Apparatus and method for controlling the allocation of instructions to instruction cache storage areas

Abstract

A device and method for controlling the allocation of instructions to an instruction cache storage area are provided. The device includes: a processing circuit for executing instructions; an extraction circuit for extracting instructions from a memory for execution by the processing circuit; and an instruction cache storage area for storing instructions extracted from the memory by the extraction circuit. The cache control circuit is responsive to the extraction circuit extracting a target instruction from a memory address determined to be a target address of an instruction stream change instruction, and at least when the memory address is within a specific address range, prevents the extracted target instruction from being allocated to the instruction cache storage area unless the extracted target instruction is at least one specific type of instruction. It has been found that this approach can inhibit the execution of speculation-based cache timing side channel attacks.

Description

Technical Field

[0001] The present disclosure relates to a technique for controlling the allocation of instructions to instruction cache storage areas. Background Art

[0002] A data processing device may support speculative execution of instructions, wherein instructions are speculatively executed before it is known whether the instructions actually need to be executed. For example, a processing device may have a branch predictor for predicting the outcome of a branch instruction so that subsequent instructions may be speculatively fetched, decoded, and executed before it is known what the actual outcome of the branch will be. If the prediction is correct, execution may be saved because the subsequent instructions can be executed more quickly than if the subsequent instructions were only fetched after the outcome of the branch is actually known.

[0003] It has recently been discovered that, in certain circumstances, the allocation of instructions to cache storage during speculative execution of the instructions may open up attacks seeking to identify the source of sensitive data. In particular, information has recently been published regarding speculation-based cache timing side-channel attacks, where a variety of techniques may be used to enable abuse of cache timing analysis to cause information to leak from mis-speculative execution of instructions. Summary of the invention

[0004] In one example configuration, a device is provided that includes: processing circuitry for executing instructions; fetching circuitry for fetching instructions from a memory for execution by the processing circuitry; an instruction cache storage area for storing instructions fetched from the memory by the fetching circuitry; and cache control circuitry that, in response to the fetching circuitry fetching a target instruction from a memory address determined to be a target address of an instruction stream change instruction, blocks allocation of the fetched target instruction to the instruction cache storage area, at least when the memory address is within a particular address range, unless the fetched target instruction is an instruction of at least one particular type.

[0005] In another example configuration, a method of controlling allocation of instructions to an instruction cache storage area for storing instructions fetched from a memory for execution by a processing circuit is provided, the method comprising: in response to fetching a target instruction from a memory address determined to be a target address of an instruction stream change instruction, at least when the memory address is within a specific address range, preventing the fetched target instruction from being allocated to the instruction cache storage area unless the fetched target instruction is at least one specific type of instruction.

[0006] In yet another example configuration, an apparatus is provided, comprising: a processing device for executing instructions; an extracting device for extracting instructions from a memory for execution by the processing device; an instruction cache storage device for storing instructions extracted from the memory by the extracting device; and a cache control device, which, in response to the extracting device extracting a target instruction from a memory address determined to be a target address of an instruction stream change instruction, blocks the extracted target instruction from being allocated to the instruction cache storage device, at least when the memory address is within a specific address range, unless the extracted target instruction is an instruction of at least one specific type. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The present technology will be further described, by way of illustration only, with reference to the examples shown in the accompanying drawings, in which:

[0008] Figure 1 schematically illustrates a data processing device according to an example;

[0009] Figure 2A Schematically illustrates how a particular type of instruction according to one example implementation may be used to indicate that a memory address determined to be a target address of a branch instruction is a legal target address, while Figure 2B shows how, when a target address of a branch instruction identifies an instruction outside of a particular type of instruction, it indicates that the target address is not a legal target address;

[0010] Figure 2C is a flow chart illustrating a branch checking process implemented in one example implementation;

[0011] Figure 3 In more detail, the Figure 1 Components provided within the level 1 instruction cache of ; and

[0012] Figure 4 In one example implementation, Figure 3 Flowchart of the operation of the instruction cache. DETAILED DESCRIPTION

[0013] Recently information has been published about speculation-based cache timing side channel attacks, where a variety of techniques can be used to abuse cache timing analysis to leak information from mis-speculative execution of instructions. The basic principle of a cache timing side channel is that the pattern of allocations to the cache, in particular which cache sets have been used for allocations, can be determined by measuring the time it takes to access previously existing entries in the cache or by measuring the time to access allocated entries. This can then be used to determine which addresses have been allocated into the cache. The novelty of the speculation-based cache timing side channel lies in its use of speculative memory reads. Speculative memory reads are typical of advanced microprocessors and part of the overall function of achieving high performance.

[0014] By performing a first speculative memory read to a cacheable location outside of an architecturally unresolved branch (or other change in program flow), the result of that read can itself be used to form addresses for other speculative memory reads. These speculative reads result in entries being allocated into the cache whose addresses indicate the values ​​of the first speculative read. This may become an exploitable side channel if untrusted code is able to control speculation in a way that results in a first speculative read of a location that is not otherwise accessible to the untrusted code. In particular, the untrusted code can measure the effects of a second speculative allocation and subsequent speculative allocations to the cache.

[0015] Although the various speculative read operations mentioned above may all relate to data values ​​and may therefore result in data being allocated to a data cache, it has been appreciated that it is possible to employ similar techniques in relation to an instruction cache storage area used to store instructions to be executed by processing circuitry. For example, although the first speculative memory read mentioned above may still be used to obtain a sensitive data value allocated to a data cache, that sensitive data may then be used to form an address of an instruction to be fetched, for example, by being used to determine a target address for a branch instruction. Thus, in this case, further speculative memory reads are actually reads of instructions found at a target address derived from the sensitive data, which are then allocated to the instruction cache. In this case, an attacker may then seek to perform a cache timing side channel attack against the instruction cache.

[0016] The techniques described in this paper aim to improve the resilience of the instruction cache memory area against such attacks.

[0017] In an example configuration, a device is provided, the device having a processing circuit for executing instructions, an extraction circuit for extracting instructions from a memory to be executed by the processing circuit, and an instruction cache storage area for storing instructions extracted from the memory by the extraction circuit. Assuming that the extracted instructions come from an address area in the memory that is considered to be cacheable, these instructions will usually be cached in the instruction cache storage area to improve the access time to these instructions thereafter. However, at least when the memory address is within a specific address range, the cache control circuit provided in association with the instruction cache storage area is arranged to be more selective about the instructions allocated to the instruction cache storage area. In particular, in response to the extraction circuit extracting the target instruction from the memory address determined as the target address of the instruction stream change instruction, the cache control circuit performs additional checks before allowing the target instruction to be cached. In particular, the cache control circuit is arranged to prevent the extracted target instruction from being allocated to the instruction cache storage unless the extracted target instruction is at least one specific type of instruction. Therefore, only when the extracted target instruction meets one or more expected types, it is allowed to be allocated to the instruction cache storage area.

[0018] Due to the nature of the attack described above (i.e., deriving addresses from sensitive data), it is unlikely that an attacker would be able to cause a target address to be generated that would identify a particular type of instruction, and therefore when employing the above approach, it is likely that instructions fetched as a result of this attack mechanism will not be allocated into the instruction cache, thereby inhibiting the ability to perform speculative-based cache timing side-channel attacks on the instruction cache.

[0019] Although the above techniques may be limited to certain situations, particularly those where the memory address is within a particular address range, in one implementation, regardless of the memory address from which the target instruction is extracted, the cache control circuitry may be arranged to prevent the extracted target instruction from being allocated to the instruction cache storage unless the extracted target instruction is of at least one of the specific types of instructions mentioned above. This provides a particularly robust solution because the same mechanism applies regardless of the memory address from which the target instruction is extracted.

[0020] In one example implementation, the processing circuit is arranged to execute software that is configured to use the at least one specific type of instruction at each memory address that is a legitimate target address of an instruction flow change instruction. Therefore, in this implementation, the software will be arranged so that various routines that can be branched out via the instruction flow change instruction start with a specific type of instruction. This provides a mechanism for checking that the target address of the instruction flow change instruction is a legitimate target address. It is very likely that when an attack of the type mentioned above is instigated to seek to extract instructions from an address derived from sensitive data, the instruction identified by the target address will not be a specific instruction type and therefore will not be a legitimate target address of the instruction flow change instruction.

[0021] Although this will subsequently be detected by mechanisms employed by the processing circuitry for managing speculative execution, and corrective action taken to restore the processing circuitry to a state prior to speculative execution, without the above techniques, these instructions may still be allocated to the instruction cache, and thus will still be present for any cache timing side channel analysis subsequently initiated. However, by using the above techniques, these instructions will not be allocated to the instruction cache storage area, and thus this will inhibit the ability to perform such cache timing side channel analysis.

[0022] At least one specific type of instruction that is a legal target address of an instruction flow changing instruction can take a variety of forms. However, in one implementation, the specific type of instruction includes a dummy instruction, the purpose of which is to indicate that the target address used by the instruction flow changing instruction to extract the dummy instruction is a legal target address.

[0023] The processing circuitry may be arranged to handle this dummy instruction in a variety of ways, but in one implementation, the processing circuitry is arranged to handle the dummy instruction by performing a no-op. Thus, the dummy instruction does not have any useful processing purpose, but is merely used to indicate that the target address of the instruction flow altering instruction is legal. In a particular implementation, this dummy instruction is referred to as a landing pad instruction, which is an instruction at which the branch is expected to land if the target address derived for the branch is legal.

[0024] From the above discussion, it will be appreciated that when the target address is obtained from data obtained by misspeculation of a load instruction, whenever the extracted target instruction is not an instruction of the at least one specific type, the cache control circuit will prevent the extracted target instruction from being allocated to the instruction cache, thereby suppressing the cache timing side channel attack performed against the instruction cache storage area. The misspeculated execution of the load instruction may, for example, be due to the aforementioned first speculative memory read being executed for a cacheable location outside of an architecturally unresolved branch (or other change in program flow). For example, this may occur when untrusted software passes a data value to trusted software for use as an offset to an array to be accessed by the trusted software. The software code may include an instruction flow change instruction in the form of a bounds checking instruction, so that a read performed at an address derived from a data value passed by the untrusted software is only performed if a bounds checking operation is passed. However, due to speculation, the read operation may be performed before the result of the bounds checking operation is known, and the accessed data may be stored in the data cache.

[0025] In the context of the techniques described herein relating to instruction caches, the case of interest is where data that should not be accessible to untrusted code is then used to generate a target address for an instruction flow altering instruction, and thus causes the instruction to be fetched from a target address that was allocated to the instruction cache. If such instructions were allocated to the instruction cache, then timing analysis can later be performed with respect to instruction execution time to figure out which cache lines were evicted from the instruction cache as a result of the allocations made by speculative execution, which enables address information to be derived, which can then be used to seek to determine the sensitive data value obtained by the original speculative memory read operation.

[0026] However, it is unlikely that the target addresses generated from the sensitive data during this process will identify the specific types of instructions mentioned previously, and therefore, by using the techniques described herein, it is likely that these fetched instructions will not be allocated to the cache, thereby inhibiting the execution of cache timing side-channel attacks.

[0027] It should also be noted that when the branch prediction circuit obtains the target address from the misprediction, whenever the extracted target instruction is not the target instruction of the at least one specific type, the cache control circuit will prevent the extracted target instruction from being allocated to the instruction cache, thereby suppressing the cache timing side channel attack performed against the instruction cache storage area. In the case of a misprediction, the target address is likely to not match the address storing at least one specific type of instruction, so the allocation to the instruction cache will not occur. This is also very useful for suppressing the ability to perform previous types of attacks. In particular, another mechanism that can be used to seek to perform this attack is called a branch target injection variant of the attack. This attack exploits the branch prediction circuit and specifically seeks to use untrusted code to train a specific branch prediction mechanism, thereby affecting the branch prediction made by the trusted code. In particular, the branch prediction mechanism can use the history of previous branches to speculate changes in the instruction flow. The speculation generated may take a considerable amount of time to resolve. The delay in this solution may result in the process of performing speculative memory accesses, resulting in allocations to the cache.

[0028] In some implementations, the history of previous branches used to drive speculation is not filtered through the exception level that the processor is in, so code running at one exception level may train branch predictors in a way that causes other exception levels (or other contexts) to perform speculative memory accesses. This can then be used to simulate speculation-based cache timing side channel attacks by causing lower exception levels to train branch predictors to affect the speculative instruction flow of higher exception levels, or in a different context, read data that would not otherwise be accessible at a lower exception level, and additionally speculatively allocate items into the cache based on that data. Code running at a lower exception level can then examine the impact of cache allocations, thereby exploiting the cache timing side channel.

[0029] This branch target injection variant of the attack can be used to seek to generate a target address for a branch instruction based on sensitive data, thereby seeking to cause allocation to the instruction cache. However, the above mechanism will tend to inhibit such an attack because the instruction identified by the target address generated in this way is unlikely to be of the specific type mentioned previously, and therefore will not be allocated to the instruction cache.

[0030] The instruction flow altering instruction may take a variety of forms, and may be virtually any instruction that causes an instruction flow alteration, ie, a non-incremental adjustment of the instruction address used as a fetch address. However, in one example, the instruction flow altering instruction is a branch instruction.

[0031] The instruction cache storage area to which the above techniques are applied can take a variety of forms. For example, it can be a dedicated cache storage area used only for caching instructions, such as a level 1 instruction cache. However, alternatively or additionally, these techniques can be applied to other types of cache storage areas. For example, the instruction cache storage area can be a cache storage area used to store instructions and data values ​​manipulated by the processing circuit when executing the instructions.

[0032] Specific examples will now be described with reference to the accompanying drawings.

[0033] Figure 1 An example of a data processing device 2 having a processing pipeline including a plurality of pipeline stages is schematically shown. The pipeline includes a branch predictor 4 for predicting the outcome of a branch instruction and generating a series of fetch addresses for instructions to be fetched. A fetch stage 6 fetches instructions identified by the fetch addresses from an instruction cache 8. A decode stage 10 decodes the fetched instructions to generate control information for controlling subsequent stages of the pipeline. A rename stage 12 performs register renaming to map an architectural register designator identified by the instruction to a physical register designator identifying a register 14 provided in hardware. Register renaming is useful for supporting out-of-order execution because it can eliminate hazards between instructions that specify the same architectural register by mapping the instructions to different physical registers in the hardware register file, thereby increasing the likelihood that the instructions can be executed in an order different from the instruction program order in which the instructions were fetched from the cache 8, which can improve performance by allowing a later instruction to be executed while an earlier instruction is waiting for operands to become available. The ability to map architectural registers to different physical registers can also facilitate rollback of architectural state in the event of a branch misprediction. Issue stage 16 queues instructions waiting to be executed until the required operands for processing these instructions are available in registers 14. Execute stage 18 executes the instructions to perform the corresponding processing operations. Writeback stage 20 writes the results of the executed instructions back to registers 14.

[0034] The execution stage 18 may include multiple execution units, such as a branch unit 21 for evaluating whether a branch instruction has been correctly predicted, an arithmetic logic unit (ALU) 22 for performing arithmetic or logic operations, a floating point unit 24 for performing operations using floating point operands, and a load / store unit 26 for performing a load operation to load data from a memory system to a register 14 or a store operation to store data from a register 14 to the memory system. In this example, the memory system includes a level 1 instruction cache 8, a level 1 data cache 30, a level 2 cache 32 shared between data and instructions, and a main memory 34, but it will be appreciated that this is only one example of a possible memory hierarchy and other implementations may have other cache levels or different arrangements. The load / store unit 26 may use a translation lookaside buffer 36, and the fetch unit 6 may use a translation lookaside buffer 37 to map virtual addresses generated by the pipeline to physical addresses identifying locations within the memory system. It should be understood that Figure 1 The pipeline shown is just one example, other examples may have different sets of pipeline stages or execution units. For example, an in-order processor may not have a rename stage 12.

[0035] like Figure 1 This device shown can be used to perform speculative execution of instructions. Speculative execution of instructions by processing circuits before actually knowing whether the inputs to these instructions are correct or whether these instructions need to be fully executed can be very beneficial in providing high processor performance. However, it has recently been recognized that if such speculation causes memory accesses to be speculatively executed, the allocation to the cache triggered by the speculative memory access may still be visible even after the speculative instructions have been resolved as mispredicted or incorrectly speculated and the architectural impact of the speculative re-execution of the instructions has been reversed. This can then allow the subsequently executed code to investigate which data was loaded by the previous code by using the cache timing side channel. The basic principle behind the cache timing side channel is that the allocation pattern to the cache, in particular which cache sets have been used for allocation, can be determined by measuring the time it takes to access entries that were previously in the cache, or by measuring the time to access the allocated entries. This can then be used to determine which addresses have been allocated in the cache.

[0036] Speculation-based cache timing side channels using speculative memory reads have recently been proposed. Speculative memory reads are often part of advanced microprocessors or an overall function to achieve very high performance. These speculative reads result in entries (whose addresses indicate the value of the first speculative read) being allocated to the cache by performing speculative memory reads to cacheable locations outside of architecturally unresolved branches (or other changes in program flow), and further using the results of these reads themselves to form addresses for other speculative memory reads. This may become an exploitable side channel if untrusted code is able to control speculation in such a way that it results in a first speculative read of a location that is not otherwise accessible to the untrusted code, but the untrusted code can measure the effect of a second speculative allocation within the cache.

[0037] As with any form of management software, untrusted software will typically pass data values ​​to be used as offsets into an array or similar structure that will be accessed by trusted software. For example, an application (untrusted) can ask for information about an open file based on a file descriptor ID. Of course, the management software will check that the offset is within the appropriate range before using it, so the software for this example might be written using the following form:

[0038]

[0039] In a modem microprocessor, the processor implementation may often speculatively perform a data access (implied by line 9 of the above code) to establish the value before executing the branch associated with the untrusted_offset_from_user range check (implied by line 7). A processor running this code at a supervisor level (such as an OS kernel or hypervisor) can speculatively load from any location in normal memory accessible to the supervisor level, as determined by the out-of-range value of untrusted_offset_from_user passed by the untrusted software. This is not an architectural problem because the loaded value will be discarded by the hardware if the speculation is incorrect.

[0040] However, advanced processors can use the speculatively loaded values ​​to further speculate. The speculation-based cache timing side channel exploits this further speculation. For example, the previous example can be extended to the following form:

[0041]

[0042] In this example, "value" (which is loaded from memory using the address calculated from arr1->data combined with untrusted_offset_from_user (line 10)) is then used as the basis for further memory accesses (line 13). Therefore, the speculative load of value2 is from an address derived from the data speculatively loaded for value. If the processor's speculative load of value2 causes an allocation to the cache, a standard cache timing side channel can be used to infer a partial address of this load. Since this address depends on the data in value, a side channel can be used to infer partial data of value. By applying this method to different bits of value, the entire data of value can be determined (in many speculative executions). Therefore, untrusted software can access any location accessible to management software by providing an out-of-range amount to untrusted_offset_from_user, and thus, untrusted software can use this method to recover the value of any memory accessible to management software.

[0043] Modem processors have a number of different types of caches, including instruction caches, data caches, and branch prediction caches. This side channel can in principle be stimulated if the allocation of entries in these caches is determined by the value of any portion of some data that has been loaded based on untrusted inputs. Although the example given above considers further speculation in the form of additional data load operations at addresses derived from sensitive data ("value") obtained by the first speculative data load operation, the technique can also be applied to the following situation: the other speculative memory access is a fetch operation that fetches an instruction from the target address of the branch operation; the target address is derived by reference to the sensitive data loaded by the initial data load operation. The attacker may then initiate a cache timing analysis based on instruction execution time, seeking to establish which cache lines have been evicted from the instruction cache by speculative allocations, thereby obtaining information about the addresses, with the goal of deriving the sensitive data. The techniques described herein are intended to make the instruction cache more robust to cache timing analysis attacks based on such actions.

[0044] According to the techniques described herein, cache control circuitry associated with level 1 instruction cache 8 is arranged to utilize a software mechanism for identifying a legitimate target address of a branch instruction to selectively inhibit the allocation of the instruction into the instruction cache. In particular, in one example implementation, Figure 2A and 2B As shown, the software may be written so that each software routine that is a legal target of a branch instruction begins with a specific type of instruction. Figure 2A, it is referred to as a landing pad instruction. Thus, if the target address determined for a branch instruction is a memory address containing a landing pad instruction, then the target address will be determined to be a valid target address. However, conversely, if the target address determined for a branch instruction is a memory address containing any other type of instruction, such as Figure 2B If the load instruction in the example of , it will be determined that the target address is not a legal target address for a branch instruction.

[0045] like Figure 2C As shown, the processing circuitry may perform a branch check operation to check the target address of a branch instruction to prevent execution of any code to which the branch instruction branches, where the code does not begin with a landing pad instruction. In particular, Figure 2C As shown, the processing circuitry determines at step 100 whether a branch has been taken, and when it is determined that a branch has been taken (i.e., execution of the instruction flow altering instruction has caused the fetch address to be discontinuously changed to the determined target address), then the process proceeds to step 105, where it is determined whether the instruction at the target address is a landing pad instruction. If not, the process proceeds to step 110, where execution of the code to which the branch was taken is prevented. This can be accomplished in a variety of ways, but in one example implementation, an exception occurs when the processing circuitry begins executing code at the target of the branch. Therefore, consider Figure 2B , when the processing circuitry reaches the point where it begins executing a load instruction, an exception will be taken and the code beginning with the load instruction will not be executed.

[0046] However, if it is determined at step 105 that the instruction at the target address is a landing pad instruction, then at step 115 the processor will continue to execute the code to which it has been branched.

[0047] The steps taken by the processor to process a landing pad instruction can vary depending on the implementation. However, in one particular implementation, the landing pad instruction is actually a dummy instruction that does not perform any useful processing other than indicating that the target address is a legal target address for a branch. Therefore, when a landing pad instruction is encountered, the processing circuitry will perform a no-op, and processing will then continue with the next instruction in the sequence, Figure 2AIn the example of , this is a load instruction. While the use of landing pad instructions described above can prevent code from being executed at unexpected branch targets, and thereby, for example, address problems associated with executing poorly written code or code execution caused by an attacker seeking to branch to an illegal target address, due to speculative execution of code, it is possible that instructions at the branch target address are cached in the instruction cache. However, in accordance with the techniques described herein, cache control circuitry associated with a level 1 instruction cache is able to selectively inhibit the allocation of instructions into the instruction cache, and in particular when those instructions are fetched at the target address of a branch instruction and are not of a particular instruction type (in the example of ). Figure 2A , will prevent instructions from being allocated into the instruction cache if they are not landing pad instructions.

[0048] Figure 3 Components provided within the level 1 instruction cache 8 according to one implementation are shown in more detail. The instruction cache includes a normal instruction cache storage area 155 for storing cache lines of instructions, and has cache control circuitry 150 for controlling allocation of instructions into the instruction cache area 155 and for performing lookup operations within the instruction cache storage area 155.

[0049] Thus, when the fetch circuitry 6 issues a fetch address to the level 1 instruction cache 8, the cache control circuitry 150 may perform a lookup within the instruction cache storage area 155 to determine whether the desired instruction is within the cache. If so, the instruction may be returned directly to the fetch circuitry, whereas if not, the cache control circuitry 150 will typically initiate a transfer request to the level 2 cache 32 in an effort to obtain the desired instruction. Typically, the cache line of valuable instructions will be returned from the level 2 cache 32 / memory 34 and then allocated to the cache storage area 155 in addition to returning the desired instruction to the fetch circuitry 6. However, as will be seen in reference to Figure 4 As discussed in the flowchart of , this behavior can be modified in certain circumstances to selectively suppress allocation of instructions into instruction cache storage area 155.

[0050] In particular, at step 200, a new fetch request is awaited from the fetch circuitry 6. Once a fetch request is received, then at step 205, the cache control circuitry performs a lookup in the cache storage area 155. It is then determined at step 210 whether a hit has been detected, and if so, the requested instruction is returned to the fetch circuitry 6 at step 215.

[0051] However, if a hit has not been detected, then at step 220 cache control circuitry 150 initiates retrieval of the cache line containing the instruction from a lower level cache / main memory.

[0052] Once the cache line has been retrieved, cache control circuitry 150 determines, at step 225, whether the fetch request indicates the address as a target address for a branch instruction. This may be indicated in a variety of ways, but in one example, as Figure 3 As shown, some form of control flag may be propagated from the fetch circuitry 6 to the instruction cache 8 along with the fetch address to indicate the situation where the fetch address is the target address of a branch instruction.

[0053] If the fetch request does not indicate that the address is the target address of a branch instruction, the process simply proceeds to step 230 where a cache line is allocated into the instruction cache storage area and the requested instruction is returned to the fetch circuitry 6 .

[0054] However, if the fetch request indicates that the address is a target address of a branch instruction, then the process proceeds to step 235 where a further check is performed before deciding whether the cache line should be allocated to the cache. In particular, a determination is made as to whether the requested instruction at the target address specified by the fetch request is a landing pad instruction. To enable this determination to be made, cache control circuitry 150 may include Figure 3 Instruction analysis circuitry 160 is shown to perform some preliminary decoding on the instruction to determine whether it is a landing pad instruction.

[0055] In some implementations, the presence of instruction analysis circuitry 160 within cache control circuitry 150 of level 1 instruction cache 8 may not be required, for example if this preliminary decoding is performed at a lower level cache, and thus this information is available to cache control circuitry 150 as part of the information retrieved from the lower level cache.

[0056] If the retrieved instruction is a landing pad instruction, this indicates that the fetch address is a legitimate target address for a branch instruction, so normal processing can be performed. Therefore, the process proceeds to step 230, where a cache line is allocated into the instruction cache storage area and the requested instruction is returned to the fetch circuit. However, if the retrieved instruction is not a landing pad instruction, then at step 230, the fetch address is returned to the instruction cache storage area. Figure 4 In the illustrated implementation, the cache line of instructions is not allocated into the cache so as not to replace any existing instruction cache contents, but rather only the requested instruction is returned to the fetch circuit 6 at step 240. Thus, as long as the instruction retrieved at the target address of the branch instruction is not a landing pad instruction, no allocation to the instruction cache is made. As this situation is likely to occur when performing an attack of the type mentioned above, this ensures that no relevant instructions are allocated into the instruction cache, and thus the performance of a subsequent cache timing analysis by an attacker seeking to obtain information about sensitive data can be inhibited.

[0057] In one implementation, at step 235, whenever the retrieved instruction is not a landing pad instruction, no allocation is made to the instruction cache. However, if desired, allocation suppression in this manner may be limited to a particular memory address range, such as where the retrieved cache line is located in a page in memory that supports a landing pad. Thus, if the retrieved instruction is not a landing pad instruction and is retrieved from a page in memory that supports a landing pad, no allocation is made to the instruction cache, otherwise an allocation may be made at step 230.

[0058] However, in Figure 4 In the example of , if step 240 is reached, no allocation is made, but in alternative implementations, a slightly different approach may be taken. For example, a decision may be made to allocate the cache line, but mark it as invalid. This may still be useful in cases where the attack scenario of interest is that the attacker seeks to view allocated cache lines rather than evicted cache lines.

[0059] Although the techniques discussed above have been described with reference to the level 1 instruction cache 8, in principle the same techniques can be applied to other levels in the memory hierarchy, for example, to the shared instruction and data level 2 cache 32, so as to prevent instructions from being allocated to the level 2 cache 32 when the situation discussed above with respect to the level 1 instruction cache 8 occurs (i.e., when the fetched instruction at the target address of the branch is not a landing pad instruction).

[0060] In this way, instructions can be prevented from being dispatched to the instruction cache in various misspeculation situations, for example, when a load instruction is misspeculated, or when the branch prediction circuitry performs certain mispredictions.

[0061] In this application, the phrase "configured to..." is used to indicate that an element of a device has a configuration that enables it to perform a defined operation. In this context, "configuration" refers to the arrangement or manner of interconnection of hardware or software. For example, a device may have dedicated hardware that provides a defined operation, or a processor or other processing device may be programmed to perform the function. "Configured to..." does not mean that the elements of the device need to be changed in any way to provide the defined operation.

[0062] Although illustrative embodiments of the present invention have been described in detail herein with reference to the accompanying drawings, it should be understood that the present invention is not limited to these precise embodiments and that various changes, additions and modifications may be made therein by those skilled in the art without departing from the scope and spirit of the present invention as defined by the appended claims. For example, the features of the dependent claims may be combined in various ways with the features of the independent claims without departing from the scope of the present invention.

Claims

1. A device comprising: A processing circuit, the processing circuit is used to execute instructions; fetch circuitry for fetching instructions from memory for execution by the processing circuitry; an instruction cache storage area, the instruction cache storage area being used to store instructions fetched from the memory by the fetch circuit; as well as cache control circuitry, responsive to the fetch circuitry to fetch a target instruction from a memory address determined to be a target address of an instruction stream altering instruction, to prevent allocation of the fetched target instruction to the instruction cache storage region, at least when the memory address is within a particular address range, unless the fetched target instruction is of at least one particular type of instruction, The fetched target instruction is returned to the fetch circuit for execution by the processing circuit, regardless of whether the fetched target instruction is at least one specific type of instruction.

2. The device according to claim 1, wherein: Regardless of the memory address from which the target instruction is fetched, the cache control circuitry is arranged to prevent allocation of the fetched target instruction to the instruction cache storage area unless the fetched target instruction is of the at least one particular type of instruction.

3. The device according to claim 1 or 2, wherein: The processing circuitry is arranged to execute software configured to use the at least one specific type of instruction at each memory address that is a legal target address for an instruction flow altering instruction.

4. The device according to claim 1 or 2, wherein: The at least one specific type of instruction comprises a dummy instruction, the purpose of the dummy instruction being to indicate that the target address used by the instruction flow altering instruction to fetch the dummy instruction is a legal target address.

5. The device according to claim 4, wherein: The processing circuitry is arranged to process the dummy instruction by performing a no-op.

6. The device according to claim 1 or 2, wherein: When the target address is obtained from data obtained by mis-speculative execution of a load instruction, the cache control circuit prevents the fetched target instruction from being allocated to the instruction cache whenever the fetched target instruction is not the at least one specific type of instruction, thereby inhibiting the execution of a cache timing side channel attack performed against the instruction cache storage region.

7. The device according to claim 1 or 2, wherein: When the target address is obtained from an incorrect prediction of a branch prediction circuit, the cache control circuit blocks the fetched target instruction from being allocated to the instruction cache whenever the fetched target instruction is not the at least one specific type of instruction, thereby inhibiting the execution of a cache timing side channel attack performed against the instruction cache storage area.

8. The device according to claim 7, wherein: The misprediction is caused by a branch target injection attack.

9. The device according to claim 1 or 2, wherein: The instruction flow changing instruction is a branch instruction.

10. The device according to claim 1 or 2, wherein: The instruction cache storage area is a cache storage area used only for caching instructions.

11. The device according to claim 1 or 2, wherein: The instruction cache storage area is a cache storage area for storing both instructions and data values ​​manipulated by the processing circuitry when executing the instructions.

12. A method of controlling the allocation of instructions to an instruction cache storage area for storing instructions fetched from a memory for execution by a processing circuit, the method comprising: In response to fetching a target instruction from a memory address determined to be a target address of an instruction flow altering instruction, preventing the fetched target instruction from being allocated to the instruction cache storage area at least when the memory address is within a specific address range unless the fetched target instruction is of at least one specific type of instruction, The fetched target instruction is returned for execution regardless of whether the fetched target instruction is at least one specific type of instruction.

13. A device comprising: A processing device, the processing device is used to execute instructions; fetching means for fetching instructions from a memory for execution by the processing means; an instruction cache storage device, the instruction cache storage device being used to store instructions fetched from the memory by the fetching device; as well as cache control means, the cache control means being configured to, in response to the extracting means extracting a target instruction from a memory address determined to be a target address of an instruction stream change instruction, prevent the extracted target instruction from being allocated to the instruction cache storage means at least when the memory address is within a specific address range, unless the extracted target instruction is of at least one specific type of instruction, The extracted target instruction is returned to the extracting device for execution by the processing device, regardless of whether the extracted target instruction is at least one specific type of instruction.

Images