Apparatus and method for controlling allocation of information into cache storage

Abstract

An apparatus and method are provided for controlling allocation of information into a cache storage. The apparatus has processing circuitry for executing instructions and for allowing speculative execution of one or more of those instructions. The invention also provides a cache storage having a plurality of entries for storing information for reference by the processing circuitry, and cache control circuitry for controlling the cache storage, the cache control circuitry including a speculative allocation tracker having a plurality of tracking entries. The cache control circuitry is responsive to a speculative request associated with the speculative execution requiring allocation of identified information into a given entry of the cache storage, to allocate a tracking entry in the speculative allocation tracker for the speculative request prior to allowing allocation of the identified information into the given entry of the cache storage. The allocated tracking entry is employed to maintain recovery information sufficient to enable the given entry to be recovered to an initial state existing prior to the identified information being allocated into the given entry. The cache control circuitry is also responsive to detecting a false speculation condition with respect to the speculative request, to employ the recovery information maintained in the allocated tracking entry for the speculative request to recover the given entry in the cache storage to an initial state. Such methods can provide robust protection against speculative based cache timing side-channel attacks while mitigating performance and / or power consumption issues associated with known techniques.

Description

BACKGROUND

[0001] The present disclosure relates to a technique for controlling allocation of information into cache storage.

[0002] Data processing apparatus can support speculative execution of instructions, in which instructions are executed speculatively before it is known whether the instructions actually need to be executed. For example, a processing apparatus can have a branch predictor for predicting the outcome of a branch instruction, so that subsequent instructions can be fetched, decoded and executed speculatively before it is known what the actual outcome of the branch should be. If the prediction is correct, then performance is saved, because the subsequent instructions can be executed faster than if they were only fetched once the outcome of the branch is actually known.

[0003] It has been recognised that, in certain circumstances, allocation of information into cache storage based on speculative execution of instructions can open up sources of attack to attempt to identify sensitive data. For example, information has been published about speculative based cache timing side-channel attacks, in which a variety of techniques can be used so that cache timing analysis can be abused to leak information from the mis-speculative execution of instructions.

[0004] Such attacks can be used to first maliciously train branch predictors so that they can redirect control flow to a part of code that should not be reached under correct execution of the instruction stream ("wrong path"). Then, due to the ability to support out-of-order execution, the instructions within such a wrong path can be executed. Thus, secret data can be read from and written into the cache during such a wrong path execution, and subsequently an attacker can seek to extract secrets from the cache by timing attack analysis. SUMMARY

[0005] In one example arrangement there is provided an apparatus comprising: processing circuitry to execute instructions, the processing circuitry being arranged to permit speculative execution of one or more instructions; cache storage means comprising a plurality of entries for storing information for reference by the processing circuitry; and cache control circuitry for controlling use of the cache storage means, the cache control circuitry comprising a speculative allocation tracker having a plurality of tracking entries; wherein: the cache control circuitry is responsive to a speculative request for identified information to be allocated into a given entry of the cache storage means in association with speculative execution, to allocate a tracking entry of the speculative allocation tracker for the speculative request prior to permitting the identified information to be allocated into the given entry of the cache storage means, and to employ the allocated tracking entry to hold restoration information sufficient to enable the given entry to be restored to an initial state existing prior to the identified information being allocated into the given entry; and the cache control circuitry is further responsive to detecting a false speculation condition in respect of the speculative request, to employ the restoration information held in the allocated tracking entry for the speculative request to restore the given entry in the cache storage means to the initial state.

[0006] In another example arrangement there is provided a method of controlling allocation of information into cache storage means, comprising: providing processing circuitry to execute instructions, the processing circuitry being arranged to permit speculative execution of one or more instructions; arranging the cache storage means to provide a plurality of entries for storing information for reference by the processing circuitry; providing a speculative allocation tracker having a plurality of tracking entries; responsive to a speculative request for identified information to be allocated into a given entry of the cache storage means in association with speculative execution, allocating a tracking entry of the speculative allocation tracker for the speculative request prior to permitting the identified information to be allocated into the given entry of the cache storage means; employing the allocated tracking entry to hold restoration information sufficient to enable the given entry to be restored to an initial state existing prior to the identified information being allocated into the given entry; and responsive to detecting a false speculation condition in respect of the speculative request, employing the restoration information held in the allocated tracking entry for the speculative request to restore the given entry in the cache storage means to the initial state.

[0007] In yet another example arrangement, there is provided an apparatus comprising: processing apparatus for executing instructions, the processing apparatus being for allowing speculative execution of one or more instructions; cache storage apparatus for providing a plurality of entries for storing information for reference by the processing circuitry; and cache control apparatus for controlling use of the cache storage apparatus, the cache control apparatus comprising speculative allocation tracker apparatus for providing a plurality of tracking entries; wherein: in response to a speculative request for allocation of identified information into a given entry of the cache storage apparatus in association with speculative execution, the cache control apparatus is for allocating a tracking entry in the speculative allocation tracker for the speculative request before allowing allocation of the identified information into the given entry of the cache storage apparatus, and for employing the allocated tracking entry to hold restoration information sufficient to enable restoration of the given entry to an initial state existing prior to the identified information being allocated into the given entry; and in response to detecting a mispeculation condition in respect of the speculative request, the cache control apparatus is for employing the restoration information held in the allocated tracking entry for the speculative request in order to restore the given entry in the cache storage apparatus to the initial state. BRIEF DESCRIPTION OF DRAWINGS

[0008] The technology will be further described, by way of example only, with reference to examples of the technology as illustrated in the following drawings in which:

[0009] Figure 1 A data processing apparatus according to one example is schematically illustrated;

[0010] Figure 2 Providing a speculative allocation tracker within cache control circuitry associated with a cache according to one example implementation is illustrated;

[0011] Figure 3 Components that can be provided within a load / store unit of a data processing apparatus according to one example arrangement are illustrated;

[0012] Figure 4A And Figure 4B A format for a tracking entry that can be provided within a speculative allocation tracker according to one example arrangement is illustrated;

[0013] Figure 5 A flow diagram illustrating steps that can be performed by cache control circuitry when processing a memory access instruction according to one example implementation is illustrated;

[0014] Figure 6 A flow diagram illustrating how a tracking entry within a speculative allocation tracker can be deallocated according to one example arrangement is illustrated;

[0015] Figure 7A and Figure 7B shows a recovery operation with respect to a cache implementation of content that can use a speculative allocation tracker according to one example arrangement;

[0016] Figure 8A is a flowchart showing steps of step 455 performed to implement Figure 7B according to one example arrangement, and Figure 8B is a table showing results of a process applied to various example scenarios Figure 8A ;

[0017] Figure 9 is a flowchart showing tracking of memory access instructions within a reorder buffer according to one example arrangement;

[0018] Figure 10 is a flowchart showing steps that can be performed within a reorder buffer when resolving branch instructions according to one example arrangement; and

[0019] Figure 11 is a flowchart showing how a timestamp field within a tracking entry of a speculative allocation tracker can be used to implement deadlock avoidance according to one example implementation. DETAILED DESCRIPTION

[0020] There has been much interest recently in speculative based cache timing side channel attacks, where various techniques can be used so that cache timing analysis can then be misused to leak information from the erroneous speculative execution of instructions. The basic principle behind cache timing side channels is that the allocation pattern into a cache, and in particular which cache sets have been used for allocation, can be determined by measuring the time taken to access an entry that was previously in that cache, or by measuring the time taken to access an entry that has been allocated. This can then be used to determine which addresses have been allocated into the cache. The novelty of speculative based cache timing side channels is that they use speculative memory reads. Speculative memory reads are a typical feature of advanced microprocessors, and are part of the overall functionality that enables high performance.

[0021] By performing a first speculative memory read (or other change in program flow) to a cacheable location other than a branch on architecture that is not resolved, the result of that read can itself be used to form the address of a further speculative memory read. These speculative reads result in the allocation of an entry into the cache whose address indicates the value of the first speculative read. If untrusted code is able to control speculation in such a way that the first speculative read results in a location that the untrusted code would not otherwise be able to access, this can become an exploitable side channel. In particular, the effect of the second speculative allocation and subsequent speculative allocations into the cache can be measured by the untrusted code.

[0022] While the various speculative read operations mentioned above can all relate to data values, and thus can result in data being allocated into a data cache, similar techniques can be employed in conjunction with other cache structures, such as instruction caches, address translation caches (often referred to as translation lookaside buffers (TLBs)), and so on.

[0023] A number of schemes have been proposed to seek to prevent such speculative based cache timing side channel attacks. For example, software patches can be used to serialize instruction sequences so that all instructions are executed sequentially and thus out-of-order execution is limited. However, when using such approaches, the performance drop can be very severe.

[0024] Another described scheme aims to implement a better branch index. As previously mentioned, an initial step in such attacks is to manipulate the branch prediction circuitry to cause a misprediction, and such branch prediction structures are typically indexed using, for example, the program counter and global history. By providing a more complex indexing scheme, this can make such attacks more difficult. However, once the indexing scheme is known, the processor again becomes vulnerable to such attacks.

[0025] A third identified approach involves preventing microarchitectural changes, such as updates to the cache structure. While this allows speculation and out-of-order execution, it prevents any speculative changes within the cache structure. Thus, for example, rather than writing into the cache structure, data can be written into a separate speculation buffer, and these changes can be made invisible until all older branches are resolved. However, it has been found that this approach can be too conservative, as the number of incorrect control path cache fills is typically very small in real-world applications due to increasingly accurate branch prediction mechanisms and improved cache microarchitectures. In order for a cache fill to occur that can be used in such attacks, a cache access needs to be performed by speculatively executing instructions due to a mispredicted branch, and needs to result in a cache miss so that the fill occurs in the cache. However, branch prediction accuracy is typically very high, and cache hit rates are typically also very high. Thus, employing a separate speculation buffer to hold such cache updates during speculative execution can have a significant impact on performance and power, as most cache lines would then need to be written twice, once to the speculation buffer and then again to the cache.

[0026] The techniques described herein aim to increase the resilience of cache storage to speculation-based cache timing side-channel attacks, while mitigating the performance or power issues associated with previously proposed techniques. According to the techniques described herein, there is provided an apparatus having processing circuitry for executing instructions, where the processing circuitry allows for speculative execution of one or more of those instructions. By way of example, the processing circuitry can support out-of-order execution, so once a branch instruction has been predicted, instructions can be fetched based on that prediction, and can be executed speculatively before it is known whether those instructions actually need to be executed, i.e. before it is known whether the prediction made in respect of the branch instruction was correct.

[0027] The apparatus also has a cache storage, which comprises a plurality of entries for storing information for reference by the processing circuitry. The cache storage can take a variety of forms, for example it can be a data cache, an instruction cache, a TLB, etc. A cache control circuitry is provided to control the use of the cache storage, the cache control circuitry comprising a speculative allocation tracker having a plurality of tracking entries.

[0028] In response to a speculative request associated with a need to allocate identified information into a given entry of the cache storage, the cache control circuitry is arranged to allocate a tracking entry in the speculative allocation tracker for the speculative request before allowing the identified information to be allocated into the given entry of the cache storage. Thus, the allocation of the tracking entry is required first before the given entry can be updated in the cache storage. The cache control circuitry then employs the allocated tracking entry to maintain recovery information sufficient to enable the given entry to be recovered to an initial state existing prior to the identified information being allocated into the given entry.

[0029] Then, if an erroneous speculation condition is detected in respect of the speculative request, the cache control circuitry is arranged to employ the recovery information maintained in the allocated tracking entry for the speculative request in order to recover the given entry in the cache storage to the initial state.

[0030] Thus, according to the above-described technique, when the processing circuitry speculatively executes an instruction, micro-architectural updates are not suppressed, but rather a tracking entry is allocated in the speculative allocation tracker before the cache storage is updated, and this tracking entry is used to maintain sufficient information to enable the update to be reversed if, at that time, it turns out that there was an erroneous speculation, and thus the speculative request should not have been processed. Thus, such an approach mitigates the performance and power consumption issues associated with previously proposed techniques, but provides robust protection against the previously discussed speculation-based cache-timing side-channel attacks. Since the cache storage is recovered to its initial state in such cases, any attempt to perform cache timing analysis will be unable to determine secret data.

[0031] As mentioned above, before an update to a given entry of the cache storage can be performed based on a received speculative request, it is necessary to allocate a tracking entry in the speculative allocation tracker. In one example implementation, in the absence of a tracking entry available for allocation in association with the speculative request, the speculative request is suspended. It can then be retried at a later point in time at which time a tracking entry can be available, or at which time the data required by the speculative request can have already been resident in the cache and thus can not require information to be allocated into the given entry of the cache storage in response to the speculative request. Indeed, by the time the request is retried, it can no longer actually be speculative, and thus can not require the above-described mechanism to be employed.

[0032] In one example implementation, when the allocation of the identified information into the given entry causes eviction of existing information from the given entry, the recovery information is arranged to include at least the existing information. Thus, this existing information is captured in association with the allocated tracking entry such that if it is necessary to recover the given entry to its initial state, this existing information is then available.

[0033] In one example implementation, once the given entry has been recovered to the initial state in response to the erroneous speculation condition, the cache control circuitry is arranged to de-allocate the allocated tracking entry. This frees up the tracking entry that was allocated in association with the subsequent speculative request.

[0034] In some implementations, it can be necessary to perform a number of steps in order to implement the recovery operation to recover the given entry to the initial state. Indeed, the number of steps required can depend on the recovery information itself. By way of a specific example, if the allocation of the identified information into the given entry does not cause eviction of valid existing information, then it will not be necessary to recover the existing information into the given entry, and it can be sufficient to invalidate the given entry when performing the recovery operation. In such implementations, the allocated tracking entry can have a recovery status field to track the performance of the steps required to implement the recovery operation, such that it can be determined when all of the required steps have been performed.

[0035] The cache storage can be arranged in a variety of ways within the apparatus. In one example implementation, the cache storage is at a given level in a memory hierarchy, the speculative request needs to be issued to a lower level of the memory hierarchy in order to obtain the identified information, and the cache control circuitry is arranged to prevent the issuance of the speculative request to the lower level of the memory hierarchy until a tracking entry is allocated in the speculative allocation tracker for the speculative request. Thus, if a tracking entry is not available to be allocated to the speculative request, the way in which the identified information is prevented from being allocated into the given entry is by preventing the propagation of the speculative request onto the lower level of the memory hierarchy. It will be appreciated that there is no expectation that the identified information will subsequently need to be allocated into the given entry before the speculative request has been propagated.

[0036] In one such example arrangement, when the misprediction condition is detected before the identified information is obtained, the cache control circuitry is arranged to prevent the identified information from being written into the given entry, thereby preserving the initial state of the given entry. Thus, assuming that a track entry is allocated, and hence a speculative request is issued to a lower level of the memory hierarchy, but before the identified information becomes available from the lower level of the memory hierarchy for writing into the given entry of the cache storage at which the misprediction condition was detected, the cache control circuitry can be arranged to prevent only the identified information from being written into the given entry. By this approach, the initial state is maintained.

[0037] In this case, there can be many ways in which the cache control circuitry can prevent the identified information from being written into the given entry. In one example arrangement, the cache control circuitry comprises a fill buffer for temporarily storing information received from a lower level of the memory hierarchy before storing that information in the cache storage. Then, when the misprediction condition is detected before the identified information is obtained, the cache control circuitry is arranged to prevent the identified information from being written into the given entry by instructing the fill buffer to discard the identified information when the identified information is received from the lower level of the memory hierarchy.

[0038] In some implementations, the cache control circuitry can prevent the identified information from being written into the given entry when the misprediction condition is detected before the identified information is obtained, and then the cache control circuitry can be arranged to de-allocate the allocated track entry once the identified information has been prevented from being written into the given entry. The exact timing of the de-allocation of the allocated track entry can vary depending on the implementation. For example, considering the fill buffer implementation discussed previously, the allocated track entry can be de-allocated at the time the fill buffer has been instructed that it should prevent the identified information from being written into the given entry. However, in alternative implementations, the cache control circuitry can wait until a confirmation is received from the fill buffer that the identified information has been prevented from being written into the given entry before de-allocating the allocated track entry.

[0039] In one example implementation, the cache control circuitry can comprise an eviction buffer into which information evicted from an entry of the cache storage is temporarily stored. When allocating the identified information into the given entry causes existing information to be evicted from the given entry, that existing information is then captured in a given buffer entry of the eviction buffer, and the speculative allocation tracker can be arranged to retain recovery information with reference to the given buffer entry. Whilst it can be that the contents from the given buffer entry are copied into the allocated tracking entry, this is not essential in some implementations, and instead the allocated tracking entry can be linked to the given buffer entry so that if necessary the existing information can be retrieved from the given buffer entry at that time. In one particular example implementation, the given buffer entry forms part of the allocated tracking entry.

[0040] In one example implementation, in response to detecting a correct speculation condition in respect of the speculative request, the cache control circuitry is arranged to de-allocate the allocated tracking entry. Thus, once it is known that the speculative request was in fact required, and is therefore no longer speculative, the allocated tracking entry can be de-allocated simply when the contents maintained by that allocated tracking entry are no longer required. This can free up tracking entries for allocation to other speculative requests.

[0041] The allocated tracking entry can take a variety of forms, but in one example implementation has a fill-complete field which is set to identify when the identified information has been stored in the given entry of the cache storage. This can be used, for example, to identify a situation in which the information has not yet been written into the given entry, and so it would be sufficient to prevent the identified information from being written into the given entry in the event of an incorrect speculation condition, for example by informing the fill buffer discussed previously. However, once the fill-complete field has been set, it is known that it will at least be necessary to invalidate the given entry, and indeed if valid existing information was evicted during the fill process it can also be necessary to restore the previous existing information into the given entry.

[0042] There are a variety of ways in which it can be determined whether it is necessary to restore existing information into the given entry during the recovery process. However, in one example implementation the allocated tracking entry can have an eviction-valid field which is set to identify when allocating the identified information into the given entry caused existing information to be evicted from the given entry. Thus, if the eviction-valid field is not set but the fill-complete field is set, it can be determined that the action required to restore the given entry to its initial state is to invalidate the current contents of the given entry. However, if the eviction-valid field is also set, it can also be necessary to write the existing information back into the given entry in order to restore the given entry to its initial state.

[0043] In one example implementation, the cache storage device is at a given level in the memory hierarchy, and the device also includes at least one additional cache storage device at a different level in the memory hierarchy. A further speculative allocation tracker can then be provided for each additional cache storage device. In such an implementation, in response to detecting the false speculation condition with respect to the speculative request, the further speculative allocation tracker associated with each additional cache storage device that already has an entry updated as a result of the speculative request can be arranged to perform a recovery operation to restore that entry to its initial state. In particular, it can be the case that during the process of obtaining the identified information for writing into a given entry of the cache storage device, an entry in one or more of the other cache storage devices can also have been updated, and so by this approach, it can be ensured that each cache in the cache is restored to its initial state in the event of false speculation.

[0044] To facilitate this process, the allocated tracking entry can have a source field to identify the level within the memory hierarchy from which the identified information was obtained. The source information can then be used to determine which further speculative allocation trackers are required to perform the recovery operation. The determination performed here can depend on a number of factors. For example, this can depend on whether the cache storage device and the at least one additional cache storage device are operating in an inclusive arrangement or an exclusive arrangement. According to an inclusive arrangement, any information held in a cache at a higher level in the memory hierarchy will also be stored in a cache at a lower level of the memory hierarchy. However, according to an exclusive arrangement, any particular block of information will only be stored in one of the caches.

[0045] When the caches are operating in an inclusive arrangement, then the source information can be used to determine to which level in the cache hierarchy the recovery request needs to be propagated, and this can avoid the need to propagate the request to cache levels beyond the source level, simply to discover that that cache level does not need to perform any recovery operation. When the caches are operating in an exclusive arrangement, if the identified information has been provided by a lower level cache, then since the caches need to operate in an exclusive arrangement, the identified information will be evicted from that lower level cache. So, when a given entry in a higher level cache is restored to its initial state, such that the identified information is evicted, that identified information can then be provided back to the source level of the cache, such that the evicted information can be restored into the source level of the cache to restore the source level of the cache to its initial state.

[0046] As previously mentioned, the cache storage can take a variety of forms. In one example arrangement, the cache storage is a data cache, and the information comprises data values processed by the processing circuitry in executing instructions. In such an implementation, the speculative request can arise from the speculative execution of a memory access instruction that causes a miss detected in the cache storage. The memory access instruction can for example be a load instruction seeking to load data from the cache into a working register of the processor, or indeed a store instruction seeking to write data from such a working register back into the cache. When a store operation is performed, this can still result in a need to retrieve information from a lower level of the cache hierarchy to write into a given entry of the cache storage, at which point the retrieved data will typically be merged with the write data to produce updated information stored in the given entry. Thus, not only in association with load operations, but also in association with store operations, there is a vulnerability to the speculative cache timing side-channel attack previously discussed, and the techniques described herein can be used in respect of both load and store instructions in order to thwart such attacks.

[0047] In one such implementation in which the cache storage is a data cache, the apparatus can also comprise an execution control circuitry to track the progress of instructions being executed by the processing circuitry, and to mark memory access instructions as speculative when older branch instructions are tracked in the execution control circuitry as unresolved branches. The execution control circuitry can then be arranged to detect an erroneous speculation condition when a branch resolution identifies a misprediction for an older branch instruction, and to trigger the cache control circuitry to perform a recovery operation in respect of the marked memory access instructions. The execution control circuitry can take a variety of forms, but in one implementation can be a reorder buffer. Thus, the reorder buffer can be arranged to maintain a marker associated with memory access instructions to identify when these memory access instructions are speculative. Once an older branch instruction is resolved, and if it is determined that the branch instruction was predicted correctly, any younger memory access instructions that have been marked can be cleared of the marker, as it is known that they are no longer speculative.

[0048] When an erroneous speculation condition is detected, there are a variety of ways in which the execution control circuitry can trigger performance of a recovery operation. In one example implementation, this is accomplished by issuing instruction identifier information to the cache control circuitry to identify each tagged memory access instruction younger than the older branch instruction. In particular, these are memory access instructions that should not be executed, now that it is known that the prediction made with respect to the older branch was erroneous. Each trace entry can then include an instruction identifier field, and the cache control circuitry can cause a lookup to be performed in the speculative allocation tracker using the instruction identifier information received from the execution control circuitry in order to identify each entry in the cache storage that needs to be recovered to its initial state.

[0049] The instruction identifier information provided by the execution control circuitry can take a variety of forms. For example, a separate instruction identifier can be issued for each tagged memory access instruction younger than the older branch instruction. Alternatively, some form of range information can be specified in order to identify all of the relevant memory access instructions, and the cache control circuitry can then recreate the required instruction identifiers in order to enable the necessary lookups to be performed within the speculative allocation tracker to identify the relevant trace entries, and thus identify the entries in the cache storage that need to be recovered to the initial state.

[0050] In some cases, a problem can arise in that the progress of a speculative request can not be able to progress before a trace entry in the speculative allocation tracker can be allocated, resulting in a deadlock situation occurring, preventing forward progress of the processing circuitry. In cases where such a problem exists, each trace entry can be supplemented to include a time stamp field that is set to a time stamp value when the trace entry is allocated, and the time stamp field is referenced to determine whether a certain time period has elapsed after which the allocated trace entry is to be deallocated to prevent a deadlock condition. In particular, the time period can be selected to be greater than the maximum expected time that the allocated trace entry will be required. In particular, speculation is an inherently transient activity, and any speculation should be resolved within a relatively short time. Thus, if there are allocated trace entries that remain after a relatively large time period has expired, this can indicate a situation in which the allocated trace entries have not been cleared as expected, and thus the allocated trace entries can be appropriately deallocated. This can then ensure that a deadlock condition does not arise in the case of all of the trace entries within the speculative allocation tracker being allocated, and thus one or more speculative requests being stalled.

[0051] As previously mentioned, cache storage can take a variety of forms, and the techniques described herein can equally apply to such other types of cache storage. For example, the cache storage can be an instruction cache, and the information can comprise instructions fetched from memory for execution by the processing circuitry. As another example, the cache storage can comprise an address translation cache, and the information can comprise address translation data used by the processing circuitry when translating virtual addresses to corresponding physical addresses of the memory system.

[0052] Particular examples will now be described with reference to the drawings.

[0053] Figure 1 An example of a data processing apparatus 2 having a processing pipeline comprising a plurality of pipeline stages is shown schematically. The pipeline comprises a branch predictor 4 for predicting the outcome of branch instructions and generating a series of fetch addresses for instructions to be fetched. A fetch stage 6 fetches the instructions identified by the fetch addresses from an instruction cache 8. A decode stage 10 decodes the fetched instructions to generate control information for controlling the subsequent stages of the pipeline. An out-of-order processing unit 12 is provided at the next stage to handle the out-of-order execution of instructions. These units can take a variety of forms, including for example a reorder buffer (ROB) (also referred to herein as an execution control circuit) and a renaming circuit. The ROB is used to keep track of the progress of instructions and ensure that instructions are committed in order, even if they are executed out of order. The renaming stage 12 performs register renaming to map architectural register indicators identified by the instructions to physical register indicators identifying registers 14 provided in the hardware. Register renaming can be used to support out-of-order execution, as this can allow hazards between instructions specifying the same architectural register to be removed by mapping the instructions specifying the same architectural register to different physical registers in the hardware register file, to increase the likelihood that instructions can be executed in an order that differs from the program order in which they were fetched from the cache 8, which can improve performance by allowing later instructions to execute while earlier instructions wait for operands to become available. The ability to map architectural registers to different physical registers can also be beneficial in rolling back architectural state in the event of a branch misprediction. A issue stage 16 queues the instructions for execution until the required operands for processing the instructions are available in the registers 14. An execution stage 18 executes the instructions to perform the corresponding processing operations. A writeback stage 20 writes back the results of the executed instructions to the registers 14.

[0054] Execution level 18 may include multiple execution units, such as a branch unit 21 for evaluating whether a branch instruction has been correctly predicted, an ALU (Arithmetic Logic Unit) 22 for performing arithmetic or logical operations, a floating-point unit 24 for performing operations using floating-point operands, and a load / store unit 26 for performing load operations to load data from the memory system into register 14 or store operations to store data from register 14 into the memory system. In this example, the memory system includes a Level 1 instruction cache 8, a Level 1 data cache 30, a Level 2 cache 32 shared between data and instructions, and main memory 34. However, it should be understood that this is merely one example of a possible memory hierarchy, and other specific implementations may have further cache tiers or different arrangements. Load / store unit 26 may use translation lookahead buffer 36, and fetch unit 6 may use translation lookahead buffer 37 to map virtual addresses generated by the pipeline to physical addresses that identify locations within the memory system. It should be understood that... Figure 1 The pipeline shown is merely an example, and other examples may have different sets of pipeline levels or execution units. For example, a sequential processor may not have renaming level 12.

[0055] like Figure 1 Such devices can be used to perform speculative execution of instructions. Speculative execution of instructions by processing circuitry before it is actually known whether the input to these instructions is correct or whether these instructions are absolutely necessary to execute can be extremely beneficial for providing high processor performance. However, it has recently been recognized that if such speculation leads to speculative memory access, the allocation in the cache triggered by the speculative memory access remains visible even after the speculative instruction has been resolved as a misprediction or misspeculation and the architectural effect of the speculatively re-executed instruction has been reversed. This then allows subsequently executed code to investigate which data was loaded by previous code using cache timing side-channels. The basic principle behind cache timing side-channels is that the allocation pattern in the cache can be determined by measuring the time spent accessing previously entered entries in that cache, or by measuring the time spent accessing allocated entries, and specifically, determining which cache sets have been used for allocation. This can then be used to determine which addresses have been allocated to that cache.

[0056] Speculative memory reads are a typical feature of advanced microprocessors and part of the overall functionality that enables very high performance. By performing speculative memory reads (or other changes in program flow) to cacheable locations beyond branches that are not resolved architecturally, and further using the results of these reads themselves to form the addresses of further speculative memory reads, these speculative reads cause allocation of entries into the cache whose addresses indicate the values of the first speculative reads. If untrusted code can control speculation in a way that causes a first speculative read of a location, then this becomes an exploitable side channel, otherwise the first speculative read of that location is not accessible at the untrusted code but the effects of the second speculative allocation within the cache can be measured by the untrusted code.

[0057] For any form of supervised software, the untrusted software will pass data values that are used as offsets into arrays or similar structures that will be accessed by trusted software. For example, an application (untrusted) can request information about an open file based on a file descriptor ID. Of course, the supervising software will check that the offset is within the appropriate range before it is used, so software for such a paradigm can be written in the following form:

[0058]

[0059]

[0060] In modern microprocessors, the processor implementation can typically perform data accesses speculatively (implied by line 9 in the code above) to establish the value before executing the branch associated with the untrusted_offset_from_user range check (implied by line 7). The processor running this code at the supervisory level (such as an OS kernel or hypervisor) can load speculatively from anywhere in normal memory accessible to this supervisory level, determined by out-of-range values of untrusted_offset_from_user passed by non-trusted software. This is not an architectural problem because if the speculation is incorrect, the hardware will discard the loaded value.

[0061] However, the advanced processor can use the value that has been loaded speculatively for further speculation. It is this further speculation that is exploited by the speculative cache timing side channel. For example, the previous example can be extended to the following form:

[0062]

[0063] In this example, the "value" loaded from memory using the address computed from arr1->data combined with untrusted_offset_fromuser (line 10) is then used as the basis for a further memory access (line 13). Thus, the speculative load of value2 comes from an address derived from the data of the speculative load of value. If the speculative load of value2 by the processor results in an allocation into the cache, then a standard cache timing side channel can be used to infer a part of the address of that load. Since the address depends on the data in value, a side channel can be used to infer a part of the data of value. By applying this method to different bits of value, the entire data of value can be determined (in multiple speculative executions). Thus, untrusted software can use this method to recover the value of any memory accessible to the supervisory software by providing untrusted_offset_from_user with an out-of-range quantity, thus accessing anywhere that the supervisory software can access.

[0064] Modern processors have a number of different types of cache, including instruction caches, data caches, TLBs, and so on. In the case where the allocation of an entry in one of these caches is determined by a value based on some portion of data loaded from untrusted input, then in principle this side channel can be exploited. While the example given above considers a further speculation in the form of an additional data load operation at an address derived from the sensitive data ("value") obtained from a first speculative data load operation, this technique can also be applied to other cache structures.

[0065] As a generalization of this mechanism, it should be understood that the underlying hardware technology means that it is possible to speculatively execute code through a branch, and thus it is possible to speculatively execute any sequence following the branch that accesses memory. In such a speculation, then a value loaded speculatively is used to construct the address of a second load or indirect branch that can also be executed speculatively, in a way that leaves an indication of the value loaded by the first speculative load that can be read using a timing analysis of the cache by code that would otherwise be unable to read that value. This generalization means that many code sequences in general will leak information into the cache allocation pattern that can be read by other less privileged software. The most serious form of this problem is the form described previously in this section, where less privileged software is able to choose which values to leak in this way.

[0066] Accordingly, it would be desirable to provide a countermeasure against this type of attack.

[0067] As Figure 2As shown, in accordance with the techniques described herein, the cache control circuitry 105 associated with the cache storage 100 is supplemented to include a speculative allocation tracker 110, also referred to herein as a speculative line tracker (SLT), with each entry in the cache storage also referred to as a cache line. The cache storage can take a variety of forms, such as a data cache (such as the level one data cache 30), an instruction cache (such as the level one instruction cache 8) or a TLB (such as the TLBs 36, 37 shown). However, for the purposes of the following discussion, it will be assumed that the cache storage 100 is a data cache storing data values for access by processing circuitry when executing instructions. Figure 1 As shown, in accordance with the techniques described herein, the cache control circuitry 105 associated with the cache storage 100 is supplemented to include a speculative allocation tracker 110, also referred to herein as a speculative line tracker (SLT), with each entry in the cache storage also referred to as a cache line. The cache storage can take a variety of forms, such as a data cache (such as the level one data cache 30), an instruction cache (such as the level one instruction cache 8) or a TLB (such as the TLBs 36, 37 shown). However, for the purposes of the following discussion, it will be assumed that the cache storage 100 is a data cache storing data values for access by processing circuitry when executing instructions.

[0068] In association with the level one data cache, the cache control circuitry can be incorporated within the functionality of a load store unit 26, also referred to herein as an LSU. Figure 3 An example LSU 150 is shown, and in this illustration the associated data cache is shown as part of the LSU 150, as indicated by block 155. The LSU can have one or more load queues 160 and store queues 165 for storing pending load operations and store operations respectively. An arbiter 170 can be used to arbitrate between various load operations and store operations in order to determine the processing order of these load operations and store operations relative to the cache 155.

[0069] In the event that processing of such a load operation or store operation results in a miss being detected within the cache 155, then a fill operation can be performed, resulting in a fill request being issued to a lower level in the memory hierarchy, such as the level two cache 32 shown in Figure 1 This results in the data for the cache line being retrieved from the lower level of the memory hierarchy, which is then temporarily stored within a fill queue 175. The data stored in the fill queue 175 is then used to perform a line fill within the relevant row of the cache 155. In the event that the allocation of data into the selected cache line results in valid data being evicted from the cache, then this valid evicted data can be stored within an eviction queue 180 as shown. For example, in the event that the evicted data is valid and dirty, meaning that it is more up to date than the version of the data held in the lower level of the memory hierarchy, then the data can be stored within the eviction queue for issuance to the lower level of the memory hierarchy. Figure 3

[0070] Also as Figure 3 ​As shown, an SLT 185 can be provided having a plurality of tracking entries. When a memory access operation (load or store) is speculatively executed, in the event that a cache miss is detected within the cache 155, then, prior to issuing a speculative fill request to a lower level of the memory hierarchy, the LSU 150 is first arranged to allocate a tracking entry within the SLT 185 for the speculative fill request / associated speculative memory access operation. Once a tracking entry has been allocated, the speculative fill request can be issued to a lower level of the memory hierarchy. However, if no tracking entry is available within the SLT to allocate at that point in time, then the speculative access operation is stalled and the speculative fill request is not issued to a lower level of the memory hierarchy at that time. The speculative access operation can subsequently be retried.

[0071] As shown, Figure 4A The SLT 185 comprises a plurality of tracking entries 200. The number of entries provided is a matter of design choice. By providing more entries, this can reduce the opportunity for a speculative access operation to be stalled, thereby improving performance. However, the more entries that are provided, the larger the size of the SLT 185, which increases the hardware overhead of the LSU 150.

[0072] Figure 4B Various fields that can be provided within each tracking entry 200 are shown schematically. The basic purpose of an allocated tracking entry is to hold sufficient recovery information for the allocated entry in the cache 155 in which fill data obtained by a speculative fill request is stored to be able to be recovered to an initial state that existed prior to the fill data being allocated as a result of the execution of the speculative fill request.

[0073] As shown, Figure 4B The instruction identifier field 205 can be used to identify the memory access instruction with which the tracking entry 200 is associated, thereby identifying the speculative fill request with which the tracking entry is associated. The instruction identifier should be sufficient to uniquely identify the instruction from the instructions in the process being executed by the data processing apparatus 2. In one example implementation, the instruction identifier used by the re-order buffer in the out-of-order processing unit 12 can be used for this purpose.

[0074] The field 210 is used to identify the memory address accessed by the memory access instruction. In one example implementation, this field is used to store the physical address of the data being accessed in memory.

[0075] The fill complete field 215 (also referred to herein as a fill done field) is used to identify when the data accessed by the speculative memory access instruction has been obtained and stored into the allocated cache line, thereby identifying when the allocated cache line has been updated by the speculative fill request. In addition, the eviction valid field 220 can be used to identify when storing this retrieved data into the allocated cache line has caused valid data to be evicted from the cache. In one example implementation, each of the fields 215, 220 can be a single bit field, with one logical value indicating a set state and the other logical value indicating a clear state. The cache control circuitry (in this case the LSU 150) can use the information held within the fill complete field 215 and the eviction valid field 220 to determine the required recovery operations in order to restore the allocated cache line to its initial state in the event of a false speculation being determined with respect to the memory access instruction.

[0076] The field 225 can be used to store initial state information for the allocated cache line. Thus, this field can be used to store both the value of the data evicted from the allocated cache line by the cache line, as well as a tag value associated with this evicted data, which is used to identify the memory address to which the evicted data relates. The information within the field 225 can be stored directly within the tracking entry 200, or alternatively, a link can be provided to a related entry within the eviction queue 180, also referred to herein as an eviction buffer. In one particular implementation, this related entry in the eviction buffer can be considered to be part of the tracking entry 200.

[0077] The source field 230 can be used to identify the source of the data obtained by the speculative fill request. Thus, this can identify a lower level of the cache hierarchy from which the data has been accessed, or can identify that the data has been obtained from the main memory 34. This source information can be used to influence the required recovery operations with respect to the lower level of the cache hierarchy in the event of a false speculation condition, as will be discussed later with reference to Figure 8A and Figure 8B

[0078] The timestamp field 235 can be used to store a timestamp value indicating the time at which the tracking entry was allocated, and as will be discussed later with reference to Figure 11 the timestamp value can be used as part of a deadlock avoidance scheme.

[0079] ​The flush field 240 can be used to hold a flush flag that can be set if it is determined that a flush is required with respect to an allocated cache line used to store data for a memory access instruction. Thus, in the event that a mispeculation condition is detected with respect to an instruction identified by the instruction identifier information in field 205, then the flush flag 240 can be set to identify that the associated cache line in cache 155 needs to be restored to its initial state.

[0080] Depending on the steps required to restore the initial content, it can be necessary to perform a number of steps, and the flush status field 245 can be used to keep track of those various steps so that it can be determined when the restore operation has been completed. For example, in some cases it can only be necessary to invalidate the relevant cache line, while in other cases there can be a need to restore back to valid evicted data in that cache line. Thus, as Figure 4B shown, in such cases a two bit field can be used to capture the relevant flush status, and in particular to distinguish when a flush operation has not yet started, when an invalidate request has been issued, when a restore request has been issued, and when the process is complete.

[0081] Finally, as Figure 4B shown, a valid flag 250 can be used to identify whether the content of a tracked entry is valid. When attempting to allocate a tracked entry for a new speculative fill request, it is necessary to find a tracked entry whose valid bit is cleared, thereby identifying that the tracked entry is available for allocation.

[0082] Figure 5 is a flowchart showing the operation of a cache control circuit, such as LSU 150, in processing a memory access instruction. At step 300, it is determined whether there is a memory access instruction to be processed. This step can be performed, for example, by the arbiter 170 in reference to the contents of the load queue 160 and the store queue 165. Upon selecting a memory access instruction to be processed, then at step 305 a lookup is performed within the cache 155, which in one example is performed using the physical address associated with the data being accessed. In one particular implementation, the cache 155 is a set associative cache, so the index portion of the address is used to identify a particular set within the cache, and then the tag portion of the address is compared to tag values stored in association with each cache line in that set in order to determine whether there is an address match, i.e. a hit in the cache. If a hit is detected at step 310, then the process proceeds to step 315 in which the memory access operation is processed normally. Thus, for a load operation this will cause the requested data to be returned directly to the processor using the contents of the cache. For a store operation, this will typically involve merging the write data specified by the store operation with the contents of the hit cache line in order to produce an updated cache line.

[0083] If a hit is not detected within the cache, the process proceeds to step 320, where it is determined whether the memory access instruction currently being processed is a speculative memory access instruction. This will typically be identified by the re-order buffer in the out-of-order processing unit 12, and results in a speculative tag being associated with the memory access instruction when it is placed within the load queue 160 or store queue 165. If the memory access instruction is not speculative, the process proceeds to step 325, where a fill request is issued to a lower level of the memory hierarchy.

[0084] However, if the memory access instruction is speculative, it is first necessary to obtain a tracking entry in the SLT 185, before the fill request is allowed to be propagated to a lower level of the memory hierarchy, in accordance with the techniques described herein. Thus, at step 330, it is determined whether there is a free tracking entry available in the SLT, i.e. whether there is a tracking entry whose valid tag 250 is currently clear. If so, at step 340, a tracking entry is allocated for the memory access instruction in the SLT, and thereafter the process proceeds to step 325, where the fill request is issued to a lower level of the memory hierarchy. From the perspective of Figure 4B It will be seen from a review of the tracking entry 200 that, when the tracking entry is first allocated, only a subset of the fill fields can be filled. For example, the instruction identifier field 205 can be used to identify the memory access instruction, and the address field 210 can be used to identify the physical memory address accessed by the instruction. The timestamp field 235 can also be filled to identify a timestamp value indicating the time of allocation of the tracking entry 200, and the valid field 250 can be set to identify that the tracking entry is valid. All of the remaining fields can initially be in a clear state, and will be updated over time as necessary, in order to maintain sufficient information to enable the initial state of the cache line allocated within the cache 155 to store the data obtained by the line fill request, in the event that it is determined that the speculative line fill request should not be performed, i.e. there is an erroneous speculation condition, at the time of the line fill request.

[0085] If there is no free tracking entry available in the SLT 185 at step 330, the process proceeds to step 335, where the memory access instruction is stalled. At this point, in one example implementation, the memory access instruction can be moved to the end of the queue in which it is located, and the process can then proceed to step 340, where a tracking entry is allocated for the memory access instruction in the SLT. In this case, the tracking entry is allocated with all of the fields initially in a clear state, and the process then proceeds to step 345, where the memory access instruction is un-stalled and the process proceeds to step 325, where a fill request is issued to a lower level of the memory hierarchy. Figure 3In a retry queue not shown, which is also connected to the arbiter 170. Of course, the arbiter can then select a memory access instruction from the retry queue in order to attempt to re-execute the memory access operation, at which point the process will return to step 305. At this point, the memory access instruction can no longer be speculative, and thus the memory access operation can be processed normally, regardless of whether there is a hit or miss. Alternatively, it can still be speculative, but there can now be a hit within the cache, allowing the access to proceed normally. Alternatively, it can be speculative, and there can still be a miss, but there can now be a free tracking entry, allowing the processing of the speculative memory access operation to continue.

[0086] Figure 6 is a flowchart illustrating a scenario in which an allocated tracking entry in the SLT is de-allocated, in particular in the event that there is a correct speculation. Thus, if a signal is received at step 350 identifying the memory access instruction as no longer being speculative, the process can proceed to step 355. In the event that the SLT is associated with a level one data cache, and thus for example in the event that the SLT is the SLT 185 shown in the LSU 150, the signal received at step 350 can for example be from a re-order buffer. However, as will be discussed later, the SLT can also be associated with a cache at one or more lower levels in the memory hierarchy, and in this case the signal received at step 350 can be received from a cache at a higher level in the memory hierarchy. Typically, the memory access instruction will be identified as no longer being speculative when resolving an associated earlier (i.e. older) branch instruction, and it is determined that the prediction made by the branch predictor 4 with respect to that branch instruction was correct, and thus the memory access instruction that was executed speculatively did need to be executed.

[0087] When the signal is received at step 350 identifying that the memory access instruction is no longer speculative, then at step 355 a lookup can be performed within the SLT 185 in order to determine whether there is a valid tracking entry in the SLT for the identified instruction. It will be appreciated that this lookup can be performed with reference to the instruction identifier field 205 of each valid tracking entry. If a valid tracking entry is detected at step 355, the process proceeds to step 365 in which the allocation of that tracking entry is de-allocated by clearing the valid bit in field 250. However, if no valid tracking entry is identified, no action is required with respect to the current SLT, as shown at step 360.

[0088] In one example implementation, when a tracking entry is allocated in association with a speculative memory access instruction (at step 340 of Figure 5 to allow the line fill to be performed into a cache line of the level one cache (at step 345 ofFigure 5 the speculative memory access content is obtained, then the level 1 cache is constrained so as to not allow the cache line data obtained for that speculative memory access content to be replaced until there is a successful branch resolution for any older branch (i.e., the speculation was correct), or it is determined that there is a branch misprediction (i.e., the speculation was incorrect). Thus, if no valid trace entry is detected at step 355, then there is no need to propagate the signal received at step 350 up the hierarchy of caches to allow a corresponding lookup to be performed with respect to the SLT associated with that lower level of cache.

[0089] Figure 7A and Figure 7B is a flowchart illustrating a recovery operation that can be performed using the SLT 185 in the presence of an erroneous speculation condition. In particular, if a signal is received at step 400 identifying a memory access instruction as being associated with an erroneous speculation condition, then the process can proceed to step 405. In one example implementation, this signal will originate from the reorder buffer when resolution of a branch instruction identifying a misprediction of that branch is detected, and in particular, for each younger memory access instruction that has been identified as speculative by the reorder buffer, an indication identifying that memory access instruction can be issued to the LSU 150.

[0090] At step 405, a lookup is performed within the SLT 185 to determine if there is a valid trace entry for the identified instruction. If not, then it is determined that no action is required at step 410.

[0091] If a valid trace entry is detected at step 405, then a flush flag is set for that trace entry at step 415. This identifies that a recovery process needs to be performed with respect to a cache line in the cache 155 that is used to store data associated with the physical memory address identified by the memory address field 210 of the trace entry. However, performance of such a recovery process will typically require access to the cache 155, which will need to be arbitrated by the arbiter 170. Furthermore, it is possible for the LSU to receive signals identifying multiple memory access instructions that are affected by an erroneous speculation of a branch, and thus the SLT can have multiple trace entries that need to be processed. Thus, there can be some delay before the required recovery process can be performed with respect to any particular trace entry, and thus it is useful to set the flush flag in order to identify the affected trace entries that need to be processed.

[0092] In one example implementation, the arbiter 170 can be arranged to give priority to the tracking entries within the SLTs for which it has set the refresh flag, thereby prioritizing such entries over pending load and store operations within the load queue 160 and store queue 165, respectively. In alternative implementations, once one or more tracking entries have had their refresh flag set, the LSU can enter a different mode of operation, such as a recovery mode that is different from the normal mode of operation, in which the arbiter processes any tracking entries in the SLTs for which the refresh flag is set before returning to the normal mode of operation.

[0093] However, in managing the recovery process within the LSU, it will be appreciated that once the refresh flag has been set for a tracking entry at step 415, then at that time the arbiter 170 will select that tracking entry for processing in relation to the cache. At this point, at step 420, it can be determined whether the fill complete field is set. If not, this means that the associated cache line within the cache that has been allocated for line fill has not yet been written with the data obtained by the speculative fill request. Therefore, the cache itself does not need to be updated, and instead the process proceeds to step 425 in which the fill queue 175 is informed so that the allocated cache line in the cache is not written to when the data arrives from the lower level of the memory hierarchy.

[0094] There are a number of ways in which this functionality can be implemented. For example, the fill queue entry can have an additional 1-bit field that indicates whether the data is to be discarded on receipt, or the fill queue can be arranged to check the SLT on receipt of data in order to determine whether there is a matching tracking entry, and if so, to check the refresh status. As another example approach, when step 325 of the process is performed to issue a line fill request to the lower level of the memory hierarchy, a fill queue entry is allocated, and the relevant SLT entry can be updated at this point to store the ID of the allocated fill queue entry. Then, at step 425, it is known which fill queue entry needs to be informed. As another alternative example approach, the fill queue can be informed at step 425 of the physical memory address held in field 210 of the tracking entry, so that when the data associated with that address is returned, the fill queue simply discards it. Figure 5

[0095] After step 425, the allocation of the tracking entry can then be de-allocated at step 430 by clearing the valid bit in field 250. The exact timing of the de-allocation will vary depending on the implementation. For example, it can be done directly after informing the fill queue at step 425, or alternatively, the de-allocation of the tracking entry can be deferred until a signal has been received back from the fill queue 175 confirming that the data has been discarded.

[0096] ​If it is determined at step 420 that the populated field is set, the process proceeds to step 435, where an invalidation request is issued to the cache, specifying the physical memory address in field 210, which invalidates the allocated cache line. The refresh status in field 245 can then be updated accordingly, for example, by using... Figure 4B The example sets the refresh status value to 01 to identify that an invalid post has been published.

[0097] After step 435, the process then proceeds to... Figure 7B In step 440, an acknowledgment that a cache line has become invalid is awaited. At this point, if the invalidation of the cache line has resulted in the evicting of valid data that is more recent than the corresponding data stored in a lower level of the cache and / or main memory, the evicted data will be captured in the evictation buffer 180. This evicted data can be used in cache hierarchy operations where the cache is arranged in an exclusive cache layout, as will be discussed in more detail later.

[0098] At step 445, it is determined whether the eviction validity field 220 is set within tracking entry 200. If not, the process can proceed to step 450, in which step, using... Figure 4B The example updates the refresh status in field 245 to a completed status, i.e., updates it to the value 11. Then, in step 455, it can be determined whether to propagate the request to another cache level, as will be discussed later. Figure 8A and Figure 8B The process will be discussed in more detail. Then, at step 460, the assignment of a tracking entry can be deassigned by clearing the valid bits in field 250.

[0099] However, if it is determined at step 445 that the eviction validity field is set, this means it is necessary to restore the initial content to the cache line in order to fully complete the restoration operation. Therefore, at step 465, a restoration request is issued to the cache using the initial state information maintained by the tracking entry to restore the allocated cache line to its initial state. Similarly, the physical address information in field 210 can be provided with the restoration request, and this can be used to identify the relevant group within the cache. Furthermore, due to the execution of the earlier step 435, one cache line will be invalidated, and therefore the initial state information can be allocated to that invalidated cache line. The restoration request will identify the initial state information in field 225 directly or by referring to the relevant entry in the eviction queue 180 storing this initial state information. Therefore, an update process can be performed relative to the cache line to restore it to its initial state.

[0100] As shown in box 465, the refresh status can be updated to recognize that a published version has been restored, and thus it can be used.Figure 4B Example update to state 10.

[0101] Thereafter, at step 470, confirmation is awaited that the recovery process has completed, and thereafter the process proceeds to step 450.

[0102] Figure 8A and Figure 8B Steps are shown which are performed in order to implement step 455 of the process of Figure 7B The need to propagate the request will depend on whether the caches in the cache hierarchy are operating in an inclusive arrangement or an exclusive arrangement. In an inclusive arrangement, any data in a higher cache level in the cache will also be stored within a lower level cache. However, according to an exclusive arrangement, any data stored at a particular cache level in the cache will not be stored in another cache at a lower cache level.

[0103] At step 500 of the process of Figure 8A It is determined whether the cache is operating in an exclusive cache arrangement. If not, this means that the cache is an inclusive cache, and at step 510 it is then determined whether the next lowest level in the cache is the source level as indicated by the information in the source field 230. If so, this means that the data which is the subject of the row fill request will have been provided from this next lowest level of the cache, and so no update will be required in order to restore this next lowest level to its initial state. Accordingly, the process ends at step 515. However, if the next lowest level is not the source level, the process proceeds to step 520 in which the request is propagated to the next cache level in order to initiate a recovery operation in that cache level. In particular, in this case the data will have originated from an even lower level of the cache, and will have resulted in a row fill allocation into the next lowest level of the cache identified at step 510. Accordingly, this allocation will need to be reversed in order to restore this next lowest level of the cache to its initial state. This can be achieved by propagating the request at step 520 to the next cache level in order to cause Figure 7A and Figure 7B the process of

[0104] If at step 500 it is determined that the cache is operating in exclusive cache placement mode, the process proceeds to step 505. Here, if the lower cache level is identified as the source in the source field 230, rather than the main memory being identified as the source, a request is issued to that source level of the cache, providing the evicted data resulting from the cache line invalidation performed at steps 435, 440. This evicted data is the data that was originally in the source cache level but will be removed as a result of the exclusive cache placement, and so this evicted data needs to be restored to the source cache level in order to restore the source cache level to its original state. Thus, the evicted data will contain both the data from the evicted cache line and the associated address information, in order to enable the data to be restored to the source cache level.

[0105] It should be noted that when the cache is operating in exclusive placement mode, no intervening action is required with respect to any intervening cache levels between the level one cache and the source cache level, since the exclusive placement will ensure that data is not stored in any of those intervening cache levels.

[0106] Figure 8B is a table summarising the actions performed in implementing the process of Figure 8A Fig. 4. Here it is assumed that there are three levels of cache. It should be noted that in all cases the invalidation and restoration processes are performed with respect to the level one cache. However, when inclusive cache placement is used, the extent to which invalidation and restoration processes need to be performed at any lower level of the cache will depend on the source information captured in the source field 230. Furthermore, when exclusive cache placement is used, only the invalidation and restoration operations with respect to the data of the initial speculative allocation need to be performed with respect to the level one cache, but where the source is also a cache level, a write back operation needs to be performed for that cache level in order to refill that cache level with the information evicted from the level one cache during the invalidation and restoration operations.

[0107] Figure 9is a flowchart showing how an execution control circuit such as a reorder buffer can keep track of memory access instructions that are being speculatively executed. At step 550, a determination is made as to whether there is a new memory access instruction to be tracked within the reorder buffer. When this occurs, the process proceeds to step 555 where a determination is made as to whether there are any older unresolved branch instructions in the reorder buffer. If so, at step 560, a speculation flag is set in the reorder buffer entry used to track the progress of the memory access instruction. Otherwise, at step 565, the speculation flag in the reorder buffer entry used to track the progress of the memory access instruction is cleared. By using the speculation flag, the reorder buffer can quickly determine which memory access instructions are affected when any particular branch instruction is resolved, and then can use that information to send appropriate signals to the load store unit to update the SLT entries as needed. This process will be discussed in more detail with reference to the flowchart of Figure 10 .

[0108] In particular, at step 600, a determination is made as to whether a branch instruction being tracked by the reorder buffer is resolved. When this occurs, the process proceeds to step 605 where a determination is made as to whether the resolution indicates that there was a branch misprediction. If not, at step 610, the reorder buffer identifies all younger memory access instructions for which its speculation flag is set up to the next unresolved branch instruction (i.e., the next unresolved branch instruction that is younger than the resolved branch instruction).

[0109] For the younger memory access instructions identified at step 610, their speculation flags can then be cleared in the associated reorder buffer entries at step 615, and further, using the process discussed previously with reference to Figure 6 , the SLT associated with the level one cache can be notified of those identified instructions so as to allow the corresponding tracking entries to be deallocated. In particular, it is known that these younger memory access instructions will not require corrective action with respect to the cache, and any data speculatively allocated into the cache based on those speculative memory access instructions can be left in place.

[0110] However, if at step 605 it is determined that the resolution indicates a branch misprediction, at step 620, in addition to performing all of the usual pipeline flush activities associated with a branch misprediction, the reorder buffer also identifies all younger memory access instructions for which its speculation flag is set. The reorder buffer then uses the process discussed previously with reference to Figure 7A and Figure 7BThe process discussed informs the SLT associated with the level one cache of those identified instructions in order to trigger a recovery operation within the level one cache. It will be apparent from the foregoing discussion that the request can then be propagated to lower levels of the cache as needed in order to cause any required recovery operations to be performed in those lower levels of the cache. Once the contents of the reorder buffer have been used to identify younger memory access instructions for which a speculation marker was set, the relevant entries in the reorder buffer, i.e., those associated with instructions that are no longer executed, can be flushed.

[0111] Once a misprediction regarding a branch is detected, all younger instructions are flushed from the pipeline and the process is replayed starting from the correct branch outcome. However, it should be noted that due to out-of-order execution, there can be older branches and older memory access instructions still tracked by the reorder buffer (i.e., older than the mispredicted branch), and the SLT can still have valid tracking entries for those older memory access instructions. In particular, those tracking entries associated with older memory access instructions still need to be preserved until the branch outcome is known for any earlier branch instructions.

[0112] Figure 11 is a flowchart illustrating a deadlock avoidance scheme that can be implemented when a timestamp field 235 is employed within each tracking entry 200, as previously discussed with reference to Figure 4B The timestamp information captured within field 235 can take a variety of forms. However, in one exemplary implementation, it is not stored at the granularity of a single clock cycle. Rather, for the deadlock avoidance scheme, blocks of thousands of cycles can be considered, for example. Thus, if an SLT entry is allocated at cycle 10002, the captured timestamp value can be 10 to identify that ten blocks of a thousand cycles have passed. The process of Figure 11 can then be implemented periodically (e.g., every thousand cycles), at which time the entire SLT can be checked, and in particular, the timestamp information regarding each valid tracking entry in the SLT can be checked.

[0113] Thus, for each valid entry, at step 650, the timestamp information can be referenced to determine whether a maximum time threshold has been reached. In particular, a comparison timestamp value can be generated from the current cycle count, e.g., to capture the number of blocks of a thousand cycles that have passed, and the timestamp value stored in field 235 can be subtracted from this comparison timestamp value in order to determine whether the result exceeds some predetermined threshold.

[0114] If it is determined at step 655 that the maximum time threshold has been reached, then the allocation of the tracking entry can be deallocated at step 665. The fact that the maximum time threshold has been reached can indicate a scenario in which the tracking entry has not been deallocated as expected, and it can therefore be considered appropriate to deallocate the tracking entry at this point in order to avoid a potential deadlock scenario. In particular, it should be noted that if the SLT is operating correctly, the maximum time threshold should not be reached, as the threshold would have been selected to exceed the maximum time, it would be expected that tracking entries would need to be allocated, given the degree of speculation supported by the system. Thus, in the event that the maximum time threshold has been exceeded, this represents a scenario in which the tracking entry has not been deallocated correctly, rather than identifying a scenario in which the tracking entry is still correctly tracking speculative memory access operations. Deallocating the tracking entry is therefore safe in order to attempt to mitigate the risk of deadlock avoidance.

[0115] If it is determined at step 655 that the maximum time threshold has not been reached, then the process waits at step 660 before re-executing the process in respect of the relevant tracking entry. For example, as previously mentioned, Figure 11 The process of Figure 6 can be executed periodically, for example every one thousand cycles.

[0116] In one implementation, the threshold against which it is determined whether the maximum time threshold has been reached can be programmable, for example by writing into a register accessible by the cache control circuitry at the time of execution of the process of Figure 6 Figure 11 This enables configurability in respect of the maximum length of time for which a tracking entry is expected to be validly allocated during correct operation of the system.

[0117] It will be appreciated that when the above-described techniques are employed, a mechanism for preventing speculative-based cache timing side-channel attacks can be provided, whilst mitigating the performance and / or power consumption issues associated with previously proposed techniques.

[0118] In this application, the word "configured" is used to mean that an element of an apparatus has a configured property. In this context, a "configuration" means an arrangement or manner of interconnection of hardware or software. For example, the apparatus can have dedicated hardware which provides the defined operation, or a processor or other processing device can be programmed to perform the function. "Configured" does not imply that an apparatus element has to be changed in any way in order to provide the defined operation.

[0119] While exemplary embodiments of the application have been described in detail herein above, it is to be understood that the application is not limited to the precise embodiments described, and that various changes, modifications, and additions can be made thereto by those of ordinary skill in the art without departing from the scope and spirit of the application as defined in the following claims. For example, features of one claim can be combined with features of another claim while not departing from the scope of the application.

Claims

1. An apparatus for controlling the allocation of information to a cache storage device, the apparatus comprising: A processing circuit for executing instructions, the processing circuit being arranged to allow speculative execution of one or more of the instructions; A cache storage device at a given level in a memory hierarchy, the cache storage device including multiple entries for storing information for reference by the processing circuitry; A cache control circuit for controlling the use of the cache storage device, the cache control circuit including a speculative allocation tracker with multiple tracking entries; At least one additional cache storage device at different levels in the memory hierarchy; as well as An additional speculative allocation tracker is used for each additional cache storage device; in: In response to a speculative request associated with the speculative execution to allocate identified information to a given entry in the cache storage device, the cache control circuit allocates a tracking entry in the speculative allocation tracker for the speculative request before allowing the allocation of the identified information to the given entry in the cache storage device, and uses the allocated tracking entry to maintain recovery information sufficient to allow the given entry to be restored to its initial state prior to the allocation of the identified information to the given entry; and The cache control circuit also responds to detecting an erroneous speculation condition regarding the speculative request by using the recovery information held in the allocated trace entry of the speculative request to restore the given entry in the cache storage device to the initial state. In response to the detection of a false speculation condition regarding the speculative request, the additional speculative allocation tracker associated with each additional cache storage device whose entry was updated due to the speculative request is arranged to perform a recovery operation to restore the entry to its initial state; and The assigned tracking entry has a source field to identify the level within the memory hierarchy from which the identified information is obtained.

2. The apparatus of claim 1, wherein the speculative request is suspended in the absence of a tracking entry available for allocation associated with the speculative request.

3. The apparatus according to claim 1 or claim 2, wherein: When assigning the identified information to the given entry results in the expulsion of existing information from the given entry, the restored information is arranged to include at least the existing information.

4. The apparatus of claim 1 or claim 2, wherein once the given entry has recovered to the initial state in response to the erroneous speculation condition, the cache control circuitry is arranged to deallocate the assigned tracking entry.

5. The apparatus of claim 1 or claim 2, wherein the number of steps required to perform a recovery operation to restore the given entry to the initial state depends on the recovery information, and the assigned tracking entry has a recovery status field to track the execution of the steps required to perform the recovery operation.

6. The apparatus of claim 1 or claim 2, wherein the cache storage device is at a given level in a memory hierarchy, the speculative request needs to be published to a lower level of the memory hierarchy to obtain the identified information, and the cache control circuitry is arranged to prevent the speculative request from being published to the lower level of the memory hierarchy until a tracking entry is assigned to the speculative request in the speculative allocation tracker.

7. The apparatus according to claim 6, wherein: When the erroneous speculation condition is detected before the identified information is obtained, the cache control circuit is arranged to prevent the identified information from being written into the given entry, thereby preserving the initial state of the given entry.

8. The apparatus according to claim 7, wherein: The cache control circuit includes a fill buffer for temporarily storing information before it is stored in the cache storage device, provided that information received from the lower level of the memory hierarchy is stored thereon. and When the erroneous speculation condition is detected before the identified information is obtained, the cache control circuit is arranged to prevent the identified information from being written into the given entry by instructing the fill buffer to discard the identified information when the identified information is received from the lower level of the memory hierarchy.

9. The apparatus of claim 7 or claim 8, wherein once the identification information has been prevented from being written into the given entry, the cache control circuitry is arranged to deallocate the assigned tracking entry.

10. The apparatus according to claim 3, wherein: The cache control circuit includes an evict buffer, where information evicted from entries in the cache storage device is temporarily stored. and When assigning the identified information to the given entry results in the existing information being evicted from the given entry, the existing information is captured in the given buffer entry of the evicting buffer, and the speculative assignment tracker is arranged to maintain the recovered information with reference to the given buffer entry.

11. The apparatus of claim 10, wherein the given buffer entry forms part of the assigned tracking entry.

12. The apparatus of claim 1 or claim 2, wherein in response to detecting a correct speculation condition regarding the speculative request, the cache control circuitry is arranged to release the allocated tracking entry.

13. The apparatus of claim 1 or claim 2, wherein the assigned tracking entry has a fill-complete field, the fill-complete field being configured to identify when the identified information has been stored in the given entry of the cache storage device.

14. The apparatus of claim 1 or claim 2, wherein the assigned tracking entry has an expulsion validity field, the expulsion validity field being configured to identify when assigning the identified information to the given entry results in the expulsion of existing information from the given entry.

15. The apparatus of claim 1, wherein the source field is used to determine which additional speculatively assigned trackers are needed to perform the recovery operation.

16. The apparatus of claim 1 or claim 2, wherein the cache storage device is a data cache, and the information includes data values ​​processed by the processing circuitry when the instruction is executed.

17. The apparatus of claim 16, wherein the speculative request originates from the speculative execution of a memory access instruction that causes a miss detected in the cache storage device.

18. The apparatus of claim 17, further comprising: An execution control circuit is configured to track the progress of instructions executed by the processing circuit and to mark memory access instructions as speculative when older branch instructions are tracked as unresolved branches in the execution control circuit. The execution control circuitry is configured to detect the erroneous prediction condition when branch parsing identifies a misprediction of the older branch instruction, and is configured to trigger the cache control circuitry to perform a recovery operation for the marked memory access instruction.

19. The apparatus according to claim 18, wherein: The execution control circuitry is configured to trigger the execution of the recovery operation by issuing instruction identifier information to the cache control circuitry, thereby identifying each tagged memory access instruction that is younger than the older branch instruction; and Each tracking entry includes an instruction identifier field, and the cache control circuitry causes a lookup to be performed in the speculative allocation tracker using the instruction identifier information received from the execution control circuitry in order to identify each entry in the cache storage device that needs to be restored to its initial state.

20. The apparatus of claim 1 or claim 2, wherein each tracking entry includes a timestamp field, the timestamp field being set to a timestamp value at the time the tracking entry is assigned, and the timestamp field being referenced to determine an elapsed time period after which the assigned tracking entry is deallocated to prevent deadlock conditions.

21. The apparatus of claim 1 or claim 2, wherein the cache storage device is an instruction cache, and the information includes instructions retrieved from memory for execution by the processing circuitry.

22. The apparatus of claim 1 or claim 2, wherein the cache storage device includes an address translation cache, and the information includes address translation data used by the processing circuitry when translating a virtual address into a corresponding physical address in the memory system.

23. A method for controlling the allocation of information to a cache storage device at a given level in a memory hierarchy, the method comprising: A processing circuit is provided to execute instructions, the processing circuit being arranged to allow speculative execution of one or more of the instructions; The cache storage device is arranged to provide multiple entries for storing information for reference by the processing circuitry; Provides a speculative allocation tracker with multiple tracking entries; Provide at least one additional cache storage device at different levels in the memory hierarchy; Provide an additional speculative allocation tracker for each additional cache storage device; In response to a speculative request associated with the speculative execution that requires the allocation of identified information to a given entry in the cache storage device, a tracking entry in the speculative allocation tracker is allocated to the speculative request before the allocation of the identified information to the given entry in the cache storage device is permitted; The assigned tracking entries are used to maintain recovery information, which is sufficient to enable the given entry to be restored to its initial state before the identified information was assigned to the given entry; In response to the detection of an erroneous speculation condition regarding the speculative request, the given entry in the cache storage device is restored to the initial state using the recovery information held in the allocated trace entry of the speculative request; as well as In response to the detection of the erroneous speculation condition regarding the speculative request, a recovery operation is performed by the additional speculative allocation tracker associated with each additional cache storage device that updated the entry due to the speculative request, so as to restore the entry to its initial state; and The assigned tracking entry has a source field to identify the level within the memory hierarchy from which the identified information is obtained.

Images