Hardware based technique to prevent critical fine-grained cache side-channel attacks

One or more non-transitory computer-readable storage devices having stored thereon instructions which, when executed by a processor, result in operations comprising:

• monitor a plurality of cache lines of a cache of the processor;
• forming, based on one or more S bits, one or more cache line subsets, each of the one or more cache line subsets including a plurality of cache lines shared between a respective one of the plurality of processes and at least one other of the plurality of processes;
• determine whether a context switch in at least one of the plurality of processes has occurred based on a change in a control register indicating a base address of a page table corresponding to a process currently being executed by the processor circuitry;
• and
• responsive to the determination that the context switch has occurred, selectively evict the plurality of cache lines included in the cache line subset associated with the at least one process in which the context switch has occurred.

A computing system, comprising:

• memory circuitry;
• processor circuitry to execute instructions associated with a plurality of processes, the processor circuitry having at least a cache, the cache including at least:
• a plurality of cache lines to store information from the memory circuitry, each cache line including one or more S bits to indicate whether the corresponding cache line is shared between two or more of the plurality of processes;
• and
• cache monitoring and eviction logic to:
• form, based on the S bits, one or more cache line subsets, each of the one or more cache line subsets including a plurality of cache lines shared between a respective one of the plurality of processes and at least one other of the plurality of processes;
• determine whether a context switch has occurred in at least one of the plurality of processes based on a change in a control register indicating a base address of a page table corresponding to a process currently being executed by the processor circuitry;
• and
• responsive to the determination that the context switch has occurred, selectively evict the plurality of cache lines included in the cache line subset associated with the at least one process in which the context switch has occurred.

A computing system, comprising:

• memory circuitry;
• processor circuitry to execute instructions associated with a plurality of processes, the processor circuitry having at least:
• a cache including at least a plurality of cache lines to store information from the memory circuitry;
• and
• cache monitoring and eviction logic to:
• monitor memory access patterns associated with the plurality of processes;
• form one or more cache line subsets, each of the one or more cache line subsets including a plurality of cache lines shared between a respective one of the plurality of processes and at least one other of the plurality of processes;
• determine, based at least on the memory access patterns, a likelihood that a side-channel attack is occurring on at least one of the plurality of processes, wherein the likelihood is based at least in part on whether a change has occurred in a control register indicating a base address of a page table corresponding to a process currently being executed by the processor circuitry;
• and
• responsive to a determination that the likelihood of the side-channel attack occurring on the at least one of the plurality of processes is above a threshold, selectively evict the plurality of cache lines included in the cache line subset associated with the at least one process in which the context switch has occurred.