A cache side channel elimination method based on speculative execution
By fine-grained division of unsafe speculative loading ranges and security check mechanisms, the problem of general handling of speculative loading in the prior art is solved, and the cache-side channel elimination of micro-architecture components is achieved without adding to the cache-side channel, reducing hardware overhead and performance losses.
Patent Information
- Application Number
- CN202310442347.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-04-23
- Publication Date
- 2025-08-19
- Estimated Expiration
- 2043-04-23
AI Technical Summary
When the prior art mitigates CPU cache-side channel attacks, there are problems such as speculative loading, the need to add new microarchitecture components and excessive performance overhead.
By fine-grained, unsafe loading ranges are divided, unsafe masks of reordering buffers are set, and security check mechanisms are implemented for filling buffers on rows to prevent unsafe loading from entering the L1 cache and avoiding the establishment of cache-side channels.
It realizes that without adding processor microarchitecture components, effectively eliminates cache-side channels and reduces hardware overhead and performance losses.
Smart Images
Figure CN116663007B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of processor architecture, and in particular relates to a cache side channel elimination method based on speculative execution. Background Art
[0002] Out-of-order execution and speculation are common optimizations used by modern CPUs to improve performance. In out-of-order execution, the CPU doesn't strictly follow the program's instruction sequence. Instead, it preempts later instructions if conditions are met, maximizing the processor's components. Speculative execution, on the other hand, involves the processor speculatively executing instructions. Combined with pipelining and out-of-order execution, it can significantly increase CPU speed. However, branch speculation isn't guaranteed to be completely accurate, and out-of-order execution can also prematurely execute unauthorized instructions. Generally speaking, these incorrectly executed instructions, also known as transient instructions, alter the microarchitectural state they alter, and the processor "undoes" it before committing it to the architectural state. Therefore, programmers only see the correct execution of instructions according to the program flow from an architectural perspective. However, side-channel attacks such as flush+reload and prime+probe demonstrate that information can be leaked through microarchitectural state and behavior. In early 2018, multiple independent security research teams disclosed serious vulnerabilities in modern CPU architectures, including the Spectre and Meltdown attacks, which had a significant impact on the industry and continue to reverberate. Among the ways to exploit these vulnerabilities, side-channel attack technology targeting CPU cache is the main method. Among them, Spectre attack can use speculative execution to change the state of the processor's microarchitecture - the cache, and then leak data through the cache side channel.
[0003] To mitigate attacks that exploit speculative execution, many hardware defense solutions have been proposed. Most of them follow the defense idea of making the microarchitecture state unaffected by speculative execution. For example, by using a speculation buffer, the results of all speculative loads that may cause security issues are stored in this buffer instead of the cache. However, these hardware solutions have three flaws. First, most of them generally regard speculative loads as unsafe loads and try to hide the side effects of all speculative loads. However, not all speculative loads can be exploited to build cache side channels. Second, new microarchitecture components need to be added, which will cause too much additional performance overhead. Third, these methods lack real hardware prototypes. Most defense solutions are only verified through architecture simulation platforms such as Gem5 rather than RTL implementation. Architecture simulation can only provide a partial evaluation of hardware mitigation measures. Summary of the Invention
[0004] In view of the technical problems existing in existing solutions, the present invention provides a cache side channel elimination method based on speculative execution. The method first proposes the concept of unsafe speculative misses (USMs) and gives a fine-grained definition of the scope of unsafe speculative loads. Then, a simple but effective safety check mechanism is set in the line fill buffer to prevent unsafe speculative loads from being reloaded into the L1 cache, thereby preventing the establishment of cache side channels. Based on the RISC-V open source architecture BOOM, the proposed solution is implemented on chipyard with RTL-level precise simulation, and a corresponding FPGA hardware prototype is developed.
[0005] A cache side channel elimination method based on speculative execution includes the following steps:
[0006] Step 1: Fine-grained partitioning of the unsafe speculative load ranges that can be exploited by attackers to construct cache side channels;
[0007] Step 2: Based on the division of the unsafe speculative load range in step 1 and the correspondence between unsafe loads and instructions in the reorder buffer,
[0008] Step 3: According to the corresponding relationship in step 2, set the reorder buffer unsafe mask;
[0009] Step 4: Set a security check mechanism in the line fill buffer to check whether the data passed through is data accessed by unsafe speculative loads;
[0010] Furthermore, the range of unsafe speculative loads that can be exploited by attackers to construct cache side channels is narrowed to speculative loads that result in L1 cache misses, referred to as unsafe speculative misses (USMs).
[0011] Furthermore, the USMs are specifically divided into USMs caused by undetermined branches in the instruction stream, USMs caused by undetermined memory access order, and USMs caused by other exceptions according to different reasons for triggering transient execution.
[0012] Furthermore, detecting the correspondence between unsafe loads and instructions in the reorder buffer, i.e., determining whether instruction-related loads belong to USMs, requires judging based on various information and exceptions returned by the front end, the branch predictor, and the memory access unit.
[0013] Furthermore, the reorder buffer unsafe mask corresponds one-to-one to the instruction entries in the reorder buffer.
[0014] Furthermore, the value of each bit of the reorder buffer unsafe mask is determined by the instructions of all blocks of the corresponding reorder buffer entry.
[0015] Furthermore, the corresponding reorder buffer unsafe mask bit can be set to 0 only when the instruction-related loads of all blocks of the reorder buffer entry do not belong to USMs, otherwise it is 1.
[0016] Furthermore, whether the load associated with the instruction belongs to USMs needs to be determined based on various information and exceptions returned by the front end, the branch predictor, and the memory access unit.
[0017] Furthermore, the security check mechanism only checks data accessed by loads that miss the L1 cache through the line fill buffer.
[0018] Furthermore, after obtaining the missing data requested by the L1 cache, the security check mechanism determines whether the security check mechanism can be passed according to the returned reorder buffer unsafe mask corresponding to the related instruction.
[0019] Furthermore, the data that passes the security check mechanism is filled into the L1 cache by the line fill buffer, and the related instructions can continue to be accessed and executed, while the related loads of the data that fails will be flushed by the processor pipeline.
[0020] Compared with the prior art, the advantages of the present invention are as follows:
[0021] The present invention does not require adding new micro-architecture components to the processor.
[0022] The present invention achieves the effect of eliminating cache side channels based on speculative execution by adding a simple security mechanism to the line fill buffer of a modern out-of-order execution processor, thereby reducing hardware overhead.
[0023] The present invention does not need to hide all side effects of speculative loads, but selectively defers the execution of speculative loads that generate L1 cache misses, thereby eliminating cache side channels based on speculative execution.
[0024] The present invention provides a fine-grained definition of the scope of dangerous speculative loads so as to load loads that are converted to safe ones into the cache hierarchy as early as possible, thereby reducing invalid operations and performance overhead. BRIEF DESCRIPTION OF THE DRAWINGS
[0025] Figure 1 is a schematic diagram of the reorder buffer unsafe mask;
[0026] Figure 2 It is the working structure diagram of the safety mechanism;
[0027] Figure 3It is the simulation experiment result diagram of the safety mechanism. DETAILED DESCRIPTION
[0028] In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention is further described in detail below through specific embodiments and drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.
[0029] Example 1: See Figure 1-Figure 3 , a cache side channel elimination method based on speculative execution, comprising the following steps:
[0030] Step 1: Fine-grained partitioning of the unsafe speculative load ranges that can be exploited by attackers to construct cache side channels;
[0031] Step 2: Based on the division of the unsafe speculative load range in step 1 and the correspondence between unsafe loads and instructions in the reorder buffer,
[0032] Step 3: Set the reorder buffer unsafe mask according to step 2;
[0033] Step 4: Set a security check mechanism in the line fill buffer to check whether the data passed through is data accessed by unsafe speculative loads;
[0034] The range of unsafe speculative loads that can be exploited by attackers to construct cache side channels is narrowed down to speculative loads that result in L1 cache misses, referred to as unsafe speculative misses (USMs).
[0035] The USMs are specifically divided into USMs caused by undetermined branches in the instruction stream, USMs caused by undetermined memory access order, and USMs caused by other exceptions according to the different reasons for triggering transient execution.
[0036] The detection of the correspondence between unsafe loads and instructions in the reorder buffer, i.e., determining whether instruction-related loads belong to USMs, requires determining based on various information and exceptions returned by the front end, the branch predictor, and the memory access unit.
[0037] The reorder buffer unsafe mask corresponds one-to-one to the instruction entries in the reorder buffer.
[0038] The value of each bit of the reorder buffer unsafe mask is determined by the instructions of all blocks of the corresponding reorder buffer entry.
[0039] The corresponding reorder buffer unsafe mask bit can be set to 0 only when the instruction-related loads of all blocks of the reorder buffer entry do not belong to USMs, otherwise it is 1.
[0040] Whether the load associated with the instruction belongs to USMs needs to be determined based on various information and exceptions returned by the front end, the branch predictor, and the memory access unit.
[0041] The safety check mechanism only checks data accessed by loads that miss the L1 cache through the line fill buffer.
[0042] After obtaining the missing data requested by the L1 cache, the security check mechanism determines whether the security check mechanism can be passed according to the returned reorder buffer unsafe mask corresponding to the related instruction.
[0043] The data that passes the security check mechanism is filled into the L1 cache by the line fill buffer, and the related instructions can continue to be accessed and executed. The related loads of the data that fails will be flushed by the processor pipeline.
[0044] Example 2: See Figure 1-Figure 3 ,The present invention mainly includes three aspects: 1) partitioning the range of unsafe speculative loads, determining the loads to be isolated by the ,security mechanism, and the time for isolation; 2) setting an unsafe mask in the reorder buffer to mark ,instruction entries related to unsafe speculative loads; 3) setting a security ,check mechanism in the line fill buffer to check whether the data accessed by ,unsafe speculative loads;
[0045] The technical solutions adopted by the present invention to solve the technical problems mainly include the following contents:
[0046] 1) Division of unsafe speculative loads
[0047] According to the principle of cache side-channel attacks, unsafe speculative loads inevitably result in cache misses. The missing data is then refilled into the L1 cache, creating a difference in data access time and thus leaking secret information. Therefore, the scope of unsafe speculative loads is narrowed to speculative loads that result in L1 cache misses, referred to as unsafe speculative misses (USMs).
[0048] USMs are classified into the following categories based on the reasons for triggering transient execution:
[0049] 1) USMs for undetermined branches in the instruction stream:
[0050] When the branch condition or target address is unknown or predicted but not yet verified, such as branches and jumps, speculative loads following these unresolved branch instructions are USMs. When the result of the speculation can be verified by the processor, if it is on the correct path, the USM can be converted to a safe load, otherwise it will be compressed with the end of the transient execution window.
[0051] 2) Accessing USMs with undetermined memory order
[0052] For store operations with unresolved addresses, also known as read-after-write dependencies, load operations can speculatively bypass stores and execute out-of-order. Speculative loads following store instructions are USMs, but if, after address resolution, it is discovered that the store points to a different address than the speculatively executed load, the USM can be converted to a safe load. Otherwise, it will be compressed with the end of the transient execution window. For some memory models that do not allow store and load operations to be out of order, speculatively executed loads are compressed because they violate the memory model. If older loads are delayed, new loads are executed speculatively. These speculative loads following older loads are USMs. If an invalid message is received after the older loads are executed that violates the model, they will be compressed with the end of the transient execution window. In the opposite case, USMs can be converted to safe loads.
[0053] 3) Other abnormal USMs
[0054] For instructions that may cause exceptions, such as instructions that access unauthorized data, the processor will handle the exception only when they reach the head of the reorder buffer. Therefore, the loads related to subsequent instructions that are speculatively executed during this period are USMs. When the permissions are verified, the processor can check for exceptions. If the verification is abnormal, the transient instructions executed within the time window, namely the related USMs, will be compressed. Otherwise, the USMs can be converted to safe loads.
[0055] 2) Setting the unsafe mask of the reorder buffer
[0056] Each bit of the reorder buffer unsafe mask must correspond one-to-one to the instruction entry in the reorder buffer. Figure 1 This is a diagram of the ROB unsafe mask. The setting of each bit value is determined by the instructions of all blocks in the row. Once the instruction stored in a block may generate USMs, the mask bit corresponding to the ROB entry is 1. i Represents the i-th bit of the reorder buffer unsafe mask, bank unsafe ijIf it is 1, it means that the instruction stored in the jth block of the i-th row of the reorder buffer may generate USMs, otherwise it is 0, that is:
[0057] ROB unsafe mask i =bank unsafe i1 ||bank unsafe i2 ||...||bank unsafe ij
[0058] For the instruction stored in the jth block of the i-th row in the reorder buffer, if it uses the load queue, uses the store queue and is not a fence instruction (a fence instruction can isolate the previous store operation from the subsequent store operation to ensure sequential execution), and is a branch instruction or a jump instruction, it will be considered that it may generate USMs and the bank will be unsafe. ij Initialized to 1, then based on the division of the unsafe speculative load range, the exception information returned by the front end and the memory access unit and the result returned by the branch predictor, the bank unsafe ij Update in a timely manner.
[0059] 3) Setting up the row fill buffer security check mechanism
[0060] After receiving the missing data requested by the L1 cache, the line fill buffer determines whether it can pass the security check mechanism based on the reorder buffer unsafe mask corresponding to the instruction associated with the returned data. Only when the mask bit is 0 can it pass the check and refill the L1 cache. This prevents USMs from changing the state of the L1 cache and prevents the establishment of cache side channels.
[0061] The specific steps are described below with reference to an embodiment.
[0062] Figure 2 This is a schematic diagram of the cache side channel elimination method based on speculative execution applied to an out-of-order execution processor. Taking an undetermined branch in the instruction stream as an example, the main working process includes the following steps:
[0063] 1) Bank unsafe corresponding to the branch instruction or the instruction belonging to the current branch ij They are all initialized to 1, and the mask bit corresponding to the reorder buffer where they are located is 1;
[0064] 2) When the data loaded by the USMs related to these instructions arrives at the line fill buffer and enters the refill phase, the security check mechanism determines that these data cannot be filled into the L1 cache because the unsafe mask of the reorder buffer corresponding to the related instructions is 1;
[0065] 3) When the branch is resolved, that is, the processor can verify whether the speculation is correct, if the verification speculation is wrong, the relevant instructions will be flushed from the pipeline. If the verification speculation is correct, then the USMs can be converted to safe loads, and the bank of its relevant instructions is unsafe. ij will become 0.
[0066] 4) When the bank of all instructions in a row of the reorder buffer is unsafe ij When it becomes 0, the mask bit corresponding to the row can also become 0, so the data loaded by the USMs that have been converted to secure loads can pass the security check and be directly refilled into the L1 cache for continued access by related instructions.
[0067] The following are the simulation results:
[0068] from Figure 3 As we saw in Figure 1, under Base, an attacker can retrieve the secret value. Only accesses to the row corresponding to the secret value hit the cache, taking less than 50 cycles. All other accesses go to main memory, taking much longer than 50 cycles. However, using the security mechanism SpecLFB described in this paper, the attack is successfully blocked. All accesses to all rows must go to main memory, as loads do not change the cache state.
[0069] The above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the same. Those skilled in the art may modify or replace the technical solutions of the present invention with equivalents without departing from the spirit and scope of the present invention. The scope of protection of the present invention shall be based on the claims.
Claims
1. A cache side channel elimination method based on speculative execution, characterized in that: The method comprises the following steps: Step 1: Fine-grained partitioning of the unsafe speculative load ranges that can be exploited by attackers to construct cache side channels; Step 2: Detect the correspondence between the unsafe loads and the instructions in the reorder buffer according to the partition of the unsafe speculative load range in step 1; Step 3: According to the corresponding relationship in step 2, set the reorder buffer unsafe mask; Step 4: Set up a security check mechanism in the line fill buffer to check whether the data passed through is data accessed by unsafe speculative loads; The range of unsafe speculative loads that can be exploited by an attacker to construct a cache side channel in step 1 is narrowed down to speculative loads that cause L1 cache misses, which are called unsafe speculative misses (USMs). The USMs are specifically divided into the following categories according to the reasons for triggering transient execution: USMs caused by undetermined branches in the instruction stream, USMs caused by undetermined memory access order, and USMs caused by other exceptions.
2. The cache side channel elimination method based on speculative execution according to claim 1, characterized in that: In step 2, detecting the correspondence between unsafe loads and instructions in the reorder buffer determines whether the loads associated with the instructions belong to USMs, based on various information and exceptions returned by the front end, branch predictor, and memory access unit.
3. The cache side channel elimination method based on speculative execution according to claim 2, characterized in that: The reorder buffer unsafe mask in step 3 corresponds one-to-one to the instruction entries in the reorder buffer.
4. The cache side channel elimination method based on speculative execution according to claim 3, characterized in that: The value of each bit of the reorder buffer unsafe mask is determined by the instructions of all blocks of the corresponding reorder buffer entry.
5. The cache side channel elimination method based on speculative execution according to claim 4, characterized in that: The reorder buffer unsafe mask bit corresponding to the reorder buffer entry can be set to 0 only when the loads associated with the instructions of all blocks of the reorder buffer entry do not belong to USMs, otherwise it is set to 1.
6. The cache side channel elimination method based on speculative execution according to claim 5, characterized in that: The safety check mechanism in step 4 will only check data accessed by loads that miss the L1 cache through the line fill buffer.
7. The cache side channel elimination method based on speculative execution according to claim 6, wherein: After obtaining the missing data requested by the L1 cache, the security check mechanism in step 4 determines whether the security check mechanism can be passed according to the reorder buffer unsafe mask corresponding to the returned relevant instruction.
8. The cache side channel elimination method based on speculative execution according to claim 7, characterized in that: The data that passes the security check mechanism is filled into the L1 cache by the line fill buffer, and the related instructions continue to be accessed and executed. The related loads of the data that fails will be flushed by the processor pipeline.