Multi-level cache security

Patent metadata

Field	Value
Publication number	US-11720495-B2
Application number	US-202016882380-A
Country	US
Kind code	B2
Filing date	May 22, 2020
Priority date	May 24, 2019
Publication date	Aug 8, 2023
Grant date	Aug 8, 2023

Abstract

In described examples, a coherent memory system includes a central processing unit (CPU) and first and second level caches. The CPU is arranged to execute program instructions to manipulate data in at least a first or second secure context. Each of the first and second caches stores a secure code for indicating the at least first or second secure contexts by which data for a respective cache line is received. The first and second level caches maintain coherency in response to comparing the secure codes of respective lines of cache and executing a cache coherency operation in response.

First claim

What is claimed is:

1. A system, comprising:
a central processing unit (CPU) arranged to execute program instructions to manipulate data in at least a first or second secure context, wherein the first and second secure contexts indicate different levels of security;
a first level cache coupled to the CPU to temporarily store data in cache lines for manipulation by the CPU, wherein the first level cache includes a first secure code memory for storing a first-level-cache secure code list of secure codes, wherein each secure code indicates one of the at least first or second secure contexts by which data for a respective cache line is received, and wherein the first level cache includes a first level cache controller; and
a second level cache coupled to the first level cache to temporarily store data in cache lines for manipulation by the CPU, wherein the second level cache includes a second secure code memory for storing a second-level-cache secure code list of secure codes, wherein each secure code indicates one of the at least first or second secure contexts by which data for a respective cache line is received, and wherein the second level cache includes a second level cache controller;
wherein the first level cache controller is configured to send an access request to the second level cache controller, the access request including an address of a selected cache line of data and a secure code indicating the one of the at least first or second secure contexts by which data for the selected cache line was received; and
wherein the second level cache controller is configured to compare the address and the secure code of the access request against a secure code stored in the second level cache for a cache line of data indicated by the address of the access request, and in response to the comparison, execute a cache coherency operation.

2. The system of claim 1 , wherein the second level cache includes a shadow copy of the first-level-cache secure code list of secure codes.

3. The system of claim 2 , wherein the first level cache includes a first level local memory addressable by the CPU.

4. The system of claim 3 , wherein the second level cache includes a second level local memory addressable by the CPU.

5. The system of claim 4 , comprising a requestor coupled to the second level cache and arranged to send a coherence read transaction to the second level cache controller, wherein the coherence read transaction includes an address of a cache line of data addressable by the CPU and the secure code that indicates the one of the at least first or second secure contexts by which data for the cache line addressed by the coherence read transaction was received, wherein the second level cache controller compares the address and the secure code of the coherence read transaction against a secure code stored in the second level cache for a cache line of data indicated by the address of the coherence read transaction, and in response to the comparison being affirmative, the second level cache controller generating a snoop read transaction and sending the snoop read transaction to the first level cache.

6. The system of claim 5 , wherein the requestor is one of a memory management unit (MMU), a streaming engine (SE), and a direct memory access (DMA) controller.

7. The system of claim 4 , comprising a third level cache coupled to the second level cache and arranged to send a snoop transaction to the second level cache controller, wherein the snoop transaction includes an address of a cache line of data addressable by the CPU and the secure code that indicates the one of the at least first or second secure contexts by which data for the cache line addressed by the snoop transaction was received, wherein the second level cache controller compares the address and the secure code of the snoop transaction against a secure code stored in the second level cache for a cache line of data indicated by the address of the snoop transaction, and in response to the comparison being affirmative, the second level cache controller generating a snoop read transaction and sending the snoop read transaction to the first level cache.

8. The system of claim 4 , wherein the CPU is arranged to send a cache maintenance operation (CMO) transaction to the second level cache controller, wherein the CMO transaction includes an address of a cache line of data addressable by the CPU and the secure code that indicates the one of the at least first or second secure contexts by which data for the cache line addressed by the CMO transaction was received, wherein the second level cache controller compares the address and the secure code of the CMO transaction against a secure code stored in the second level cache for a cache line of data indicated by the address of the CMO transaction, and in response to the comparison being affirmative, the second level cache controller generating a snoop read transaction and sending the snoop read transaction to the first level cache.

9. The system of claim 4 , comprising a data memory controller (DMC) coupled to the second level cache and arranged to send a victim write transaction to the second level cache controller, wherein the victim write transaction includes a victim data, an address of a cache line of data addressable by the CPU, and the secure code that indicates the one of the at least first or second secure contexts by which data for the cache line addressed by the victim write transaction was received, wherein the second level cache controller compares the address and the secure code of the victim write transaction against a secure code stored in the second level cache for a cache line of data indicated by the address of the victim write transaction, and in response to the comparison being affirmative, the second level cache controller updating a shadow victim cache with the victim data.

10. The system of claim 4 , comprising a DMA controller coupled to the second level cache and arranged to send a coherence DMA write transaction to the second level cache controller, wherein the coherence DMA write transaction includes an address of a cache line of data addressable by the CPU and the secure code that indicates the one of the at least first or second secure contexts by which data for the cache line addressed by the coherence DMA write transaction was received, wherein the second level cache controller compares the address and the secure code of the coherence DMA write transaction against a secure code stored in the second level cache for a cache line of data indicated by the address of the coherence DMA write transaction, and in response to the comparison being affirmative, the second level cache controller generating a snoop read transaction and sending the snoop read transaction to the first level cache.

11. The system of claim 1 , wherein the secure code is a bit for indicating one of the first and second secure contexts.

12. A method, comprising:
executing program instructions to manipulate data by a CPU in at least a first or second secure context, wherein the first and second secure contexts indicate different levels of security;
temporarily storing data in cache lines of a first level cache for manipulation by the CPU, wherein the first level cache includes a first secure code memory and a first level cache controller;
storing a secure code in a first-level-cache secure code list, wherein each secure code indicates one of the at least first or second secure contexts by which data for a respective cache line is received by the first level cache;
temporarily storing data in cache lines of a second level cache for manipulation by the CPU, wherein the second level cache includes a second secur

Assignees

• Texas Instruments Inc
• Texas Instmments Incorporated

Inventors

• Chachad Abhijeet Ashok
• Thompson David Matthew
• Bhoria Naveen

Classifications

• G06F12/0811 Primary

  with multilevel cache hierarchies · CPC title

• G06F9/467

  Transactional memory (G06F9/528 takes precedence) · CPC title

• G06F12/0828

  with concurrent directory accessing, i.e. handling multiple concurrent coherency transactions · CPC title

• G06F12/0831

  using a bus scheme, e.g. with bus monitoring or watching means · CPC title

• G06F12/1081

  for peripheral access to main memory, e.g. direct memory access [DMA] · CPC title