Method for defending ghost attacks by mshr-based superscalar risc-v processor hardware

Abstract

The present application belongs to the field of integrated circuit design, and specifically relates to a method for preventing a spectre attack on a superscalar RISC-V processor based on a missing state holding register (MSHR). The method comprises modifying the MSHR module with the original pipeline logic of the Berkeley open source processor BOOM; specifically, adding judgment logic to the MSHR module to prevent non-safe instruction information from being written into the data cache before leaving the error speculation path based on the original MSHR state machine; and adding timeout logic to solve the deadlock problem under certain conditions; and combining the above two points to prevent the spectre attack. The present application can successfully prevent attack variants such as spectre without making large-scale changes to the pipeline architecture, and the performance loss is relatively small.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of integrated circuit design, and particularly relates to a method for defending against spectre attack of a superscalar RISC-V processor based on a missing state holding register (MSHR). BACKGROUND

[0002] In recent years, the development of general-purpose processors has been greatly promoted by the introduction of superscalar processors. Along with the rapid development of processors, a series of security vulnerabilities have also emerged. Cache side channel attacks are one of the vulnerabilities that exploit the characteristics of computer hardware. In 2018, two attack models, meltdown and spectre, were proposed. They use high-performance technologies such as branch prediction at the microarchitecture level of the processor to bypass hardware security checks and obtain relevant data in a transient instruction stream, which has attracted attention from the academic and industrial communities. For the meltdown attack model, chip manufacturers such as Intel and AMD responded promptly by updating the operating system to address the vulnerability. For the spectre attack model, the attack is usually completed by exploiting the characteristics of the hardware itself, so we propose a hardware-level defense scheme against spectre attacks.

[0003] Transient instruction streams are specific instruction sequences that attackers introduce and that the general program does not actively execute. Side channel attacks based on transient instruction streams exploit security flaws in the hardware microarchitecture to complete the attack process, so they cannot be completely prevented at the operating system software level.

[0004] For high-performance processors, introducing defense schemes will have some impact, mainly in the following aspects:

[0005] 1. The introduction of related defense schemes will increase the additional hardware overhead, which will have some impact on the chip area and cost.

[0006] 2. Due to the high performance of modern processors, the introduction of security defense schemes essentially delays the execution of related instructions or the submission of states, which will inevitably affect the performance of the processor. While affecting the performance of the processor, attention must be paid to the competition with the performance of the processor.

[0007] 3. Since the details of the microarchitecture of processors from different manufacturers are not publicly disclosed, there will be significant differences in the implementation of different processor microarchitectures, as well as significant differences in the instruction set types and program execution environments.

[0008] The implementation of side channel attacks on processors means that there are conditions on modern processors that satisfy the implementation of attacks, mainly the following points:

[0009] 1. Most modern processors have cache structures;

[0010] 2. Most modern processors support superscalar out-of-order execution;

[0011] 3. For memory load instructions, different cache states may result in the same program execution results, but side characteristics such as execution time and power consumption may vary significantly.

[0012] Attack implementation principle

[0013] Taking flush+reload as an example, the basic principle of the attack can be combined with Figure 4 The following three stages are used to explain:

[0014] Phase 1: The attacker flushes the contents of the memory address (A) to be acquired from the cache (Flush).

[0015] Phase 2: Waiting for the victim’s code to access this memory address (A), thereby loading the contents of this address back into the cache;

[0016] Phase 3: The attacker re-accesses the memory address (A) and measures the time of this access. If the access time is within a certain standard, it means that the victim has accessed this address.

[0017] Therefore, the flush+reload method can be used to determine whether the victim has accessed a certain address and obtain the content stored at that address. In the above principle description, the attacker and the victim share a memory area. In actual attack scenarios, the victim's access to a certain address can also be constructed into the attacker's code. In other words, the storage content of any address to be attacked can be used as an address of the attacker's process and actively accessed by the attacker.

[0018] Since the fifth-generation reduced instruction set (RISC-V) does not currently support direct operations on cache lines, a workaround is needed to clear the cache. This can be achieved by loading new garbage content into the cache, such as writing all 0s, to overwrite the original cache line that you want to clear, thereby indirectly clearing the specified address of the cache.

[0019] Introduction to the Missing Status Holding Register (MSHR)

[0020] Because modern superscalar processors all use the Harvard architecture, the L1 cache is divided into an instruction cache for storing instructions and a data cache for storing data. Since the instruction cache only needs to be read, and instruction fetching requires a serial order, its processing is relatively special and cannot be simply handled using a non-blocking approach. Therefore, only the data cache is described. In a reduced instruction set processor, only instructions that access memory, such as memory load / write instructions, can access the data cache. For memory load / write instructions, both types of instructions may cause a data cache miss.

[0021] (1) For a load instruction, if the required data is not in the data cache, a miss occurs and the data needs to be obtained from the next level of physical memory. According to a certain algorithm, a cache line is found in the data cache to be written or replaced. If the cache line being written is dirty, the data block in this cache line needs to be written back to the physical memory first.

[0022] (2) For a storage instruction, if the address it carries is not in the data cache, for a write-back or write-allocate type cache, it is necessary to find the data block corresponding to this address from the physical memory, read it out, merge it with the data carried by the storage instruction, and find a cache line from the data cache according to a certain algorithm, and write the merged data into this cache line; if the cache line being replaced has been marked as dirty, then before being written, the data in the cache line being overwritten must be written back to the physical memory, so as to meet the requirements related to cache consistency.

[0023] Both of these situations are called data cache misses. As can be seen from the description above, whether it's a load instruction or a store instruction, when a data cache miss occurs, data must be exchanged between the data cache and physical memory. This process typically takes many cycles to complete. If another data cache miss occurs within these cycles, the processing is divided into blocking and non-blocking methods. The miss status holding register is a component that supports the non-blocking method.

[0024] To support non-blocking operations, the processor needs to store memory load / write instructions that have generated data cache misses. This component in modern processors is usually called the Miss Status / Information Holding Register (MSHR). To understand the working principle of the Miss Status Holding Register, it is necessary to clarify the following two concepts:

[0025] (1) Primary Miss: For a given address, the first miss generated when accessing the data cache is called a primary miss;

[0026] (2) Secondary Miss: After a first miss occurs and is not resolved, a subsequent instruction accessing the memory accesses the cache line where the miss occurred again. This is called a second miss. Two points need to be added here. First, a second miss does not refer to just a single miss. Before the cache line is retrieved back to the data cache, all subsequent load / store instructions accessing the cache line will generate a second miss. Second, the address used by the second miss does not necessarily have to be the same as the address used by the first miss, as long as they belong to the same cache line. Summary of the Invention

[0027] The object of the present invention is to provide a convenient and effective method for defending a superscalar RISC-V processor from Spectre attacks based on missing state retention registers.

[0028] The present invention provides a method for defending superscalar RISC-V processors against Spectre attacks based on a Missing State Holding Register (MSHR), a component common to all modern high-performance processors. This method modifies the existing pipeline logic and MSHR module of the Berkeley open-source BOOM processor. Specifically, based on the existing Missing State Holding Register (MSHR) state machine, judgment logic is added to the module to prevent unsafe instruction information from being written to the data cache before escaping the misspeculated path. Timeout logic is also introduced to address deadlock issues that may occur in certain situations.

[0029] In the present invention, the logic that prevents non-secure instruction information from being written to the data cache before escaping the misspeculated path is responsible for preventing the backfilling of data and metadata for instructions on the misspeculated path. If the current instruction does not escape the misspeculated path, it constitutes a condition for the formation of a side channel. By adding judgment logic (misspeculated path judgment logic) within the missing state holding register module, when the missing state holding register module is uncertain whether the instruction is safe, data backfill is prevented during data backfill.

[0030] The deadlock-resolving logic in this invention addresses the potential situation where all missing state holding register entries become fully occupied during speculative execution, potentially before a branch prediction result is available. If this occurs, the missing state holding register cannot remain in the information-committed state forever. To address this, the invention incorporates timeout logic. If the speculative state of the instruction remains unresolved after a set timeout, the missing state holding register module proactively abandons backfilling the current cache line.

[0031] The modification of the missing status holding register module (adding judgment logic and timeout logic) is as follows:

[0032] The path judgment logic uses the rob_pnr_idx signal in the ROB module of the BOOM processor. This signal is intended to indicate in the ROB whether the current instruction is a branch, jump, memory access instruction, or an exception has occurred. Introducing this signal into the missing status holding register module can indicate whether the current instruction is safe. The main principle of the judgment logic is to compare the rob_idx position of the first missing instruction with rob_pnr_idx and rob_tail_idx (the position of the last row of rob). When rob_pnr_idx is closer to rob_tail_idx than the rob_idx of the memory access instruction, the instruction is safe (untainted), and backfill can be initiated at this time.

[0033] The timeout logic adds an expire_time register to the missing state holding register module. This register increments by one every cycle while the missing state holding register module is in the s_commit_line state (commit line buffer data state), waiting for instructions to release the unsafe state. If the expire_time count exceeds a threshold, the missing state holding register module abandons backfilling to the cache.

[0034] The Missing Status Holding Register (MSHR) module of the BOOM processor handles various transactions in the following manner: Figure 3 The state machine shown in the figure is used to implement the state machine, and different situations are handled by jumping the state machine.

[0035] like Figure 2As shown, the Miss Status Holding Register module describes the behavior of transactions such as I / O port, bus, data cache misses, data refill, metadata refill, writeback, and prefetch. Because the BOOM processor configuration is highly parameterized, taking the MegaBOOM as an example, there are eight Miss Status Holding Register (MSHR) entries, meaning that up to eight memory access instruction misses at different addresses can be managed simultaneously. If all Miss Status Holding Registers are full, the pipeline will be stalled, significantly affecting processor performance.

[0036] Because data cache and bus response are closely related, the BOOM processor uses SiFive's open-source TileLink bus. TileLink is a high-performance bus that supports cache coherence. This bus is responsible for signal transmission between different cache levels, between cache and physical memory, and between different cores.

[0037] The state machine of the missing status holding register module contains a total of 16 states, namely s_invalid, s_refill_req, s_refill_resp, s_drain_rpq_loads, s_meta_read, s_meta_resp_1, s_meta_resp_2, s_meta_clear, s_wb_req, s_wb_resp, s_commit_line, s_drain_rpq, s_meta_write_rpq, s_mem_finish_1, s_mem_finish_2, and s_prefetch. Each state is described as follows:

[0038] Initial state (s_invalid): When the req_pri_val signal, i.e., the first missing signal, is valid, the state jumps from s_invalid to s_refill_rpq. On the contrary, if req_pri_val is valid and the data cache hits, the state jumps directly to s_drain_rpq.

[0039] The replay queue (rpq) is a queue used by BOOM to store miss information within the miss status register module. All memory access instructions that miss the same address enter a miss status register entry. Each entry contains an rpq queue, which in turn has 16 entries to handle primary misses and secondary misses of the same address. The branch status mask (br_mask) of each rpq queue entry is also updated based on whether the branch instruction is resolved.

[0040] Backfill request state (s_refill_rpq): This state sends a grant signal to the L2 cache through the A channel of TileLink. If the bus Tilelink arbitration receives the grant handshake signal, it jumps to the s_refill_resp state.

[0041] Backfill response state (s_refill_resp): The data is temporarily stored in the line buffer. If the data is a data, the state jumps to s_drain_rpq_loads. Otherwise, if it is an address, the state jumps to s_drain_rpq.

[0042] The line buffer is a buffer, which is equivalent to a register group, used to temporarily store the information of the related subsequent cache backfill.

[0043] Fast backfill of regular load state (s_drain_rpq_loads): In this state, the concept of drain_load is distinguished. Drain_load indicates a normal load instruction other than the atomic instruction LR and write instructions. The main purpose is to quickly deliver the data of normal load instructions to the core. Other cases need to wait until the s_drain_rpq state is executed again (replay). If it is a drain_load, it will end directly in the s_drain_rpq_loads state and be dequeued from the rpq queue; other load and write instructions need to jump to the s_meta_read state. If it is a prefetch miss, and because prefetch will not be queued in the rpq queue, it is necessary to wait until the rpq queue is empty and then jump to the s_mem_finish_1 state.

[0044] Metadata read state (s_meta_read): In this stage, the request is submitted to the meta_read port, and after waiting for the data handshake, it jumps to the s_meta_resp_1 state.

[0045] Metadata response first state (s_meta_resp_1): Take a beat and jump to s_meta_resp_2 state.

[0046] Metadata response second state (s_meta_resp_2): It is necessary to determine whether a write back is required. If not, the state jumps to s_commit_line. If the corresponding cache block is dirty and needs to be written back, the state jumps to s_meta_clear. If a NACK conflict occurs, the state jumps back to s_meta_read.

[0047] BOOM defines nack as follows: BOOM's data cache is equivalent to a listening cache. There is a probe unit to detect consistency requests from other cores on the bus and update the consistency information of the cache lines in the data cache of the current core. If the index bit in the address of the request sent to the data cache corresponds to the index bit of the metadata write (meta_write) port of the probe, and the request port of the probe is not ready, then it indicates that a nack has occurred. If the nack is valid, the current metadata information (meta_resp) needs to be discarded, and the process returns to the meta_read state and waits for the consistency parameters to be updated before re-execution.

[0048] Metadata clear state (s_meta_clear): This state requires writing the metadata information of the corresponding cache block (referring to the cache tag and consistency information) back to the next level cache, and then writing it to the physical memory. After the information handshake, jump to the s_wb_req state.

[0049] Writeback request status (s_wb_req): Sends a request to write back metadata information to the writeback unit module (writeback unit), and at the same time sends the ID to the writeback unit module, allowing the unit to complete the data writeback.

[0050] Write back response state (s_wb_resp): In this state, wait for the response signal of the write back unit module. If the response signal is valid, jump to the s_commit_line state.

[0051] Commit line buffer data state (s_commit_line): Read data from the line buffer read port based on the missing ID transmitted from the previous data cache, wait for the line buffer handshake, and then pass the handshake data to the missing state holding register module for further transmission to the data cache. The data cache's data write port first writes the data to the data array. Writing metadata information requires waiting until the s_meta_write state. That is, the BOOM missing state holding register (MSHR) writes data (data) and metadata (cache tag, consistency information) to the data cache separately in different states. After data backfill is complete, jump to the s_drain_rpq state.

[0052] Re-execution state (s_drain_rpq): This state corresponds to the conventional miss handling approach. Conventional miss handling involves replaying the data after retrieving it from the cache. This is considered a cache hit, and the cache hit logic is executed. In BOOM, to improve performance, the linebuffer information for common load instructions is already provided to the core in the s_drain_rpq_loads state. All other write instructions or atomic instructions must be re-executed in the s_drain_rpq state. Dirty block information for write instructions must also be updated in this state. The state then jumps to the s_meta_write_req state.

[0053] Metadata write request state (s_meta_write_req): Submit the metadata write request to the meta_write port, update the metadata information of the backfilled cache block, and jump to the s_mem_finish_1 state after the information handshake.

[0054] Waiting for bus acknowledgment state (s_mem_finish_1): In this state, the system waits for the grant signal from other cores on the TileLink's E channel to confirm that the reception is correct (grant ack). Then, the system jumps to the s_mem_finish_2 state.

[0055] Prefetch judgment state (s_mem_finish_2): If the prefetched data is in the s_drain_rpq_loads state, it will jump directly to the s_mem_finish_1 state. In the s_mem_finish_2 state, if the prefetched data jumps to the s_prefetch state, all other cases will jump to s_invalid and execute the next miss.

[0056] Handling prefetch miss state (s_prefetch): If the second miss (secondary miss) is not ready (for example, the probe detects a conflict with other requests from other buses or the permission to support the secondary miss is insufficient), jump directly to the s_invalid state; if the second miss is ready, first check whether it has a hit. If it has a hit, it means that the cache line has been obtained for the first miss, and jump directly to s_meta_read to continue waiting for the data. If it is a miss, it means that there is no permission. At this time, it is necessary to return to the s_refill_req state to re-request the cache line; if it is ready for the first miss, directly call the handle_pri_req processing function and return to the s_refill_req or s_drain_rpq state.

[0057] In the present invention, the state machine of the missing state holding register module is described as follows Figure 2 As shown, the main idea of ​​this defense solution is to defend in the s_commit_line state, prevent the information of related unsafe memory access instructions from being written in advance, and solve the problem of hardware deadlock by adding timeout logic.

[0058] Native BOOM processor architecture vulnerability: Conventional defenses require "shadow hardware" to temporarily store memory access results during speculative execution of memory access instructions. This shadow hardware ensures that subsequent processor access requests to addresses on the cache line receive timely responses. Furthermore, when an instruction is proven correct after de-speculation, the cache can be backfilled using the results temporarily stored in the shadow hardware, ensuring subsequent accesses to the cache line will hit. Therefore, the line buffer structure in the BOOM processor's MSHR naturally serves as shadow hardware. The native BOOM Miss Status Register (MSHR) is designed to backfill the data cache as soon as the line buffer receives missing data from the downstream cache. The secure architecture requires the line buffer to continuously determine the safety of a missed memory access request after receiving data from the downstream cache. If the instruction is ultimately deemed safe, the backfill process is initiated; otherwise, if the instruction is aborted within the core, the backfill process is aborted.

[0059] Compared with the prior art, the beneficial effects of the present invention are embodied in:

[0060] (1) Based on a mature high-performance processor pipeline, by modifying part of the state machine logic of the BOOM missing state holding register module, without making large-scale changes to the pipeline architecture, the logic of preventing unsafe instructions from being written back to the data cache is added to the memory access part. This can successfully defend against attack variants such as Spectre, while at the same time causing relatively little performance loss.

[0061] (2) This solution makes relatively few changes to the logic in the BOOM processor missing state holding register module, and has a smaller area overhead than other defense solutions that change the pipeline part. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 A method model for hardware defense against Spectre attacks on MSHR-based superscalar RISC-V processors.

[0063] Figure 2 This is a diagram of the interaction architecture between BOOM's Missing Status Holding Register (MSHR), data cache (dcache), and core.

[0064] Figure 3 This is a state machine diagram for the BOOM Missing Status Holding Register (MSHR) module.

[0065] Figure 4 This is a flush+reload diagram. DETAILED DESCRIPTION

[0066] 1. Specify a safe path to backfill to the data cache

[0067] according to Figure 1The scheme defines the unlocked and can_commit signals. For can_commit, it indicates whether the current miss backfill information can be passed back to the core. We believe that the data and metadata information can be submitted when the first miss request is issued, that is, the can_commit signal is high, and at the same time, the can_commit signal of the memory miss that is rolled back under a certain branch is low. For the unlocked signal, it can indicate whether the current instruction is safe. It is divided into the following situations. In the case of the first miss request, if the cache tag information matches and is valid but the permission is insufficient (there are many reasons for insufficient permission, such as reading an expired data), it is directly set to safe. In this case, the s_invalid state calls the handle_pri_req function to process and jump to the s_refill_req state, and further update the permission in the MSHR state machine. If the cache tag information does not match, it means that the cache line does not exist in the data cache. It is a normal cache miss. In this case, as long as the memory access request type is not an ordinary load instruction, it is considered safe. The reasons are as follows:

[0068] The following situations do not satisfy the normal loading instructions:

[0069] ①LR, SC mutually exclusive atomic instructions. For LR and SC instructions, although no more than 16 instructions can be interspersed between the two, these instructions are limited to the RISC-VI instruction set (integer instruction set) and cannot have memory access instructions, so it is safe at this level;

[0070] ② For write instructions such as store, the information leaked is the read instruction, and this solution does not prevent the execution of the write instruction;

[0071] ③ AMO atomic instructions other than LR and SC, such as the atomic algorithm instruction AMOADD, are considered safe because they have fixed execution time;

[0072] ④HLVX (hypervisor virtual machine load instructions). For BOOM, CPU virtualization is not considered for the time being.

[0073] For the original BOOM design, the missing state holding register module starts backfilling immediately after entering the s_commit_line state. Figure 1As shown, the security architecture enters this state and waits for the MSHR to execute. Each cycle, it checks whether the first missing instruction in the current MSHR is safe. This detection method utilizes the rob_pnr_idx signal within the BOOM ROB module, which indicates whether the current instruction is safe. The rob_idx position of the first missing instruction is compared with rob_pnr_idx and rob_tail_idx. When rob_pnr_idx is closer to rob_tail_idx than the instruction's rob_idx, the instruction is considered safe, and backfill can be initiated, with the lb_commited signal high. If the first missing instruction is on a misspeculated path and is ultimately retired by the core, the MSHR abandons backfilling for this cache line and pulls the lb_commited signal low. After backfilling is complete or abandoned, the state machine jumps to s_drain_rpq.

[0074] Since all memory access requests recorded in a single MSHR are necessarily for the same cache line, if a primary miss is safe, then even if a secondary miss occurs on an incorrect inference path, line buffer backfilling will not cause a safety issue. Conversely, if a primary miss is aborted by the core and the MSHR abandons backfilling the cache line, then for safe read requests in the RPM, abandoning backfilling will only result in a performance loss and will not affect security or program functionality.

[0075] 2. Avoid deadlock

[0076] There is a problem with the state machine design of the native BOOM missing state holding register module. Consider the following instruction segment:

[0077] addr = ... / / Complex ALU

[0078] X=load(addr)

[0079] if(X){

[0080] load0

[0081] load1

[0082] load2

[0083] …loadn

[0084] }

[0085] In this code, the direction of a conditional branch depends on a memory load instruction, load(addr). However, the memory address addr for this instruction requires complex ALU calculations. Therefore, if(X) is executed speculatively for a long time using branch prediction. Consequently, the series of memory access instructions, such as load0 through loadn, are speculatively issued to the cache. Consider the following scenario: if load0 through loadn all miss and access different cache lines, these memory access instructions will occupy entries in the Miss Status Holding Register (MSHR) one by one. If n is large enough, all entries in the MSHR may be occupied. The current safety architecture prevents these speculative memory access instructions from directly backfilling the cache and requires them to wait for the branch result of if(X) to resolve. However, the value of X must be obtained through load(addr). Once addr is finally calculated, the load(addr) request to the cache cannot be processed because the MSHR entries are already occupied by load0 through loadn. This results in a deadlock in the program.

[0086] To resolve the deadlock, the missing state holding register module cannot stay in the s_commit_line state forever. There are two solutions:

[0087] (a) When the MSHR enters the s_commit_line state and the current first missing request instruction has not yet been de-speculated, a timeout period, expire_time, is set for the entry. If the instruction's speculative status is still not resolved after the set time, the MSHR proactively abandons backfilling the current cache line;

[0088] (b) Once the MSHR enters the s_commit_line state and the current first miss request instruction has not yet been de-speculated, subsequent first miss requests are immediately allowed to evict the current MSHR entry. Essentially, this acts as a variable timeout (depending on when the next first miss request arrives).

[0089] If deadlock occurs frequently, solution (a) may cause more frequent long waits at the MSHR (depending on the specific value of the timeout); conversely, if the processor frequently has miss requests for different cache lines, solution (b) will cause a large amount of correct data to be unable to be backfilled into the cache (some speculative memory accesses are ultimately safe and only need to wait for the parsing of the speculative results in the s_commit_line state, but new memory access requests may cause the MSHR entry to directly abandon the backfill). Considering that deadlock is relatively rare in processors, the hardware security solution for superscalar RISC-V processors based on the missing state holding register adopts the following Figure 1The (a) solution shown in the figure is used, and the timeout period is artificially set to 200 clock cycles.

Claims

1. A method for defending a superscalar RISC-V processor from Spectre attacks based on missing state retention registers, characterized in that: This involves modifying the Missing State Holding Register (MSHR) module based on the original pipeline logic of the Berkeley open-source processor BOOM. Specifically, based on the original Missing State Holding Register (MSHR) state machine, judgment logic is added to the module to prevent unsafe instruction information from being written to the data cache before escaping the misspeculated path. Timeout logic is also added to resolve deadlock issues that may occur in certain situations. The logic that prevents non-secure instruction information from being written to the data cache before escaping the misspeculated path is responsible for preventing the backfilling of data and metadata for instructions on the misspeculated path. If the current instruction has not escaped the misspeculated path, the conditions for the formation of a side channel are formed. By adding judgment logic to the missing state holding register module, when the missing state holding register module is uncertain whether the instruction is safe or not, data backfill is prevented. Among them, the deadlock-related logic is responsible for handling the situation where all the missing state holding register entries are occupied during a long period of speculative execution before the branch prediction result comes out; for the above situation, a timeout logic is added to the missing state holding register. If the speculative state of the instruction is still not resolved after the set time, the missing state holding register module will actively give up backfilling the current cache line.

2. The method according to claim 1, wherein: The judgment logic and timeout logic are added to the missing status holding register module. The specific steps are as follows: Add judgment logic, specifically using the rob_pnr_idx signal in the ROB module of the BOOM processor. This signal is originally intended to indicate in the ROB whether the current instruction is a branch, jump, memory access instruction, or an exception occurs. This signal is introduced into the missing status holding register module to indicate whether the current instruction is safe. The main principle of this judgment logic is to compare the rob_idx position of the first missing instruction with rob_pnr_idx and rob_tail_idx. When rob_pnr_idx is closer to rob_tail_idx than the rob_idx of the memory access instruction, the instruction becomes safe and backfill can be started at this time. Add timeout logic and add an expire_time register in the missing status holding register module. When the missing status holding register module is in the s_commit_line state waiting for instructions to release the unsafe state, the register increments by one every cycle. When the expire_time count exceeds the threshold, the missing status holding register module gives up backfilling to the cache.

Images