Detectors and detection methods for processor circuits

Abstract

A detector and detection method for processor circuits. The detection method includes: determining whether a data cache sends a data backfill request during branch prediction execution to obtain a first determination result; determining whether the data requested by the data backfill request is written into a register and processed during branch prediction execution to obtain a second determination result; and determining whether the processor circuit has an attack vulnerability based on the first determination result and the second determination result.

Description

Technical Field

[0001] This invention relates to a detector and a detection method, and more particularly to a detector and a detection method for a processor circuit. Background Technology

[0002] Conventional processor architectures incorporate out-of-order execution and branch prediction to improve instruction processing performance. However, processors with out-of-order execution and branch prediction capabilities are vulnerable to cybersecurity vulnerabilities, making them susceptible to hacking and data theft. Spectre attacks are a particularly common type of attack.

[0003] To avoid attacks from Spectre vulnerabilities, existing solutions mainly include: (1) using software solutions to disable branch prediction; or (2) inserting barrier instructions into program segments with information security concerns. However, these solutions will severely impact processor performance. Summary of the Invention

[0004] The purpose of this invention is to provide a detection method for a processor circuit, the processor circuit including out-of-order execution and branch prediction units, the detection method including: determining whether a data cache sends a data backfill request in the branch prediction execution state to obtain a first determination result; determining whether the data requested by the data backfill request is written into a register and processed in the branch prediction execution state to obtain a second determination result; and determining whether the processor circuit has an attack vulnerability based on the first determination result and the second determination result.

[0005] This invention also provides a detector for a processor circuit. The processor circuit includes an out-of-order execution and branch prediction unit. The detector includes a first detection module, a second detection module, and a judgment module. The first detection module is used to determine whether the processor circuit's data cache sends a data backfill request during branch prediction execution, to obtain a first judgment result. The second detection module is used to determine whether the data requested by the data backfill request has been written into the processor circuit's register and processed during branch prediction execution, to obtain a second judgment result. The judgment module is used to determine whether the processor circuit has an attack vulnerability based on the first and second judgment results. Attached Figure Description

[0006] The following detailed description, taken in conjunction with the accompanying drawings, will provide the best understanding of the invention. It should be noted that various features may not be drawn to scale. In fact, the dimensions of various features may be arbitrarily increased or decreased for clarity of explanation.

[0007] Figure 1A This is a block diagram of a detector according to some embodiments of the present invention.

[0008] Figure 1B This is a block diagram of a detector according to some embodiments of the present invention.

[0009] Figure 2A This is a block diagram of a detector according to some embodiments of the present invention.

[0010] Figure 2B This is a block diagram of a detector according to some embodiments of the present invention.

[0011] Figure 3 This is a flowchart of a detection method according to some embodiments of the present invention.

[0012] Figure 4 This is a flowchart of a detection method according to some embodiments of the present invention. Detailed Implementation

[0013] Embodiments of the invention are discussed in more detail below. However, it should be understood that the invention provides many applicable concepts that can be embodied in a wide variety of specific contexts. The specific embodiments discussed are merely illustrative and do not limit the scope of the invention.

[0014] Please see Figure 1A This is a block diagram of a detector 1 according to some embodiments of the present invention. Detector 1 is used to detect whether a processor circuit 9 has an attack vulnerability (e.g., Spectre attack). In some embodiments, the processor circuit 9 includes: an out-of-order execution and branch prediction unit 91, a register 93, and a data cache 95. The out-of-order execution and branch prediction unit 91 is used to decode instructions and execute the decoded instructions out of order. The out-of-order execution and branch prediction unit 91 has a branch prediction function and can record the branch prediction state, such as: branch prediction execution state (branch prediction not unpacked state) and branch prediction not executed state (branch prediction unpacked state).

[0015] In some embodiments, detector 1 includes a first detection module 11, a second detection module 13, and a judgment module 15. Specifically, the first detection module 11 is used to determine whether the data cache 95 of the processor circuit 9 sends a data refill request during branch prediction execution, to obtain a first judgment result. The second detection module 13 is used to determine whether the data requested by the data refill request has been written into the register 93 of the processor circuit 9 and processed during branch prediction execution, to obtain a second judgment result. The judgment module 15 is used to determine whether the processor circuit 9 has an attack vulnerability based on the first judgment result and the second judgment result.

[0016] Please see Figure 1B In some embodiments, when the first detection module 11 determines that the data cache 95 of the processor circuit 9 sends a data backfill request 950 in the branch prediction execution state, the second detection module 13 further determines whether the data requested by the data backfill request 950 has been written into the register 93 of the processor circuit 9 and processed in the branch prediction execution state. When the second detection module 13 determines that a data 952 requested by the data backfill request 950 has been written into the register 93 of the processor circuit 9 and processed in the branch prediction execution state, the judgment module 15 determines, based on the detection results of the first detection module 11 and the second detection module 13, that the processor circuit 9 may have an attack vulnerability.

[0017] In some embodiments, when: (1) the first detection module 11 determines that the data cache 95 of the processor circuit 9 has not sent any data backfill request in the branch prediction execution state; (2) when the second detection module 13 determines that the data 952 requested by the data backfill request 950 has not been written into the register 93 of the processor circuit 9 in the branch prediction execution state; or (3) when the second detection module 13 determines that the data 952 has not been processed in the branch prediction execution state, the judgment module 15 determines, based on the detection results of the first detection module 11 and the second detection module 13, that the processor circuit 9 may not have an attack vulnerability.

[0018] It should be noted that, in some embodiments, the aforementioned processor circuit and detector may include hardware circuitry. The components of the processor circuit (e.g., out-of-order execution and branch prediction unit, registers, and data cache) and the components of the detector (first detection module, second detection module, and judgment module) are electrically connected to transmit data and signals. In some embodiments, the signal and data transmission between the aforementioned processor circuit, detector, and components can also be simulated by software (e.g., Electronic Design Automation, EDA).

[0019] Please see Figure 2A This is a block diagram of a detector 2 according to some embodiments of the present invention. The detector 2 is used to detect whether a processor circuit 8 has an attack vulnerability. In some embodiments, the processor circuit 8 includes: an out-of-order execution and branch prediction unit 81, a register 83, a data cache 85, a memory access unit (load-store unit) 87, and an arithmetic unit 89. The out-of-order execution and branch prediction unit 81 is used to decode instructions and execute the decoded instructions out of order. The out-of-order execution and branch prediction unit 81 has a branch prediction function and can record the branch prediction state (e.g., branch prediction execution state and branch prediction non-execution state) in a reorder buffer 811. The data cache 85 has a miss status holding register (MSHR) 851.

[0020] In some embodiments, detector 2 includes a first detection module 21, a second detection module 23, and a judgment module 25. Specifically, the first detection module 21 is used to determine whether a cache miss occurs in the data cache 85 of the processor circuit 8 during branch prediction execution. Due to the cache miss, a data fill request may be generated. The first detection module 21 is used to determine whether the MSHR 851 of the data cache 85 sends a data fill request to the lower-level memory 7 (e.g., L2 cache, bus-connected memory, etc.) during branch prediction execution, in order to obtain a first judgment result.

[0021] The second detection module 23 is used to determine whether the memory access unit 87 writes the data requested by the data backfill request to the register 83 in the branch prediction execution state, and to determine whether the arithmetic unit 89 accesses the data in the register 83 in the branch prediction execution state, so as to obtain a second judgment result. The judgment module 25 is used to determine whether the processor circuit 8 has an attack vulnerability based on the first judgment result and the second judgment result.

[0022] Please see Figure 2B In some embodiments, when the first detection module 21 determines that a cache miss occurs in the data cache 85 of the processor circuit 8 during the branch prediction execution state, and determines that the data cache 85 of the processor circuit 8 sends a data backfill request 850 during the branch prediction execution state, the second detection module 23 further determines whether the data requested by the data backfill request 850 has been written into the register 83 of the processor circuit 8 and processed during the branch prediction execution state.

[0023] Furthermore, when the second detection module 23 determines that the memory access unit 87 writes the data 852 requested by the data backfill request 850 from the data cache 85 into the register 83 of the processor circuit 8 in the branch prediction execution state, and determines that the arithmetic unit 89 accesses the data 852 in the register 83 in the branch prediction execution state, then the judgment module 85 determines, based on the detection results of the aforementioned first detection module 21 and second detection module 23, that the processor circuit 8 may have an attack vulnerability.

[0024] In some embodiments, when: (1) the first detection module 21 determines that the data cache 85 of the processor circuit 8 has not sent any data backfill request in the branch prediction execution state; (2) when the second detection module 23 determines that the data 852 requested by the data backfill request 850 has not been written into the register 83 of the processor circuit 8 by the memory access unit 87 in the branch prediction execution state; or (3) when the second detection module 23 determines that the data 852 has not been accessed by the arithmetic unit 89 in the branch prediction execution state, the judgment module 85 determines, based on the detection results of the first detection module 21 and the second detection module 23, that the processor circuit 8 may not have an attack vulnerability.

[0025] In some embodiments, the out-of-order execution and branch prediction unit 81 of the processor circuit 8 may further include, in addition to the reordering buffer 811, an instruction fetch / branch prediction unit, an instruction decode unit, and a register renaming / dispatch / retire unit.

[0026] It should be specifically noted that whether the aforementioned operations are performed in the branch prediction execution state can be determined based on the data in the reordering buffer 851 at the time of operation execution. Furthermore, in some embodiments, the aforementioned processor circuit, detector, and lower-level memory may include hardware circuitry. The components of the processor circuit (e.g., out-of-order execution and branch prediction unit, registers, data cache, memory access unit, arithmetic unit), the components of the detector (first detection module, second detection module, and judgment module), and the lower-level memory are electrically connected to transmit data and signals. In some embodiments, the signal and data transmission between the aforementioned processor circuit, detector, lower-level memory, and components can also be simulated by software (e.g., EDA).

[0027] Some embodiments of the present invention include a detection method for a processor circuit, the flowchart of which is shown below. Figure 3As shown. The processor circuit includes an out-of-order execution and branch prediction unit. The detection method of these embodiments is implemented by a detector (such as the detector in the aforementioned embodiments), and the detailed operation of the method is as follows. First, step S301 is executed to determine whether a data cache of the processor circuit sends a data backfill request in a branch prediction execution state, so as to obtain a first judgment result. If the first judgment result is negative, then step S304 is executed to determine that the processor circuit does not have an attack vulnerability. If the first judgment result is positive, then step S302 is executed to determine whether the data requested by the data backfill request is written into a register and operated on in the branch prediction execution state, so as to obtain a second judgment result. If the second judgment result is negative, then step S304 is executed. If the second judgment result is positive, then step S303 is executed to determine that the processor circuit has an attack vulnerability.

[0028] Some embodiments of the present invention include a detection method for a processor circuit, the flowchart of which is shown below. Figure 4 As shown. The processor circuit includes an out-of-order execution and branch prediction unit. The detection method of these embodiments is implemented by a detector (such as the detector in the aforementioned embodiments), and the detailed operation of the method is as follows. First, step S401 is executed to determine whether a data cache of the processor circuit has experienced a cache miss in a branch prediction execution state. If not, step S401 is repeated.

[0029] If step S401 is yes, proceed to step S402 to determine whether a data cache MSHR sends a data fill request to the lower-level memory in branch prediction execution state, to obtain a first determination result. If the first determination result is no, proceed to step S406 to determine that the processor circuit does not have an attack vulnerability. If the first determination result is yes, proceed to step S403 to determine whether a memory access unit of the processor circuit writes the data requested by the data fill request from the data cache to the register in branch prediction execution state. If no, proceed to step S406 to determine that the processor circuit does not have an attack vulnerability.

[0030] If the result of step S403 is yes, proceed to step S404 to determine whether an arithmetic unit of the processor circuit accesses register data in the branch prediction execution state, to obtain a second determination result. If the second determination result is no, proceed to step S406 to determine that the processor circuit does not have an attack vulnerability. If the second determination result is yes, proceed to step S405 to determine that the processor circuit has an attack vulnerability.

[0031] In summary, the detector and detection method for processor circuits provided by this invention can determine whether a specific attack operation mode (e.g., Spectre vulnerability attack mode) may exist through detection steps, so as to facilitate subsequent adjustments and modifications to the processor circuit.

[0032] The foregoing description briefly outlines the features of certain embodiments of the present invention, enabling those skilled in the art to more fully understand the various forms of the invention. Those skilled in the art will readily recognize that they can easily use the present invention as a basis to design or modify other processes and structures to achieve the same objectives and / or advantages as the embodiments described herein. Those skilled in the art should understand that these equivalent embodiments remain within the spirit and scope of the present invention, and various changes, substitutions, and modifications can be made without departing from the spirit and scope of the present invention.

[0033] [Symbol Explanation]

[0034] 1: Detector

[0035] 11: First Detection Module

[0036] 13: Second Detection Module

[0037] 15: Judgment Module

[0038] 2: Detector

[0039] 21: First Detection Module

[0040] 23: Second Detection Module

[0041] 25: Judgment Module

[0042] 7: Lower-level memory

[0043] 8: Processor Circuit

[0044] 81: Out-of-order execution and branch prediction unit

[0045] 811: Reordering Buffer

[0046] 83: Register

[0047] 85: Data Cache

[0048] 850: Data Backfill Request

[0049] 851:MHSR

[0050] 852: Data

[0051] 87: Memory Access Unit

[0052] 89: Arithmetic Unit

[0053] 9: Processor circuit

[0054] 91: Out-of-order execution and branch prediction unit

[0055] 93: Register

[0056] 95: Data Cache

[0057] 950: Data Backfill Request

[0058] 952: Data

[0059] S301~S304: Steps

[0060] S401~S406: Steps.

Claims

1. A detection method for a processor circuit, the processor circuit comprising an out-of-order execution and branch prediction unit, the detection method comprising: determining whether a data cache sends a data fill back request in a branch prediction execution state to obtain a first determination result; determining whether a data required by the data fill back request is written into a register and operated in the branch prediction execution state to obtain a second determination result; and determining whether the processor circuit has an attack vulnerability according to the first determination result and the second determination result, wherein determining that the processor circuit does not have the attack vulnerability when the first determination result indicates that the data cache does not send the data fill back request in the branch prediction execution state or the second determination result indicates that the data required by the data fill back request is not written into the register and operated in the branch prediction execution state; determining that the processor circuit does not have the attack vulnerability when the first determination result indicates that the data cache sends the data fill back request in the branch prediction execution state and the second determination result indicates that the data required by the data fill back request is not written into the register and operated in the branch prediction execution state; and determining that the processor circuit has the attack vulnerability when the first determination result indicates that the data cache sends the data fill back request in the branch prediction execution state and the second determination result indicates that the data required by the data fill back request is written into the register and operated in the branch prediction execution state.

2. The detection method of claim 1, further comprising: determining that the data cache has a cache miss in the branch prediction execution state.

3. The detection method according to claim 2, wherein, The step of determining whether the data cache sends the data fill back request in the branch prediction execution state further comprises: determining whether a miss status holding register of the data cache sends the data fill back request in the branch prediction execution state to obtain the first determination result.

4. A detector for a processor circuit, the processor circuit comprising an out-of-order execution and branch prediction unit, the detector comprising: a first detection module configured to: determine whether a data cache of the processor circuit sends a data fill back request in a branch prediction execution state to obtain a first determination result; a second detection module configured to: determine whether a data required by the data fill back request is written into a register of the processor circuit and operated in the branch prediction execution state to obtain a second determination result; and a determination module configured to: determine whether the processor circuit has an attack vulnerability according to the first determination result and the second determination result, wherein determine that the processor circuit does not have the attack vulnerability when the first determination result indicates that the data cache does not send the data fill back request in the branch prediction execution state or the second determination result indicates that the data required by the data fill back request is not written into the register and operated in the branch prediction execution state; determine that the processor circuit does not have the attack vulnerability when the first determination result indicates that the data cache sends the data fill back request in the branch prediction execution state and the second determination result indicates that the data required by the data fill back request is not written into the register and operated in the branch prediction execution state; and determine that the processor circuit has the attack vulnerability when the first determination result indicates that the data cache sends the data fill back request in the branch prediction execution state and the second determination result indicates that the data required by the data fill back request is written into the register and operated in the branch prediction execution state. determining that the processor circuit does not have the attack vulnerability when the first determination result indicates that the data cache sends the data fill request in the branch prediction execution state and when the second determination result indicates that the data required by the data fill request is not written into the register and operated in the branch prediction execution state; and determining that the processor circuit has the attack vulnerability when the first determination result indicates that the data cache sends the data fill request in the branch prediction execution state and when the second determination result indicates that the data required by the data fill request is written into the register and operated in the branch prediction execution state.

5. The detector of claim 4, wherein, The first detection module is further used to: determine whether the data cache sends the data fill request in the branch prediction execution state.

6. The detector of claim 5, wherein, The first detection module is further used to: determine whether a miss state holding register of the data cache sends the data fill request in the branch prediction execution state to obtain the first determination result.

7. The detector of claim 6, wherein, The first detection module is further used to: determine whether the miss state holding register of the data cache sends the data fill request to a lower layer memory in the branch prediction execution state to obtain the first determination result.

8. The detector of claim 4, wherein, The second detection module is further used to: determine whether the data required by the data fill request is written into the register from the data cache in the branch prediction execution state; and determine whether the data of the register is operated in the branch prediction execution state to obtain the second determination result.

Images