Method and system for securing instruction caches using cache line locking
AssigneeSamsung Electronics Co., Ltd.
InventorsOnur Aciicmez, Jean-Pierre Seifert, Qingwei Ma, Xinwen Zhang
Life of this patent
Estimating the term…
Abstract
A method and system is provided for securing micro-architectural instruction caches (I-caches). Securing an I-cache involves providing security critical instructions to indicate a security critical code section; and implementing an I-cache locking policy to prevent unauthorized eviction and replacement of security critical instructions in the I-cache. Securing the I-cache may further involve dynamically partitioning the I-cache into multiple logical partitions, and sharing access to the I-cache by an I-cache mapping policy that provides access to each I-cache partition by only one logical processor.
Claims33
A method of instruction cache (I-cache) management, comprising:
- providing security critical instructions to indicate a security critical code section for an I-cache;
- and
- implementing an I-cache locking policy to prevent unauthorized eviction and replacement of security critical instructions in the I-cache;
- wherein implementing the I-cache locking policy further includes:
- for each I-cache entry:
- providing a status value indicating that an instruction in the entry is security critical or non-critical;
- and
- during the selection of I-cache entries to be evicted, checking said status value for each entry to be evicted and selecting entries with non-critical instructions to evict from the I-cache.
A method of instruction cache (I-cache) management, comprising:
- providing security critical instructions to indicate a security critical code section for an I-cache;
- and
- implementing an I-cache locking policy to prevent unauthorized eviction and replacement of security critical instructions in the I-cache;
- wherein
- implementing the I-cache locking policy further includes:
- for each I-cache entry:
- (i) providing a status value indicating that an instruction in the entry is security critical or non-critical, and (ii) providing a process identifier for identifying the process the security instruction belongs to;
- and
- during the selection of I-cache entries to be evicted, checking said status value for each entry to be evicted and selecting entries with non-critical instructions to evict from the I-cache.
An instruction cache system, comprising:
- an instruction cache (I-cache);
- and
- a cache manager configured for implementing an I-cache locking policy to prevent unauthorized eviction and replacement of security critical instructions in the I-cache;
- wherein the cache manager is further configured for implementing the I-cache locking policy including, providing for each I-cache entry a status value indicating that an instruction in the entry is security critical or non-critical, during the selection of I-cache entries to be evicted, checking said status value for each entry and selecting entries with non-critical instructions to evict from the I-cache.
An instruction cache system, comprising:
- an instruction cache (I-cache);
- and
- a cache manager configured for implementing an I-cache locking policy to prevent unauthorized eviction and replacement of security critical instructions in the I-cache wherein the cache manager is further configured for implementing the I-cache locking policy including, providing for each I-cache entry:
- (i) a status value indicating that an instruction in the entry is security critical or non-critical, and (ii) a process identifier for identifying the process the security instruction belongs to, and during the selection of I-cache entries to be evicted, checking said status value for each entry and selecting entries with non-critical instructions to evict from the I-cache.
Dependencies are inferred from the claim text.