Store-to-load forwarding for return addresses

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing techniques fail to effectively prevent security vulnerabilities related to mis-execution of indirect branch instructions, which can lead to speculative redirection and data leakage through side channels, particularly due to unauthorized manipulation of redirect targets during speculative execution.

Innovation Solution

Implementing a processing system that selectively performs store-to-load forwarding based on whether a store operation is associated with a call instruction, blocking forwarding until the store operation retires, and constraining redirect information to be provided at retire time instead of during speculative execution, using tags to identify call instructions and operating in specific hardware modes or virtual machine settings.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If store-to-load forwarding is performed during speculative execution to enhance performance, then processing speed is improved, but security vulnerabilities arise due to unauthorized manipulation of redirect targets

Engineering Contradiction:

Improveprocessing speedVSAvoidsecurity vulnerability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent applies preliminary anti-action by blocking store-to-load forwarding for indirect branch instructions before speculative execution can manipulate redirect targets. The system proactively prevents potential security vulnerabilities by restricting data forwarding during speculative execution of indirect branches, while maintaining normal forwarding for other instructions to preserve performance.

Inventive Principle:

Principle #9Preliminary anti-action

Solution Approach 2:

The patent applies local quality by selectively enabling store-to-load forwarding based on instruction type. Normal load instructions continue to benefit from forwarding, while only indirect branch instructions have forwarding blocked. This localized restriction maintains overall system performance while preventing security vulnerabilities specific to indirect branch manipulation.

Inventive Principle:

Principle #3Local quality

2Reliability

If store-to-load forwarding is blocked for all instructions to prevent security vulnerabilities, then security is improved, but processing performance deteriorates

Engineering Contradiction:

Improvesecurity vulnerabilityVSAvoidprocessing speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent applies partial action by implementing a selective forwarding policy that blocks forwarding only for indirect branch instructions rather than all instructions. This partial restriction is sufficient to prevent the security vulnerability while minimizing impact on overall processing performance, as most load instructions remain unaffected.

Inventive Principle:

Principle #16Partial or excessive action

3Productivity

If speculative execution is allowed without restrictions to maximize performance, then processing throughput is improved, but mis-execution of indirect branch instructions occurs

Engineering Contradiction:

Improveprocessing throughputVSAvoidmis-execution vulnerability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent applies preliminary anti-action by blocking store-to-load forwarding for indirect branch instructions before speculative execution can manipulate redirect targets. The system proactively prevents potential mis-execution vulnerabilities by restricting data forwarding during speculative execution of indirect branches, while maintaining normal forwarding for other instructions to preserve performance.

Inventive Principle:

Principle #9Preliminary anti-action

Solution Approach 2:

The patent applies the intermediary principle by using the store-to-load forwarding mechanism as a controlled intermediary. Rather than completely disabling speculative execution or forwarding, the system uses the forwarding infrastructure itself as a mediator to selectively permit or block data flow based on instruction type, enabling safe speculative execution.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11822923B1Performing store-to-load forwarding of a return address for a return instruction

Publication Date: 2023.11.21 ADVANCED MICRO DEVICES INC

AI summary

A load/store unit includes a first queue including a first entry for a store operation and a second queue including a second entry for a load operation that includes a return instruction that redirects a program flow to a location indicated by the return instruction. The load/store unit also includes a processor to determine that the store operation matches the load operation and selectively perform store-to-load forwarding (STLF) of a return address for the return instruction from the first entry to the second entry based on whether the store operation is associated with a call instruction. The load/store unit forwards the return address to the second entry in response to the store operation being associated with the call instruction. The load/store unit blocks forwarding until the store operation retires in response to the store operation not being associated with the call instruction.