Hardware mitigations for attacks like Spectre and Meltdown

Abstract

The embodiment includes a circuit including a first global generation counter (GGC) that is incremented upon decoding of the branch instruction and a second GGC that is incremented upon completion of the branch instruction. Upon a triggered rollback, the first GGC is reset. The circuit further includes a generation tag memory that accepts loads during a side channel attack and is associated with a register to which the first GGC is set upon the first load, and a decision unit for determining, for a second load from an address that depends on the first load's register, a generation tag value associated with the second load's register as a function of the first GGC, the second GGC, and the generation tag value associated with the first load's register. The wait queue is configured to block the second load if the generation tag is greater than the second GGC.

Description

[Technical Field]

[0001] The present invention relates generally to computer processing, and more particularly to blocking side-channel attacks against processors. [Background technology]

[0002] Processor design for modern information technology infrastructure is both a science and an art. Processor complexity continues to increase as architecture sizes shrink. Meanwhile, cybersecurity attacks against IT infrastructure, aimed not simply at stealing data but at degrading the functionality of entire computer systems, are proliferating. One highly sophisticated attack can be directed at the internal workings of a processor, specifically at out-of-order (OoO) processors, which do not execute machine instructions in the order they were programmed or in the order in which the compiler optimized the flow of machine instructions. Instead, OoO processors optimize the sequencing of instructions at the hardware level, resulting in even greater performance.

[0003] One of these hardware-level optimization techniques involves branch prediction. In some OoO processors, the front end (i.e., the incoming stream of instructions) and back end (i.e., the resulting string of instructions) are executed in order, but the instructions themselves between the front end and back end may be executed out of order. Everything in the back end is reordered, checked for dependencies, and committed or rolled back. Thus, rollbacks only affect the processor's architectural state (i.e., register and memory contents). Rollbacks do not affect microarchitectural state such as caches and translation lookaside buffers (TLBs). While this optimization technique can further improve the performance of modern central processing units (CPUs), it can also open the door to attacks against the microarchitectural state.

[0004] Meltdown and Spectre are two types of attacks that have emerged in recent years. Meltdown attacks violate a fundamental assumption of operating system security: applications running in user space cannot access kernel memory. This can be important because kernel memory may contain sensitive information from other applications, such as passwords. To enforce this access restriction, operating systems utilize page tables to divide virtual memory into sections: one for the kernel and one for untrusted user-mode applications. The kernel then relies on the processor to allow the more privileged kernel access to both sections, while restricting user applications to the user portion. However, some processors have been shown to not maintain this restriction. A Meltdown attack can occur when kernel memory is leaked into user mode via OoO execution long enough to be captured by a side-channel cache attack.

[0005] Spectre, on the other hand, is a type of exploit, of which two have been discovered. An attacking application preemptively teaches a branch prediction cache so that the victim application speculatively executes a malicious code path. Speculative execution has a special type of Out-of-Band (OoO) execution that makes Spectre similar to Meltdown. Execution of this malicious code path is rolled back, but metadata is left in the cache that is susceptible to side-channel attacks. Side-channel attacks may leak some information depending on timing or other means beyond the architectural state. While application code modifications may be implemented to defend against potential security breaches caused by Meltdown and Spectre attacks, such modifications may be expensive and unreliable. Summary of the Invention

[0006] An embodiment of the present invention is directed to blocking side-channel attacks on a processor. A non-limiting exemplary system includes a processing circuit including a first global generation counter (GGC) that increments for each decode and prediction of a branch-type instruction and a second GGC that increments for each completion of the branch-type instruction. The first GGC counter is configured to be reset upon a triggered rollback to a value of the second GGC. The circuit also includes at least one generation tag memory, each associated with at least one register on the processor that receives a load during a side-channel attack. Each of the at least one generation tag memory is configured to store a generation tag value associated with the register. Each of the at least one generation tag memory is configured such that, upon a first load, the value of the first global generation counter is set in the register associated with the first load. The circuit also includes a determination unit configured to determine, for a second load of the at least one register loaded from an address dependent on the value of the register of the first load, a generation tag value associated with the register of the second load. The generation tag value of the second load is a function of the value of the first global generation counter, the value of the second global generation counter, and a register generation tag value associated with the register of the first load. The circuit also includes a wait queue configured to block the second load if the determined generation tag value is one or more generations ahead of the value of the second global generation counter.

[0007] Other embodiments of the present invention embody features of the above-described systems in computer-implemented methods and computer program products.

[0008] Additional technical features and advantages are realized by the techniques of the present invention. Embodiments and aspects of the present invention are described in detail herein and are considered a part of the claimed subject matter. For a better understanding, please refer to the detailed description and drawings. [Brief explanation of the drawings]

[0009] The particulars of the exclusive rights set forth herein are particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other features and advantages of embodiments of the present invention will become apparent from the following detailed description taken in conjunction with the accompanying drawings.

[0010] [Figure 1] FIG. 1 is a block diagram of an embodiment of a processing circuit for blocking side-channel attacks on a processor in accordance with one or more embodiments of the present invention. [Figure 2] FIG. 1 illustrates an example of blocking side-channel attacks on a processor in accordance with one or more embodiments of the present invention. [Figure 3] FIG. 1 illustrates an example of blocking side-channel attacks against a processor in accordance with one or more embodiments of the present invention. [Figure 4] FIG. 1 illustrates an example of blocking side-channel attacks on a processor in accordance with one or more embodiments of the present invention. [Figure 5] FIG. 1 is a block diagram of one embodiment of an out-of-order (OoO) processor core in accordance with one or more embodiments of the present invention. [Figure 6] 1 is a flowchart of a method for blocking side-channel attacks on a processor in accordance with one or more embodiments of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0011] One or more embodiments of the present invention are directed to blocking side-channel attacks on a processor.

[0012] As used herein, the term "blocking" refers to an instruction that is not forwarded by a processor's instruction wait queue to an execution unit in an out-of-order (OoO) manner for an associated register. Instead, the blocking may remain active until a condition is met, such that the instruction is executed in-order, or alternatively, in a "less" OoO manner. For example, one instruction may enter the OoO region at a later point in time as soon as a condition is met.

[0013] As used herein, the term "side-channel attack" refers to unauthorized or inappropriate access to memory or other data by a particular form of malware in a computer system. A side-channel attack can target data remaining in memory where it should not. For example, an attack can occur when a speculative load relies on a previous speculative load whose address is outside the valid checked range of a malicious process control for memory addresses.

[0014] As used herein, the term "register" refers to the well-known processor core internal storage where instructions and data are stored for processing by one of the execution units.

[0015] As used herein, the term "load" refers to data and / or instructions being stored in a register.

[0016] As used herein, the term "first global generation counter" refers to a newly introduced element in the processor core that has a value that can be incremented each time a branch-type instruction is decoded by the processor's instruction / data decoder.

[0017] As used herein, the term "prediction" refers to branch prediction, which attempts to guess which way a branch instruction (e.g., an if-then-else or conditional jump) will go, or the address of the target of a branch, before it is known with certainty. The purpose of branch prediction is to improve the flow of the instruction pipeline to increase processor performance.

[0018] As used herein, the term "branch-type instruction" refers to, but is not limited to, if-then-else instructions and conditional jump instructions.

[0019] As used herein, the term "triggered rollback" refers to the eventual known incorrect prediction not using the results of instructions already executed on the predicted branch path.

[0020] As used herein, the term "generation tag memory" refers to storage closely related to registers that can store counter values, i.e., generation tag values.

[0021] As used herein, the term "first load" may refer to a first indirect load to a first register.

[0022] As used herein, the term "second load" may refer to a second indirect load to a second register. In some cases, the first register and the second register may be the same.

[0023] As used herein, the term "wait queue" refers to a well-known element of a processor that determines the order in which incoming instructions are executed. The wait queue may determine the delivery of data and instructions to registers and execution units for OoO execution, or, according to one or more embodiments of the present invention, may disable OoO execution, forcing in-order execution or delaying OoO execution until after all conditions are met.

[0024] As used herein, the term "one generation ahead" refers to the situation where the stored generation tag value of the register being loaded is greater than the second global generation counter ("GC_COMPLETE").

[0025] As used herein, the term "cache flush" refers to the contents of cache memory being declared invalid due to the fact that other data is actually needed from main memory in the cache.

[0026] As used herein, the term "immediate load" refers to the direct loading of a register with a particular value.

[0027] As used herein, the term "indirect load" or "relative load" refers to a register being loaded with a value that depends on the address of the load instruction (the value is relative to the instruction address).

[0028] As used herein, the term "load and store unit" refers to a specialized execution unit that is responsible for executing load and store instructions, generating virtual addresses for load and store operations, and loading data from memory / cache memory or restoring data from registers to memory / cache memory.

[0029] One or more embodiments of the present invention provide for blocking side-channel attacks against a processor, which provides multiple benefits and technical effects.

[0030] in general, LatestSide-channel attacks against central processing unit processors (CPUs), particularly those operating according to the OoO framework, may be blocked or avoided entirely, or both, by one or more embodiments of the present invention. One or more embodiments may also avoid modifying application software, middleware software, or operating system software, or a combination thereof, to address potential side-channel attacks.

[0031] One interesting aspect of these side-channel attacks is that the speculation on a second load may use the value of a previously speculative first load as part of the address for the second load. In other words, exploiting Spectre or Meltdown may require a speculative dependent load of a speculative load that may hold an address controlled by the attacker. One or more embodiments of the present invention go beyond current workarounds, such as OoO barriers at branch points, which result in subsequent loads no longer being speculative. However, such solutions may significantly degrade processor performance.

[0032] The performance impact of one or more embodiments of the present invention is minimal, as they only delay the affected instructions, while all other instructions are able to execute in a normal OoO scheme as in an unprotected processor.

[0033] One or more embodiments of the present invention also make unnecessary other countermeasures such as building data dependencies from control dependencies, or measures to slow branch behavior and / or global branch prediction barriers, or tagging, which may only be useful against a subset of currently known side-channel attacks (e.g., Spectre 2).

[0034] In accordance with one or more embodiments of the present invention, no software changes are required to existing applications or other programs and / or compiler optimization routines.

[0035] Another advantage of one or more embodiments of the present invention is that the total amount of extra hardware (logic gates and registers) is feasibly small, both in terms of area (size) and timing (processor frequency), as an addition to an existing design, which may allow it to be implemented without sacrificing typical processor performance, even if new features are not used.

[0036] According to one useful embodiment of a processing circuit, a processor may include at least one of a central processing unit, a core of a CPU, and a thread of a core of a processor, all of which may have speculative branch predictions that may be executed and thus may be victims of side-channel attacks.

[0037] According to an embodiment of the present invention, a rollback may be triggered based on one of the events selected from the group consisting of a misprediction of a branch-type instruction, a restart of a pipeline in the processor, and a flush of a cache of the processor. All of these triggering events include: Latest CPU efficiency Latest However, one or more embodiments of the present invention may allow these trigger events for rollback and also prevent side-channel attacks.

[0038] According to an embodiment of the present invention, upon a triggered rollback, all values ​​in the generation tag memory associated with a register associated with one of the triggering events may be set to a second global generation counter, as described in more detail below with reference to Rule 6.

[0039] According to one or more embodiments of the present invention, the first load may be an immediate load or a relative load. The first load may not be controllable by a side channel attack, and therefore the first load is not vulnerable to a malicious process. Therefore, the type of load instruction is not important.

[0040] According to one or more embodiments of the present invention, the decision unit may be part of a load and store unit of a processor. Ibis may be a natural place in the architecture of an OoO processor, since all the relevant status required for the proposed concept may be present in the processor's load and store units.

[0041] According to one or more embodiments of the present invention, the register of the first load is the same as the register of the second load. Ibis may be a requirement for Spectre and Meltdown type attacks against OoO processors. Thus, one or more embodiments may address precisely this security hole and render Spectre and Meltdown type attacks impossible through hardware processor-internal countermeasures.

[0042] According to one or more embodiments of the present invention, blocking may further depend on whether the data for the second load is in the processor's cache. If the data is already in the cache, a side-channel attack will not be possible. Thus, malicious instructions will not be "introduced" into the cache memory via a side-channel attack.

[0043] According to one or more embodiments of the present invention, the functional dependency is at least one of the following: if the value of the first global generation counter is equal to the value of the second global generation counter, then the generation tag value of the second load is set equal to the value of the second global generation counter; if the value of the first global generation counter is equal to the generation tag value of the first load, then the generation tag value of the second load is set equal to the generation tag value of the first load; if the value of the first global generation counter is greater than the generation tag value of the first load, then the generation tag value of the second load is set equal to the generation tag value of the first load plus one.

[0044] These dependencies may allow for simple and straightforward implementation of the proposed processing circuits and methods, and are further described below with reference to Rules 1, 2 and 4.

[0045] The figures are described in detail below. All instructions in the figures are schematic. First, a block diagram of a circuit for implementing an embodiment for blocking side-channel attacks on a processor is given. Afterwards, further embodiments and an embodiment of a method for blocking side-channel attacks on a processor are described.

[0046] 1 is a block diagram of an embodiment 100 of a processing circuit for blocking side-channel attacks against a processor 102, particularly an OoO processor. Instruction blocking can result in delayed or in-order execution of instructions executed by the OoO processor 102. That is, OoO execution of an instruction is partially blocked or postponed to a later time. OoO execution can involve speculative execution of branch-type instructions. The processor 102 includes at least one register 108 that can receive a load during a side-channel attack.

[0047] 1 also includes a first global generation counter (first GGC or GC_DECODE) 106 that is incremented for each decode and prediction of a branch instruction, which may be a conditional jump instruction at the entry of OoO execution.

[0048] The processing circuit 104 also includes a second global generation counter (second GGC or GC_COMPLETE) 108 that is incremented each time a branch-type instruction completes. global The branch-type instruction mentioned in the context of the generation counter 106 is not necessarily the same branch instruction mentioned in the context of the second global generation counter 108. Thus, the two branch-type instructions mentioned may be different.

[0049] The first global generation counter 106 is configured to be reset by the reset unit 110 to the value of the second global generation counter upon a triggered rollback, the rollback possibly relating to the rollback of a mispredicted branch that is the target of or follows a branch-type instruction.

[0050] The processing circuit 104 also includes at least one generation tag memory 116 configured to store a generation tag value (GT_REGx) associated with at least one register 118 of the processor 102. In a possible implementation, the generation tag may be implemented as a few extra bits for the register, such that each register has a generation tag memory 116 associated with it.

[0051] Each of the at least one generation tag memory 116 is configured to be set to the value of the first global generation counter 106 upon a first load of the associated register.

[0052] Additionally, the processing circuit 104 also includes a decision unit 112. The decision unit 112 may be associated with a generation tag memory 116 and stores at least one register (typically a first load register (REG 1The processor may be configured to determine a generation tag value (GT_REG2) associated with the second load's register (REG1) for a second load of the register, the second load being a second register (REG2) loaded from an address that depends on the value of the first global generation counter (GC_DECODE) 106, the value of the second global generation counter (GC_COMPLETE) 108, and the register generation tag value (GT_REG1) associated with the first load's register (REG1).

[0053] Furthermore, the processing circuit 104 also includes a wait queue 114 configured to block the second load (i.e., the dependent one of the two loads) only if the determined generation tag value (GT_REGx) is more than one generation ahead (i.e., greater than) the value of the second global generation counter (GC_COMPLETE) 108, or to reject the instruction until it is available to be executed.

[0054] Thus, one or more embodiments of the present invention are based on the idea of ​​allowing full OoO speculation for most instructions and for at least one level of speculation for loads by blocking speculative dependent loads for speculative loads through tagging based on global generation counters.

[0055] Before moving on to the next diagram, here are some simple examples: By convention, the expression Rx=[Ry] means that register x is loaded from an address that depends on the contents of register y.

[0056] Below are five examples of when each type of access is acceptable:

[0057] Example 1: R1 = [R0]; branch; R2 = [R1]; since R2 = [R1], there is only one speculative load, not two.

[0058] Example 2: Branch; R1=[relative]; R2=[R1]; R3=[R2]; where [relative] is a load of an absolute or relative address, and because R1=[relative] this does not depend on any value from before the branch.

[0059] Example 3. R1=[R0];branch; R2=[R1nospec];R3=[R2];R4 =[R3];The load of R3 is not speculative because R2 is loaded non-speculatively (e.g. because the branch has already completed).

[0060] Example 4: R1=[R0];branch;R2=[R1];R3=[R2nnspec];R4=[R3];Since R2 is the only speculative load, R3 is loaded non-speculatively, and R4 is the same as in example 3.

[0061] Example 5: R1=[R0];branch;R2=[R1];R3=[R1];Since R2 and R3 are independent of each other;in order to take advantage of speculation, a dependency is required.

[0062] However, the following access, for example, would be potentially dangerous and not allowable: R1=[R0];branch;R2=[R1];R3=[R2]; in this case R3 would have a value determined by the address of R2 which in turn depends on the address of register R1. This would represent a dangerous case in the sense of a side-channel attack.

[0063] This is because an attacker would want a speculative load followed by a dependent speculative load (i.e., one speculative load is not enough). Therefore, one or more embodiments of the present invention have two global generation counters: one (GC_DECODE) that is incremented upon decode of every branch-type instruction (i.e., upon entry into OoO processing), and another (GC_COMPLETE) that is incremented upon completion of each such branch-type instruction. Furthermore, one or more embodiments provide for resetting GC_DECODE to the value of GC_COMPLETE in the event of a misprediction, restart, or cache flush.

[0064] According to one or more embodiments of the present invention, a generation tag is attached to each register GT_REG, and for immediate or relative loads, GT_REG is set to the value of GC_DECODE. When loading register R2 from an address based on register R1, double dependencies are tracked by calculating the registered generation tag GT_REG2 based on GC_COMPLETE and GT_REG1. Then, as a key step, the load is blocked if GT_REG is more than one generation ahead of GC_COMPLETE.

[0065] Subsequently, six rules can be applied when loading REG2 from [REG1] in accordance with one or more embodiments of the present invention.

[0066] 1. if (GC_DECODE =GC_COMPLETE) then GT_REG2 = GC_COMPLETE; (If the GC decode value and the GC complete value are equal, set the GC complete value to the value of GT register 2.)

[0067] 2. if (GC_DECODE -GT_REG1 =0) then GT_REG2 = GT_REG1; (If the value obtained by subtracting the value of GT register 1 from the value of GC decode is 0, set the value of GT register 2 to the value of GT register 1.)

[0068] 3. if (GT_REG1 -GC_COMPLETE >= 1) then reject this operation / instruction; (If the value of GT register 1 minus the value of GC complete is 1 or greater, reject this operation / instruction.)

[0069] 4. if (GC_DECODE-GT_REG1 > 0) then GT_REG2 = GTREG1 + 1 (If the value obtained by subtracting the value of GT register 1 from the value of GC decode is greater than 0, set the value of GT register 2 to the value obtained by adding 1 to the value of GT register 1.)

[0070] Additionally, relevant rules include:

[0071] 5. relative / immediate load: GT_REG2 = GC_DECODE (performs a relative / immediate load and sets the value of GT register 2 to the value of GC decode.)

[0072] 6. On rollback: GT REGO = GT REG2 ....= GT REGn = GC DECODE = GC COMPLETE (Perform a rollback and set the GC complete value to GT register 0, GT register 2, ...., GT register n, and GC decode values.)

[0073] According to one or more embodiments of the present invention, the incrementing of the counter and the addition of rule 4 are logical additions, so that wraparound can be handled.

[0074] A limited range of values ​​for small counters (i.e., only a few bits available for the counter) can also be considered. For sufficiently large counters (larger than the OoO window), it is known that GC_DECODE cannot wrap over GC_COMPLETE. For smaller counters, one or more embodiments can block further branches before wraparound occurs.

[0075] As a further optimization, one or more embodiments of the present invention consider that for more than two loads, blocking occurs only if the fastest cache, primarily the L1 (Level 1) cache, is not present.

[0076] 2, a diagram 200 of an example of blocking side-channel attacks on a processor is generally shown in accordance with one or more embodiments of the present invention. Consider now the following example: R1 = [R0]; branch; R2 = [R1]; R3 = [R2], the third load operation into R3 is a dangerous operation.

[0077] Also, when interpreting Figure 2, note that if a value remains unchanged, only a "." is shown. The other values ​​shown are the values ​​after they have been updated by the respective instructions.

[0078] All counters are set to a value of "0". <init>". The counter has a range that is size dependent, so other starting values ​​work as well. On the left side of the table, various instructions are shown, with "Br complete" meaning "branch complete". The nomenclature for loads from addresses is the same as explained above. After the first load R1 from the address stored in [R0] (i.e., R1[R0]), the first global generation counter (GC_DECODE) changes value from "0" to "1" due to the branch. With the instruction Load R2[R1], the generation tech counter for register 2 (GT_REG2) is set to "1". In the next step, which means executing R3[R2], this instruction is blocked until it is allowed to execute again. The term "reject" means that it only rejects until it is unblocked to execute the incoming instructions in order.

[0079] It can also be seen that after the branch completes ("Br complete"), the blocked instruction R3[R2] will be executed because it is now no longer blocked by the rules (see above). Thus, all instructions will be executed in a mostly OoO fashion (apart from those that are blocked and must wait) until instruction execution is again possible. The rules shown on the right side of the table can be implemented using hardware elements in accordance with one or more embodiments of the present invention. Alternatively, they may be implemented as microcode, which (as opposed to a hardware implementation) may have an impact on performance.

[0080] 3, a diagram 300 of another example of blocking side-channel attacks against a processor is shown generally in accordance with one or more embodiments of the present invention. The example shown in FIG. 3 includes: branch; R1=[relative]; R2=[R1]; and R3=[R2]. In this case, no blocking would be required.

[0081] 4, a diagram 400 of another example of blocking side-channel attacks against a processor is generally shown in accordance with one or more embodiments of the present invention. The example shown in FIG. 4 includes: R1 = [R0]; branch; R2 = [R1nospec]; R3 = [R2]; R4 = [R3]. In this example, only Rule 1 applies, which does not result in a single block of OoO instructions.

[0082] 5, a block diagram of an embodiment of an OoO processor 500 is shown generally in accordance with one or more embodiments of the present invention. The OoO processor 500 is separated into three sections by two vertical lines. The middle section comprises an OoO core 502. The OoO core 502 has a front-end unit 504 of the processor 500 on its left side and a back-end unit 506 on its right side. Elements of the core 502 of the processor 500 include at least registers 508, a construction wait queue 510, and execution units 512, 514, ..., 516.

[0083] Instructions 518, symbolically shown as six instructions i1, ..., i6, arriving in sequence at processor 500, are decoded by decoder 520 and formatted into instruction wait queue 510. In the middle, in core 502, the instructions are executed by execution units 512, 514, ..., 516, generally in an OoO fashion. The instruction results are then brought back into order by back-end units, specifically commit unit 522. The results can be seen as instruction results 524, symbolically shown as i1, ..., i6.

[0084] In accordance with one or more embodiments of the present invention, processing circuit 526 includes a processing circuit controller 528, a first global generation counter 530 (CG_DECODE), a second global generation counter 532, and a register tag 534. The interdependencies and interactions between these units are as described herein above.

[0085] According to one or more embodiments of the present invention, through the interaction of processing circuit 526, and particularly processing circuit controller 528, with instruction wait queue 510, instructions to be executed in one of execution units 512, 514, ..., 516 may be controlled to be supplied directly (e.g., in an OoO fashion) to execution units 512, 514, ..., 516. However, in some cases, and in accordance with rules 1-6 described above, immediate OoO execution may be blocked or deferred until conditions are reached that make side-channel attacks impossible. These conditions are symbolized by vertical line 536 in FIG. 5 .

[0086] 6, a flowchart of a method 600 for blocking side-channel attacks on a processor is generally shown in accordance with one or more embodiments of the present invention. The processor includes at least one register that receives a register load during a side-channel attack. The method 600 includes, at block 602, incrementing a first global generation counter for each decode and prediction of a branch-type instruction, and, at block 604, incrementing a second global generation counter for each completion of the branch-type instruction.

[0087] At block 606, the first global generation counter is reset to the value of the second global generation counter upon the triggered rollback.

[0088] Processing continues at block 608 with storing a generation tag value in a generation tag memory associated with at least one register of the processor. The generation tag value is set to the value of a first global generation counter upon a first load into the associated register. At block 610, for a second load of registers, the at least one register being loaded from an address dependent on the value of the register of the first load, a generation tag value associated with the register of the second load is determined. The generation tag value is a function of the value of the first global generation counter, the value of the second global generation counter, and the register generation tag value associated with the register of the first load.

[0089] Processing continues at block 612 with blocking the second load by a wait queue if the determined generation tag value is more than one generation ahead of the value of the second global generation counter.

[0090] Various embodiments of the present invention are described herein with reference to the associated drawings. Alternative embodiments of the present invention may be devised without departing from the scope of the present invention. Various connections and relationships (e.g., above, below, adjacent, etc.) between elements are made clear in the following description and in the drawings. These connections and / or relationships may be direct or indirect unless otherwise specified, and the present invention is not intended to be limited in this respect. Thus, coupling of things can refer to either direct or indirect coupling, and relationships between things may be direct or indirect. Furthermore, various tasks and process steps described herein may be combined into a more comprehensive procedure or process having additional steps or functions not specifically described herein.

[0091] One or more of the methods described herein can be implemented with any one or combination of the following technologies, each of which is well known in the art: discrete logic circuits having logic gates for implementing logic functions on data signals, application specific integrated circuits (ASICs) with appropriate combinatorial logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

[0092] For the sake of brevity, conventional technology related to making and using aspects of the present invention may or may not be described in detail herein. In particular, various aspects of computing systems and specific computer programs for implementing various technical features described herein are well known. Accordingly, for the sake of brevity, many conventional implementation details are only briefly described herein or omitted entirely, without providing details of well-known systems and / or processes.

[0093] In some embodiments, various functions or acts may be performed at a given location, or in connection with the operation of one or more devices or systems, or both. In some embodiments, a portion of a given function or act may be performed at a first device or location, and the remainder of the function or act may be performed at one or more additional devices or locations.

[0094] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms unless otherwise clear from the context. It will be further understood that the terms "comprises" and / or "comprising" as used herein specify the presence of stated features, integers, steps, operations, elements, or components, or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups thereof, or combinations thereof.

[0095] The corresponding structure, material, acts, and equivalents of all means or step-plus-function elements in the following claims are intended to include any structure, material, or acts for performing a function in combination with other specifically claimed claim elements. This disclosure has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the disclosed form. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the disclosure. The embodiments have been chosen and described in order to best explain the principles and practical applications of the disclosure and to enable those skilled in the art to appreciate the disclosure in various embodiments with various modifications suited to the particular uses contemplated.

[0096] The diagrams shown herein are for illustrative purposes. There may be many variations to the diagrams or the steps (or operations) described therein without departing from the scope of this disclosure. For example, operations may be performed in a different order, or operations may be added, deleted, or modified. Also, the term "coupled" describes having a signal path between two elements, but does not imply a direct connection between elements with no intervening elements / connections therebetween. All of these variations are considered part of this disclosure.

[0097] The following definitions and abbreviations are used for the interpretation of the claims and the specification. As used herein, the terms "comprises," "comprising," "includes," "including," "has," "having," "contains," or "containing," or other variations thereof, are intended to cover a non-exclusive inclusion. For example, a composition, mixture, process, method, article, or device that includes a list of elements is not necessarily limited to only those elements, but can include other elements not expressly listed or that are inherent in such composition, mixture, process, method, article, or device.

[0098] Moreover, the word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any embodiment or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments or designs. The terms "at least one" and "one or more" are understood to include any integer greater than or equal to one, i.e., 1, 2, 3, 4, etc. The term "plurality" is understood to include any integer greater than or equal to two, i.e., 2, 3, 4, 5, etc. The term "connected" can include both an indirect and a direct connection.

[0099] The terms "about," "substantially," "approximately," and variations thereof are intended to include the degree of error associated with measurement of a particular quantity based on equipment available at the time of filing. For example, "about" can include a range of ±8%, or 5%, or 2% of a given value.

[0100] The present invention may be a system, method, or computer program product, or combination thereof, integrated at any possible level of technical detail. The computer program product may include a computer-readable storage medium having stored thereon computer-readable program instructions for causing a processor to carry out aspects of the present invention.

[0101] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions for use by an instruction execution device. The computer-readable storage medium may be, by way of non-limiting example, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or a suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device having instructions recorded on it, such as a punch card or a ridge-in-a-groove structure, and a suitable combination thereof. As used herein, a computer-readable storage medium should not be construed as a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted over a wire.

[0102] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or storage device via a network (e.g., the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof). The network may be comprised of copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface of each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on a computer-readable storage medium within the respective computing / processing device.

[0103] Computer-readable program instructions for carrying out operations of the present invention may be either source code or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or object-oriented programming languages ​​such as Smalltalk, C++, etc., and procedural programming languages ​​such as the "C" programming language and similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, as a standalone software package, or partially on the user's computer. Alternatively, the computer may be executed partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) can execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the computer-readable program instructions in order to carry out aspects of the present invention.

[0104] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0105] These computer-readable program instructions can be provided to a general-purpose computer, a processor of a special-purpose computer, or other programmable data processing apparatus to create a machine, such that the instructions, executed by a processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions can also be stored in a computer-readable storage medium connectable to a computer, programmable data processing apparatus, or other device, or combination thereof, that functions in a particular way, such that the computer-readable program instructions stored therein configure one of the products including instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0106] Computer-readable program instructions, such as instructions to perform the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams on a computer, other programmable apparatus, or other device, can also be loaded into a computer, other programmable data processing apparatus, or other device to perform a series of operational steps on the computer, other programmable apparatus, or other device to produce a computer-implemented process.

[0107] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of executable implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, which constitute one or more executable instructions for implementing the specified logical function(s). In some alternative embodiments, the functions shown in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may be executed in the reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a special-purpose hardware-based system that performs the specified functions or operations or executes a combination of special-purpose hardware and computer instructions.

[0108] The description of various embodiments of the present invention is presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. It will be apparent to those skilled in the art that many modifications and variations are possible without departing from the scope of the described embodiments. The terms used herein have been selected to best explain the principles of the embodiments, practical applications or technical improvements to technology found in the market, or to enable those skilled in the art to understand the embodiments described herein.< / init>

Claims

1. 1. A processing circuit of a processor for blocking side channel attacks against the processor, the processor including at least one register that receives a load during the side channel attack, the processing circuit comprising: a first global generation counter that is incremented each time a branch-type instruction is decoded and predicted; a second global generation counter that is incremented each time a branch-type instruction completes, the first global generation counter being configured to reset to the value of the second global generation counter upon a triggered rollback; at least one generation tag memory configured to store a generation tag value associated with the at least one register of the processor, each of the at least one generation tag memory configured to be set to the value of the first global generation counter upon a first load to the associated register; a determination unit configured to determine, for a second load of a register, the at least one register being loaded from an address dependent on the value of the register of the first load, a generation tag value associated with the register of the second load, the generation tag value being a function of the value of the first global generation counter, the value of the second global generation counter, and the generation tag value associated with the register of the first load; a wait queue configured to block the second load if the determined generation tag value is one or more generations ahead of the value of the second global generation counter.

2. the processor includes at least one of a central processing unit, a core of the central processing unit, and a thread of a core of the processor; 2. The processing circuit of claim 1.

3. The rollback is triggered by one of the events selected from the group consisting of a misprediction of the branch-type instruction, a restart of a pipeline in the processor, and a flush of a cache of the processor.

2. The processing circuit of claim 1.

4. Upon the triggered rollback, all values ​​in the generation tag memory associated with the register associated with the one of the events are set to the second global generation counter.

4. The processing circuit of claim 3.

5. the first load is one of an immediate load and a relative load; 2. The processing circuit of claim 1.

6. the decision unit is part of a load and store unit of the processor; 2. The processing circuit of claim 1.

7. the register of the first load is the same as the register of the second load; 2. The processing circuit of claim 1.

8. the blocking is further dependent on whether data for the second load is in a cache of the processor.

2. The processing circuit of claim 1.

9. The functional dependencies are: if the value of the first global generation counter is equal to the value of a second global generation counter, then the generation tag value associated with the register of the second load is set equal to the value of the second global generation counter; if the value of the first global generation counter is equal to the generation tag value of the first load, then the generation tag value associated with the register of the second load is set equal to the generation tag value associated with the register of the first load; if the value of the first global generation counter is greater than the generation tag value of the first load, then the generation tag value of the second load is set equal to the generation tag value associated with the register of the first load plus one; 2. The processing circuit of claim 1, comprising one of:

10. 1. A method for blocking side-channel attacks on a processor, the processor including at least one register that receives a load during the side-channel attack, the method comprising: incrementing a first global generation counter for each decoded and predicted branch-type instruction; incrementing a second global generation counter each time a branch-type instruction completes, the first global generation counter being reset to the value of the second global generation counter upon a triggered rollback; storing a generation tag value in a generation tag memory associated with the at least one register of the processor, the generation tag memory being set to the value of the first global generation counter upon a first load into the associated register; determining, for a second load of a register, the at least one register being loaded from an address dependent on the value of the register of the first load, a generation tag value associated with the register of the second load, the generation tag value being a function of the value of the first global generation counter, the value of the second global generation counter, and the generation tag value associated with the register of the first load; blocking the second load with a wait queue if the determined generation tag value is one or more generations ahead of the value of the second global generation counter; A method comprising:

11. the processor includes at least one of a central processing unit, a core of the central processing unit, and a thread of a core of the processor; The method of claim 10.

12. The rollback is triggered by one of the events selected from the group consisting of a misprediction of the branch-type instruction, a restart of a pipeline in the processor, and a flush of a cache of the processor. The method of claim 10.

13. Upon the triggered rollback, all values ​​in the generation tag memory associated with the register associated with the one of the events are set to the second global generation counter. The method of claim 12.

14. the first load is one of an immediate load and a relative load; The method of claim 10.

15. the determining is performed by a load and store unit of the processor; The method of claim 10.

16. the register of the first load is the same as the register of the second load; The method of claim 10.

17. the blocking is further dependent on whether data for the second load is in a cache of the processor. The method of claim 10.

18. The functional dependencies are: if the value of the first global generation counter is equal to the value of a second global generation counter, then the generation tag value associated with the register of the second load is set equal to the value of the second global generation counter; if the value of the first global generation counter is equal to the generation tag value of the first load, then the generation tag value associated with the register of the second load is set equal to the generation tag value associated with the register of the first load; if the value of the first global generation counter is greater than the generation tag value of the first load, then the generation tag value of the second load is set equal to the generation tag value associated with the register of the first load plus one; The method of claim 10, comprising one of:

19. 1. A computer program for blocking side-channel attacks against a processor including at least one register that receives a load during a side-channel attack, the computer program being executable by one or more processors including the processor, the computer program comprising: incrementing a first global generation counter for each decoded and predicted branch-type instruction; incrementing a second global generation counter each time a branch-type instruction completes, the first global generation counter being reset to the value of the second global generation counter upon a triggered rollback; storing a generation tag value in a generation tag memory associated with the at least one register of the processor, the generation tag memory being set to the value of the first global generation counter upon a first load into the associated register; determining, for a second load of a register, the at least one register being loaded from an address dependent on the value of the register of the first load, a generation tag value associated with the register of the second load, the generation tag value being a function of the value of the first global generation counter, the value of the second global generation counter, and the generation tag value associated with the register of the first load; blocking the second load with a wait queue if the determined generation tag value is one or more generations ahead of the value of the second global generation counter; Execute a process including Computer program.

20. The rollback is triggered based on one of the events selected from the group consisting of a misprediction of the branch-type instruction, a restart of a pipeline in the processor, and a flush of a cache of the processor.

20. A computer program according to claim 19.

Images