
Liang Fu and Charles L. Kane[8], where topological superconductivity is
expected if superconductivity and topological surface states coexist in the
SC-TI interface[17, 18]. In 2D, the heterostructure formed by an $s$-wave SC
and a quantum anomalous Hall (QAH) system was proposed by X.-L. Qi, Taylor L.
Hughes and Shou-Cheng Zhang[9, 10], where topological superconductivity is
expected if superconductivity and topological surface states coexist in the
SC-QAH interface. Thus, in order to engineer topological superconductivity in
a heterostructure[20, 19], one first needs to ensure the coexistence of
superconductivity and topological states in its interface. On the other hand,
it was recently reported that in some 3D[21, 22, 23, 24, 25, 26, 27] and
2D[29, 28] materials, superconductivity and topological states may coexist,
where topological superconductivity could take place. In these intrinsic
candidates of topological superconductors, one also needs to confirm that the
superconductivity and topological states do coexist on the open surface (3D)
or along the open edge (2D). As such, the identification of superconductivity
coexisting with topological states on the boundaries (interface, common edge,
open surface and open edge) has been becoming a critical issue in the
exploration of topological superconductivity. In the following, we demonstrate
that the nucleation of superconductivity[39, 40, 41, 42, 45, 46, 43, 44] could
provide an answer to this question.

Nucleation is the first step of a thermodynamic phase transition prior to the
bulk transition when there are preferential sites. In our case of topological
superconductors, boundaries are preferential for the Cooper pairs to
accumulate. Deep in the superconducting phase, contributions from the
boundaries are negligible due to the lower dimensionality compared to the
bulk. However, near the bulk phase transition, the bulk coherence length
becomes so divergent that boundaries can also affect the bulk significantly,
resulting in a nucleation prior to the bulk phase transition.

To explore the nucleation of topological superconductivity on surfaces,
similar to the previous theoretical models, we construct a theoretical model
in Fig. 1a, where the 3D superconductor is in the semi-infinite region $z\leq
0$, with topological surface states near the open surface $z=0$, and
topological surface superconductivity is realized.

We consider the Ginzburg-Landau (GL) regime, which is near the superconducting
phase transitions and at distances greater than the zero-temperature bulk
coherence length $\xi_{0}$. Since the topological surface states usually
extend to the bulk by a few atomic layers[47], on the scale of $\xi_{0}$ we
can assume that the topological surface states only live on the 2D open
surface $z=0$. After washing out the short-range details, the GL free energy
is composed of the bulk and surface terms

$F=\int_{z\leq
0}d^{3}\bm{r}\left\\{\frac{1}{2m}\left|\bm{D}\psi\right|^{2}+\mathcal{A}|\psi|^{2}\right\\}+\sigma\int_{z=0}d^{2}\bm{r}|\psi|^{2},$
(1)

where $\psi(\bm{r})$ is the superconducting order parameter and
$\bm{r}=(x,y,z)$ is the spatial coordinate.

The bulk Cooper pairs are described by the kinetic energy
$|\bm{D}\psi|^{2}/2m$ and the potential energy $\mathcal{A}|\psi|^{2}$. Here
$m$ is the electron mass, $\bm{D}=-i\nabla-2\pi\bm{A}/\Phi_{0}$ is the
momentum operator with vector potential $\bm{A}$ and flux quantum
$\Phi_{0}=h/(2e)$, and $\mathcal{A}=\alpha(T-T_{c0})$ depends on temperature
$T$ with $T_{c0}$ being the bulk critical temperature. The surface Cooper
pairs are described by the surface energy $\sigma$, which can be negative,
zero and positive. In our model, without topological surface states, the
surface energy is zero; while with topological surface states, the surface
energy is negative. Microscopic derivations of such conclusion and Eq. (1) can
be found in Methods. We would like to point out that $\psi$ describes the
pairing correlation, which is related to but not directly proportional to the
energy gap of Bogouliubov quasiparticles.

In the maintext, we deal with the topological case of negative surface energy
($\sigma<0$). Other cases of $\sigma\geq 0$ can be found in Methods.

First we consider the nucleation at zero field. The free energy Eq. (1) has a
negative surface energy, suggesting the preferential accumulation of the
Cooper pairs on the open surface. As a result, the superconducting phase
transition at zero field consists of two steps as the temperature goes down,
whose order parameters are plotted in Fig. 1b. As shown in Fig. 1b, the first
step (blue line) is analogous to the heterogeneous nucleation in the vapor to
liquid condensation, where the electron gas condenses into Cooper pairs on the
open surface, while the bulk electrons stay mostly normal. This step is at
temperatures above the bulk critical temperature $T>T_{c0}$, whose the order
parameter is mainly localized on the surface layer. In the second step (black
line) when the temperature is lower than the bulk critical temperature
$T<T_{c0}$, besides the surface layer, the bulk is also superconducting. In
both cases, the extrapolations of the order parameters (dashed lines)
intercept the $z$-axis at the same point, the de Gennes extrapolation
length[40], given by $l_{s}\equiv(2m|\sigma|)^{-1}$. We have shown that, at
zero field the negative surface energy requires the order parameter to
increase in the surface layer of thickness $\sim l_{s}$, so that the nucleated
superconductivity can bear stronger thermal fluctuations, and the onset
critical temperature $T_{c}=T_{c0}+2m\sigma^{2}/\alpha>T_{c0}$ is higher than
the bulk one.

Next we consider the nucleation under a magnetic field
$\bm{B}=\nabla\times\bm{A}$. In fact, the mechanism at zero field also applies
to the nucleation under finite fields, in which the negative surface energy
requires order parameters to increase near the surface, so that the nucleated
superconductivity can bear stronger magnetic fields. This enhanced critical
field is denoted as the nucleation critical field $B_{c3}(T)$. In this work we
focus on the type-II superconductor, but our theory of nucleation critical
field also applies to a type-I superconductor sufficiently close to $T_{c}$,
as long as its Ginzburg parameter is not too small[43].

We start with examining the bulk nucleation of type-II superconductors under
finite fields. Near the upper critical field $B_{c2}$, any bulk line away from
the open surface could be a nucleus for Cooper pairs to accumulate, as found
by Abrikosov in terms of vortices[39]. When the bulk nucleus moves to the
surface region, the negative surface energy requires an increase in the order
parameter near the surface, which stabilizes the surface superconductivity and
hence leads to $B_{c3}>B_{c2}$.

Due to the isotropic bulk free energy in Eq. (1), the upper critical field
$B_{c2}$ of the bulk is isotropic. However, the nucleation critical field
$B_{c3}$ is highly anisotropic, due to the negative surface energy of the
$z=0$ open surface instead of other surfaces.

We first consider in-plane fields $\bm{B}\parallel xy$-plane. As shown in Fig.
2a, the bulk nucleus is Gaussian along the $z$-axis under an in-plane field
$B\sim B_{c2}$. As $B$ increases the nucleus moves to the surface region,
where the order parameter is enhanced compared with the bulk nucleus (dashed
line), resulting in the surface superconductivity.

At weak fields and temperatures close to $T_{c}$, the nucleated surface
superconductivity is essentially 2D in the $xy$ layer with an effective
thickness $\sim l_{s}$ along the $z$-axis. The nucleation critical field is
thus $B_{c3}={\Phi_{0}}/{(\pi\xi l_{s})}\propto(T_{c}-T)^{1/2}$ with the
coherence length $\xi=(2m\alpha|T_{c}-T|)^{-1/2}$, and the critical exponent
of the in-plane magnetic field is 1/2[40, 42, 41, 44, 43].

As the magnetic field increases and the temperature is slightly away from
$T_{c}$, the nucleation critical field is found to be
$B_{c3}\propto|T_{c}-T|^{\gamma}$ with the fractional exponent $\gamma=2/3$,
based on a heuristic argument as follows. In the trivial case, the
inhomogeneity of nucleated bulk superconductivity along the $z$-axis is
characterized by the coherence length $\xi$, and when the magnetic flux
trapped in the area $\xi^{2}$ is on the order of $\Phi_{0}$, the nucleated
bulk superconductivity is destroyed. In the topological case, the
inhomogeneity of nucleated surface superconductivity along the $z$-axis turns
out to be characterized by the length $\zeta=(\xi^{2}l_{s})^{1/3}$. Similarly,
when the magnetic flux trapped in the area $\zeta^{2}$ is on the order of
$\Phi_{0}$, the nucleated surface superconductivity is destroyed. Hence the
in-plane nucleation critical field in the intermediate field regime is

$B_{c3}^{\rm
in}=0.525\frac{\Phi_{0}}{\left(\xi^{2}l_{s}\right)^{\frac{2}{3}}}\propto(T_{c}-T)^{2/3}.$
(2)

The exact order parameter and the exact nucleation critical field in the full
GL regime are given in Methods, from which the weak field regime is found as
$B<0.01B_{s}$, and the intermediate field regime is $0.1B_{s}<B<B_{s}$ with
$B_{s}\equiv\Phi_{0}/(\pi l_{s}^{2})$.

The full phase diagram of temperature and in-plane magnetic field in the GL
regime is shown in Fig. 2c. As field increases, the bulk superconductivity
stays uniform until the lower critical field $B_{c1}$ where vortices start to
nucleate, and the bulk is in the mixed phase when $B_{c1}<B<B_{c2}$. In the
regime $B_{c2}<B<B_{c3}$, nucleated superconductivity and topological states
coexist on the surface, resulting in the _topological surface
superconductivity_ (TSSC).

Then we consider out-of-plane fields $\bm{B}\parallel z$-axis. As shown in
Fig. 2b, the bulk nucleus is uniform along the $z$-axis under an out-of-plane
field $B\sim B_{c2}$. As $B$ further increases, near the open surface $z=0$
superconductivity nucleates due to negative surface energy, resulting in the
surface superconductivity. The out-of-plane nucleation critical field is
similar to the one obtained by Abrikosov[39]

$B_{c3}^{\rm out}=\frac{\Phi_{0}}{2\pi\xi^{2}}\propto(T_{c}-T)^{1}.$ (3)

The full phase diagram of temperature and out-of-plane magnetic field in the
GL regime is shown in Fig. 2d. We find the same lower and upper critical
fields $B_{c1}$ and $B_{c2}$ as those of the in-plane case, while $B_{c3}$ can
be obtained by parallel shifting of $B_{c2}$ along the temperature axis from
$T_{c0}$ to $T_{c}$. TSSC is also found in the regime $B_{c2}<B<B_{c3}$.

We have thus found two types of nuclei in 3D topological superconductors. At
zero field, the only nucleus is the surface, and under finite fields, bulk
nucleus also arises due to the orbital effect. Our methods can also be applied
in 2D topological superconductors where topological surface states are
replaced by topological edge states, and the surface nucleus is replaced by
the edge nucleus. The model and results are summarized in Fig. 3.

We construct a 2D theoretical model as shown in Fig. 3a, where the 2D
superconductor is confined in the 2D plane of $z=0$, topological edge states
exist along the edge $x=0$, and bulk superconductivity in the semi-infinite
region $x\leq 0$. Similar to the 3D case, at zero field the superconducting
phase transition consists of two steps as the temperature goes down, whose
order parameters are plotted in Fig. 3b.

Under in-plane fields, the orbital effect is screened[42] and hence only edge
nucleus remains as shown in Fig. 3c. In the resulting phase diagram Fig. 3e,
the mixed phase and the lower critical field $B_{c1}$ caused by the orbital
effect are absent, and the TSSC is replaced by the _topological edge
superconductivity_ (TESC), where the nucleated superconductivity and
topological states coexist along the edge. Importantly, both the upper
critical field $B_{c2}\propto\sqrt{T_{c0}-T}$ and the nucleation critical
field $B_{c3}\propto\sqrt{T_{c}-T}$ follow the square-root behaviour.

Under out-of-plane fields, both bulk and surface nuclei are present as shown
in Fig. 3d. The resulting phase diagram Fig. 3f is the same as that of the 3D
superconductor under in-plane fields, where the upper critical field
$B_{c2}\propto{T_{c0}-T}$ and the nucleation critical field
$B_{c3}\propto({T_{c}-T})^{2/3}$ follow different power laws.

In Table 1 we list the critical exponent $\gamma$ of critical fields along the
in-plane and out-of-plane directions for both the topological and trivial
cases, where $\gamma$ is defined by $B_{c3}\sim(T_{c}-T)^{\gamma}$, and the
superconductor can be 3D or 2D. Detailed derivations of Table 1 can be found
in Methods.

Our theory could be applied in intrinsic topological superconductors[21, 22,
23, 24, 25, 28, 26, 27, 29], or superconducting heterostructures[17, 18, 19,
20], where the topological states can be inherited from the normal phase[21,
22, 23, 24, 25, 28, 26, 27, 17, 18, 19, 20], or emerge in the superconducting
phase[29].

To examine the validity of the proposed critical field measure from
experiments, we choose the well defined candidate of intrinsic topological
superconductors FeTe1-xSex ($x\sim 0.5$) as examples. The theoretical
calculations[48] revealed the topological surface states on the (001) surface
in such systems. The substitution composition $x$ around 0.5 was found to be
critical for holding both the superconducting and topological states[49]. The
predicted topological superconductivity was indeed detected for FeTe0.55Se0.45
from the high-resolution spin-resolved and angle-resolved photoelectron
spectroscopy measurements[23]. The experimental evidence for Majorana bound
states was further provided on the same superconductor by using scanning
tunneling spectroscopy on the superconducting Dirac surface state[24, 50].
Thus, FeTe1-xSex ($x\sim 0.5$) system provides an excellent platform for the
realization of the Majorana bound states and for the examination of any
theories of topological superconductivity.

Thanks for the high magnetic field measurements which were carried out on
FeTe0.52Se0.48 and FeTe0.5Se0.5 at Toulouse in 2010[51] and 2014[52],
respectively. The upper critical fields, collected from the measurements of
the resistance[51] and tunnel diode oscillator frequency[52], can be used to
compare with the present theoretical prediction for the magnetic field
directions in the $ab$ plane and along the $c$ axis, respectively. For 3D
topological superconductors, the critical exponent $\gamma$ should be $2/3$
and $1$ for the applied magnetic field direction in the $ab$ plane and along
the $c$ direction, respectively, over the wide regime of intermediate magnetic
fields (see Table 1). As shown in Fig. 4, the theory reproduces very well the
experimental results for FeTe0.52Se0.48[51] and FeTe0.5Se0.5[52] in two
magnetic field directions. The excellent agreement between the theory and
experiments adds solid evidence for the topological superconductivity in the
studied FeTe1-xSex from the high magnetic field measurements. Importantly, the
comparison demonstrates that the critical field measure is indeed effective
and powerful in judging topological superconductivity.

Besides the critical field measure, the electrical resistivity at zero field
also carries up the feature of topological superconductors. For 2D topological
superconductors, one can measure the local tunneling conductance at zero
bias[29], which should resemble Fig. 1b in the topological case. For 3D
topological superconductors, one can analyze the evolution of electrical
resistivity during the superconducting phase transition. According to the
Mermin-Wagner theorem[54, 53, 55], long-range fluctuations are favored in
dimensions equal to or less than 2. Hence in the clean limit of the trivial
case, the superconducting transition is signaled by a sharp drop of the
resistivity at the critical temperature for 3D superconductors, while a slow
resistivity transition due to fluctuations is expected for 2D superconductors.
In a 3D topological superconductor, the nucleation on the 2D surfaces is the
first step prior to the 3D bulk transition, and as a result, a slow
resistivity transition from the onset superconducting state (surface
superconductivity at $T_{c}$) to the complete zero-resistivity superconducting
state (bulk superconductivity at $T_{c0}$) should be found, similar to the
trivial 2D case instead of the trivial 3D case. The slow resistivity
transition with a relatively large width is the additional transport signature
for the topological superconductivity in a 3D material even perfectly grown.

## References

  * [1] Nielsen, M. A. & Chuang, I. L. Quantum computation and quantum information (Cambridge University Press, 2000).
  * [2] Kitaev, A. Y. Fault-tolerant quantum computation by anyons. _Ann. Phys._ 303, 2-30 (2003).
  * [3] Nayak, C., Simon, S. H., Stern, A., Freedman, M. & Sarma, S. D. Non-Abelian anyons and topological quantum computation. _Rev. Mod. Phys._ 80, 1083-1159 (2008).
  * [4] Kitaev, A. Y. Unpaired Majorana fermions in quantum wires. _Phys.-Usp._ 44, 131-136 (2001).
  * [5] Read, N. & Green, D. Paired states of fermions in two dimensions with breaking of parity and time-reversal symmetries and the fractional quantum Hall effect. _Phys. Rev. B_ 61, 10267-10297 (2000).
  * [6] Ivanov, D. A. Non-Abelian statistics of half-quantum vortices in $p$-wave superconductors. _Phys. Rev. Lett._ 86, 268-271 (2001).
  * [7] Alicea, J., Oreg, Y., Refael, G., von Oppen, F. & Fisher, M. P. A. Non-Abelian statistics and topological quantum information processing in 1D wire networks. _Nat. Phys._ 7, 412-417 (2011).
  * [8] Fu, L. & Kane, C. L. Superconducting proximity effect and Majorana fermions at the surface of a topological insulator. _Phys. Rev. Lett._ 100, 096407 (2008).
  * [9] Qi, X. L., Hughes, T. L. & Zhang, S. C. Chiral topological superconductor from the quantum Hall state. _Phys. Rev. B_ 82, 184516 (2010).
  * [10] Qi, X. L. & Zhang, S. C. Topological insulators and superconductors. _Rev. Mod. Phys._ 83, 1057-1110 (2011).
  * [11] Law, K. T., Lee, P. A. & Ng, T. K. Majorana fermion induced resonant Andreev reflection. _Phys. Rev. Lett._ 103, 237001 (2009).
  * [12] Flensberg, K. Tunneling characteristics of a chain of Majorana bound states. _Phys. Rev. B_ 82, 180516(R) (2010).
  * [13] Beenakker, C. W. J., Dahlhaus, J. P., Wimmer, M. & Akhmerov A. R. Random-matrix theory of Andreev reflection from a topological superconductor. _Phys. Rev. B_ 83, 085413 (2011).
  * [14] Sasaki, S., Ren, Z., Taskin, A. A., Segawa, K., Fu, L. & Ando, Y. Odd-parity pairing and topological superconductivity in a strongly spin-orbit coupled semiconductor. _Phys. Rev. Lett._ 109, 217004 (2012).
  * [15] Mourik, V., Zuo, K., Frolov, S. M., Plissard, S. R., Bakkers, E. P. A. M. & Kouwenhoven, L. P. Signatures of Majorana fermions in hybrid superconductor-semiconductor nanowire devices. _Science_ 336, 1003-1007 (2012).
  * [16] Nadj-Perge, S., Drozdov, I. K., Li, J., Chen, H., Jeon, S., Seo, J., MacDonald, A. H., Bernevig, B. A. & Yazdani, A. Observation of Majorana fermions in ferromagnetic atomic chains on a superconductor. _Science_ 346, 602-607 (2014).
  * [17] Xu, J. P., Wang, M. X., Liu, Z. L., Ge, J. F., Yang, X. J., Liu, C. H., Xu, Z. A., Guan, D. D., Gao, C. L., Qian, D., Liu, Y., Wang, Q. H., Zhang, F. C., Xue, Q. K. & Jia, J. F. Experimental detection of a Majorana mode in the core of a magnetic vortex inside a topological insulator-superconductor Bi2Te3/NbSe2 heterostructure. _Phys. Rev. Lett._ 114, 017001 (2015).
  * [18] Sun, H. H., Zhang, K. W., Hu, L. H., Li, C., Wang, G. Y., Ma, H. Y., Xu, Z. A., Gao, C. L., Guan, D. D., Li, Y. Y., Liu, C. H., Qian, D., Zhou, Y., Fu, L., Li, S. C., Zhang, F. C. & Jia, J. F. Majorana zero mode detected with spin selective Andreev reflection in the vortex of a topological superconductor. _Phys. Rev. Lett._ 116, 257003 (2016).
  * [19] Jäck, B., Xie, Y. L., Li, J., Jeon, S., Bernevig, B. A. & Yazdani A. Observation of a Majorana zero mode in a topologically protected edge channel. _Science_ 364, 1255-1259 (2019).
  * [20] Kezilebieke, S., Huda, M. N., Va?o, V., Aapro, M., Ganguli, S. C., Silveira, O. J., G?odzik, S., Foster, A. S., Ojanen, T. & Liljeroth, P. Topological superconductivity in a van der Waals heterostructure. _Nature_ 588, 424-428 (2020).
  * [21] Aggarwal, L., Gaurav, A., Thakur, G. S., Haque, Z., Ganguli, A. K. & Sheet, G. Unconventional superconductivity at mesoscopic point contacts on the 3D Dirac semimetal Cd3As2. _Nat. Mater._ 15, 32-37 (2016).
  * [22] Wang, H., Wang, H. C., Liu, H. W., Lu, H., Yang, W. H., Jia, S., Liu, X. J., Xie, X. C., Wei, J. & Wang, J. Observation of superconductivity induced by a point contact on 3D Dirac semimetal Cd3As2 crystals. _Nat. Mater._ 15, 38-42 (2016).
  * [23] Zhang, P., Yaji, K., Hashimoto, T., Ota, Y., Kondo, T., Okazaki, K., Wang, Z. J., Wen, J. S., Gu, G. D., Ding, H. & Shin, S. Observation of topological superconductivity on the surface of an iron-based superconductor. _Science_ 360, 182-186 (2018).
  * [24] Wang, D. F., Kong, L. Y., Fan, P., Chen, H., Zhu, S. Y., Liu, W. Y., Cao, L., Sun, Y. J., Du, S. X., Schneeloch, J., Zhong, R. D., Gu, G. D., Fu, L., Ding, H. & Gao, H. J. Evidence for Majorana bound states in an iron-based superconductor. _Science_ 362, 333-335 (2018).
  * [25] Zhu, S. Y., Kong, L. Y., Cao, L., Chen, H., Papaj, M., Du, S. X., Xing, Y. Q., Liu, W. Y., Wang, D. F., Shen, C. M., Yang, F. Z., Schneeloch, J., Zhong, R. D., Gu, G. D., Fu, L., Zhang, Y. Y., Ding, H. & Gao, H. J. Nearly quantized conductance plateau of vortex zero mode in an iron-based superconductor. _Science_ 367, 189-192 (2020).
  * [26] Li, M., Li, G., Cao, L., Zhou, X., Wang, X., Jin, C., Chiu, C. K., Pennycook, S. J., Wang, Z. & Gao H. J. Ordered and tunable Majorana-zero-mode lattice in naturally strained LiFeAs. _Nature_ 606, 890-895 (2022).
  * [27] Yuan, Y. H., Pan, J., Wang, X. T., Fang, Y. Q., Song, C. L., Wang, L. L., He, K., Ma, X. C., Zhang, H. J., Huang, F. Q., Li, W. & Xue, Q. K. Evidence of anisotropic Majorana bound states in 2M-WS2. _Nat. Phys._ 15, 106-1051 (2019).
  * [28] Zhao, C., Li, L. Q., Zhang, L. Y., Qin, J., Chen, H. Y., Xia, B., Yang, B., Zheng, H., Wang, S. Y., Liu, C. H., Li, Y. Y., Guan, D. D., Cui, P., Zhang, Z. Y. & Jia, J. F. Coexistence of robust edge states and superconductivity in few-layer stanene. _Phys. Rev. Lett._ 128, 206802 (2022).
  * [29] Nayak, A. K., Steinbok, A., Roet, Y., Koo, J., Margalit, G., Feldman, I., Almoalem, A., Kanigel, A., Fiete, G. A., Yan, B. H., Oreg, Y., Avraham, N. & Beidenkopf, H. Evidence of topological boundary modes with topological nodal-point superconductivity. _Nat. Phys._ 17, 1413-1419 (2021).
  * [30] Sasaki, S., Kriener, M., Segawa, K., Yada, K., Tanaka, Y., Sato, M. & Ando, Y. Topological superconductivity in CuxBi2Se3. _Phys. Rev. Lett._ 107, 217001 (2011).
  * [31] Peng, H. B., De, D., Lv, B., Wei, F. Y. & Chu, C. W. Absence of zero-energy surface bound states in CuxBi2Se3 studied via Andreev reflection spectroscopy. _Phys. Rev. B_ 88, 024515 (2013).
  * [32] He, Q. L., Pan, L., Stern, A. L., Burks, E. C., Che, X., Yin, G., Wang, J., Lian, B., Zhou, Q., Choi, E. S., Murata, K., Kou, X., Chen, Z., Nie, T., Shao, Q., Fan, Y., Zhang, S. C., Liu, K., Xia, J. & Wang, K. L. Chiral Majorana fermion modes in a quantum anomalous Hall insulator-superconductor structure. _Science_ 357, 294-299 (2017).
  * [33] Kayyalha, M., Xiao, D., Zhang, R. X., Shin, J., Jiang, J., Wang, F., Zhao, Y. F., Zhang, L., Fijalkowski, K. M., Mandal, P., Winnerlein, M., Gould, C., Li, Q., Molenkamp, L. W., Chan, M. H. W., Samarth, N. & Chang, C. Z. Absence of evidence for chiral Majorana modes in quantum anomalous Hall-superconductor devices. _Science_ 367, 64-67 (2020).
  * [34] Liu, J., Potter, A. C., Law, K. T. & Lee, P. A. Zero-bias peaks in the tunneling conductance of spin-orbit-coupled superconducting wires with and without Majorana end-states. _Phys. Rev. Lett._ 109, 267002 (2012).
  * [35] Sarma, S. D. & Pan, H. Disorder-induced zero-bias peaks in Majorana nanowires. _Phys. Rev. B_ 103, 195158 (2021).
  * [36] Rice, T. M. & Sigrist, M. Sr2RuO4: An electronic analogue of 3He? _J. Phys.: Condens. Matter_ 7, L643-L648 (1995).
  * [37] Mackenzie, A. P. & Maeno, Y. The superconductivity of Sr2RuO4 and the physics of spin?triplet pairing. _Rev. Mod. Phys._ 75, 657-712 (2003).
  * [38] Pustogow, A., Luo, Y., Chronister, A., Su, Y. S., Sokolov, D. A., Jerzembeck, F., Mackenzie, A. P., Hicks, C. W., Kikugawa, N., Raghu, S., Bauer, E. D. & Brown S. E. Constraints on the superconducting order parameter in Sr2RuO4 from oxygen-17 nuclear magnetic resonance. _Nature_ 574, 72-75 (2019).
  * [39] Abrikosov, A. A. On the magnetic properties of superconductors of the second group, _Sov. Phys.-JETP_ 5, 1174-1182 (1957) [_Zh. Eksp. Teor. Fiz. SSSR_ 32, 1442-1452 (1957)].
  * [40] de Gennes, P. G. Superconductivity of metals and alloys (W. A. Benjamin, New York, 1966).
  * [41] Abrikosov, A. A. Fundamentals of the theory of metals (North Holland, Amsterdam, 1988).
  * [42] Tinkham, M. Introduction to superconductivity (2nd Edition) (McGraw-Hill, New York, 1996).
  * [43] Khlyustikov, I. N. & Buzdin, A. I. Twinning-plane superconductivity. _Adv. Phys._ 36, 271-330 (1987).
  * [44] Matsumoto, M., Belardinelli, C. & Sigrist, M. Upper critical field of the 3 Kelvin phase in Sr2RuO4. _J. Phys. Soc. Jpn._ 72, 1623-1626 (2003).
  * [45] Saint-James, D. & de Gennes, P. Onset of superconductivity in decreasing fields. _Phys. Lett._ 7, 306-308 (1963).
  * [46] Saint-James, D. Angular dependence of the upper critical field of type II superconductors; theory. _Phys. Lett._ 16, 218-220 (1965).
  * [47] Liu, C. X., Qi, X. L., Zhang, H., Dai, X., Fang, Z. & Zhang S. C. Model Hamiltonian for topological insulators. _Phys. Rev. B_ 82, 045122 (2010).
  * [48] Xu, G., Lian, B., Tang, P., Qi, X. L. & Zhang, S. C. Topological superconductivity on the surface of Fe-based superconductors. _Phys. Rev. Lett._ 117, 047001 (2016).
  * [49] Li, Y. M., Zaki, N., Garlea, V. O., Savici, A. T., Fobes, D., Xu, Z. J., Camino, F., Petrovic, C., Gu, G. D., Johnson, P. D., Tranquada, J. M. & Zaliznyak, I. A. Electronic properties of the bulk and surface states of Fe1+yTe1-xSex. _Nat. Mater._ 20, 1221-1227 (2021).
  * [50] Kong, L. Y., Zhu, S. Y., Papaj, M., Chen, H., Cao, L., Isobe, H., Xing, Y. Q., Liu, W. Y., Wang, D. F., Fan, P., Sun, Y. J., Du, S. X., Schneeloch, J., Zhong, R. D., Gu, G. D., Fu, L., Gao, H. J. & Ding, H. Half-integer level shift of vortex bound states in an iron-based superconductor. _Nat. Phys._ 15, 1181-1187 (2019).
  * [51] Braithwaite, D., Lapertot, G., Knafo, W. & Sheikin, I. Evidence for anisotropic vortex dynamics and Pauli limitation in the upper critical field of FeSe1-xTex. _J. Phys. Soc. Jpn._ 79, 053703 (2010).
  * [52] Audouard, A., Drigo, L., Duc, F., Fabrèges, X., Bosseaux, L. & Toulemonde, P. Tunnel diode oscillator measurements of the upper critical magnetic field of FeTe0.5Se0.5. _J. Phys.: Condens. Matter_ 26, 185701 (2014).
  * [53] Mermin, N. D. & Wagner, H. Absence of ferromagnetism or antiferromagnetism in one- or two-dimensional isotropic Heisenberg models. _Phys. Rev. Lett._ 17, 1133-1136 (1966).
  * [54] Hohenberg, P. C. Existence of long-range order in one and two dimensions. _Phys. Rev._ 158, 383-386 (1967).
  * [55] Coleman, S. There are no Goldstone bosons in two dimensions. _Commun. Math. Phys._ 31, 259-264 (1973).

N.F.Q.Y. acknowledges the National Natural Science Foundation of China (Grant.
No. 12174021) for the financial support. X.J.C. thanks the financial support
from the Shenzhen Science and Technology Program (Grant No.
KQTD20200820113045081), the Basic Research Program of Shenzhen (Grant No.
JCYJ20200109112810241), and the National Key R$\&$D Program of China (Grant
No. 2018YFA0305900).

Figure 1 $\mid$ Nucleation at zero field in the 3D topological superconductor.
a, The 3D topological superconductor with bulk superconductivity (Bulk SC) in
the semi-infinite region $z\leq 0$ and topological surface superconductivity
(TSSC) near the open surface $z=0$. TSSC is the result of the interplay
between bulk superconductivity and topological surface states (TSS). Here
$\xi_{0}$ is the zero-temperature coherence length of the bulk, and in this
work we consider long-range physics at distances greater than $\xi_{0}$. b,
Surface nucleation at zero field. The blue and black lines correspond to the
order parameters in the temperature regimes $T_{c0}<T<T_{c}$ and $T<T_{c0}$,
respectively. Dashed lines denote the extrapolations of order parameters,
which intercept the $z$-axis at the extrapolation length $l_{s}$. The nucleus
of the order parameter is the surface $z=0$, as depicted in a.

Figure 2 $\mid$ Nucleation and phase diagrams under magnetic fields in the 3D
topological superconductor. a, b, Bulk and surface nucleation under magnetic
fields. As the field increases, superconductivity first nucleates in the bulk
(bulk nucleus) and then on the surface (surface nucleus). The spatial profiles
of order parameters along the $z$-axis are plotted under the in-plane (a) and
out-of-plane (b) magnetic fields. In b, bulk and surface nuclei are both
localized in the $xy$-plane, but the bulk nucleus is uniform along the
$z$-axis. c, d, Phase diagrams of temperature and magnetic field along in-
plane (c) or out-of-plane (d) direction. The lower critical field $B_{c1}$,
upper critical field $B_{c2}$, and nucleation critical field $B_{c3}$ separate
the bulk uniform superconducting phase (Bulk SC), the mixed phase (Mixed), the
topological surface superconducting phase (TSSC), and the non-superconducting
normal phase (N).

Figure 3 $\mid$ Nucleation and phase diagrams in the 2D topological
superconductor. a, The 2D topological superconductor with bulk
superconductivity (Bulk SC) in the semi-infinite region $x\leq 0$ and
topological edge superconductivity (TESC) near the open edge $x=0$, and
$\xi_{0}$ is the zero-temperature coherence length of the bulk. b, Edge
nucleation at zero field. The blue and black lines correspond to the
temperature regimes $T_{c0}<T<T_{c}$ and $T<T_{c0}$, respectively. c-f,
Nucleation and phase diagrams under magnetic fields. Under the in-plane (c, e)
and out-of-plane (d, f) fields, the order parameters along $x$-axis (c, d) and
phase diagrams of temperature and field (e, f) are plotted. Under the in-plane
fields (c, e), orbital effect is screened, hence the bulk nucleus is absent
(c). As a result, the lower critical field $B_{c1}$, and the mixed phase
(Mixed) are absent in the phase diagram (e).

Figure 4 $\mid$ Upper critical field behaviours of two iron-based
superconductors FeTe0.52Se0.48 and FeTe0.5Se0.5 as a function of temperature
for the magnetic field applied in the $ab$ plane and along the $c$ direction,
respectively. The symbols represent the experimental data points (squares for
the $ab$ plane and circles for the $c$ direction) from the resistance and
tunnel diode oscillator measurements on FeTe0.52Se0.48[51] (a and c) and
FeTe0.5Se0.5[52] (b and d), respectively. The curves are the theoretical
fitting results to the data points by using the critical exponent $\gamma$ of
$2/3$ and $1$ for the $ab$ plane and $c$ axis for the topological
superconductivity with the surface state given in Table 1.

Table 1 $\mid$ Critical exponents of the applied magnetic fields along the in-
plane and out-of-plane directions in 3D and 2D topological and trivial
superconductors. The critical exponent $\gamma$ is defined by the nucleation
critical field $B_{c3}\sim(T_{c}-T)^{\gamma}$ with $T_{c}$ being the onset
critical temperature. In 3D, the plane is the open surface where topological
surface states reside, while in 2D the plane is the superconductor itself.

Direction | 3D Topological | 3D Trivial | 2D Topological | 2D Trivial
---|---|---|---|---
In-plane | ${2}/{3}$ | $1$ | ${1}/{2}$ | ${1}/{2}$
Out-of-plane | $1$ | $1$ | ${2}/{3}$ | $1$

Methods

Microscopic derivations. To demonstrate the main steps of microscopic
derivations, we consider the microscopic Hamiltonian at zero field with on-
site attractive interaction among electrons

$H=\int
d^{3}\bm{r}d^{3}\bm{s}\left\\{c^{\dagger}(\bm{r})\mathcal{H}(\bm{r},\bm{s})c(\bm{s})\right\\}-\frac{1}{2}g\int
d^{3}\bm{r}\left\\{c^{\dagger}(\bm{r})c(\bm{r})\right\\}^{2},$ (4)

where $c=\\{c_{\mu}\\}^{\rm T}$, $c_{\mu}(\bm{r})$ denotes an electron at site
$\bm{r}$ with band index $\mu$, $\mathcal{H}(\bm{r},\bm{s})$ is the normal
state Hamiltonian matrix of the topological material, and $g>0$ is the on-site
attraction strength between electrons. We would like to compute the $s$-wave
pairing correlation $\Delta(\bm{r})=g\langle
c_{\uparrow}(\bm{r})c_{\downarrow}(\bm{r})\rangle$ in order to obtain the
physics of superconductivity in this system, where $\langle O\rangle\equiv{\rm
Tr}(Oe^{-\frac{H}{k_{\rm B}T}})/Z$ denotes the thermodynamic average at
temperature $T$, and $Z\equiv{\rm Tr}e^{-\frac{H}{k_{\rm B}T}}$ is the
partition function. To capture the long-range physics of $\Delta(\bm{r})$, we
expand the free energy $F\equiv{-{k_{\rm B}T}}\log Z$ within mean field

$F=\int d^{3}\bm{r}\frac{|\Delta(\bm{r})|^{2}}{g}-\int
d^{3}\bm{r}d^{3}\bm{s}K(\bm{r},\bm{s})\Delta^{*}(\bm{r})\Delta(\bm{s}),$ (5)

where $K$ is the kernel in terms of sum over Mastubara frequency
$\omega=(2n+1)\pi k_{\rm B}T$ $(n\in\mathbb{Z})$:

$K(\bm{r},\bm{s})=k_{\rm B}T\sum_{\omega
ab}\frac{\phi_{a}(\bm{r})^{\dagger}\phi_{a}(\bm{s})}{\xi_{a}-i\omega}\left[\frac{\phi_{b}(\bm{r})^{\dagger}\phi_{b}(\bm{s})}{\xi_{b}-i\omega}\right]^{*},$
(6)

and we introduce eigenstates $\mathcal{H}\phi_{a}=\xi_{a}\phi_{a}$, including
both bulk states $\phi^{\rm B}$ and surface states $\phi^{\rm S}$. Deep in the
bulk, the kernel only involves bulk states and hence has full translation
symmetry

$K^{\rm B}(\bm{r},\bm{s})=k_{\rm B}T\sum_{\omega ab}\frac{\phi^{\rm
B}_{a}(\bm{r})^{\dagger}\phi^{\rm
B}_{a}(\bm{s})}{\xi_{a}-i\omega}\left[\frac{\phi^{\rm
B}_{b}(\bm{r})^{\dagger}\phi^{\rm
B}_{b}(\bm{s})}{\xi_{b}-i\omega}\right]^{*}=K^{\rm B}(\bm{r}-\bm{s}).$ (7)

The bulk critical temperature $T_{c0}$ and the bulk coherence length $\xi_{0}$
at zero temperature are determined by ($v_{F}$ is the bulk Fermi velocity)

$g\left.\int K^{\rm
B}(\bm{s})d^{3}\bm{s}\right|_{T=T_{c0}}=1,\quad\xi_{0}=0.18\frac{\hbar
v_{F}}{k_{\rm B}T_{c0}}.$ (8)

The introduction of the topological surface states on the open surface $z=0$
breaks the translation symmetry along the $z$ axis. On the scale
$r\gg\xi_{0}$, the free energy can be rewritten as

$F=\int_{z\leq
0}d^{3}\bm{r}\left\\{\frac{|\nabla\psi|^{2}}{2m}+\mathcal{A}|\psi|^{2}\right\\}+\sigma\int_{z=0}d^{2}\bm{r}|\psi|^{2}.$
(9)

Here we introduce the superconducting order parameter $\psi$, the temperature-
dependent potential energy $\mathcal{A}$ and the temperature-independent
surface energy $\sigma$ as follows[40]

$\psi(\bm{r})={\sqrt{mL}}\Delta(\bm{r}),\quad\mathcal{A}=\frac{1}{mL}\left\\{\frac{1}{g}-\int
K^{\rm B}(\bm{r})d^{3}\bm{r}\right\\},\quad\sigma=\int_{z\leq
0}\frac{\Delta(\bm{r})}{\Delta_{0}}\left\\{1-\frac{N(\bm{r})}{N_{0}}\right\\}\frac{dz}{mgL},$
(10)

where $N(\bm{r})$ is the local density of states,
$N_{0}=\underset{z\to-\infty}{\lim}N(\bm{r})$ is the bulk density of states,
and

$L=\frac{1}{3}\int K^{\rm
B}(\bm{r})|\bm{r}|^{2}d^{3}\bm{r},\quad\alpha=\frac{N_{0}}{mLT_{c0}},\quad\Delta_{0}=\Delta(\bm{r})|_{z=0}.$
(11)

Without topological surface states, $N(\bm{r})\equiv N_{0}$ and the surface
energy is zero. With topological surface states, $N(\bm{r})>N_{0}$ and the
surface energy is negative. Define the norm
$||\phi||\equiv\sqrt{\phi^{\dagger}\phi}$, then
$N(\bm{r})=\sum_{a}||\phi_{a}(\bm{r})||^{2}\delta(\xi_{a})$ and
$N_{0}=\sum_{a}||\phi_{a}^{\rm B}||^{2}\delta(\xi^{\rm B}_{a})$. Hence
$N(\bm{r})=N_{0}+N^{\rm S}(\bm{r})>N_{0}$, where $N^{\rm
S}(\bm{r})\equiv\sum_{a}||\phi_{a}^{\rm S}(\bm{r})||^{2}\delta(\xi^{\rm
S}_{a})$ is the local density of the topological surface states. Hence

$\frac{1}{l_{s}}=\frac{2}{gL}\int_{z\leq
0}dz\frac{\Delta(\bm{r})}{\Delta_{0}}\frac{N^{\rm S}(\bm{r})}{N_{0}}.$ (12)

Since $gL\sim\xi_{0}^{2}$, we expect $l_{s}\sim\xi_{0}^{2}/l_{c}$ where
$l_{c}$ is the decay length of topological surface states[47]. When we take
$l_{c}\sim$ 1 Å, $\xi_{0}\sim$ 10 Å, we have $l_{s}\sim$ 100 Å. From the
critical field data of FeTe1-xSex ($x\sim$0.5), we estimate $\xi_{0}$=21.68 Å
and $l_{s}$=276.65 Å. The orders of magnitudes are consistent with our
expectations.

Ginzburg-Landau equation and de Gennes boundary condition. By minimal coupling
$-i\nabla\to\bm{D}=-i\nabla-2\pi\bm{A}/\Phi_{0}$, the derived Ginzburg-Landau
free energy is then Eq. (1) of the maintext

$F=\int_{z\leq
0}d^{3}\bm{r}\left\\{\frac{1}{2m}\left|\bm{D}\psi\right|^{2}+\mathcal{A}|\psi|^{2}\right\\}-\frac{1}{2ml_{s}}\int_{z=0}d^{2}\bm{r}|\psi|^{2}.$
(13)

The variation of the Ginzburg-Landau free energy with respect to the order
parameter reads

$\delta F=\int_{z\leq
0}d^{3}\bm{r}\left(\frac{\bm{D}^{2}}{2m}+\mathcal{A}\right)\psi\delta\psi^{*}+\frac{1}{2m}\int_{z=0}d^{2}\bm{r}(iD_{z}\psi-
l_{s}^{-1}\psi)\delta\psi^{*}.$ (14)

In the thermodynamic equilibrium, $\delta F=0$ for any $\delta\psi^{*}$. The
variation in the bulk leads to the linearized Ginzburg-Landau equation (GLE)

$\displaystyle\left(\frac{1}{2m}\bm{D}^{2}+\mathcal{A}\right)\psi=0,$ (15)

and the variation on the surface $z=0$ leads to the de Gennes boundary
condition (dGBC)

$\displaystyle\left.(iD_{z}\psi-l_{s}^{-1}\psi)\right|_{z=0}=0.$ (16)

Finally, at infinity we find the von Neumann-type boundary condition

$\lim_{|\bm{r}|\to\infty}\bm{D}\psi=\bm{0}.$ (17)

Nucleation at zero field in 3D topological superconductors. Without external
fields $\bm{A}=\bm{0}$, near the phase transition the GLE is

$\left(-\frac{1}{2m}\nabla^{2}+\mathcal{A}\right)\psi=0,$ (18)

and the dGBC reads

$\left({\partial_{z}\psi}-{l_{s}}^{-1}\psi\right)_{z=0}=0.$ (19)

The order parameter is hence localized exponentially on the surface

$\psi=\exp(-{|z|}/{l_{s}}),$ (20)

corresponding to the onset critical temperature

$T_{c}=T_{c0}+\frac{1}{2m\alpha l_{s}^{2}}.$ (21)

Nucleation under the in-plane fields in 3D topological superconductors.
Without loss of generality, under a magnetic field $B\hat{\bm{x}}$ along the
$x$ axis, we choose the Landau gauge $\bm{A}=(0,-Bz,0)$, then the GLE can be
written as

$\left\\{-\frac{1}{2m}\left[\partial_{z}^{2}+\partial_{x}^{2}-\left(i\partial_{y}-\frac{2\pi
B}{\Phi_{0}}z\right)^{2}\right]+\mathcal{A}\right\\}\psi=0,$ (22)

and the dGBC is the same as the zero-field case since $A_{z}=0$:

$\left.(\partial_{z}\psi-l_{s}^{-1}\psi)\right|_{z=0}=0.$ (23)

As plotted in Fig. 2a as the surface nucleus, the solution of the order
parameter is

$\psi=D_{\nu}\left(-\sqrt{2}\frac{z+kl_{B}^{2}}{l_{B}}\right)e^{iky},\
\nu=\frac{1}{2}\left(\frac{B_{c2}}{B}-1\right),$ (24)

where $l_{B}\equiv\sqrt{\Phi_{0}/2\pi B}$ is the magnetic length, and
$D_{\nu}(\eta)$ is the parabolic cylinder function.

Optimization of the critical field leads to $k=1/\xi$, and the equation for
the nucleation critical field $B_{c3}=B(T)$ is hence derived from dGBC

$\displaystyle
D^{\prime}_{\nu}\left(-\frac{\sqrt{2}l_{B}}{\xi}\right)=\frac{-1}{\sqrt{2}}\frac{l_{B}}{l_{s}}D_{\nu}\left(-\frac{\sqrt{2}l_{B}}{\xi}\right).$
(25)

At weak fields $B\ll B_{s}=\Phi_{0}/(\pi l_{s}^{2})$, the solution to the
above equation Eq. (25) is $B=\Phi_{0}/(\pi\xi l_{s})\propto(T_{c}-T)^{1/2}$.
In the temperature regime $T_{c0}<T<T_{c}$, expanded to the leading order
beyond exponential one can derive the order parameter

$\psi=\exp(-\frac{|z|}{l_{s}}-\frac{2}{3}\frac{|z|^{3}}{\xi^{3}l_{s}}+i\frac{y}{\xi}),$
(26)

and hence the imhomogeneity of the order parameter is described by the length
$\zeta=(\xi^{2}l_{s})^{1/3}$. It can be found that
$B=0.525{\Phi_{0}}/{\zeta^{2}}\propto(T_{c}-T)^{2/3}$ in Eq. (2) of the
maintext is a good solution to Eq. (25) in the intermediate field regime
$B\sim B_{s}$.

In the intermediate field regime, we can also introduce the post-Gaussian
trial order parameter $\psi=\exp(-\frac{2}{3}z^{3}/\zeta^{3}-iry/l_{B}^{2})$
with two variational parameters $r$ and $\zeta$, and minimize

$\displaystyle\varepsilon(r,\zeta)\equiv{\int_{0}^{\infty}dz\left\\{|\partial_{z}\psi|^{2}+\left|\left(\partial_{y}+i\frac{2\pi
B}{\Phi_{0}}z\right)\psi\right|^{2}\right\\}}\left/{\int_{0}^{\infty}dz|\psi|^{2}}\right..$
(27)

Then the nucleation critical field in the intermediate field regime can be
worked out as

$B_{c3}=\frac{\Phi}{(\xi^{2}l_{s})^{2/3}},\quad\frac{\Phi}{\Phi_{0}}=\frac{1}{\sqrt[6]{6}\pi}\sqrt{\frac{\Gamma\left(\frac{1}{3}\right)\Gamma\left(\frac{2}{3}\right)}{\Gamma\left(\frac{1}{3}\right)-\Gamma\left(\frac{2}{3}\right)^{2}}}=0.489,$
(28)

which is very close to the value $\Phi=0.525\Phi_{0}$ in Eq. (2) of the
maintext. And the other parameter is
$r=\sqrt[3]{\frac{3}{4}}\frac{\Gamma\left({2}/{3}\right)}{\Gamma\left({1}/{3}\right)}\zeta$.
The full phase diagram is shown in Fig. 2c, where the numerical solution
$B=B_{c3}(T)$ to Eq. (25) is plotted.

Nucleation under the out-of-plane fields in 3D topological superconductors.
Under a magnetic field $B\hat{\bm{z}}$ along the $z$ axis, we choose the
Landau gauge $\bm{A}=(0,Bx,0)$, then the GLE reads

$\left\\{-\frac{1}{2m}\left[\partial_{z}^{2}+\partial_{x}^{2}-\left(i\partial_{y}+\frac{2\pi
B}{\Phi_{0}}x\right)^{2}\right]+\mathcal{A}\right\\}\psi=0,$ (29)

and the dGBC is also the same as the zero-field case since $A_{z}=0$:

$\left.(\partial_{z}\psi-l_{s}^{-1}\psi)\right|_{z=0}=0.$ (30)

So the solution of the order parameter is factorized as shown in Fig. 2b as
the surface nucleus

$\psi=\exp(-\frac{|z|}{l_{s}})\exp\left(-\frac{|x-kl_{B}^{2}|^{2}}{2l_{B}^{2}}\right)e^{iky}.$
(31)

We find the critical exponent for the out-of-plane fields is 1, the same as
the conventional case[42, 40, 41]

$B_{c3,\perp}=\frac{\Phi_{0}}{2\pi\xi^{2}}\propto T_{c}-T.$ (32)

The full phase diagram is shown in Fig. 2d.

Nucleation under fields in 3D trivial superconductors. Without topological
surface states, the superconductor is trivial, $N(\bm{r})\equiv N_{0}$ and the
surface energy is zero ($\sigma=0$). In this case, there is no nucleation at
zero field and hence there is only one critical temperature $T_{c0}$. There
will still be surface nucleation under finite magnetic fields as shown in
Extended Data Fig. 1a, but the nucleation critical field is linear in
temperature. The two critical fields have the following relation:
$B_{c3}=1.69463B_{c2}$[45]. The full phase diagram is shown in Extended Data
Fig. 1b. In the regime $B_{c2}<B<B_{c3}$, the nucleated superconductivity
becomes the _trivial surface superconductivity_.

In summary, we find that in 3D the critical exponent of magnetic fields in the
trivial case is 1 along any directions, while in the topological case, the
critical exponent is 1 along the out-of-plane direction and 2/3 along the in-
plane directions, where the plane is the open surface for topological states
to reside. These results are listed in Table 1.

Ginzburg-Landau free energy in 2D superconductors. In a 2D superconductor, the
surface energy reduces to the edge energy $\sigma^{\prime}$, and the Ginzburg-
Landau free energy is

$F=\int_{x\leq
0}dxdy\left\\{\frac{1}{2m}\left|\bm{D}\psi\right|^{2}+\mathcal{A}|\psi|^{2}\right\\}+\sigma^{\prime}\int_{x=0}dy|\psi|^{2},$
(33)

where we assume the region of $x\leq 0$ is the 2D superconductor. When edge
states exist along the open edge $x=0$, then
$\sigma^{\prime}=-({2ml_{s}})^{-1}<0$, the GLE and dGBC in 2D are

$\displaystyle\left(\frac{1}{2m}\bm{D}^{2}+\mathcal{A}\right)\psi=0,\quad\left.(iD_{x}\psi-
l_{s}^{-1}\psi)\right|_{x=0}=0.$ (34)

Nucleation at zero field in 2D topological superconductors. Without external
fields $\bm{A}=\bm{0}$, near phase transition the GLE is
$\left(-\nabla^{2}/2m+\mathcal{A}\right)\psi=0,$ and the dGBC reads
$\left.(\partial_{x}\psi-l_{s}^{-1}\psi)\right|_{x=0}=0.$ The order parameter
is hence localized exponentially on the edge $\psi=\exp(-{|x|}/{l_{s}}),$
corresponding to the onset critical temperature $T_{c}=T_{c0}+({2m\alpha
l_{s}^{2}})^{-1}.$

Nucleation under the in-plane fields in 2D topological superconductors. Under
a magnetic field $B\hat{\bm{n}}$ in the $xy$ plane
($\hat{\bm{n}}\perp\hat{\bm{z}}$), we choose the Landau gauge
$\bm{A}=Bz\hat{\bm{n}}\times\hat{\bm{z}}$, then $\bm{A}\equiv\bm{0}$ since the
superconductor is confined in the plane $z=0$. In other words, the orbital
effect of magnetic fields can be neglected in 2D superconductors. But the
potential term $\mathcal{A}$ is modified by the magnetic field via Zeeman
effect, and a magnetic energy is introduced

$\mathcal{A}\to\mathcal{A}^{\prime}=\alpha(T-T_{c0})+\beta
B^{2}.\quad(\beta>0)$ (35)

Hence the GLE and the dGBC read
$\left(-\frac{1}{2m}\nabla^{2}+\mathcal{A}+\beta B^{2}\right)\psi=0$, and
$\left({\partial_{x}\psi}-{l_{s}}^{-1}\psi\right)_{x=0}=0$ respectively. The
solution is still localized exponentially on the edge
$\psi=\exp(-{|x|}/{l_{s}})$ as shown in Fig. 3a, but we find the critical
exponent for the in-plane fields is 1/2, the same as that in the conventional
case of 2D superconductivity[42]

$B_{c3}=\sqrt{\alpha(T_{c}-T)/\beta}\propto(T_{c}-T)^{1/2}.$ (36)

The full phase diagram of the in-plane magnetic field and temperature in the
GL regime for 2D topological superconductors is shown in Fig. 3c. As field
increases, the bulk superconductivity stays uniform until the upper critical
field $B_{c2}=\sqrt{\alpha(T_{c0}-T)/\beta}$ where bulk superconductivity is
killed. In the regime $B_{c2}<B<B_{c3}$, nucleated superconductivity and
topological states coexist along the edge, resulting in the _topological edge
superconductivity_.

Nucleation under the out-of-plane fields in 2D topological superconductors.
Under a magnetic field $B\hat{\bm{z}}$ along the $z$ axis, we choose the
Landau gauge $\bm{A}=(0,Bx,0)$, then the GLE reads

$\left\\{-\frac{1}{2m}\left[\partial_{x}^{2}-\left(i\partial_{y}+\frac{2\pi
B}{\Phi_{0}}x\right)^{2}\right]+\mathcal{A}\right\\}\psi=0,$ (37)

and the dGBC reads $\left.(\partial_{x}\psi-l_{s}^{-1}\psi)\right|_{x=0}=0.$
So the solution is as shown in Fig. 3b

$\psi=D_{\nu}\left(-\sqrt{2}\frac{x-kl_{B}^{2}}{l_{B}}\right)e^{iky},\
\nu=\frac{1}{2}\left(\frac{B_{c2}}{B}-1\right).$ (38)

The full phase diagram of the out-of-plane magnetic field and temperature in
the GL regime for 2D topological superconductors is shown in Fig. 3d. As field
increases, the bulk superconductivity stays uniform until the lower critical
field $B_{c1}$ where vortices start to nucleate in the plane. Then vortices
proliferate and the bulk is in the mixed phase when $B_{c1}<B<B_{c2}$. In the
regime $B_{c2}<B<B_{c3}$, the nucleated superconductivity and topological
states coexist along the edge, resulting in the _topological edge
superconductivity_.

Nucleation under fields in 2D trivial superconductors. Without topological
surface states, the superconductor is trivial, $N(\bm{r})\equiv N_{0}$ and the
edge energy is zero ($\sigma^{\prime}=0$). In this case, there is no
nucleation at zero field and hence there is only one critical temperature
$T_{c0}$. There is no nucleation under in-plane magnetic fields as orbital
effect is screened, and the Zeeman effect leads to
$B_{c3}=B_{c2}=\sqrt{\alpha(T_{c0}-T)/\beta}$. There is an edge nucleus under
the out-of-plane magnetic fields similar to Extended Data Fig. 1a, and
$B_{c3}=1.69463B_{c2}\propto T_{c0}-T$ still holds. The full phase diagram is
shown in Extended Data Fig. 1b, except that in the regime $B_{c2}<B<B_{c3}$,
the nucleated superconductivity is the _trivial edge superconductivity_.

In summary, we find that in 2D, the critical exponent of magnetic fields in
the trivial case is 1 along the out-of-plane direction and 1/2 along the in-
plane directions, while in the topological case, the critical exponent is 2/3
along the out-of-plane direction and 1/2 along the in-plane directions, where
the plane is the superconductor itself. These results are also listed in Table
1.

Nucleation in superconducting heterostructures. When the region of $z>0$ is a
metal or an insulator, a superconducting heterostructure is formed.

Without topological states on the open surface or along the open edge,
$N(\bm{r})<N_{0}$ due to non-superconducting states near the open surface
(edge) and the surface (edge) energy is positive ($\sigma>0$). There is no
surface (edge) nucleation either at zero field or finite fields[40, 41], hence
the critical temperature, critical fields and the phase diagram of field and
temperature are the same as those of the bulk.

With topological states on the open surface or along the open edge, the sign
of the surface (edge) energy depends on the detailed competition between the
topological states and the non-superconducting states near the open surface
(edge). Our theory applies to the case of negative surface (edge) energy.

Extended Data Fig. 1 $\mid$ Nucleation and phase diagram with zero surface
energy (3D) or zero edge energy (2D). a, Bulk and surface nuclei with fields.
b, Phase diagram of field and temperature. The lower critical field $B_{c1}$,
the upper critical field $B_{c2}$, and the nucleation critical field $B_{c3}$
separate the bulk uniform superconducting phase (Bulk SC), the mixed phase
(Mixed), the trivial surface superconducting phase (Trivial Surface SC), and
the normal phase (Normal).


# “It’s a Trap!”—How Speculation Invariance Can Be Abused with Forward
Speculative Interference

Pavlos Aimoniotis  Uppsala University
<EMAIL_ADDRESS>Christos Sakalis  Uppsala University
<EMAIL_ADDRESS>Magnus Själander  Norwegian University of Science
and Technology
<EMAIL_ADDRESS>Stefanos Kaxiras  Uppsala University
<EMAIL_ADDRESS>
###### Abstract

Side-channel attacks based on speculative execution access sensitive data and
use transmitters to leak such data during wrong-path execution. Speculative
side-channel defenses have been proposed to prevent such information leakage.
In one class of defenses, speculative instructions are considered unsafe and
are _delayed_ until they become non-speculative.

However, not all speculative instructions are unsafe: Recent work demonstrates
that speculative invariant instructions are independent of a speculative
control-flow path and are guaranteed to eventually execute and commit,
regardless of the outcome of the performed speculation. Compile time
information coupled with run-time mechanisms can then selectively lift
defenses for _Speculative Invariant_ instructions, regaining some of the
performance lost to “delay” defenses.

Unfortunately, speculative invariance can be easily mishandled with
_Speculative Interference_ to leak information using a new side-channel that
we introduce in this paper. Recent work shows that younger _speculative_
instructions can _interfere_ with older non-speculative instructions that are
bound to commit. This “backward” speculative interference reveals
speculatively accessed secrets through the non-speculative instructions, in a
way that delay-defenses do not cover, rendering them ineffective for this type
of attack.

In our work, we show that the counterpart to backward speculative
interference, i.e., _forward speculative interference_ , enables _older_
speculative instructions to interfere with _younger speculative-invariant
(bound-to-commit) instructions_ , effectively turning them into transmitters
for secret data accessed during speculation. We demonstrate _forward
speculative interference_ on real hardware, by selectively filling the reorder
buffer (ROB) with spurious instructions, pushing speculative-invariant
instructions in- or-out the ROB _on demand_ , based on a speculatively
accessed secret. This reveals the speculatively accessed secret, as the
occupancy of the ROB itself becomes a new speculative side-channel. We also
demonstrate that it is possible to use the x86 ISA REP prefix, which unrolls
as a micro-op loop in the microarchitecture at decode time (before any side-
channel defenses have taken effect), as a method for generating spurious
instructions. We propose several mitigations that range from changing compile-
time decisions for speculative-invariance to run-time mechanisms that aim to
make ROB occupancy operand-independent.

##  I Introduction

††footnotetext: A later version of this paper has been published on IEEE
Computer Architecture Letters (CAL) under the name Reorder Buffer Contention
[1] and Digital Object Identifier no. 10.1109/LCA.2021.3123408.

Speculative side-channel attacks use speculative execution to gain access to
information that would otherwise be inaccessible. Speculatively executed
instructions are capable of temporarily bypassing hardware or software
defenses to gain illegal access to data that are then passed to speculative
side-channel instructions, a _transmitter gadget_ , capable of leaking those
sensitive data to the non-speculative domain. Transmitter gadgets perform an
operation that alters the microarchitectural state of the processors, leading
to a data leak. A receiver observes the changes in the microarchitectural
states and is able to identify leaked data outside of the speculation window.

To tackle this problem several hardware defenses [11, 13, 16, 2, 5, 7, 9, 12]
have been proposed, introducing a variety of security guarantees. However,
defenses also introduce various levels of complexity and performance overhead.
Several hardware defenses rely on techniques that protect instructions while
they are speculative, and focus on making them invisible. One example is
Delay-on-Miss (DoM) [11]. DoM delays speculative loads that miss in the L1
cache until they become non-speculative, at which point they can be executed
safely. Another example is InvisiSpec [13]. InvisiSpec performs speculative
loads but keeps the effects of a miss invisible in the cache hierarchy. When
the speculation is verified, changes in the memory hierarchy are effected with
a visible access.

Hardware defenses, such as DoM and InvisiSpec, add significant performance
overhead [11, 13]. For this, Zhao et al. proposed InvarSpec [17], a framework
that detects and lifts the protection for speculative instructions that become
_speculation invariant_. For an instruction to be speculative invariant, its
data and control dependencies must be resolved during the speculation window.
Such instructions are eventually going to execute with the same operands, even
if they are temporarily squashed due to misspeculation, and are, thus,
considered safe to execute. Lifting the protection for speculation invariant
instructions enables the visible execution of an instruction while it is still
under speculation, maintaining the “invisible speculative execution” semantics
of defenses such as DoM or InvisiSpec while recovering significant performance
lost to these defenses.

In a related development, Behnia et al. demonstrate that _Speculative
Interference_ [6] can break (under some assumptions) the DoM and InvisiSpec
defenses. Up until now, the transmitter instructions were considered to be
exclusively under speculative execution. With the introduction of Speculative
Interference attacks, this has changed. In such an attack, the transmitter
instructions are placed before (in program order) the speculation window.
Hence, the transmitter instructions can lie outside the protection of DoM or
InvisiSpec defenses, as these are engaged only for instructions that follow
(in program order) the source-of-speculation instruction(s). Since Speculative
Interference is based on the fact that younger speculative instructions can
influence the timing of older instructions, it can consequently lead to
information leakage even under speculative defense mechanisms [6].

The key insight of our work is that speculation-invariant instructions are
susceptible to speculative interference from _older_ speculative instructions:
_Forward Speculative Interference_ (FSI). To clearly differentiate between FSI
and the speculative interference from _younger_ speculative instructions, we
refer to the latter as Backward Speculative Interference (BSI). Using FSI, a
new side-channel can be created by manipulating the inclusion or exclusion of
speculation-invariant instructions in the reorder buffer (ROB). Other forms of
forward interference are also possible and Behnia et al. [6] discuss how to
delay instruction fetch with reservation station (RS) contention, called
${G^{I}}_{RS}$ in [6]. However, ${G^{I}}_{RS}$ concerns blocking of
instruction fetch (and the front-end) which affects the I-Cache and is
distinctly different from the _ROB-contention_ interference discussed here
that concerns instruction execution.

We demonstrate FSI with _ROB contention_ on actual processors (Intel Sandy
Bridge) and show how the ROB can be used as a side-channel. Specifically, we
show how, during speculation, we can selectively push in-or-out of the ROB
load instructions that are on the—yet unknown—correct path of execution,
leading to side-effects that remain observable after the speculation has been
resolved. These load instructions would be marked as speculative-invariant by
InvarSpec, therefore the InvarSpec framework is susceptible to such a side-
channel attack as well.

In addition to the attacks, we propose FSI ROB-contention mitigations from the
speculative invariance point-of-view. We propose two potential mitigations:
conservatively considering at compile time instructions that are susceptible
to ROB-contention interference as non-speculation-invariant and compile-time
path balancing to prevent ROB-contention FSI. Finally, we briefly touch on
making ROB contention, operant-invariant to manage the ROB side-channel in a
more general approach. Evaluation of our proposed mitigations is work in
progress and we aim to report results in a future version of the paper.

##  II Background

###  II-A Delay-on-Miss

Delay-on-Miss (DoM) is a hardware defense mechanism against speculative side-
channel attacks, focusing on side-channels that abuse the memory hierarchy
[11]. Consecutively, side-channel attacks that do not focus on the memory
hierarchy are outside the scope of DoM and are not hindered by it.

DoM operates on two fundamental principles. First, DoM delays transient loads
until they become non-speculative. DoM introduces the concept of _speculative
shadows_ to efficiently track the speculative state of instructions and
discover the earliest time instructions become non-speculative, typically
significantly earlier than reaching the commit stage (becoming head of the
reorder buffer).

Second, DoM delays only loads that miss in the cache. Because reading data
into a cache requires complicated interactions with the rest of the system, it
is difficult to hide the side-effects of loads in the memory hierarchy on a
cache miss, as demonstrated in prior solutions such as InvisiSpec [13] and
Ghost Loads [10]. However, a cache hit requires only small modifications to
the cache state (update of the replacement state etc.), which can be easily
deferred for when the load is non-speculative. Thus, instead of delaying all
loads, DoM allows loads that hit in L1 cache to execute under speculation,
while delaying any side-effects until the load becomes non-speculative.

###  II-B Speculation Invariance: InvarSpec

InvarSpec is not itself a speculative side-channel defense but rather a
framework that detects when a speculative instruction becomes _speculation
invariant_ and upon detection lifts any existing protections for the
instruction [17]. InvarSpec consists of two main parts. The first part is a
compiler technique that after static analysis generates a _safe set_ (SS) for
the instructions. The second part is a hardware mechanism that at runtime
designates an _execution-safe point_ (ESP) according to the SS.

An example of speculation invariance is shown in Figure 1, where a (instr3)
has a potential data dependence with instr2, and instr2 has a control
dependence with instr1. In order for instr3 to become speculation invariant,
it must reach its execution safe point, meaning both instr1 and instr2 must
reach their _outcome safe point_. Since instr4 has no data nor control
dependencies with any other instruction (its SS is empty) it can execute
immediately.

⬇

1if(cond){ // instr1

2 si = load i; // instr2

3}

4a = load si; // instr3

5b = load j; // instr4

(a) Source Code

(b) Instruction dependence graphs

Figure 1: Dependences related to safe set (SS)

Each instruction has its safe set (SS) defined by the compiler and corresponds
to the instruction’s control and data dependencies on the instructions in the
set [17].

The SS is used to determine at run-time when an instruction is ready and safe
to execute during speculative execution.

An instruction is considered to be speculation invariant when it reaches its
execution-safe point (ESP). To reach the ESP, the operands of an instruction
must have been finalized. Older instructions that comply with these rules are
said to have reached their outcome-safe point (OSP), meaning that their final
result will not change, no matter how many future squashes may happen. When
everything in the safe set reaches the outcome-safe point, the instruction
itself has reached the execution-safe point and the speculative side-channel
defense mechanisms can be lifted for the instruction to be executed, even if
the speculation has not be verified.

Figure 2 shows the timeline of an instruction using InvarSpec framework. As a
reminder, an instruction is said to have reached its ESP when all its operands
reach their OSP. Once the instruction is ready to be executed, even if the
speculation has not been resolved, the defense mechanisms are lifted and the
instruction executes.

Figure 2: Speculation Invariant Timeline: For instr3 to be considered
speculation invariant, instr2 and instr1 must reach their OSP. Instr4 has no
dependences, and executes immediately under speculation using InvarSpec
framework.

###  II-C Backward Speculative Interference

Speculative Interference attacks [6] are able to break defense mechanisms
similar to DoM and InvisiSpec. Even though speculative loads are executed
invisibly, misspeculated instructions can change the timing of older
instructions that _may be outside the protection of DoM or InvisiSpec as non-
speculative instructions_. This change can influence the ordering of memory
operations that will be committed, setting the fundamentals for a possible
attack.

The attack consists of three parts:

  1. 1.

A bound-to-commit instruction —the _interference target_ — waiting to be
executed.

  2. 2.

A branch predictor that is trained to mispredict, which creates a speculative
window and the opportunity to illegally access some secret data.

  3. 3.

The secret is used in an _interference gadget_ in such a way that the
interference target is delayed in a secret-dependent manner.

For example, assume that the interference target is a load that takes $X$
cycles before its operand becomes ready. The interference gadget can then use
the secret value to selectively add contention in the MSHRs. For example, if
the secret is equal to 1, the interference gadget attempts to fill all MSHR
entries before the interference target is ready to execute. Otherwise, if the
secret is equal to 0, no memory operations are performed by the interference
gadget.

Once the interference target becomes ready to execute, if the secret was 1 it
will be further delayed, otherwise, if the secret was 0, it will be executed
unhindered. This difference in behavior can lead to information leakage as it
can affect the order of the interference target with respect to other loads,
and thus affect the cache replacement state.

##  III ROB-contention: an FSI attack that breaks Speculative Invariance

Speculation invariance allows (bound-to-commit) speculative instructions to be
executed without defenses before the speculation is verified. In this respect,
speculation-invariant instructions behave the same as the corresponding
instructions in an unprotected processor. In this work, we demonstrate our
attack on an unprotected processor and then argue that the same attack can be
used to leak information on a processor that implements InvarSpec.

In _Backward Speculative Interference_ , the interference gadget delays the
execution of the interference target, a bound-to-commit instruction that is
placed _prior_ to the speculation. In _Forward Speculative Interference_ , the
interference gadget instead interferes with a bound-to-commit speculation-
invariant instruction, which is executed _while still under speculation_ ,
unprotected by defense mechanisms like DoM [11] or InvisiSpec [13].

⬇

1interference_target;

2// mispredict

3if(cond){

4 interference_gadget;

5}

(a) Backward

⬇

1// mispredict

2if(cond){

3 interference_gadget;

4}

5interference_target;

(b) Forward

Figure 3: Speculative Interference Attacks

While FSI can take many forms, in this paper we introduce a novel side-channel
based on manipulating ROB contention. To the best of our knowledge, this has
not been explored previously. The ROB side-channel can be used to construct
new Spectre [8] variants on unprotected processors, but more importantly, it
can break InvarSpec approaches [17] that selectively lift defenses of
instructions under speculation. Assuming DoM as the underlying defense
mechanism—other defenses, such as InvisiSpec, are similarly susceptible—an FSI
ROB-contention attack consists of three parts:

  1. 1.

A branch predictor that is trained to follow the attack path.

  2. 2.

A secret that is read from the cache (allowed in DoM) and ROB contention, as a
function of the secret value, is added.

  3. 3.

A speculation-invariant target instruction that resides just after the
reconvergence point and that is executed with the DoM protections _lifted_. We
initialize the speculation-invariant instruction with an empty safe set, i.e.,
a set that has no dependencies and can execute immediately when it becomes
ready.

Depending on the contention-induced delay, and thus on the secret value, the
speculation invariant target instruction will be affected in terms of _when it
will be ready to execute_. For example, when the secret is equal to 1, we add
extra ROB contention, in the form of a loop or a long sequence of spurious
instructions. As a result, the ROB is filled with speculative instructions,
which prevents the speculation-invariant target instruction from even entering
the ROB and executing. On the other hand, the path followed when the secret is
0 behaves normally, enabling the speculation-invariant target instruction to
execute when it enters the ROB. Since InvarSpec has lifted the defenses from
the instruction, any side-effects caused by its execution will remain
observable even after the misspeculation has been detected and squashed,
making it possible to infer the secret value outside of the speculative
window.

While the FSI ROB-contention attack shares some similarities with the
${G^{I}}_{RS}$ speculative interference attack, described by Behnia et al.
[6], it is distinctly different in a number of ways: First, in contrast to
${G^{I}}_{RS}$, ROB-contention manipulates the execution of bound-to-commit
loads (which lie after the reconvergence point) rather than instruction fetch.
As such, ROB-contention directly affects mitigations such as DoM or InvisiSpec
(when combined with InvarSpec) that aim to protect _data caches_ from leaking
information, which is not a concern with ${G^{I}}_{RS}$: ${G^{I}}_{RS}$ uses
the instruction cache as a side-channel—ROB-contention uses the data cache.
Second, ${G^{I}}_{RS}$ must cause a front-end stall to work. ROB-contention
works as long as a target instruction is kept just outside the ROB, which does
not necessarily mean a front-end stall. For example, if the target instruction
is sufficiently far from the reconvergence point, the front end will keep
fetching and decoding instructions from the reconvergence point onwards.

(a) FSI v1: Depending on the secret, we influence the execution time of the
speculation-invariant target instruction, hence the latency of the measured
instruction.

(b) FSI v2: Depending on the secret, Ld A and Ld B will be placed either as Ld
B, Ld A or Ld A, Ld B in the cache.

Figure 4: Two techniques to extract the secret.

Two possible techniques to identify the secret, are shown in Figure 4. The
first technique can be thought-of as a version of the _Flush &Reload_ attack
[14]. It is shown in 4(a) and is based on testing if data are cached in the L1
cache or not. To achieve this, we measure the access time of the speculation-
invariant target instruction when the speculation is finally resolved and the
execution continues from the correct path. While on the misspeculated attack
path, whether the load instruction at the reconvergence point will be executed
depends on which path the speculative execution followed, i.e., it depends on
if secret is 0 or 1. Then, on the correct path, the time it takes to execute
the load will change depending on if the data was loaded by the attack path,
thus making it possible to infer the secret value. The second technique
(4(b)), taken from Behnia et al. [6], is similar to the first technique but is
instead based on the relative order of two load instructions, as seen by the
cache, which causes visible changes in the cache replacement state. To do so,
we load another address in the correct path that conflicts with the address
loaded by the speculation-invariant instruction. At a later time, we observe
the cache replacement state to extract the leaked information. We will discuss
both of these techniques, as well as an alternative method (to loops) for
introducing ROB contention in the sections that follow.

###  III-A Measuring Cache Access Time

In this technique (4(a)), we measure the access time of the speculation-
invariant target instruction when we access it during the correct path, once
the speculation is verified as incorrect.

The attack starts by ensuring that the address of the speculation-invariant
target instruction is flushed from the cache. If the secret is equal to 1 then
the speculative-invariant target instruction is never executed along the
incorrect path. Once the speculation is resolved and the correct path is taken
a load with the same address as the speculative-invariant target instruction
will miss in the cache and experience a long delay. If the secret is equal to
0 then the speculative-invariant target instruction is executed in the
incorrect path and the load in the correct path will hit in the cache and
experience a short delay.

###  III-B Observing Replacement State

In this technique (4(b)), we focus on the replacement state of the L1 cache to
leak the information.

Behnia, et al. demonstrate a complete attack based on replacement state [6],
but here, for simplicity, we assume a direct-mapped cache and load addresses
that map to the same set.111Changes in a cache set or in its replacement state
can be easily verified in a simulated environment, e.g., using gem5.

Just as with the previous technique (Section III-A), depending on the secret
our goal is to add ROB contention to affect the speculation-invariant
instruction. Once the branch is resolved as incorrect and continues on the
correct path, another load instruction accesses a different address that
conflicts with the speculation-invariant load instruction on the same cache
set.

If the secret is equal to 1, the speculation-invariant load will be prevented
from executing due to ROB contention. The load instruction from the correct
path will be executed first, taking place in the cache set. After that, the
interference target (speculation-invariant load), will be normally executed,
evicting the load of the normal path from the cache. On the other hand, if the
secret is equal to 0 then the speculation-invariant load will be executed
first, and once the branch is resolved as incorrect, the load from the correct
path will evict the interference target (speculation-invariant load) from the
cache.

###  III-C ROB Attack Using REP Instructions

An FSI ROB-contention attack requires filling the ROB with speculative
instructions. While either a tight loop, or a long sequence of spurious
instructions, fit the bill for this purpose, interestingly, one can achieve
the same result with a _single static instruction_.

In the x86 ISA, REP is a prefix that can be used before string instructions.
It creates a single-instruction loop, with the value stored in the ECX
register acting as the loop counter.

The key property that enables a single REP instruction to affect ROB
contention is that it unrolls as a $\mu$op loop in the microarchitecture, at
_decode time_ [3]. ROB occupancy becomes a function of ECX.

According to empirical studies [3, 4], REP-prefixed x86 instructions expand
into a number of $\mu$ops in the ROB. The following table lists the $\mu$op
expansion (ECX==n) in the ROB for two typical REP instructions and for some
well-known microarchitectures—similar expansion takes place for the majority
of x86 microarchitectures [3].

Instr./Proc. | Haswell | Broadwell | Skylake | IceLake
---|---|---|---|---
rep movs | 2n | 2n | 2n | 2n
rep lods | 5n+12 | 5n+12 | 5n+12 | 5n+12

Furthermore, we ascertain that the REP movs instruction expands
_speculatively_ on a Sandy Bridge microarchitecture. We tested this scenario
by giving ECX various values, after a speculation point, followed by a REP
instruction (as in the code shown in Figure 5). By timing the code, we observe
that the REP instruction, indeed, expands speculatively into a number of
$\mu$ops that is proportional to ECX.

To mount a ROB attack with REP instructions (Figure 5), we use the
speculatively-accessed secret to update the ECX register, which then controls
the number of $\mu$ops that are dispatched to the ROB. To create a large
enough repetition factor, we left-shift the secret by, e.g., ten places (if
the secret is zero, it does not change). This value is passed to ECX which
subsequently drives a REP movs instruction to _selectively_ flood the ROB with
up to $2n$ $\mu$ops.

⬇

1if(value){ // mispredict - Attack Path

2

3 secret = secret << 10; // Repetition factor

4

5 // Pass secret to ECX and execute rep

6 asm("movl␣%0,␣%%ecx" : : "c" (secret));

7 asm("rep␣movsb");

8}

9else { // Normal Path

10 t1 = __rdtscp(); // Start measuring latency

11 transmitter = probe[0]; // Evaluation

12 t2 = __rdtscp(); // End measuring latency

13 t = t2-t1;

14}

15

16transmitter = probe[0]; // Recovergence Point

Figure 5: Abusing InvarSpec with Forward Speculative Interference using REP
Instruction

##  IV Attack Demo and Experimental Results

We implemented our FSI attack on actual hardware. While DoM defenses and
InvarSpec are not implemented, we can see the effects of the attack in an
unprotected core, which behaves the same as a protected core with respect to
speculative-invariant instructions. We evaluated our results on an Intel®
CoreTM i7-2600K, which is a Sandy Bridge microarchitecture, running at up to
3.40GHz. The processor has 4 cores (2 SMT threads per core, for 8 threads in
total) and 3 cache levels. Each core has a 32KiB L1 Cache and a 256KiB L2
Cache, and all cores share an 8MiB LLC. Our source code is written in C, and
we measure the timing of a variable assignment to detect difference in the
correct path as shown below.

⬇

1t1 = __rdtscp(); // Start measuring latency

2transmitter = probe[0]; // Evaluation

3t2 = __rdtscp(); // End measuring latency

4t = t2-t1;

Figure 6: Attack Demo: (1) measure time Ld B, to see if its in cache and
distinguish the secret. (2) determine in Cache if A or B is cached. i.e. in a
direct mapped cache where A and B maps on the same set, if secret==1, B will
evict A from the cache.

The overall structure of the attack demo is illustrated in Figure 6 for two
variants: timing loads and determining the order of loads. We report on the
results for the timing-load variant on a real system. While determining the
order of loads can be easily demonstrated in gem5, on actual systems, this
requires detection code (as in Behnia et al. [6]), which is work in progress.
Before we follow the attack path, all load addresses are flushed from the
cache. The branch predictor is trained so that it will always mispredict and
follow the attack path. The secret value is already cached in the L1.
Depending on the secret, ROB contention is added, so that ld B will be
delayed. If secret==1, delay from ROB contention will be sufficient for
speculation to be verified before ld B executes. If secret==0, no delay is
applied and ld B is executed as soon as possible.

Figure 7: Attack using for-loop to delay the reconvergence point.

###  IV-A Delaying with a for-loop

In this version, we use a for-loop to delay the execution of the reconvergence
point. This is the attack discussed in Section III. The results are shown in
Figure 7. The distribution of all 1000 attempts per secret is presented,
without outliers, in the graph. We show that an average load is equal to 258
cycles, if the secret is equal to 1, and 73 cycles when the secret is equal to
0.

Figure 8: ROB Attack using REP instruction: All 1000 attempts per secret
Figure 9: ROB Attack using REP instruction: Average every 100 attempts

###  IV-B Delaying with REP instruction

In this version, we use a REP instruction to delay the execution of the
reconvergence point. This is the attack discussed in Section III-C. Figure 9
illustrates the average of every 100 attempts. We show, that when repeating
the attack, the results diverge, making it easier to identify the secret: An
average load when secret==0 is 170 cycles. On the other hand, when secret==1
an average load is 260 cycles.

###  IV-C Discussion

Our results show that _forward speculative interference_ and ROB-contention
work successfully in actual processors, and constitute a new side-channel that
can be used to construct Spectre-type attacks. Because the speculation-
invariant instructions behave the same as instructions from the re-convergence
path in unprotected processors, FSI ROB-contention poses a significant threat
when we want to lift defenses for speculation-invariant instructions.

##  V Forward Speculative Interference Mitigations

In this section, we discuss some possible mitigations for the FSI ROB-
contention side-channel. Evaluation of these mitigations is currently work-in-
progress and results will be presented in future versions of this paper. We
propose mitigations that are specific to InvarSpec+DoM, but also more general
mitigations that can be applied to unprotected processors.

#### InvarSpec+DoM Specific Mitigations

To protect against FSI ROB-contention attacks, InvarSpec must be conservative
in declaring instructions as speculation-invariant if they are vulnerable to
ROB-contention. For example, if the compiler can ascertain that the paths to
the reconvergence point can differ in length, it would be prudent _not to_
call instructions after the reconvergence path as speculation-invariant and
take them off DoM protection. This would include the cases described in our
work: i.e., detecting loops or REP instructions in a path would automatically
make that path suspect for ROB-contention as a variable-length path. Note that
this mitigation can only reduce the benefit from InvarSpec but cannot
introduce any overhead to a baseline DoM-protected system. However, because in
most cases paths to reconvergence do differ in length, this may lead to a
dramatic reduction in coverage, i.e., the number of instructions that could be
safely called speculation-invariant. One way to improve coverage is for the
compiler to try to “balance” path-length differences (especially if these are
modest) with padding, which may introduce small overheads in the shorter
paths. We shall examine such options in future work.

#### General Mitigations

Another direction to defend against FSI ROB-contention, independently of
InvarSpec and delay defenses, is to make speculative ROB-filling _operand-
independent_ [15]. In other words, to ensure that the number of $\mu$ops that
enter the ROB cannot be dependent on speculatively-accessed values. Similar to
SDO [15], ROB-filling itself can be turned into a prediction, which can lead
to a squash if mispredicted.

##  VI Conclusion

In this work, we present a new side-channel, based on ROB contention, and a
new speculative execution attack (ROB-contention attack) using this side-
channel. The attack is achieved through _Forward Speculative Interference_ ,
i.e., speculative instructions interfering with _younger_ instructions that
are bound to commit regardless of the speculation outcome. For this reason,
techniques, such as the InvarSpec framework, that lift the defenses for such
bound-to-commit instructions, are susceptible to the same attack and can leak
speculatively accessed information. We demonstrate the ROB-contention attack
on actual cores and show that, indeed, instructions after the reconvergence
point of a control-speculation can leak information accessed during the
control-speculation. To prevent ROB-contention attacks, assuming defenses such
as DoM, we argue that frameworks that selectively lift such defenses must take
into account Forward Speculative Interference and change their tactics. We
propose a number of mitigations that we are in the process of evaluating.

## Acknowledgments

This work was supported by Microsoft Research through its EMEA PhD Scholarship
Programme grant no. 2021-020 and by the Swedish Research Council grants no.
2015-05159 and 2018-05254.

## References

  * [1] P. Aimoniotis, C. Sakalis, M. Själander, and S. Kaxiras, “Reorder buffer contention: A forward speculative interference attack for speculation invariant instructions,” _IEEE Computer Architecture Letters_ , vol. 20, no. 2, pp. 162–165, 2021.
  * [2] S. Ainsworth and T. M. Jones, “Muontrap: Preventing cross-domain spectre-like attacks by capturing speculative state,” in _Proceedings of the International Symposium on Computer Architecture_ , 2020, pp. 132–144. [Online]. Available: https://doi.org/10.1109/ISCA45697.2020.00022
  * [3] F. Anger, “Instruction tables,” May 2021. [Online]. Available: https://www.agner.org/optimize/instruction_tables.pdf
  * [4] ——, “The microarchitecture of Intel, AMD, and VIA CPUs: An optimization guide for assembly programmers and compiler makers,” May 2021. [Online]. Available: https://www.agner.org/optimize/microarchitecture.pdf
  * [5] K. Barber, A. Bacha, L. Zhou, Y. Zhang, and R. Teodorescu, “SpecShield: Shielding Speculative Data from Microarchitectural Covert Channels,” in _Proceedings of the International Conference on Parallel Architectural and Compilation Techniques_ , Sep. 2019, pp. 151–164. [Online]. Available: https://doi.org/10.1109/PACT.2019.00020
  * [6] M. Behnia, P. Sahu, R. Paccagnella, J. Yu, Z. N. Zhao, X. Zou, T. Unterluggauer, J. Torrellas, C. Rozas, A. Morrison _et al._ , “Speculative interference attacks: Breaking invisible speculation schemes,” in _Proceedings of the Architectural Support for Programming Languages and Operating Systems_ , Apr. 2021, pp. 1046–1060. [Online]. Available: https://doi.org/10.1145/3445814.3446708
  * [7] K. N. Khasawneh, E. M. Koruyeh, C. Song, D. Evtyushkin, D. Ponomarev, and N. Abu-Ghazaleh, “SafeSpec: Banishing the Spectre of a Meltdown with Leakage-Free Speculation,” in _Proceedings of the ACM/IEEE Design Automation Conference_ , Jun. 2019, pp. 1–6.
  * [8] P. Kocher, D. Genkin, D. Gruss, W. Haas, M. Hamburg, M. Lipp, S. Mangard, T. Prescher, M. Schwarz, and Y. Yarom, “Spectre attacks: Exploiting speculative execution,” in _Proceedings of the IEEE Symposium on Security and Privacy_ , May 2019, pp. 19–37. [Online]. Available: https://doi.org/10.1109/SP.2019.00002
  * [9] G. Saileshwar and M. K. Qureshi, “CleanupSpec: An ”undo” approach to safe speculation,” in _Proceedings of the ACM/IEEE International Symposium on Microarchitecture_ , 2019, pp. 73–86. [Online]. Available: http://doi.acm.org/10.1145/3352460.3358314
  * [10] C. Sakalis, M. Alipour, A. Ros, A. Jimborean, S. Kaxiras, and M. Själander, “Ghost loads: What is the cost of invisible speculation?” in _Proceedings of the ACM International Conference on Computing Frontiers_ , 2019, pp. 153–163. [Online]. Available: http://doi.acm.org/10.1145/3310273.3321558
  * [11] C. Sakalis, S. Kaxiras, A. Ros, A. Jimborean, and M. Själander, “Efficient invisible speculative execution through selective delay and value prediction,” in _Proceedings of the International Symposium on Computer Architecture_ , 2019, pp. 723–735. [Online]. Available: http://doi.acm.org/10.1145/3307650.3322216
  * [12] M. Taram, A. Venkat, and D. Tullsen, “Context-Sensitive Fencing: Securing Speculative Execution via Microcode Customization,” in _Proceedings of the Architectural Support for Programming Languages and Operating Systems_ , 2019, pp. 395–410. [Online]. Available: http://dl.acm.org/citation.cfm?doid=3297858.3304060
  * [13] M. Yan, J. Choi, D. Skarlatos, A. Morrison, C. W. Fletcher, and J. Torrellas, “InvisiSpec: Making speculative execution invisible in the cache hierarchy,” in _Proceedings of the ACM/IEEE International Symposium on Microarchitecture_ , Oct. 2018, pp. 428–441. [Online]. Available: https://doi.org/10.1109/MICRO.2018.00042
  * [14] Y. Yarom and K. Falkner, “FLUSH+ RELOAD: A high resolution, low noise, l3 cache side-channel attack,” in _Proceedings of the USENIX Security Symposium_ , 2014, pp. 719–732. [Online]. Available: https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/yarom
  * [15] J. Yu, N. Mantri, J. Torrellas, A. Morrison, and C. W. Fletcher, “Speculative data-oblivious execution: Mobilizing safe prediction for safe and efficient speculative execution,” in _Proceedings of the International Symposium on Computer Architecture_ , 2020, pp. 707–720.
  * [16] J. Yu, M. Yan, A. Khyzha, A. Morrison, J. Torrellas, and C. W. Fletcher, “Speculative Taint Tracking (STT): A Comprehensive Protection for Speculatively Accessed Data,” in _Proceedings of the ACM/IEEE International Symposium on Microarchitecture_ , 2019, pp. 954–968. [Online]. Available: http://doi.acm.org/10.1145/3352460.3358274
  * [17] Z. N. Zhao, H. Ji, M. Yan, J. Yu, C. W. Fletcher, A. Morrison, D. Marinov, and J. Torrellas, “Speculation invariance (InvarSpec): Faster safe execution through program analysis,” in _Proceedings of the ACM/IEEE International Symposium on Microarchitecture_ , 2020, pp. 1138–1152. [Online]. Available: https://doi.org/10.1109/MICRO50266.2020.00094