Cracking Intel Sandy Bridge's Cache Hash Function

TL;DR

This paper uncovers the undocumented hash function used for cache slicing on Intel Sandy Bridge processors, enabling cache partitioning techniques like page coloring that were previously infeasible due to the hash function's secrecy.

Contribution

It introduces a method to crack the cache hash function by analyzing eviction relationships, demonstrating the feasibility of cache partitioning on hashed cache architectures.

Findings

Successfully cracked the cache hash function on Sandy Bridge processors.

Proved cache partitioning via page coloring is possible despite hashing.

Enhanced understanding of cache behavior for security and performance optimization.

Abstract

On Intel Sandy Bridge processor, last level cache (LLC) is divided into cache slices and all physical addresses are distributed across the cache slices using an hash function. With this undocumented hash function existing, it is impossible to implement cache partition based on page coloring. This article cracks the hash functions on two types of Intel Sandy processors by converting the problem of cracking the hash function to the problem of classifying data blocks into different groups based on eviction relationship existing between data blocks that are mapped to the same cache set. Based on the cracking result, this article proves that it's possible to implement cache partition based on page coloring on cache indexed by hashing.