Secure predictor for speculative execution

Abstract

Systems and methods for secure predictors for speculative execution are disclosed. Some embodiments may eliminate or mitigate side-channel attacks in a processor, such as Spectre‑class attacks. For example, an integrated circuit for executing instructions includes a predictor circuit that, when operating in a first mode, generates a prediction using data stored in a set of predictor entries. For example, the integrated circuit may be configured to: detect a security domain transition of software being executed by the integrated circuit; in response to the security domain transition, change a mode of the predictor circuit from the first mode to a second mode and invoke a reset of the set of predictor entries, wherein the second mode prevents use of a first subset of predictor entries in the set of predictor entries; and after completing the reset, change the mode back to the first mode.

Description

Technical Field

[0001] The present disclosure relates to a secure predictor for speculative execution. Background Art

[0002] Side-channel attacks that rely on processor branch prediction and speculative execution have been disclosed. The first of these attacks was originally labeled Spectre for Intel x86 processors, and other variants or classes of these attacks also exist. In short, these attacks rely on training the branch predictor to execute code of the attacker's choice in order to load the target's secret data into cache memory after a process / context and / or privilege level change. The target code used by the attacker may be code from the target process or a shared library, so it is legitimate for the target process to execute that code. After the attacker process regains control of the processor, the attacker can measure the time it takes to read the data from the same location in the cache, thereby determining which target data is present in the cache, and therefore the value of the data in the target process. Mitigating these attacks is important for secure and reliable computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] The present disclosure can be best understood from the following detailed description when read in conjunction with the accompanying drawings. It should be emphasized that, according to common practice, the various features of the drawings are not to scale. Instead, the sizes of the various features are arbitrarily expanded or reduced for clarity.

[0004] Figure 1 is a block diagram of an example of an integrated circuit for executing instructions with a secure prediction.

[0005] Figure 2 is a block diagram of an example of a predictor circuit for security prediction.

[0006] Figure 3 is a block diagram of an example of a system for executing instructions with a secure prediction.

[0007] Figure 4 is a flow diagram of an example of a technique for executing instructions with a secure prediction.

[0008] Figure 5 is a flow chart of an example of a technique for executing instructions with predictions based on a subset of a set of predictor entries during a reset operation of a predictor. DETAILED DESCRIPTION

[0009] Overview

[0010] Embodiments of a secure predictor for speculative execution are disclosed herein. Some embodiments can be used to more effectively eliminate or reduce the likelihood of side-channel attacks (e.g., Spectre-like attacks) on processors (e.g., CPUs such as x86, ARM, and / or RISC-V CPUs) than previously known solutions.

[0011] Systems and methods for secure prediction are disclosed. An integrated circuit (e.g., a processor or microcontroller) may be configured to decode and execute instructions in an instruction set architecture (ISA) (e.g., a RISC V instruction set). The integrated circuit may implement a pipeline architecture. The integrated circuit may include a predictor circuit (e.g., a branch predictor) for improving performance by reducing latency in executing instructions in the pipeline architecture. The predictor circuit accesses prediction data placed in an entry, which may be used to determine a prediction for a corresponding instruction.

[0012] The integrated circuit may be configured to detect when a security domain transition occurs for software being executed by the integrated circuit. For example, the security domain transition may be detected based on implicitly or explicitly decoding instructions associated with the security domain transition. For example, special instructions for indicating security domain boundaries in software may be used, or existing instructions may be interpreted as causing a security domain transition. In some embodiments, the security domain transition may be detected based on receiving an interrupt signal.

[0013] When a security domain transition is detected, the state of the predictor, including a set of predictor entries, may be reset to prevent data in that state from passing information between security domains. Since the state of the predictor may be large and resetting the entire state may require multiple clock cycles to complete, the predictor may be configured to operate in one or more restricted modes to prevent the predictor from generating predictions using predictor entries marked as reset during a time interval specified for the reset operation. For example, in a restricted mode, during a reset time interval, the predictor circuit may be prohibited from generating predictions to facilitate speculative execution. For example, in a restricted mode, the predictor circuit may be configured to generate static predictions that do not depend on the predictor entries during the reset time interval. In some embodiments, the predictor circuit may include a hybrid predictor that may generate predictions based on a subset of its predictor state. For example, in a restricted mode, the predictor circuit may be configured to generate predictions based on a subset of predictor entries, and a disjoint subset of the predictor entries may not be used when reset. In some embodiments, the duration of the time interval of the reset operation is fixed, which may provide benefits such as preventing information leakage through timing variations and / or preventing jitter (e.g., for real-time applications).

[0014] As used herein, the term "circuit" refers to an arrangement of electronic components (e.g., transistors, resistors, capacitors, and / or inductors) configured to implement one or more functions. For example, a circuit may include one or more transistors interconnected to form a logic gate that together implements a logic function.

[0015] As used herein, the term "microarchitectural state" refers to a portion of the state (e.g., data bits) of an integrated circuit (e.g., a processor or microcontroller) that is not directly accessible by software executed by the integrated circuit. For example, the microarchitectural state may include data stored in a cache and / or data stored by a control flow predictor for making predictions about control flow execution.

[0016] Details

[0017] Figure 11 is a block diagram of an example of an integrated circuit 110 for executing instructions with a security prediction. For example, the integrated circuit 110 may be a processor, a microprocessor, a microcontroller, or an IP core. The integrated circuit 110 includes a predictor circuit 120 and a security domain transition detection circuit 130. For example, the predictor circuit 120 may include a value predictor, a memory dependency predictor, a prefetch predictor, a control flow predictor, a branch predictor, a branch history table, a branch target buffer, and / or a return address stack predictor. For example, the predictor circuit 120 may be configured to generate a prediction for speculative execution of the instruction using data stored in one or more entries selected from any of a set of predictor entries when operating in a first mode (e.g., a standard or normal mode). For example, the security domain transition detection circuit 130 may detect when the integrated circuit 110 (e.g., a processor) performs a context switch to a different process, or switches from a user process to an operating system (kernel mode), or switches from an operating system to a virtual machine hypervisor (hypervisor mode). In some embodiments, the security domain transition detection circuit 130 may detect a transition based on decoding of an instruction that is explicitly or implicitly associated with a transition to a security domain. In some embodiments, the security domain transition detection circuit 130 may detect the transition based on receiving an interrupt signal. The predictor circuit 120 includes a predictor reset circuit 140 configured to reset the state of the predictor circuit 120 when the security domain transition detection circuit 130 detects a security domain transition event. For example, the predictor entry set may be stored in whole or in part in SRAM and may require multiple clock cycles to fully reset. When a reset operation is being performed, the predictor circuit 120 may be configured to avoid using some or all of the predictor states scheduled to be reset (e.g., a subset of the predictor entries). For example, during the time interval for performing a reset, the predictor circuit 120 may completely disable prediction, generate a static prediction that does not depend on any predictor entry, or generate a prediction based on a subset of the predictor entry set that has been reset (e.g., a subset of entries that are stored in a flip-flop and can be reset immediately when a security domain transition is detected). For example, the predictor circuit 120 may include a hybrid predictor that can generate predictions using a subset of its predictor entries. In some embodiments, the reset operation may be performed during time intervals of fixed duration, which may prevent information leakage in the form of reset delays and prevent sources of jitter (e.g., to improve performance of real-time applications). For example, the predictor circuit 120 may be implemented as Figure 2 For example, the integrated circuit 110 may be used to implement Figure 4 Technology 400.

[0018] For example, the integrated circuit 110 may be configured to detect a security domain transition for software being executed by the integrated circuit 110 using the security domain transition detection circuit 130, and in response to the security domain transition, change the mode 120 of the predictor circuit from the first mode to the second mode, and invoke a reset of the predictor entry set by inputting a reset signal to the predictor reset circuit 140. The second mode may prevent the predictor circuit 120 from using at least a first subset of the predictor entries in the predictor entry set to generate predictions. The integrated circuit 110 may be configured to change the mode of the predictor circuit to the first mode to restore normal predictions after completing the predictor state reset. In some embodiments, the integrated circuit 110 may be configured to change the mode of the predictor circuit 120 to a third mode in response to partial completion of the reset, the third mode enabling the predictor circuit 120 to use a second subset of the predictor entry set that has been reset while preventing the use of a third subset of the predictor entry set that has not been reset. The second subset and the third subset may be non-empty and disjoint subsets of the first subset. The integrated circuit 110 may be configured to generate predictions based on the predictor entries in the second subset before the reset is completed. In some embodiments, operating in the second mode prevents the predictor circuit 120 from generating predictions. In some embodiments, operating in the second mode prevents the predictor circuit 120 from using all of the predictor entry set and causes the predictor circuit 120 to generate static predictions. In some embodiments, operating in the second mode causes the predictor circuit 120 to generate predictions based on predictor entries in a second subset of the predictor entry set that is disjoint from the first subset of the predictor entries. For example, the predictor circuit 120, when operating in the first mode, may generate predictions based on a combination of a prediction determined based on a second subset of the predictor entry set and one or more predictions determined based on one or more corresponding additional subsets of the predictor entry set that are disjoint from the second set. In some embodiments, the security domain transition detection circuit 130 is configured to detect a security domain transition based on decoding an instruction associated with the security domain transition. In some embodiments, the security domain transition detection circuit 130 is configured to detect a security domain transition based on receiving an interrupt signal. In some implementations, a time interval between invoking reset and changing the mode of the predictor circuit to the first mode has a fixed duration, which may prevent information leakage via the timing of the reset operation and / or reduce or eliminate jitter.

[0019] Figure 22 is a block diagram of an example of a predictor circuit 210 for secure prediction. Prediction circuit 210 includes prediction determination circuit 230; a prediction data table 240 having predictor entries; prediction update circuit 250 and predictor reset circuit 252. For example, prediction determination circuit 230 may be configured to determine a prediction 260 (e.g., a branch prediction or a value prediction) for an instruction based on data in an entry of prediction data table 240 corresponding to the instruction. However, when a secure domain transition has been detected, a predictor reset signal may be input to predictor circuit 210 to cause predictor reset circuit 252 to perform a reset of the predictor entry stored in prediction data table 240, and a prediction mode select signal may be input to predictor circuit 210 to modify the manner in which prediction determination circuit generates prediction 260. For example, changing the mode of predictor circuit 210 may cause prediction 260 to be generated as a static prediction that is not dependent on the predictor entry in prediction data table 240 or prevent prediction 260 from being generated. For example, changing the mode of predictor circuit 210 may cause prediction 260 to be generated by accessing only a subset of predictor entries (e.g., entries stored in flip-flops) in prediction data table 240 that have been reset in an early stage of a reset operation. Figure 4 of Technology 400.

[0020] For example, the predictor circuit 210 may include a branch predictor and the prediction 260 may include a prediction of whether the branch instruction will be adopted. For example, the entry of the prediction data table 240 may include a corresponding counter (e.g., a two-bit saturation counter) reflecting the frequency of the corresponding branch instruction that has been adopted recently. In some embodiments, the predictor circuit 210 includes a branch history table. For example, the entry of the prediction data table 240 may include a corresponding shift register reflecting the branch history of the most recent corresponding branch instruction. For example, the entry of the prediction data table 240 may be indexed by a program counter. In a first mode (e.g., a standard or normal mode), the prediction determination circuit 230 may be configured to determine the prediction 260 for the instruction based on the data in the entry of the prediction data table 240 corresponding to the instruction. For example, if the saturation counter in the corresponding entry of the prediction data table 240 is above a threshold, the prediction 260 for the branch instruction may be "adopted". For example, in a second mode (e.g., a restricted reset mode), the prediction determination circuit 230 may be configured to determine the prediction 260 for the instruction as a static prediction. For example, in the second mode (eg, restricted reset mode), prediction determination circuitry 230 may be configured to determine prediction 260 for the instruction based on data from a subset of the set of predictor entries that have been reset in an early stage of a reset operation and are available for safe use.

[0021] The prediction update circuit 250 is configured to update the prediction data table 240 after executing an instruction. For example, when a branch instruction is taken, the prediction update circuit 250 may increment a saturation counter in the entry of the prediction data table 240 corresponding to the branch instruction. For example, when a branch instruction is not taken, the prediction update circuit 250 may decrement a saturation counter in the entry of the prediction data table 240 corresponding to the branch instruction.

[0022] Predictor reset circuit 252 may be configured to perform a reset operation on a set of predictor entries stored in prediction data table 240. For example, when a security domain transition is detected, the predictor circuit may receive a predictor reset signal from the detector circuit, which may cause predictor reset circuit 252 to initiate a reset of the predictor entries in prediction data table 240. For example, some or all of the predictor entries of prediction data table 240 may be stored in SRAM. Resetting (e.g., setting the entry value to zero or some other default or initial value) all predictor entries may require multiple clock cycles. For example, a full reset operation may be performed by predictor reset circuit 252 during a time interval spanning multiple clock cycles. In some embodiments, some predictor entries of prediction data table 240 may be stored in flip-flops or registers, which may be cleared or reset within a single clock cycle when a predictor reset signal is received. For example, a subset of predictor entries stored in flip-flops may be cleared within the first clock cycle after receiving the predictor reset signal, while another disjoint subset of predictor entries stored in SRAM may be reset over the course of a longer time interval (e.g., using a series of writes to different portions of the SRAM).

[0023] Figure 3 is a block diagram of an example of a system 300 for executing instructions with a security prediction. System 300 includes a memory 302 storing instructions and an integrated circuit 310 configured to execute the instructions. For example, integrated circuit 310 may be a processor, a microprocessor, a microcontroller, or an IP core. Integrated circuit 310 includes interconnect interface circuitry 312; a cache 314; an instruction decode buffer 320 configured to store instructions fetched from memory 302; an instruction decoder circuit 330 configured to decode instructions from instruction decode buffer 320 and pass corresponding microinstructions to one or more execution resource circuits (340, 342, 344, and 346) for execution; a predictor circuit 350; and a security domain transition detection circuit 360. For example, predictor circuit 350 may be implemented as Figure 2 For example, the integrated circuit 310 may be configured to implement Figure 4 Technology 400.

[0024] The interconnect interface circuit 312 (e.g., bus interface circuit) is configured to transmit and receive data to and from external devices including the memory 302. For example, the interconnect interface circuit 312 can be configured to fetch instructions from the memory 302 and store them in the instruction decode buffer 320 while the instructions are processed by the pipeline architecture of the integrated circuit 310. For example, the interconnect interface circuit 312 can be configured to write data generated by executing the instructions to the memory 302 during the write-back stage of the pipeline. For example, the interconnect interface circuit 312 can fetch a block of data (e.g., an instruction). The interconnect interface circuit 312 can be configured to use the cache 314 to optimize data transfer.

[0025] Integrated circuit 310 includes an instruction decode buffer 320 configured to store instructions fetched from memory 302 while they are decoded for execution. For example, instruction decode buffer 320 may have a depth (e.g., 4, 8, 12, 16, or 24 instructions) that facilitates the pipeline and / or superscalar architecture of integrated circuit 310. The instructions may be members of an instruction set supported by integrated circuit 310 (e.g., a RISC V instruction set, an x86 instruction set, an ARM instruction set, or a MIPS instruction set).

[0026] Integrated circuit 310 includes one or more execution resource circuits (340, 342, 344, and 346) configured to execute instructions or microinstructions to support an instruction set. For example, the instruction set may be a RISC V instruction set. For example, one or more execution resource circuits (340, 342, 344, and 346) may include an adder, a shifter (e.g., a barrel shifter), a multiplier, and / or a floating point unit. One or more execution resource circuits (340, 342, 344, and 346) may update the state of integrated circuit 310 based on the result of executing the instruction, including internal registers and / or flags or status bits ( Figure 3 The results of the execution of the instructions may also be written to the memory 302 (eg, during a subsequent stage of pipeline execution).

[0027] Integrated circuit 310 includes instruction decoder circuit 330 configured to decode instructions in instruction decode buffer 320. Instruction decode buffer 320 may use one or more execution resource circuits (340, 342, 344, and 346) to convert instructions into corresponding microinstructions that are executed internally to integrated circuit 310. Instruction decoder circuit 330 is configured to use predictions from predictor circuit 350 to schedule instructions for execution and implement speculative execution.

[0028] Integrated circuit 310 includes predictor circuit 350, which is configured to generate predictions to enable speculative execution. Predictor entries of predictor circuit 350 may store data (e.g., counters) for determining predictions for instructions (e.g., branch instructions). For example, predictor circuit 350 may include a value predictor, a memory dependency predictor, a prefetch predictor, a control flow predictor, a branch predictor, a branch history table, a branch target buffer, and / or a return address stack predictor. For example, predictor circuit 350 may be configured to use data stored in one or more entries selected from any of a set of predictor entries to generate predictions for speculative execution of instructions when operating in a first mode (e.g., a standard or normal mode). Predictor circuit 350 may support a reset of a set of predictor entries, which may be invoked when a security domain transition occurs in software being executed by integrated circuit 310 to prevent data of the predictor entries from being used as a side channel information leak. Since a reset operation may require more than one clock cycle to complete, the predictor circuit 350 may also support a restrictive mode that prevents the use of predictor entries scheduled for reset during the time interval allocated for performing the reset operation. For example, the predictor circuit 350 may support a restrictive mode that disables the predictor circuit 350 and prevents the generation of predictions during the time interval allocated for resetting the predictor state. For example, the predictor circuit 350 may support a restrictive mode that causes the predictor circuit 350 to generate static predictions during the time interval allocated for resetting the predictor state. For example, the predictor circuit 350 may support a restrictive mode that causes the predictor circuit 350 to generate predictions using only a subset of the predictor entries that have been reset during the early stages of the reset operation. In some embodiments, the predictor circuit 350 is a hybrid predictor that is configured to generate predictions based on one or more subsets of a set of predictor entries. For example, the predictor circuit 350 may combine predictions from multiple respective subsets of predictor entries using a majority voting scheme, a fixed hierarchy or priority of subsets, a meta-prediction that selects predictions from available subsets, or based on prediction confidence scores for predictions generated using respective subsets. For example, these hybrid schemes may be used to determine reasonable predictions when portions of the set of predictor entries are unavailable during a reset operation.

[0029] Integrated circuit 310 includes security domain transition circuit 360, which is configured to detect when software being executed by integrated circuit 310 changes from one security domain to another security domain. For example, when integrated circuit 310 performs a context switch to a different process, or receives an interrupt, or switches from a user process to an operating system, or switches from an operating system to a virtual machine hypervisor, security domain transition detection circuit 360 can detect the transition. In some embodiments, security domain transition detection circuit 360 can detect security domain transition based on decoding (e.g., using instruction decoder circuit 330) instructions associated with security domain transition. The decoded instructions can be explicitly or implicitly associated with the transition of security domains. For example, the decoded instructions can be special instructions whose explicit purpose is to signal the intention of the software writer to enforce the security domain boundary just before or after the instruction. For example, the instruction can be a procedure call or return instruction implicitly associated with a security domain transition. In some embodiments, security domain transition detection circuit 360 can detect security domain transition based on receiving an interrupt signal. When a security domain transition is detected, the security domain transition detection circuit 360 may issue a mode selection signal and / or a reset signal to the predictor circuit 350 .

[0030] For example, the integrated circuit 310 may be configured to detect a security domain transition for software being executed by the integrated circuit 310 using the security domain transition detection circuit 360, and in response to the security domain transition, change the mode 350 of the predictor circuit from the first mode to the second mode and invoke a reset of the predictor entry set. The second mode may prevent the predictor circuit 350 from using at least a first subset of the predictor entries in the predictor entry set to generate predictions. The integrated circuit 310 may be configured to change the mode of the predictor circuit to the first mode to restore normal predictions after the reset is completed. In some embodiments, the integrated circuit 310 may be configured to change the mode of the predictor circuit 350 to a third mode in response to partial completion of the reset, which enables the predictor circuit 350 to use a second subset of the predictor entry set that has been reset, while preventing the use of a third subset of the predictor entry set that has not been reset. The second subset and the third subset may be non-empty and disjoint subsets of the first subset. The integrated circuit 310 may be configured to generate predictions based on the predictor entries in the second subset before the reset is completed. In some embodiments, operating in the second mode prevents the predictor circuit 350 from generating predictions. In some embodiments, operating in the second mode prevents the predictor circuit 350 from using all of the predictor entries in the set and causes the predictor circuit 350 to generate static predictions. In some embodiments, operating in the second mode causes the predictor circuit 350 to generate predictions based on predictor entries in a second subset of the set of predictor entries that is disjoint from the first subset of predictor entries. For example, the predictor circuit 350, when operating in the first mode, may generate predictions based on a combination of predictions determined from the second subset of the set of predictor entries and one or more predictions determined from one or more corresponding additional subsets of the set of predictor entries that are disjoint from the second set. In some embodiments, the security domain transition detection circuit 360 is configured to detect a security domain transition based on decoding an instruction associated with the security domain transition. In some embodiments, the security domain transition detection circuit 360 is configured to detect a security domain transition based on receiving an interrupt signal. In some implementations, a time interval between invoking reset and changing the mode of the predictor circuit to the first mode has a fixed duration, which may prevent information leakage via the timing of the reset operation and / or reduce or eliminate jitter.

[0031] Figure 4is a flow chart of an example of a technique 400 for executing instructions with a security prediction. Technique 400 includes detecting a security domain transition for software being executed by an integrated circuit (410); in response to the security domain transition, invoking a reset of a set of predictor entries (420) and changing a mode of a predictor circuit from a first mode to a second mode (430); during a reset time interval, continuing to execute the predictor circuit using one or more restriction modes to restrict access to the predictor entries (440); and after completing the reset, changing the mode of the predictor circuit to the first mode (450), and continuing to execute using the first mode with full access to the predictor entries (460). For example, the predictor circuit may include a control flow predictor, a value predictor, a branch predictor, a branch history table, a branch target buffer, and / or a return address stack predictor. For example, the predictor circuit may be used Figure 1 The integrated circuit 110 can be used to implement the technique 400. For example, Figure 2 The predictor circuit 210 of FIG. 4 can be used to implement the technique 400. For example, Figure 3 The system 300 implements the technique 400.

[0032] Technique 400 includes detecting a security domain transition (410) for software being executed by an integrated circuit (e.g., integrated circuit 310), the integrated circuit including a predictor circuit configured to generate a prediction for speculative execution of an instruction using data stored in any selected one or more entries from a set of predictor entries when operating in a first mode (e.g., standard or normal standard). In some embodiments, the security domain transition (410) can be detected based on decoding instructions associated with the security domain transition. For example, special instructions that can be used to explicitly indicate security domain boundaries in software can be decoded. For example, instructions that serve another purpose (e.g., procedure call or return instructions) can be implicitly associated with a security domain transition, and the security domain transition (410) can be detected based on decoding one of these implicitly associated instructions. In some embodiments, the security domain transition (410) is detected based on receiving an interrupt signal. For example, certain interrupts may be associated with security domain transitions, or all interrupts may be associated with security domain transitions. In some implementations, a security domain transition (410) is detected based on decoding the instruction and also based on an internal state of an integrated circuit (e.g., a processor) associated with the security domain transition. For example, the security domain transition (410) can be detected based on decoding or executing an exception return instruction and based on a privileged mode of a destination having a value associated with the security domain transition, where the processor state records which privileged mode to return to.

[0033] When a security domain transition has been detected (at operation 415), technique 400 includes, in response to the security domain transition, changing a mode of the predictor circuit from a first mode to a second mode (430) and invoking a reset of the predictor entry set (420). The second mode may prevent the predictor circuit from using at least a first subset of the predictor entries in the predictor entry set to generate predictions. For example, operating in the second mode may prevent the predictor circuit from generating predictions. For example, operating in the second mode may prevent the predictor circuit from using all of the predictor entries in the predictor entry set and may cause the predictor circuit to generate static predictions. In some embodiments, operating in the second mode causes the predictor circuit to generate predictions based on predictor entries in a second subset of the predictor entry set that is disjoint from the first subset of the predictor entries. For example, the predictor circuit may include a hybrid predictor that is capable of generating predictions based on one or more subsets of the predictor entries included in its predictor state. For example, the predictor circuit may combine predictions from multiple corresponding subsets of predictor entries using a majority voting scheme, a fixed hierarchy or priority of subsets, a meta-prediction that selects predictions from available subsets, or based on prediction confidence scores for predictions generated using corresponding subsets. In a normal mode, the predictor circuit may generate predictions by combining predictions based on multiple subsets of a set of predictor entries. For example, the predictor circuit, when operating in a first mode, may generate predictions based on a combination of predictions determined based on a second subset of the set of predictor entries and one or more predictions based on one or more corresponding additional subsets of the set of predictor entries that are disjoint from the second set. For example, in a second mode (e.g., a restricted mode), the predictor circuit may be configured to determine predictions based only on one or more subsets of predictor entries as they become available during a reset operation.

[0034] Technique 400 includes continuing execution of the predictor circuit using one or more restricted modes that restrict access to predictor entries during the reset time interval (440). For example, continuing execution of instructions (440) can include facilitating speculative execution using predictions determined by the predictor circuit operating in the second mode. In some embodiments, when operating in the second mode, the predictor circuit does not generate predictions, and execution continues (440) without the benefit of speculative execution until the reset operation is complete. For example, Figure 5 The technique 500 may be implemented to utilize additional portions of the predictor entry set as they become available during a reset operation to improve the performance of the predictor to continue speculative execution (440).

[0035] When the reset is complete (at operation 445), technique 400 includes changing the mode of the predictor circuit to a first mode (e.g., a standard or normal mode) after the reset is complete (450). In some embodiments, the time interval between invoking the reset (420) and changing the mode of the predictor circuit to the first mode (450) has a fixed duration. Limiting the time interval to have a fixed duration can provide benefits, such as preventing information leakage across security domain boundaries in the form of timing information and / or preventing sources of jitter (e.g., for real-time applications).

[0036] After the mode of the predictor circuit has been changed back to the first mode (e.g., standard or normal mode) (450), technique 400 includes continuing execution using the first mode with full access to the predictor entries (460). After a period of continued execution (460) with prediction updates (e.g., using prediction update circuit 250), the predictor state including the set of predictor entries may stabilize and converge to useful values ​​adjusted to conditions within the new security domain. Figure 5 is a flow chart of an example of a technique 500 for executing instructions with predictions based on a subset of a set of predictor entries during a reset operation of a predictor.

[0037] Figure 5 1 is a flow chart of an example of a technique 500 for executing instructions with predictions based on a subset of a set of predictor entries during a reset operation of a predictor. Technique 500 includes, in response to partial completion of the reset, changing a mode of a predictor circuit to a third mode (e.g., an additional less restrictive mode) (510), which enables the predictor circuit to use a second subset of the set of predictor entries that have been reset while preventing use of a third subset of the set of predictor entries that have not been reset. The second subset and the third subset may be non-empty and disjoint subsets of the first subset. Technique 500 includes, before completing the reset, generating predictions based on predictor entries in the second subset (520). For example, technique 500 may be used to utilize additional subsets of predictor entries in a hybrid predictor when these subsets become available during a reset operation.

[0038] In a first aspect, the subject matter described in this specification may be embodied in an integrated circuit for executing instructions, the integrated circuit comprising a predictor circuit configured to, when operating in a first mode, generate predictions for speculative execution of instructions using data stored in any one or more entries selected from a set of predictor entries, wherein the integrated circuit is configured to: detect a security domain transition of software being executed by the integrated circuit; in response to the security domain transition, change a mode of the predictor circuit from the first mode to a second mode and invoke a reset of the set of predictor entries, wherein the second mode prevents the predictor circuit from using at least a first subset of predictor entries in the set of predictor entries to generate predictions; and after the reset is completed, change the mode of the predictor circuit to the first mode.

[0039] In a second aspect, the subject matter described in this specification may be embodied in a method comprising detecting a security domain transition of software being executed by an integrated circuit, the integrated circuit comprising a predictor circuit configured to, when operating in a first mode, generate predictions for speculative execution of instructions using data stored in any one or more entries selected from a set of predictor entries; in response to the security domain transition, changing a mode of the predictor circuit from the first mode to a second mode and invoking a reset of the set of predictor entries, wherein the second mode prevents the predictor circuit from using at least a first subset of predictor entries in the set of predictor entries to generate predictions; and after the reset is completed, changing the mode of the predictor circuit to the first mode.

[0040] While the present disclosure has been described in conjunction with certain embodiments, it should be understood that the present disclosure is not limited to the disclosed embodiments, but on the contrary is intended to cover various modifications and equivalent arrangements included within the purview of the appended claims, the scope of which is to be given the broadest interpretation to encompass all such modifications and equivalent structures permitted by law.

Claims

1. An integrated circuit for executing instructions, comprising: predictor circuitry configured to, when operating in a first mode, generate a prediction for speculative execution of an instruction using data stored in one or more entries selected from any one of a set of predictor entries, wherein the integrated circuit is configured to: detecting a security domain transition of software being executed by the integrated circuit; responsive to the security domain transition, changing a mode of the predictor circuit from the first mode to a second mode and invoking a reset of the set of predictor entries, wherein the second mode prevents the predictor circuit from using at least a first subset of predictor entries in the set of predictor entries to generate predictions; continuing to execute one or more instructions using said second mode for said predictor circuit during at least a portion of a reset time interval between invoking said reset and completion of said reset; responsive to partial completion of the resetting, changing a mode of the predictor circuit to a third mode, the third mode enabling the predictor circuit to use a second subset of the set of predictor entries that have been reset while preventing use of a third subset of the set of predictor entries that have not been reset, wherein the second and third subsets are non-empty and disjoint subsets of the first subset; before completing the resetting, generating a prediction based on predictor entries in the second subset; and After the resetting is completed, the mode of the predictor circuit is changed to the first mode.

2. The integrated circuit according to claim 1, wherein: Operating in the second mode prevents the predictor circuit from generating predictions.

3. The integrated circuit according to claim 1, wherein: Operating in the second mode prevents the predictor circuit from using all of the set of predictor entries and causes the predictor circuit to generate static predictions.

4. The integrated circuit according to claim 1, wherein: Operating in the second mode causes the predictor circuit to generate predictions based on predictor entries in a fourth subset of the set of predictor entries that is disjoint from the first subset of the predictor entries.

5. The integrated circuit according to claim 4, wherein: The predictor circuit, when operating in the first mode, generates a prediction based on a combination of a prediction determined from the fourth subset of the set of predictor entries and one or more predictions from one or more corresponding additional subsets of the set of predictor entries that are disjoint from the fourth subset.

6. The integrated circuit of claim 1, wherein: The integrated circuit is configured to detect a security domain transition based on decoding an instruction associated with the security domain transition.

7. The integrated circuit according to claim 6, wherein: The integrated circuit is configured to detect a security domain transition based on an internal state of the integrated circuit associated with the security domain transition.

8. The integrated circuit of claim 1, wherein: The integrated circuit is configured to detect the security domain transition based on receiving an interrupt signal.

9. The integrated circuit of claim 1, wherein: A time interval between invoking the reset and changing the mode of the predictor circuit to the first mode has a fixed duration.

10. The integrated circuit of claim 1, wherein: The predictor circuit includes a control flow predictor.

11. The integrated circuit of claim 1, wherein: The predictor circuit includes a value predictor.

12. The integrated circuit of claim 1, wherein: The predictor circuit includes a branch history table.

13. The integrated circuit of claim 1, wherein: The predictor circuit includes a branch target buffer.

14. The integrated circuit of claim 1, wherein: The predictor circuit includes a return address stack predictor.

15. A method comprising: detecting a security domain transition of software being executed by an integrated circuit, the integrated circuit comprising a predictor circuit configured to, when operating in a first mode, generate a prediction for speculative execution of an instruction using data stored in one or more entries selected from any one of a set of predictor entries; responsive to the security domain transition, changing a mode of the predictor circuit from the first mode to a second mode and invoking a reset of the set of predictor entries, wherein the second mode prevents the predictor circuit from using at least a first subset of predictor entries in the set of predictor entries to generate predictions; continuing to execute one or more instructions using said second mode for said predictor circuit during at least a portion of a reset time interval between invoking said reset and completion of said reset; responsive to partial completion of the resetting, changing a mode of the predictor circuit to a third mode, the third mode enabling the predictor circuit to use a second subset of the set of predictor entries that have been reset while preventing use of a third subset of the set of predictor entries that have not been reset, wherein the second and third subsets are non-empty and disjoint subsets of the first subset; before completing the resetting, generating a prediction based on predictor entries in the second subset; and After the resetting is completed, the mode of the predictor circuit is changed to the first mode.

16. The method according to claim 15, wherein: Operating in the second mode prevents the predictor circuit from generating predictions.

17. The method according to claim 15, wherein: Operating in the second mode prevents the predictor circuit from using all of the set of predictor entries and causes the predictor circuit to generate static predictions.

18. The method according to claim 15, wherein: Operating in the second mode causes the predictor circuit to generate predictions based on predictor entries in a fourth subset of the set of predictor entries that is disjoint from the first subset of the predictor entries.

19. The method according to claim 18, wherein: The predictor circuit, when operating in the first mode, generates a prediction based on a combination of a prediction determined from the fourth subset of the set of predictor entries and one or more predictions from one or more corresponding additional subsets of the set of predictor entries that are disjoint from the fourth subset.

20. The method according to claim 15, wherein: A security domain transition is detected based on decoding of an instruction associated with the security domain transition.

21. The method according to claim 20, wherein: A security domain transition is detected based on an internal state of the integrated circuit associated with the security domain transition.

22. The method according to claim 15, wherein: The security domain transition is detected based on receiving an interrupt signal.

23. The method according to claim 15, wherein: A time interval between invoking the reset and changing the mode of the predictor circuit to the first mode has a fixed duration.

24. The method according to claim 15, wherein: The predictor circuit includes a control flow predictor.

25. The method of claim 15, wherein: The predictor circuit includes a value predictor.

26. The method of claim 15, wherein: The predictor circuit includes a branch history table.

27. The method of claim 15, wherein: The predictor circuit includes a branch target buffer.

28. The method of claim 15, wherein: The predictor circuit includes a return address stack predictor.

Images