SPECULATING OBJECT-GRANULAR KEY IDENTIFIERS FOR MEMORY SAFETY

A processor core requests a cacheline to be loaded from a memory in a memory access request; and a cache determines a speculated color value for the memory access request, receives a data granule of the cacheline from the memory, and decrypts data of the data granule using the speculated color value.

BACKGROUND

Memory safety, referring to the safety of the contents of computer memory in a computing system, is a high priority issue in the computer industry. It is estimated that 70% of software vulnerabilities are due to memory safety violations.

However, memory safety enforcement often imposes substantial overheads and code size increases due to metadata accesses and instrumentation, thus creating significant performance costs from memory safety measures.

DETAILED DESCRIPTION

The present disclosure relates to methods, apparatus, systems, and non-transitory machine-readable storage media for speculating object-granular key identifiers (IDs) for memory safety. As used herein, an object-granular key ID may also be called a color value, or simply a color.

Memory Safety (MS) measures are used to prevent vulnerabilities in computer memory. However, MS generally requires substantial overheads and code size increases due to metadata accesses and instrumentation. For example, the use of memory tagging enables comparison of a tag within a pointer with a tag associated with each granule of data (a granule of data being a data object of a certain size) to ensure there is a match before proceeding with access. However, this operation requires significant amounts of data storage to enable the memory tag operation, substantial code instrumentation to check the tags, and significant performance overhead due to loading the tags from memory.

Memory encryption features such as Multi-Key Total Memory Encryption (MK-TME) enable the use of multiple encryption keys for memory allocations. Address transformation features such as Linear Address Masking (LAM) modify checking that is applied to 64-bit linear or virtual addresses such that software may use a subset of address bits for metadata without those ignored bits being input to address translation. Memory encryption features and address transformation features may be utilized together in providing memory safety. Memory encryption features can be used to enforce MS without requiring costly metadata because it permits individual cachelines to be encrypted with separate keys as specified with a Key identifier (ID) (KID) in the physical memory address used to access a cacheline. Thus, by assigning different keys to different allocations (such as adjacent allocations) and rotating through a set of keys as memory is reused, both spatial and temporal safety can be enforced, e.g., to address both buffer overflows and use-after-free (in which an attempt is made to access memory after it has been freed) vulnerabilities. This enforces cryptographic isolation even with an only-encryption operation (without integrity check), and memory encryption features with added memory integrity protection further enables detecting memory safety violations because the integrity check will trigger if the wrong key is used for a particular cacheline. To enable integrity, a Message Authentication Code (MAC) may be stored within memory to verify the correct (same) data encryption key was used to decrypt the data. These MACs may be stored per cacheline using available Error Correction Code (ECC) memory devices or stored in a sequestered location in a memory.

In one known approach for enforcing memory safety, memory tagging associates 4-bit color values loaded from sequestered memory into cachelines alongside the cacheline data. Those values are matched against colors embedded in pointers. Managing the in-memory metadata may impose high performance overhead, in addition to overheads for tag checking.

An alternative is to cryptographically bind data to color values so that using a pointer with an incorrect color results in garbling the data access. This can be accomplished by treating color values as key IDs and providing object-granular key ID distinctions rather than operating just at cacheline granularity, as is the case for memory encryption. However, purely relying on color information in the pointer does not provide direct detection support in which an access by a pointer with an incorrect color immediately generates an exception.

The technology described herein resolves these tradeoffs by checking colors in pointers against colors stored in memory to allow generating exceptions on mismatches, but the technology allows some limited uses of the decrypted data to proceed prior to colors being loaded from memory by relying on cryptographic isolation of data. This reduces performance overheads. This approach can also be used without data encryption to allow speculative tag checks, although that does not protect data from garbling during accesses that are mis-speculated as passing tag checks.

The naïve approach is for the memory controller to wait for color values to be loaded from a metadata table in memory prior to placing data into the cache so that the data is inseparable from the associated color values. However, waiting for color values to be loaded prior to placing data into the cache imposes substantial slowdowns, especially when usages are facing tight memory bandwidth constraints. Tag checking overheads are on top of that.

An alternative approach is to not rely on color values stored in a metadata table, but rather to rely solely on cryptographic isolation. Relying solely on cryptographic isolation mitigates software memory safety vulnerabilities, but it does not provide immediate detection of memory safety violations. Some implementations may also check integrity, which does provide immediate detection, but the integrity check values themselves are a form of metadata that imposes substantial overheads when these values are consulted as cachelines are loaded by the memory controller.

In the present technology described herein, data can be loaded into the cache, sent to a processor core, and consumed, all without being delayed waiting for associated color values to be loaded from memory. Data is optionally encrypted with a binding between the encryption of each granule and the associated color for that granule such that a memory safety violation based on an access with an incorrect color value results in garbled data.

Efficiently enforcing memory safety both during architectural execution and transient execution is a high priority for many customers of computing systems. Alternative architectures support color value checks via memory tagging, but the technology described herein provides the opportunity to develop a more performant approach with deeper hardening against physical attacks, untrusted system on a chip (SoC) intellectual property (IP), side channels, and untrusted tenants on shared platforms by relying on cryptography to protect data in use in a way that is bound to color values.

FIG.1is a block diagram of a computing environment100that reduces the likelihood of successful side-channel attacks within a central processing unit (CPU) by providing address-based security features for memory within the CPU, according to one example. The computing environment100reduces the likelihood of successful side-channel attacks and memory exploits, while concurrently enabling the CPU to perform and benefit from performing speculative operations, according to an embodiment. The computing environment100includes an adversary102coupled to a system104through one or more networks106or one or more physical connections108, according to an embodiment. The adversary102may perform one or more memory exploits or side-channel attacks110on the system104through the networks106and/or through the physical connections108. The system104may include one or more of a variety of computing devices, including, but not limited, to a personal computer, a server, a laptop, a tablet, a smartphone, a motherboard with a chipset, or some other computing device, according to various embodiments. The system104is configured to protect a CPU against side-channel attacks using a variety of address-based security features that enable the CPU to safely operate while performing speculative operations.

The adversary102may be a computing system, a person, or a combination of the computing system and a person, which may attempt one or more memory exploits or side-channel attacks on and against the system104. The adversary102may use one or more networks106to execute the exploits and side-channel attacks110. The adversary102may also use one or more physical connections108, such as a memory interposer, memory probes, or the like, to read, modify, and/or write to one or more memory addresses within the system104in order to physically attack the system. Some of the attacks110may include attempting to override a pointer, attempting to manipulate a pointer (e.g., add a value to a pointer to cause the pointer to point to an unintended object or move beyond the object's bounds), use a freed pointer to access a new object, and the like.

The system104is configured to provide a variety of memory-based security features to protect against the attacks110, according to an embodiment. The system104includes at least one central processing unit (CPU)112which is coupled to memory circuitry114through one or more communications channels116, according to an embodiment. The CPU112includes one or more processor cores118, memory controller113, cache120, encryption and decryption circuitry122, and integrity check circuitry124, according to an embodiment. Memory circuitry114may be managed by memory controller113on CPU112. The CPU112also includes pointer security circuitry126that is configured to expand memory tag capabilities, reduce or prevent pointer override attacks, reduce or prevent pointer manipulation, prevent the reuse of freed pointers and enable byte-granularity memory safety for the CPU112, according to an embodiment. In various implementations, pointer security circuitry126may be included in cache120, processor core(s)118, or within other circuitry in CPU112.

The CPU112may include any number and/or combination of currently available and/or future developed single- or multi-core central processing units. In embodiments, the CPU112may include a general-purpose processor, such as a Core® i3, i5, i7, 2 Duo and Quad, Xeon®, Itanium®, Atom®, or Quark® microprocessor, available from Intel® (Intel Corporation, Santa Clara, CA). Alternatively, the CPU112may include one or more processors from another manufacturer or supplier, such as Advanced Micro Devices (AMD®, Inc.), ARM Holdings® Ltd, MIPS®, etc. The CPU112may include a special-purpose processor, such as, for example, a network or communication processor, compression engine, graphics processor, co-processor, embedded processor, or the like. The CPU112may be implemented as a single semiconductor package or as a combination of stacked or otherwise interconnected semiconductor packages and/or dies. The CPU112may be a part of and/or may be implemented on one or more substrates using any of a number of process technologies, such as, for example, BiCMOS, complementary metal-oxide semiconductor (CMOS), Bipolar CMOS (BiCMOS), or n-type metal-oxide semiconductor (NMOS).

The memory circuitry114represents one or more of a variety of types of memory that may be used in the system104and managed by memory controller113, according to an embodiment. The memory circuitry114may be volatile memory, may be non-volatile memory, or may be a combination of volatile memory and non-volatile memory, according to an embodiment. The volatile memory may include various types of random-access memory (RAM). The non-volatile memory may include NAND memory, 3D crosspoint (3DXP), phase-change memory (PCM), hard disk drives, and the like, according to an embodiment.

The CPU112uses a number of components to move data back and forth between the CPU112and the memory circuitry114, according to an embodiment. For example, while operating one or more software programs or while executing various instructions, processor core118may generate new data128. Processor core118may use a virtual address (a.k.a. Linear Address or Logical Address)130the new data128to write the new data128to the cache120or to the memory circuitry114via a translated physical address134. The new data128may be saved in the cache120as cache data132, or may be added to existing cached data132, according to an embodiment. The cached data132may have a physical address134including Key IDs, tags (or additional meta-data)142. The CPU112may be configured to use the encryption and decryption circuitry122to encrypt the new data128and/or the cached data132prior to saving the new data128and/or the cached data132to the memory circuitry114, as encrypted data138. The CPU112may also use the integrity check circuitry124to generate integrity check values (or Message Authentication Codes/MAC)140that are based on the new data128, the translated virtual address130, the tags142for selecting the cryptographic MAC Key154, and/or the physical address134, according to an embodiment. The CPU112writes the integrity check values140to the memory circuitry114, to enable corruption detection for the encrypted data138(caused, for example, by decrypting the data with using the wrong key).

In an embodiment, encryption and decryption circuitry122may be included in cache120.

Although inFIG.1cache120is represented as a single block, it should be understood that cache120comprises one or more levels of a cache hierarchy, such as a level one cache (L1), a level two cache (L2), and a last level cache (LLC), and so on.

The CPU112may use pointer security circuitry126to provide security for the data within the system104. Pointer security circuitry126enforces correct data access via pointers. The pointer security circuitry126may be configured to detect when the virtual address130and/or the corresponding translated physical address134is being overridden, detect when the virtual address130and/or the physical address134has been manipulated, detect when the virtual address130and/or the physical address134has been used after being freed, provide byte-granularity memory safety through bounds checking, provide definitions for use of memory tags, according to various embodiments disclosed herein.

When processor core118assigns (e.g., by executing a software program) the virtual address130to the new data128, the pointer security instructions158may define, insert, or identify one or more memory tags142in the virtual address130, to associate with the new data128to reduce the likelihood of a successful attack. The one or more memory tags142may include an identification tag144, an encryption tag146, a small object tag (or indicator)148, and/or a bound distance tag150.

The virtual address130for the new data128may include the identification tag144to provide security for the new data128. The identification tag144may be colloquially referred to as a color, a color value, a cryptographic color, a memory color, a tag color, and the like. The identification tag144may include one or more bits of the virtual address130. The pointer security circuitry126may be configured to define where within the virtual address130the identification tag144resides or is defined. For example, the pointer security circuitry126may define the identification tag144as the 8 most significant bits in the virtual address130. The identification tag144may be defined as, for example, bits56-62(i.e., 7 bits) of bits0-63of the virtual address130, assuming, as an example, that the length of the virtual address130is 64 bits.

The pointer security circuitry126may use the identification tag144in a variety of ways to provide security to the new data128. For example, the pointer security circuitry126may use the identification tag144as a tweak or as part of a tweak in encryption and decryption circuitry122. In one embodiment, the identification tag144is combined with a subset of the virtual address130translated to the physical address134to define a tweak that may be used by encryption and decryption circuitry122when encrypting the new data128, according to an embodiment. Alternatively, the identification tag144(e.g., color) may be used as a key identifier (Key ID)152used to select the cryptographic key154used for encryption and/or integrity.

The physical address134for the new data128may include the encryption tag146to provide security for the new data128. The encryption tag146may include one or more bits of the physical address134. The pointer security circuitry126may be configured to define where within the physical address134the encryption tag146resides or is defined. For example, the pointer security circuitry126may define the encryption tag146as the 4 most significant bits in the physical address134. The encryption tag146may be defined as, for example, bits60-63(i.e., 4 bits) of bits0-63of the physical address134, assuming, as an example, that the length of the physical address134is 64 bits. The physical address may also be smaller than the virtual address, such as 56 bits in size. The encryption tag146may be a representation of a key ID152that is used to look up the encryption key154within a key table156, by the encryption circuitry122, according to an embodiment. The encryption tag146may also or alternatively be identified using other techniques, e.g., may be defined within one or more bits in the physical address134. The encryption tag may be assigned by the processor based on which virtual machine (VM) is executing on a core or thread in a multi-tenant system or may be determined by the translation of a virtual address into a physical address via the page tables or extended page tables (EPTs) utilized by a memory management unit to populate virtual to physical address translations via translation lookaside buffers (TLB).

The virtual address130for the new data128may include the small object tag (or small object indicator bit)148to provide security for the new data128. The small object tag148may include one or more bits of the virtual address130. The pointer security circuitry126may be configured to define where within the virtual address130the small object tag148resides or is defined. For example, the pointer security circuitry126may define the small object tag148as the most significant bit in the virtual address130. In one example, the pointer security circuitry126may use the small object tag148to provide byte-level pairings of memory tags of sub-cacheline objects stored within the same cacheline. For example, if the small object tag148is set (e.g., to “1”), the pointer security circuitry126may be configured to associate a number of identification tags within a single cacheline so that each of a number of subsets of data objects within that cacheline are assigned their own “color tag” or identification tag, according to an embodiment.

The virtual address130for the new data128may include the bound distance tag150to provide bounds security for the new data128. The bound distance tag150and its associated features may be used as an alternative to the small object tag148. The bound distance tag150may include one or more bits of the virtual address130. The pointer security circuitry126may be configured to define where within the virtual address130the bound distance tag150resides or is defined. For example, the pointer security circuitry126may define the bound distance tag150as bits51-57of bits0-63of the virtual address130. In one embodiment, the bound distance tag150includes bits51-57of bits0-63of the virtual address130, and the identification tag144(the color) includes bits58-63(most significant 6 bits) of the virtual address130, as an example.

The pointer security circuitry126may use the bound distance tag150to indicate how far outside of an object a memory address (i.e., a pointer) has strayed. The bound distance tag150may represent a signed number that represents a pointer that is either above or below the bounds of an original object that the memory address identified. The pointer security circuitry126may use the bound distance tag150to detect when the adversary102has modified a memory address (of a pointer) to redirect the memory address into a different object having the same identification tag as the object to which the memory address is authorized to point.

The pointer security circuitry126may also include pointer security instructions158that at least partially provide tag definitions160. The pointer security instructions158may include a number of instructions or operations that may be used by the pointer security circuitry126or the CPU112to add a pointer in accordance with the tag definitions160. The tag definitions160may define one or more of the length, location, and use of one or more of the identification tag144, the encryption tag146, the small object tag148, and/or the bound distance tag150.

The pointer security circuitry126may use a pointer metadata table162to store, update, and retrieve the memory tags142and/or the tag definitions160, according to one embodiment. The pointer metadata table162may be used as an alternative to small object meta data that is stored on the same cacheline as its associated data, so that the small object meta data may be processed at the same time as the data and thus avoid speculation-based attacks. A separate table requires additional memory lookup operations which may either expose the solution to side-channel attack or reduce system performance as both memory lookups need to complete (both the metadata table lookup and the data lookup). In an embodiment, pointer metadata table162is a part of a processor core118. In another embodiment, pointer metadata table162is stored in memory circuitry114.

When the CPU112writes the data132for the physical address134location, the pointer security circuitry126may define, insert, or identify one or more memory tags142in the physical address134, to associate with the cached data132to reduce the likelihood of a successful side-channel attack. The one or more memory tags142embedded within the physical address134may include one or more of the identification tag144, the encryption tag146, the small object tag148, and/or the bound distance tag150. The physical address134may include fewer, more, translated or different ones of the memory tags142than are used or associated with the virtual address130, according to an embodiment.

As described herein above, the pointer security circuitry126may be configured to use the one or more memory tags142from the virtual address of the new data128, from the cached data132and physical address, and from the encrypted data138to mitigate data corruption, memory address corruption, address manipulation, use after free, or otherwise unauthorized changes to address pointers within the CPU112.

Various forms of memory tagging have been implemented in existing technology. In general memory tagging provides a tag within a pointer and a tag that is associated with each granule of memory to be accessed. The tags then can be compared to determine whether a memory access should be allowed.

As illustrated inFIG.2, a pointer210includes a virtual address and other pointer bits214, as well as a tag212. The pointer210will point to one of a number of memory elements with an allocation in memory220. The memory elements are referred to as granules, with, for example, each granule of memory including 16 bytes. In an embodiment, memory granules are stored in memory circuitry114. As shown inFIG.2, the allocation in memory includes a certain number n (where n can be any positive integer) 16-byte granules. Further, each granule includes a tag that can be matched against the tag of an associated pointer. For example, pointer210points to Granule1including memory tag222, thus resulting in a comparison between pointer tag212and memory tag222prior to allowing memory access.

If there is a mismatch between pointer tag212and the memory tag222, a processor (e.g., CPU112) will generate an exception. Some memory tagging implementations are based on software instrumentation to load and check tags using ordinary arithmetic instructions. Other memory tagging implementations are based on dedicated hardware support.

Thus, memory tagging relies on comparing a tag value in a pointer against a tag value (e.g., memory tags142) stored alongside any memory that may be accessed in a particular memory reference. If there is a mismatch in any of those comparisons, an exception may be generated synchronously, or an asynchronous indication of the violation may be set (e.g., in a Model-Specific Register (MSR) of CPU112).

The tag value can be visualized as a “color” of a pointer or memory region so that pointers can only access memory regions of the same color. Allowing the color to be specified for every byte in memory would provide ideal memory safety detection properties. However, it would also impose significant metadata and performance overheads for storing, updating, retrieving, and propagating duplicated color values. Thus, memory tagging typically operates at a coarser granularity, e.g., 16 bytes (as shown inFIG.2) or a whole cacheline.

A physical tagging approach may use a sequestered region of memory to store a table of tags (e.g., pointer metadata table162) that are indexed by the physical address of the associated granule of data memory. This indexing scheme aligns well with tags being managed by memory controller113, since the memory controller operates on physical addresses. For example, the sequestered memory may have a base physical address that is specified in a register in the memory controller, and the physical address of a tag associated with a granule of physical data memory may be computed by determining how far the physical address of the data granule is from the beginning of the tagged region of physical data memory, scaling that by a factor to account for the size of each data granule in proportion to the size of each stored color value, and adding the scaled index to the base address for the sequestered memory containing the metadata.

The memory controller113may load color values while loading associated data into the cache so that those color values can be stored alongside cacheline data in a logical construct called a “sidecar” herein. Some embodiments may only attach a sidecar to certain cache levels, e.g., level one (L1) and level two (L2) and not last level cache (LLC).

Even with a coarser granularity of 16 bytes, managing tags can impose substantial overhead if the memory controller waits to fill a cacheline until both the data and associated color values are available. This can be exacerbated by limitations in access granularity in the underlying physical memory (e.g., memory circuitry114implemented as dynamic random-access memory (DRAM)). For example, DRAM may require an entire row of metadata at a time to be energized, even if only a single nibble of metadata in that row is needed.

There are other technologies besides memory tagging that require fine-grained metadata. For example, Multi-Key Total Memory Encryption (MKTME), available from Intel Corporation, specifies a key ID to be used for each cacheline. However, a crucial distinction between how MKTME manages metadata and how physical memory tagging manages metadata is that MKTME supplies metadata from a processor core118instead of loading it from sequestered memory (e.g., in memory circuitry114). This avoids the overheads of loading metadata from memory. What enables MKTME to manage metadata in this more efficient manner while still meeting the security requirements of its usages is that it binds data encryption to the metadata values, i.e., by using the metadata to select a key. Thus, an attempt to access a cacheline using an incorrect key ID results in data garbling. This does not require checking the attempted key ID against the correct key ID; the cryptography itself enforces isolation.

In contrast, memory tagging relies on architectural checks between pointer colors and memory colors to enforce isolation. The underlying data in existing memory tagging approaches is left unencrypted. However, memory tagging has the advantage of detecting memory safety violations immediately within the particular access that violates the memory safety policy.

As described herein, these disparate approaches are hybridized to 1) minimize metadata overheads; 2) immediately detect memory safety violations; and 3) cryptographically enforce memory safety.

The technology described herein uses this hybrid approach is to interpret per-granule metadata as both a color value for memory tagging and a key ID for MKTME or other memory encryption approach. For example, encryption and decryption may occur closer to the processing core than in MKTME (e.g., between the L1 and L2 caches).

The deepest cache level in which cachelines are decrypted as plaintext can read in just data as is currently done when filling a cacheline and speculate on the color/key ID values. In an embodiment, that speculation may be informed by the pointer used to access a portion of the cacheline by passing the color bits from the pointer all the way to the decryption engines along with the physical address. Alternatively, to avoid needing to pass color bits, especially if the decryption engines are deep in the computing environment (such as in a SoC), perhaps in the memory controller, the color bit speculation may be informed by the color in any cachelines for nearby physical addresses, that is, guessing that they may be part of the same allocation, or by some other strategy, such as guessing randomly.

Some prefetchers, specifically the ones prefetching into caches closer to the processing core than the decryption engines, would also need to speculate on colors to be used in prefetches. Those prefetchers could use similar speculation strategies as those described above.

The metadata would not need to be loaded simultaneously from sequestered memory (e.g., a protected portion of memory circuitry114). A request for the metadata may be enqueued at the level of the caching hierarchy where cachelines are first stored as plaintext. Multiple requests may be combined to maximize the probability of multiple requested metadata items residing near each other in memory such that they can be read as a single request from DRAM or a cache.

When the metadata is eventually loaded from memory circuitry114or cache120, the metadata may be forwarded through the cache hierarchy to be loaded into the sidecars associated with the corresponding data lines. Meanwhile, to account for the possibility of mis-speculated metadata being used as the basis for decisions, cachelines may be enhanced with additional information to indicate the status of the metadata in those cachelines, as well as any decisions that have been made based on that metadata.

FIG.3is a diagram of using a speculated color value in an example. A processor core118of CPU112may generate a memory access request302when access is needed to data that is stored in one or more of cache120and memory circuitry114. When memory access request302indicates that data in memory is to be written, memory access request302includes updated data304to be stored in memory circuitry114. Memory access request302includes information from a pointer (e.g., pointer210) to the data, including virtual address306and color308(where tag212in this approach comprises color308). When the cacheline storing the requested data is not in cache120, processor core118requests that cacheline310of cache120be loaded from memory circuitry114. Cacheline310includes one or more data granules312, physical address314, and one or more colors316. Cache120receives the color308from the memory access request302. Cache120determines speculated color318while awaiting a (definitive) color324from pointer metadata table162in memory circuitry114. In an example, cache120determines the speculated color318based at least in part on other, previous memory access requests or other cachelines. Cache120returns speculated color318for the processor core to optionally and provisionally use the speculated color318instead of color324from the pointer metadata table162(and while waiting for color324), thereby improving the efficiency of processor core118.

Processor core118may subsequently fetch color316from cacheline310(after color324of pointer metadata table162is loaded into cacheline310(replacing color316)) containing data granule(s)312of cache120whose physical address314is associated with virtual address306in the memory access request302. Data granule322of data memory320in memory circuitry114may be used by memory controller113and cache120to update data granule312in cacheline310. In an embodiment, speculated color318in cache120may be made available to processor core118faster than color324from pointer metadata table162in memory circuitry114, since access by processor core118to cache120is faster than access to memory circuitry114.

FIG.4is a flow diagram of cacheline processing400according to an example. Blocks402through412for data processing and blocks416through422for metadata processing may be performed in parallel. At block402, processor core118sends a memory access request302(including updated data304for a write request, virtual address306, and color308from a pointer) to request a cacheline310to be loaded from memory114. At block404, cache120determines a speculated color318for the memory access request302. At block406, memory controller113loads data granule322from data memory320of memory circuitry114into cacheline310using speculated color318to decrypt the data (e.g., by encryption and decryption circuitry122). At block408, cache120optionally propagates data in data granule312of cacheline310to other cache levels. At block410, processor core118optionally speculatively accesses data in data granule312of cacheline310(since the data is now decrypted). At block412, one or more of processor core118, cache120, and/or pointer security circuitry126performs security checks (e.g., memory safety checks) based at least in part on the speculated color318. At block414, if the security checks pass, processor core118accesses the decrypted data or optionally waits to access the data in the cacheline until metadata (including the (definitive) color324) from pointer metadata table162is received from memory and then the data is decrypted using color324.

At block416, processor core118requests metadata (including color324) from pointer metadata table162associated with the pointer indicated by the memory access request302. At block418, memory controller loads metadata from the pointer metadata table in memory circuitry114and forwards the metadata to associated one or more cachelines310. In an embodiment, loading metadata takes longer than loading data. At block420, when the metadata reaches the associated one or more cachelines, processor core118and/or cache stores the metadata in cacheline310. At block422, one or more of cache120, and/or pointer security circuitry126performs security checks (e.g., memory safety checks) based at least in part on the metadata, including color324. Performance of the security checks may include updating selected MSR bits for hardware threads that previously accessed the cacheline310. If the processor core waited at block414, then the processor core now proceeds with the access to the data based on the results of the security checking of block422.

FIG.5illustrates data, metadata, and status bits pertaining to the metadata and how the metadata has been used, all within a cacheline500according to an example. Cacheline500(e.g., an example of cacheline310) of cache120includes a plurality of data granules, shown here as data granule1502, data granule2504, . . . data granule M506, where M is a natural number. In an embodiment, each data granule has an associated key ID and a plurality of access bits. For example, data granule1502is associated with key ID1512and access (ACC) bits1.1518and1.2520, data granule2504is associated with key ID2514and access (ACC) bits2.1522and2.2524, . . . data granule M506is associated with key ID M516and access (ACC) bits M.1526and M.2528. A data granule is decrypted with the data granule's associated Key ID (also called a color herein). In one implementation, the number of access bits associated with each data granule is equal to the number of processing threads in processor core118. For example, if there are two processing threads, then there are two access bits for each data granule, as shown inFIG.5. In an embodiment, the Key IDs and access bits collectively are known as the “sidecar” to the cacheline. If key IDs may be speculated within caches that are shared across multiple processor cores, then a separate ACC bit may be defined for each processing thread that may access each unit of data granule storage in the cache.

Data of a data granule will be decrypted incorrectly if the Key ID (color) for the data granule is mis-speculated. Data will be “repaired” later when the correct Key ID (color) is loaded from pointer metadata table162. Access bits indicate whether each data granule was accessed (either read access or write access) using the current Key ID encoded in the cacheline500. The access bits may be used to detect asynchronously whether a memory safety violation occurred due to an access with an incorrect Key ID. A per-hardware (HW) thread access bit is reserved for the Key ID storage for each data granule. If the asynchronous mode is not supported, then the access bits are unused. Key ID check530indicates whether the Key IDs have been checked against the pointer metadata table162. Key IDs may be speculated based at least in part on accesses and prefetches until Key ID check530is set.

Either synchronous or asynchronous violation reporting may be supported, depending on what status bits are maintained. In either case, the data may be forwarded prior to checking the metadata, since the cryptography would protect the data in a mis-speculated transient execution.

If data is not encrypted, but rather just color checks are performed, then Key IDs as indicated inFIG.5are treated as colors.

Supporting speculative metadata affects several cache flows, including accessing data from the cache, moving data between caches, and checking asynchronously for memory safety violations. Furthermore, a new cache flow is needed for allowing metadata to be joined into a cacheline that already contains data.

FIGS.6(A) and6(B)are flow diagrams illustrating processing for accessing data from the cache120according to an example. At block600, an attempt to access a data granule is generated by processor core118. At block602, pointer security circuitry126determines if the color308in the pointer of the memory access request302matches the Key ID for the data granule to be accessed in a cacheline. If the color308matches the Key ID for the data granule to be accessed, then processing continues at block620onFIG.6(B)via connector6A. At block620, pointer security circuitry126determines if the Key ID check530is set for the cacheline. If so, access to the data proceeds at block622. If not, then pointer security circuitry126determines at block624if asynchronous mode is enabled. If so, at block626, pointer security circuitry126requests that cache120set the access (ACC) bit for the data granule and the HW thread (executing on the processor core) attempting to access the data granule. If not, processing goes back to block614onFIG.1via connector6D. At block614, processor core118waits for the correct Key ID(s) to be loaded from pointer metadata table162prior to allowing instruction retirement. However, data from the data granule may still be forwarded speculatively while waiting. After the waiting for loading of Key ID(s) from the pointer metadata table is complete, processing continues with block602.

At block602, if the color308in the pointer of the memory access request302does not match the Key ID for the data granule to be accessed in a cacheline, then at block604, pointer security circuitry126determines if Key ID check530is set for the cacheline. If so, at block606, pointer security circuitry126determines if asynchronous mode is enabled. If so, processing continues with block626ofFIG.6(B)via connector6E. Otherwise an exception is generated at block608due to the color mismatch. At block604, if the Key ID check530is not set, then at block610pointer security circuitry126determines if asynchronous mode is enabled. If not, processing continues at block614with waiting for the corrects Key ID(s) to be loaded. If asynchronous mode is enabled at block610, then at block612pointer security circuitry126determines if the access bit is already set for the data granule and the HW thread. If the access bit is not set, then processing continues with block628onFIG.6(B)via connector6B. At block628, pointer security circuitry126requests that cache120set the access bit for the data granule and the HW thread. At block630, encryption and decryption circuitry122of CPU112re-decrypts the data granule with the Key ID matching the color in the pointer (in the memory access request). At block632, pointer security circuitry126requests that cache120update the Key ID for the data granule in the cacheline in the cache to match the color in the pointer. Access to the data in the data granule then proceeds. If the access bit is set at block612, in an embodiment cache120requests that processor core118set a model specific register (MSR)123in processor core118indicating a memory safety violation has occurred for the HW thread. Processing then continues with block622onFIG.6(B)via connector6C, where access to the data proceeds.

FIG.7is a flow diagram illustrating processing for moving data between caches according to an example. At block700, an attempt to move a cacheline out of one first-level cache to a lower cache or a different first-level cache is received. Recall that cache120comprises one or more levels of caches. At block702, cache120determines if the Key ID check530is set for the cacheline. If Key ID check530is set, the move is allowed immediately. If the Key ID check530is not set, then at block706cache120determines if any access bits are set for the cacheline. If not, the move is allowed immediately at block704. If any access bits are set, then at block708cache120waits for metadata (e.g., the Key ID/color) to arrive from pointer metadata table162in memory circuitry114and for any mismatches to be asynchronously reported on the HW thread(s) for the source first-level cache. Once the wait is complete and the reporting is accomplished, the cacheline is allowed to be moved at block710. This will require redirecting the metadata to the new cache holding the cacheline when that metadata arrives. If the cacheline is moved to a lower cache, then the lower cache would have already intercepted the metadata, so this is only relevant if the cacheline is moved to a different first-level cache. For example, perhaps the source first-level cache may broadcast the metadata when the source first-level cache detects that it no longer contains the cacheline. Alternatively, the source first-level cache may reclaim ownership of the cacheline once the metadata arrives. In another alternative, the source first-level cache may maintain a list of forward references to the destination first-level cache for the cacheline.

FIG.8is a flow diagram illustrating processing for checking asynchronously for memory safety violations according to an example. At block800, processor core118reads the MSR123in which violations are reported asynchronously. At block802, if any access bits for the HW thread are set for any cacheline in any of the caches that track accesses, then at block804, processor core118waits for metadata to arrive and for any mismatches to be reflected in the MSR value. At block806, processor core118returns the MSR value to the software that read the MSR, e.g., the operating system. If no access bits are set at block802, then processor core118returns the MSR value to the software that read the MSR at block806. In an embodiment, the access bits for each cache may be held in a centralized structure, thereby making this check more efficient, rather than distributed among the cachelines.

FIG.9is a flow diagram illustrating processing for allowing metadata to be joined into a cacheline that already contains data in an example. At block900, metadata arrives at a cacheline containing data (e.g., in data granules) and access indicators. At block902, if the speculated Key ID (e.g., speculated color318) matches the Key ID stored in the memory circuitry114(e.g., color324of pointer metadata table162), then the Key ID check530is set at block914. If the speculated Key ID does not match the Key ID stored in the memory circuitry114, at block904the mi-speculated Key ID in the cacheline is replaced with the stored Key ID and the data granule is re-decrypted. At block906, if any access bit is set for the data granule processing, then at block908, cache120determines if any memory access is blocked synchronously waiting for the metadata from the pointer metadata table162in memory circuitry114. If a memory access is blocked synchronously, then at block910an exception is generated for the oldest memory access blocked on waiting for the metadata. The Key ID check bit is then set at block914. If no access bits are set for the data granule at block906, then at block912the MSR bit that asynchronously indicates a memory safety violation is set by cache120. If no memory accesses are blocked synchronously at block908, then at block912the MSR bit that asynchronously indicates a memory safety violation is set by the cache. Processing continues with setting the Key ID check bit at block914.

Both the access flow ofFIGS.6(A) and6(B)and the flow for metadata arriving at a cacheline ofFIG.9depend on the ability to selectively re-decrypt granules using updated color values. This requires access by cache120to data encryption and decryption units of encryption and decryption circuitry122. In an embodiment, encryption and decryption circuitry122may be included in cache120. The data must first be re-encrypted using the current color value and then re-decrypted using the updated color value. The crypto units may exist at a particular level of the cache hierarchy, e.g., between the memory controller and the LLC. In that case, the affected cacheline may be evicted to the LLC level, processed cryptographically by the crypto units, and then returned to the cache that it occupied when the operation occurred that triggered the re-encryption.

Alternatively, additional cryptographic units may be placed at various levels of the cache hierarchy to more flexibly accommodate re-decryption requests with lower latency and less traffic between caches.

Placing the cryptographic units at a shallow cache level may lead to relatively less performance overhead from re-decryption, since access operations that trigger re-decryption will frequently be accessing data that is already present in the L1 cache. Placing cryptographic units at a shallow cache level will minimize the distance that the data needs to travel to be re-decrypted.

By removing the cryptographic operations from the flow ofFIGS.6(A) and6(B)above, the technology described herein may also be used to speculate color values for non-cryptographic memory tagging. However, as data is forwarded to the pipeline due to color checks mis-speculated as passing either during transient execution or in asynchronous checking mode, the data will only be cryptographically protected (i.e., garbled) if data encryption is implemented.

The metadata must be directed towards its corresponding data to be joined with the data. A simple approach would be to broadcast any loaded metadata throughout the entire cache hierarchy so that the loaded metadata will reach any corresponding data wherever it resides in the cache hierarchy. However, that would generate significant traffic throughout the cache hierarchy.

Some cache subsystems record directory information to locate particular cachelines, which may be used to more efficiently locate any cachelines with corresponding data. The metadata request queue entry could also record which shallower cache requested the metadata so that the metadata can be directed straight to that cache.

An alternative to setting indicators in cachelines and waiting for metadata to be joined with data before performing associated checks would be to forward the access request deeper into the cache hierarchy, even if the data is available at a shallower level of cache. Eventually, that request will reach the metadata, which may already have been loaded and is traveling upward in the cache or that has not yet been loaded from memory. In that latter case, the request will eventually reach the level of cache that issues metadata requests, cause a metadata request to be issued, and then wait for the metadata to be returned and checked.

The metadata may be encrypted (e.g., using a designated key ID), in DRAM and levels of caches where it is treated as ordinary data.

Example Computer Architectures.

Detailed below are descriptions of example computer architectures. Other system designs and configurations known in the arts for laptop, desktop, and handheld personal computers (PC)s, personal digital assistants, engineering workstations, servers, disaggregated servers, network devices, network hubs, switches, routers, embedded processors, digital signal processors (DSPs), graphics devices, video game devices, set-top boxes, micro controllers, cell phones, portable media players, hand-held devices, and various other electronic devices, are also suitable. In general, a variety of systems or electronic devices capable of incorporating a processor and/or other execution logic as disclosed herein are generally suitable.

FIG.10illustrates an example computing system. Multiprocessor system1000is an interfaced system and includes a plurality of processors or cores including a first processor1070and a second processor1080coupled via an interface1050such as a point-to-point (P-P) interconnect, a fabric, and/or bus. In some examples, the first processor1070and the second processor1080are homogeneous. In some examples, first processor1070and the second processor1080are heterogenous. Though the example system1000is shown to have two processors, the system may have three or more processors, or may be a single processor system. In some examples, the computing system is a system on a chip (SoC).

Processors1070and1080are shown including integrated memory controller (IMC) circuitry1072and1082, respectively. Processor1070also includes interface circuits1076and1078; similarly, second processor1080includes interface circuits1086and1088. Processors1070,1080may exchange information via the interface1050using interface circuits1078,1088. IMCs1072and1082couple the processors1070,1080to respective memories, namely a memory1032and a memory1034, which may be portions of main memory locally attached to the respective processors.

Processors1070,1080may each exchange information with a network interface (NW I/F)1090via individual interfaces1052,1054using interface circuits1076,1094,1086,1098. The network interface1090(e.g., one or more of an interconnect, bus, and/or fabric, and in some examples is a chipset) may optionally exchange information with a coprocessor1038via an interface circuit1092. In some examples, the coprocessor1038is a special-purpose processor, such as, for example, a high-throughput processor, a network or communication processor, compression engine, graphics processor, general purpose graphics processing unit (GPGPU), neural-network processing unit (NPU), embedded processor, or the like.

Network interface1090may be coupled to a first interface1016via interface circuit1096. In some examples, first interface1016may be an interface such as a Peripheral Component Interconnect (PCI) interconnect, a PCI Express interconnect or another I/O interconnect. In some examples, first interface1016is coupled to a power control unit (PCU)1017, which may include circuitry, software, and/or firmware to perform power management operations with regard to the processors1070,1080and/or co-processor1038. PCU1017provides control information to a voltage regulator (not shown) to cause the voltage regulator to generate the appropriate regulated voltage. PCU1017also provides control information to control the operating voltage generated. In various examples, PCU1017may include a variety of power management logic units (circuitry) to perform hardware-based power management. Such power management may be wholly processor controlled (e.g., by various processor hardware, and which may be triggered by workload and/or power, thermal or other processor constraints) and/or the power management may be performed responsive to external sources (such as a platform or power management source or system software).

PCU1017is illustrated as being present as logic separate from the processor1070and/or processor1080. In other cases, PCU1017may execute on a given one or more of cores (not shown) of processor1070or1080. In some cases, PCU1017may be implemented as a microcontroller (dedicated or general-purpose) or other control logic configured to execute its own dedicated power management code, sometimes referred to as P-code. In yet other examples, power management operations to be performed by PCU1017may be implemented externally to a processor, such as by way of a separate power management integrated circuit (PMIC) or another component external to the processor. In yet other examples, power management operations to be performed by PCU1017may be implemented within BIOS or other system software.

Various I/O devices1014may be coupled to first interface1016, along with a bus bridge1018which couples first interface1016to a second interface1020. In some examples, one or more additional processor(s)1015, such as coprocessors, high throughput many integrated core (MIC) processors, GPGPUs, accelerators (such as graphics accelerators or digital signal processing (DSP) units), field programmable gate arrays (FPGAs), or any other processor, are coupled to first interface1016. In some examples, second interface1020may be a low pin count (LPC) interface. Various devices may be coupled to second interface1020including, for example, a keyboard and/or mouse1022, communication devices1027and storage circuitry1028. Storage circuitry1028may be one or more non-transitory machine-readable storage media as described below, such as a disk drive or other mass storage device which may include instructions/code and data1030and may implement the storage 'ISAB03 in some examples. Further, an audio I/O1024may be coupled to second interface1020. Note that other architectures than the point-to-point architecture described above are possible. For example, instead of the point-to-point architecture, a system such as multiprocessor system1000may implement a multi-drop interface or other such architecture.

Example Core Architectures, Processors, and Computer Architectures.

FIG.11illustrates a block diagram of an example processor and/or SoC1100that may have one or more cores and an integrated memory controller. The solid lined boxes illustrate a processor1100with a single core1102(A), system agent unit circuitry1110, and a set of one or more interface controller unit(s) circuitry1116, while the optional addition of the dashed lined boxes illustrates an alternative processor1100with multiple cores1102(A)-(N), a set of one or more integrated memory controller unit(s) circuitry1114in the system agent unit circuitry1110, and special purpose logic1108, as well as a set of one or more interface controller units circuitry1116. Note that the processor1100may be one of the processors1070or1080, or co-processor1038or1015ofFIG.10.

A memory hierarchy includes one or more levels of cache unit(s) circuitry1104(A)-(N) within the cores1102(A)-(N), a set of one or more shared cache unit(s) circuitry1106, and external memory (not shown) coupled to the set of integrated memory controller unit(s) circuitry1114. The set of one or more shared cache unit(s) circuitry1106may include one or more mid-level caches, such as level 2 (L2), level 3 (L3), level 4 (L4), or other levels of cache, such as a last level cache (LLC), and/or combinations thereof. While in some examples interface network circuitry1112(e.g., a ring interconnect) interfaces the special purpose logic1108(e.g., integrated graphics logic), the set of shared cache unit(s) circuitry1106, and the system agent unit circuitry1110, alternative examples use any number of well-known techniques for interfacing such units. In some examples, coherency is maintained between one or more of the shared cache unit(s) circuitry1106and cores1102(A)-(N). In some examples, interface controller units circuitry1116couple the cores1102to one or more other devices1118such as one or more I/O devices, storage, one or more communication devices (e.g., wireless networking, wired networking, etc.), etc.

In some examples, one or more of the cores1102(A)-(N) are capable of multi-threading. The system agent unit circuitry1110includes those components coordinating and operating cores1102(A)-(N). The system agent unit circuitry1110may include, for example, power control unit (PCU) circuitry and/or display unit circuitry (not shown). The PCU may be or may include logic and components needed for regulating the power state of the cores1102(A)-(N) and/or the special purpose logic1108(e.g., integrated graphics logic). The display unit circuitry is for driving one or more externally connected displays.

The cores1102(A)-(N) may be homogenous in terms of instruction set architecture (ISA). Alternatively, the cores1102(A)-(N) may be heterogeneous in terms of ISA; that is, a subset of the cores1102(A)-(N) may be capable of executing an ISA, while other cores may be capable of executing only a subset of that ISA or another ISA.

Example Core Architectures—In-Order and Out-of-Order Core Block Diagram.

InFIG.12(A), a processor pipeline1200includes a fetch stage1202, an optional length decoding stage1204, a decode stage1206, an optional allocation (Alloc) stage1208, an optional renaming stage1210, a schedule (also known as a dispatch or issue) stage1212, an optional register read/memory read stage1214, an execute stage1216, a write back/memory write stage1218, an optional exception handling stage1222, and an optional commit stage1224. One or more operations can be performed in each of these processor pipeline stages. For example, during the fetch stage1202, one or more instructions are fetched from instruction memory, and during the decode stage1206, the one or more fetched instructions may be decoded, addresses (e.g., load store unit (LSU) addresses) using forwarded register ports may be generated, and branch forwarding (e.g., immediate offset or a link register (LR)) may be performed. In one example, the decode stage1206and the register read/memory read stage1214may be combined into one pipeline stage. In one example, during the execute stage1216, the decoded instructions may be executed, LSU address/data pipelining to an Advanced Microcontroller Bus (AMB) interface may be performed, multiply and add operations may be performed, arithmetic operations with branch results may be performed, etc.

By way of example, the example register renaming, out-of-order issue/execution architecture core ofFIG.12(B)may implement the pipeline1200as follows: 1) the instruction fetch circuitry1238performs the fetch and length decoding stages1202and1204; 2) the decode circuitry1240performs the decode stage1206; 3) the rename/allocator unit circuitry1252performs the allocation stage1208and renaming stage1210; 4) the scheduler(s) circuitry1256performs the schedule stage1212; 5) the physical register file(s) circuitry1258and the memory unit circuitry1270perform the register read/memory read stage1214; the execution cluster(s)1260perform the execute stage1216; 6) the memory unit circuitry1270and the physical register file(s) circuitry1258perform the write back/memory write stage1218; 7) various circuitry may be involved in the exception handling stage1222; and 8) the retirement unit circuitry1254and the physical register file(s) circuitry1258perform the commit stage1224.

FIG.12(B)shows a processor core1290including front-end unit circuitry1230coupled to execution engine unit circuitry1250, and both are coupled to memory unit circuitry1270. The core1290may be a reduced instruction set architecture computing (RISC) core, a complex instruction set architecture computing (CISC) core, a very long instruction word (VLIW) core, or a hybrid or alternative core type. As yet another option, the core1290may be a special-purpose core, such as, for example, a network or communication core, compression engine, coprocessor core, general purpose computing graphics processing unit (GPGPU) core, graphics core, or the like.

The front-end unit circuitry1230may include branch prediction circuitry1232coupled to instruction cache circuitry1234, which is coupled to an instruction translation lookaside buffer (TLB)1236, which is coupled to instruction fetch circuitry1238, which is coupled to decode circuitry1240. In one example, the instruction cache circuitry1234is included in the memory unit circuitry1270rather than the front-end circuitry1230. The decode circuitry1240(or decoder) may decode instructions, and generate as an output one or more micro-operations, micro-code entry points, microinstructions, other instructions, or other control signals, which are decoded from, or which otherwise reflect, or are derived from, the original instructions. The decode circuitry1240may further include address generation unit (AGU, not shown) circuitry. In one example, the AGU generates an LSU address using forwarded register ports, and may further perform branch forwarding (e.g., immediate offset branch forwarding, LR register branch forwarding, etc.). The decode circuitry1240may be implemented using various different mechanisms. Examples of suitable mechanisms include, but are not limited to, look-up tables, hardware implementations, programmable logic arrays (PLAs), microcode read only memories (ROMs), etc. In one example, the core1290includes a microcode ROM (not shown) or other medium that stores microcode for certain macroinstructions (e.g., in decode circuitry1240or otherwise within the front-end circuitry1230). In one example, the decode circuitry1240includes a micro-operation (micro-op) or operation cache (not shown) to hold/cache decoded operations, micro-tags, or micro-operations generated during the decode or other stages of the processor pipeline1200. The decode circuitry1240may be coupled to rename/allocator unit circuitry1252in the execution engine circuitry1250.

The execution engine circuitry1250includes the rename/allocator unit circuitry1252coupled to retirement unit circuitry1254and a set of one or more scheduler(s) circuitry1256. The scheduler(s) circuitry1256represents any number of different schedulers, including reservations stations, central instruction window, etc. In some examples, the scheduler(s) circuitry1256can include arithmetic logic unit (ALU) scheduler/scheduling circuitry, ALU queues, address generation unit (AGU) scheduler/scheduling circuitry, AGU queues, etc. The scheduler(s) circuitry1256is coupled to the physical register file(s) circuitry1258. Each of the physical register file(s) circuitry1258represents one or more physical register files, different ones of which store one or more different data types, such as scalar integer, scalar floating-point, packed integer, packed floating-point, vector integer, vector floating-point, status (e.g., an instruction pointer that is the address of the next instruction to be executed), etc. In one example, the physical register file(s) circuitry1258includes vector registers unit circuitry, writemask registers unit circuitry, and scalar register unit circuitry. These register units may provide architectural vector registers, vector mask registers, general-purpose registers, etc. The physical register file(s) circuitry1258is coupled to the retirement unit circuitry1254(also known as a retire queue or a retirement queue) to illustrate various ways in which register renaming and out-of-order execution may be implemented (e.g., using a reorder buffer(s) (ROB(s)) and a retirement register file(s); using a future file(s), a history buffer(s), and a retirement register file(s); using a register maps and a pool of registers; etc.). The retirement unit circuitry1254and the physical register file(s) circuitry1258are coupled to the execution cluster(s)1260. The execution cluster(s)1260includes a set of one or more execution unit(s) circuitry1262and a set of one or more memory access circuitry1264. The execution unit(s) circuitry1262may perform various arithmetic, logic, floating-point or other types of operations (e.g., shifts, addition, subtraction, multiplication) and on various types of data (e.g., scalar integer, scalar floating-point, packed integer, packed floating-point, vector integer, vector floating-point). While some examples may include a number of execution units or execution unit circuitry dedicated to specific functions or sets of functions, other examples may include only one execution unit circuitry or multiple execution units/execution unit circuitry that all perform all functions. The scheduler(s) circuitry1256, physical register file(s) circuitry1258, and execution cluster(s)1260are shown as being possibly plural because certain examples create separate pipelines for certain types of data/operations (e.g., a scalar integer pipeline, a scalar floating-point/packed integer/packed floating-point/vector integer/vector floating-point pipeline, and/or a memory access pipeline that each have their own scheduler circuitry, physical register file(s) circuitry, and/or execution cluster—and in the case of a separate memory access pipeline, certain examples are implemented in which only the execution cluster of this pipeline has the memory access unit(s) circuitry1264). It should also be understood that where separate pipelines are used, one or more of these pipelines may be out-of-order issue/execution and the rest in-order.

In some examples, the execution engine unit circuitry1250may perform load store unit (LSU) address/data pipelining to an Advanced Microcontroller Bus (AMB) interface (not shown), and address phase and writeback, data phase load, store, and branches.

The set of memory access circuitry1264is coupled to the memory unit circuitry1270, which includes data TLB circuitry1272coupled to data cache circuitry1274coupled to level 2 (L2) cache circuitry1276. In one example, the memory access circuitry1264may include load unit circuitry, store address unit circuitry, and store data unit circuitry, each of which is coupled to the data TLB circuitry1272in the memory unit circuitry1270. The instruction cache circuitry1234is further coupled to the level 2 (L2) cache circuitry1276in the memory unit circuitry1270. In one example, the instruction cache1234and the data cache1274are combined into a single instruction and data cache (not shown) in L2 cache circuitry1276, level 3 (L3) cache circuitry (not shown), and/or main memory. The L2 cache circuitry1276is coupled to one or more other levels of cache and eventually to a main memory.

The core1290may support one or more instructions sets (e.g., the x86 instruction set architecture (optionally with some extensions that have been added with newer versions); the MIPS instruction set architecture; the ARM instruction set architecture (optionally with optional additional extensions such as NEON)), including the instruction(s) described herein. In one example, the core1290includes logic to support a packed data instruction set architecture extension (e.g., AVX1, AVX2), thereby allowing the operations used by many multimedia applications to be performed using packed data.

FIG.13illustrates examples of execution unit(s) circuitry, such as execution unit(s) circuitry1262ofFIG.12(B). As illustrated, execution unit(s) circuitry1262may include one or more ALU circuits1301, optional vector/single instruction multiple data (SIMD) circuits1303, load/store circuits1305, branch/jump circuits1307, and/or Floating-point unit (FPU) circuits1309. ALU circuits1301perform integer arithmetic and/or Boolean operations. Vector/SIMD circuits1303perform vector/SIMD operations on packed data (such as SIMD/vector registers). Load/store circuits1305execute load and store instructions to load data from memory into registers or store from registers to memory. Load/store circuits1305may also generate addresses. Branch/jump circuits1307cause a branch or jump to a memory address depending on the instruction. FPU circuits1309perform floating-point arithmetic. The width of the execution unit(s) circuitry1262varies depending upon the example and can range from 16-bit to 1,024-bit, for example. In some examples, two or more smaller execution units are logically combined to form a larger execution unit (e.g., two 128-bit execution units are logically combined to form a 256-bit execution unit).

Example Register Architecture.

FIG.14is a block diagram of a register architecture1400according to some examples. As illustrated, the register architecture1400includes vector/SIMD registers1410that vary from 128-bit to 1,024 bits width. In some examples, the vector/SIMD registers1410are physically 512-bits and, depending upon the mapping, only some of the lower bits are used. For example, in some examples, the vector/SIMD registers1410are ZMIM registers which are 512 bits: the lower 256 bits are used for YMM registers and the lower 128 bits are used for XMM registers. As such, there is an overlay of registers. In some examples, a vector length field selects between a maximum length and one or more other shorter lengths, where each such shorter length is half the length of the preceding length. Scalar operations are operations performed on the lowest order data element position in a ZMM/YMM/XMM register; the higher order data element positions are either left the same as they were prior to the instruction or zeroed depending on the example.

In some examples, the register architecture1400includes writemask/predicate registers1415. For example, in some examples, there are 8 writemask/predicate registers (sometimes called k0 through k7) that are each 16-bit, 32-bit, 64-bit, or 128-bit in size. Writemask/predicate registers1415may allow for merging (e.g., allowing any set of elements in the destination to be protected from updates during the execution of any operation) and/or zeroing (e.g., zeroing vector masks allow any set of elements in the destination to be zeroed during the execution of any operation). In some examples, each data element position in a given writemask/predicate register1415corresponds to a data element position of the destination. In other examples, the writemask/predicate registers1415are scalable and consists of a set number of enable bits for a given vector element (e.g., 8 enable bits per 64-bit vector element).

The register architecture1400includes a plurality of general-purpose registers1425. These registers may be 16-bit, 32-bit, 64-bit, etc. and can be used for scalar operations. In some examples, these registers are referenced by the names RAX, RBX, RCX, RDX, RBP, RSI, RDI, RSP, and R8 through R15.

In some examples, the register architecture1400includes scalar floating-point (FP) register file1445which is used for scalar floating-point operations on 32/64/80-bit floating-point data using the x87 instruction set architecture extension or as MMX registers to perform operations on 64-bit packed integer data, as well as to hold operands for some operations performed between the MMX and XMIVI registers.

One or more flag registers1440(e.g., EFLAGS, RFLAGS, etc.) store status and control information for arithmetic, compare, and system operations. For example, the one or more flag registers1440may store condition code information such as carry, parity, auxiliary carry, zero, sign, and overflow. In some examples, the one or more flag registers1440are called program status and control registers.

Segment registers1420contain segment points for use in accessing memory. In some examples, these registers are referenced by the names CS, DS, SS, ES, FS, and GS.

Machine specific registers (MSRs)1435control and report on processor performance. Most MSRs1435handle system-related functions and are not accessible to an application program. Machine check registers1460consist of control, status, and error reporting MSRs that are used to detect and report on hardware errors.

One or more instruction pointer register(s)1430store an instruction pointer value. Control register(s)1455(e.g., CR0-CR4) determine the operating mode of a processor (e.g., processor1070,1080,1038,1015, and/or1100) and the characteristics of a currently executing task. Debug registers1450control and allow for the monitoring of a processor or core's debugging operations.

Memory (mem) management registers1465specify the locations of data structures used in protected mode memory management. These registers may include a global descriptor table register (GDTR), interrupt descriptor table register (IDTR), task register, and a local descriptor table register (LDTR) register.

Alternative examples may use wider or narrower registers. Additionally, alternative examples may use more, less, or different register files and registers. The register architecture1400may, for example, be used in register file/memory 'ISAB08, or physical register file(s) circuitry1258.

Instruction Set Architectures.

Example Instruction Formats.

FIG.15illustrates examples of an instruction format. As illustrated, an instruction may include multiple components including, but not limited to, one or more fields for: one or more prefixes1501, an opcode1503, addressing information1505(e.g., register identifiers, memory addressing information, etc.), a displacement value1507, and/or an immediate value1509. Note that some instructions utilize some or all the fields of the format whereas others may only use the field for the opcode1503. In some examples, the order illustrated is the order in which these fields are to be encoded, however, it should be appreciated that in other examples these fields may be encoded in a different order, combined, etc.

The prefix(es) field(s)1501, when used, modifies an instruction. In some examples, one or more prefixes are used to repeat string instructions (e.g., 0xF0, 0xF2, 0xF3, etc.), to provide section overrides (e.g., 0x2E, 0x36, 0x3E, 0x26, 0x64, 0x65, 0x2E, 0x3E, etc.), to perform bus lock operations, and/or to change operand (e.g., 0x66) and address sizes (e.g., 0x67). Certain instructions require a mandatory prefix (e.g., 0x66, 0xF2, 0xF3, etc.). Certain of these prefixes may be considered “legacy” prefixes. Other prefixes, one or more examples of which are detailed herein, indicate, and/or provide further capability, such as specifying particular registers, etc. The other prefixes typically follow the “legacy” prefixes.

The opcode field1503is used to at least partially define the operation to be performed upon a decoding of the instruction. In some examples, a primary opcode encoded in the opcode field1503is one, two, or three bytes in length. In other examples, a primary opcode can be a different length. An additional 3-bit opcode field is sometimes encoded in another field.

The addressing information field1505is used to address one or more operands of the instruction, such as a location in memory or one or more registers.FIG.16illustrates examples of the addressing information field1505. In this illustration, an optional MOD R/M byte1602and an optional Scale, Index, Base (SIB) byte1604are shown. The MOD R/M byte1602and the SIB byte1604are used to encode up to two operands of an instruction, each of which is a direct register or effective memory address. Note that both of these fields are optional in that not all instructions include one or more of these fields. The MOD R/M byte1602includes a MOD field1642, a register (reg) field1644, and R/M field1646.

The content of the MOD field1642distinguishes between memory access and non-memory access modes. In some examples, when the MOD field1642has a binary value of 11 (11b), a register-direct addressing mode is utilized, and otherwise a register-indirect addressing mode is used.

The register field1644may encode either the destination register operand or a source register operand or may encode an opcode extension and not be used to encode any instruction operand. The content of register field1644, directly or through address generation, specifies the locations of a source or destination operand (either in a register or in memory). In some examples, the register field1644is supplemented with an additional bit from a prefix (e.g., prefix1501) to allow for greater addressing.

The R/M field1646may be used to encode an instruction operand that references a memory address or may be used to encode either the destination register operand or a source register operand. Note the R/M field1646may be combined with the MOD field1642to dictate an addressing mode in some examples.

The SIB byte1604includes a scale field1652, an index field1654, and a base field1656to be used in the generation of an address. The scale field1652indicates a scaling factor. The index field1654specifies an index register to use. In some examples, the index field1654is supplemented with an additional bit from a prefix (e.g., prefix1501) to allow for greater addressing. The base field1656specifies a base register to use. In some examples, the base field1656is supplemented with an additional bit from a prefix (e.g., prefix1501) to allow for greater addressing. In practice, the content of the scale field1652allows for the scaling of the content of the index field1654for memory address generation (e.g., for address generation that uses 2scale*index+base).

Some addressing forms utilize a displacement value to generate a memory address. For example, a memory address may be generated according to 2scale*index+base+displacement, index*scale+displacement, r/m+displacement, instruction pointer (RIP/EIP)+displacement, register+displacement, etc. The displacement may be a 1-byte, 2-byte, 4-byte, etc. value. In some examples, the displacement field1507provides this value. Additionally, in some examples, a displacement factor usage is encoded in the MOD field of the addressing information field1505that indicates a compressed displacement scheme for which a displacement value is calculated and stored in the displacement field1507.

In some examples, the immediate value field1509specifies an immediate value for the instruction. An immediate value may be encoded as a 1-byte value, a 2-byte value, a 4-byte value, etc.

FIG.17illustrates examples of a first prefix1501(A). In some examples, the first prefix1501(A) is an example of a REX prefix. Instructions that use this prefix may specify general purpose registers, 64-bit packed data registers (e.g., single instruction, multiple data (SIMD) registers or vector registers), and/or control registers and debug registers (e.g., CR8-CR15and DR8-DR15).

Instructions using the first prefix1501(A) may specify up to three registers using 3-bit fields depending on the format: 1) using the reg field1644and the R/M field1646of the MOD R/M byte1602; 2) using the MOD R/M byte1602with the SIB byte1604including using the reg field1644and the base field1656and index field1654; or 3) using the register field of an opcode.

In the first prefix1501(A), bit positions7:4are set as 0100. Bit position3(W) can be used to determine the operand size but may not solely determine operand width. As such, when W=0, the operand size is determined by a code segment descriptor (CS.D) and when W=1, the operand size is 64-bit.

Note that the addition of another bit allows for 16 (24) registers to be addressed, whereas the MOD R/M reg field1644and MOD R/M R/M field1646alone can each only address 8 registers.

In the first prefix1501(A), bit position2(R) may be an extension of the MOD R/M reg field1644and may be used to modify the MOD R/M reg field1644when that field encodes a general-purpose register, a 64-bit packed data register (e.g., a SSE register), or a control or debug register. R is ignored when MOD R/M byte1602specifies other registers or defines an extended opcode.

Bit position1(X) may modify the SIB byte index field1654.

FIGS.18(A)-(D) illustrate examples of how the R, X, and B fields of the first prefix1501(A) are used.FIG.18(A)illustrates R and B from the first prefix1501(A) being used to extend the reg field1644and R/M field1646of the MOD R/M byte1602when the SIB byte1604is not used for memory addressing.FIG.18(B)illustrates R and B from the first prefix1501(A) being used to extend the reg field1644and R/M field1646of the MOD R/M byte1602when the SIB byte1604is not used (register-register addressing).FIG.18(C)illustrates R, X, and B from the first prefix1501(A) being used to extend the reg field1644of the MOD R/M byte1602and the index field1654and base field1656when the SIB byte1604being used for memory addressing.FIG.18(D)illustrates B from the first prefix1501(A) being used to extend the reg field1644of the MOD R/M byte1602when a register is encoded in the opcode1503.

FIGS.19(A)-(B) illustrate examples of a second prefix1501(B). In some examples, the second prefix1501(B) is an example of a VEX prefix. The second prefix1501(B) encoding allows instructions to have more than two operands, and allows SIMD vector registers (e.g., vector/SIMD registers1410) to be longer than 64-bits (e.g., 128-bit and 256-bit). The use of the second prefix1501(B) provides for three-operand (or more) syntax. For example, previous two-operand instructions performed operations such as A=A+B, which overwrites a source operand. The use of the second prefix1501(B) enables operands to perform nondestructive operations such as A=B+C.

In some examples, the second prefix1501(B) comes in two forms—a two-byte form and a three-byte form. The two-byte second prefix1501(B) is used mainly for 128-bit, scalar, and some 256-bit instructions; while the three-byte second prefix1501(B) provides a compact replacement of the first prefix1501(A) and 3-byte opcode instructions.

FIG.19(A)illustrates examples of a two-byte form of the second prefix1501(B). In one example, a format field1901(byte 01903) contains the value CSH. In one example, byte 11905includes an “R” value in bit[7]. This value is the complement of the “R” value of the first prefix1501(A). Bit[2] is used to dictate the length (L) of the vector (where a value of 0 is a scalar or 128-bit vector and a value of 1 is a 256-bit vector). Bits[1:0] provide opcode extensionality equivalent to some legacy prefixes (e.g., 00=no prefix, 01=66H, 10=F3H, and 11=F2H). Bits[6:3] shown as vvvv may be used to: 1) encode the first source register operand, specified in inverted (1s complement) form and valid for instructions with 2 or more source operands; 2) encode the destination register operand, specified in 1s complement form for certain vector shifts; or 3) not encode any operand, the field is reserved and should contain a certain value, such as 1111b.

Instructions that use this prefix may use the MOD R/M R/M field1646to encode the instruction operand that references a memory address or encode either the destination register operand or a source register operand.

Instructions that use this prefix may use the MOD R/M reg field1644to encode either the destination register operand or a source register operand, or to be treated as an opcode extension and not used to encode any instruction operand.

For instruction syntax that support four operands, vvvv, the MOD R/M R/M field1646and the MOD R/M reg field1644encode three of the four operands. Bits[7:4] of the immediate value field1509are then used to encode the third source register operand.

FIG.19(B)illustrates examples of a three-byte form of the second prefix1501(B). In one example, a format field1911(byte 01913) contains the value C4H. Byte 11915includes in bits[7:5] “R,” “X,” and “B” which are the complements of the same values of the first prefix1501(A). Bits[4:0] of byte 11915(shown as mmmmm) include content to encode, as need, one or more implied leading opcode bytes. For example, 00001 implies a OFH leading opcode, 00010 implies a OF38H leading opcode, 00011 implies a OF3AH leading opcode, etc.

Bit[7] of byte 21917is used similar to W of the first prefix1501(A) including helping to determine promotable operand sizes. Bit[2] is used to dictate the length (L) of the vector (where a value of 0 is a scalar or 128-bit vector and a value of 1 is a 256-bit vector). Bits[1:0] provide opcode extensionality equivalent to some legacy prefixes (e.g., 00=no prefix, 01=66H, 10=F3H, and 11=F2H). Bits[6:3], shown as vvvv, may be used to: 1) encode the first source register operand, specified in inverted (1s complement) form and valid for instructions with 2 or more source operands; 2) encode the destination register operand, specified in is complement form for certain vector shifts; or 3) not encode any operand, the field is reserved and should contain a certain value, such as 1111b.

Instructions that use this prefix may use the MOD R/M R/M field1646to encode the instruction operand that references a memory address or encode either the destination register operand or a source register operand.

Instructions that use this prefix may use the MOD R/M reg field1644to encode either the destination register operand or a source register operand, or to be treated as an opcode extension and not used to encode any instruction operand.

For instruction syntax that support four operands, vvvv, the MOD R/M R/M field1646, and the MOD R/M reg field1644encode three of the four operands. Bits[7:4] of the immediate value field1509are then used to encode the third source register operand.

FIG.20illustrates examples of a third prefix1501(C). In some examples, the third prefix1501(C) is an example of an EVEX prefix. The third prefix1501(C) is a four-byte prefix.

The third prefix1501(C) can encode 32 vector registers (e.g., 128-bit, 256-bit, and 512-bit registers) in 64-bit mode. In some examples, instructions that utilize a writemask/opmask (see discussion of registers in a previous figure, such asFIG.14) or predication utilize this prefix. Opmask register allow for conditional processing or selection control. Opmask instructions, whose source/destination operands are opmask registers and treat the content of an opmask register as a single value, are encoded using the second prefix1501(B).

The third prefix1501(C) may encode functionality that is specific to instruction classes (e.g., a packed instruction with “load+op” semantic can support embedded broadcast functionality, a floating-point instruction with rounding semantic can support static rounding functionality, a floating-point instruction with non-rounding arithmetic semantic can support “suppress all exceptions” functionality, etc.).

The first byte of the third prefix1501(C) is a format field2011that has a value, in one example, of 62H. Subsequent bytes are referred to as payload bytes2015-2019and collectively form a 24-bit value of P[23:0] providing specific capability in the form of one or more fields (detailed herein).

In some examples, P[1:0] of payload byte2019are identical to the low two mm bits. P[3:2] are reserved in some examples. Bit P[4] (R′) allows access to the high 16 vector register set when combined with P[7] and the MOD R/M reg field1644. P[6] can also provide access to a high 16 vector register when SIB-type addressing is not needed. P[7:5] consist of R, X, and B which are operand specifier modifier bits for vector register, general purpose register, memory addressing and allow access to the next set of 8 registers beyond the low 8 registers when combined with the MOD R/M register field1644and MOD R/M R/M field1646. P[9:8] provide opcode extensionality equivalent to some legacy prefixes (e.g., 00=no prefix, 01=66H, 10=F3H, and 11=F2H). P[10] in some examples is a fixed value of 1. P[14:11], shown as vvvv, may be used to: 1) encode the first source register operand, specified in inverted (1s complement) form and valid for instructions with 2 or more source operands; 2) encode the destination register operand, specified in 1s complement form for certain vector shifts; or 3) not encode any operand, the field is reserved and should contain a certain value, such as 1111b.

P[15] is similar to W of the first prefix1501(A) and second prefix1511(B) and may serve as an opcode extension bit or operand size promotion.

P[18:16] specify the index of a register in the opmask (writemask) registers (e.g., writemask/predicate registers1415). In one example, the specific value aaa=000 has a special behavior implying no opmask is used for the particular instruction (this may be implemented in a variety of ways including the use of a opmask hardwired to all ones or hardware that bypasses the masking hardware). When merging, vector masks allow any set of elements in the destination to be protected from updates during the execution of any operation (specified by the base operation and the augmentation operation); in other one example, preserving the old value of each element of the destination where the corresponding mask bit has a 0. In contrast, when zeroing vector masks allow any set of elements in the destination to be zeroed during the execution of any operation (specified by the base operation and the augmentation operation); in one example, an element of the destination is set to 0 when the corresponding mask bit has a 0 value. A subset of this functionality is the ability to control the vector length of the operation being performed (that is, the span of elements being modified, from the first to the last one); however, it is not necessary that the elements that are modified be consecutive. Thus, the opmask field allows for partial vector operations, including loads, stores, arithmetic, logical, etc. While examples are described in which the opmask field's content selects one of a number of opmask registers that contains the opmask to be used (and thus the opmask field's content indirectly identifies that masking to be performed), alternative examples instead or additional allow the mask write field's content to directly specify the masking to be performed.

P[19] can be combined with P[14:11] to encode a second source vector register in a non-destructive source syntax which can access an upper 16 vector registers using P[19]. P[20] encodes multiple functionalities, which differs across different classes of instructions and can affect the meaning of the vector length/rounding control specifier field (P[22:21]). P[23] indicates support for merging-writemasking (e.g., when set to 0) or support for zeroing and merging-writemasking (e.g., when set to 1).

Example examples of encoding of registers in instructions using the third prefix1501(C) are detailed in the following tables.

Program code may be applied to input information to perform the functions described herein and generate output information. The output information may be applied to one or more output devices, in known fashion. For purposes of this application, a processing system includes any system that has a processor, such as, for example, a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a microprocessor, or any combination thereof.

One or more aspects of at least one example may be implemented by representative instructions stored on a machine-readable medium which represents various logic within the processor, which when read by a machine causes the machine to fabricate logic to perform the techniques described herein. Such representations, known as “intellectual property (IP) cores” may be stored on a tangible, machine readable medium and supplied to various customers or manufacturing facilities to load into the fabrication machines that make the logic or processor.

Accordingly, examples also include non-transitory, tangible machine-readable media containing instructions or containing design data, such as Hardware Description Language (HDL), which defines structures, circuits, apparatuses, processors and/or system features described herein. Such examples may also be referred to as program products.

FIG.21is a block diagram illustrating the use of a software instruction converter to convert binary instructions in a source ISA to binary instructions in a target ISA according to examples. In the illustrated example, the instruction converter is a software instruction converter, although alternatively the instruction converter may be implemented in software, firmware, hardware, or various combinations thereof.FIG.21shows a program in a high-level language2102may be compiled using a first ISA compiler2104to generate first ISA binary code2106that may be natively executed by a processor with at least one first ISA core2116. The processor with at least one first ISA core2116represents any processor that can perform substantially the same functions as an Intel® processor with at least one first ISA core by compatibly executing or otherwise processing (1) a substantial portion of the first ISA or (2) object code versions of applications or other software targeted to run on an Intel processor with at least one first ISA core, in order to achieve substantially the same result as a processor with at least one first ISA core. The first ISA compiler2104represents a compiler that is operable to generate first ISA binary code2106(e.g., object code) that can, with or without additional linkage processing, be executed on the processor with at least one first ISA core2116. Similarly,FIG.21shows the program in the high-level language2102may be compiled using an alternative ISA compiler2108to generate alternative ISA binary code2110that may be natively executed by a processor without a first ISA core2114. The instruction converter2112is used to convert the first ISA binary code2106into code that may be natively executed by the processor without a first ISA core2114. This converted code is not necessarily to be the same as the alternative ISA binary code2110; however, the converted code will accomplish the general operation and be made up of instructions from the alternative ISA. Thus, the instruction converter2112represents software, firmware, hardware, or a combination thereof that, through emulation, simulation or any other process, allows a processor or other electronic device that does not have a first ISA processor or core to execute the first ISA binary code2106.

Moreover, in the various examples described above, unless specifically noted otherwise, disjunctive language such as the phrase “at least one of A, B, or C” or “A, B, and/or C” is intended to be understood to mean either A, B, or C, or any combination thereof (i.e. A and B, A and C, B and C, and A, B and C).

EXAMPLES

Example 1 is an apparatus including a processor core to request a cacheline to be loaded from a memory in a memory access request; and a cache to determine a speculated color value for the memory access request, receive a data granule of the cacheline from the memory, and decrypt data of the data granule using the speculated color value. In Example 2, the subject matter of Example 1 optionally includes the cache to propagate the decrypted data of the data granule to other levels of the cache. In Example 3, the subject matter of Example 1 optionally includes the processor core to speculatively access the decrypted data of the data granule. In Example 4, the subject matter of Example 3 optionally includes the processor core to set an access bit associated with the data granule and a hardware thread of the processor core when the processor core speculatively accesses the decrypted data of the data granule. In Example 5, the subject matter of Example 1 optionally includes the processor core to perform a memory safety check for accessing the decrypted data of the data granule based at least in part on the speculated color value.

In Example 6, the subject matter of Example 5 optionally includes the processor core to access the decrypted data when the memory safety check passes. In Example 7, the subject matter of Example 1 optionally includes wherein the speculated color value is a key identifier used for decrypting the data of the data granule and a memory tag used for performing a memory safety check for accessing the decrypted data of the data granule. In Example 8, the subject matter of Example 1 optionally includes the processor core to request metadata associated with the memory access request from the memory, and the cache to receive the metadata and store the metadata in the cacheline. In Example 9, the subject matter of Example 8 optionally includes the processor core to perform a memory safety check for accessing the decrypted data of the data granule based at least in part on a color value of the metadata and access the data decrypted using the color value when the memory safety check passes. In Example 10, the subject matter of Example 9 optionally includes the processor core to replace the speculated color value with the color value of the metadata and re-decrypt the data of the data granule using the color value of the metadata when the speculated color value does not match the color value of the metadata. In Example 11, the subject matter of Example 9 optionally includes wherein the processor core is to speculatively access the data decrypted using the speculative color value faster than the processor core is to access the data decrypted using the color value. In Example 12, the subject matter of Example 1 optionally includes the processor core to request the cacheline to be loaded from the memory when data to be accessed, the data being referenced by a pointer in a memory access request, is not in the cache. In Example 13, the subject matter of Example 11 optionally includes the cache to determine the speculated color value based at least in part on a previous memory access request.

Example 14 is a system including a memory to store a cacheline including a data granule; and a processor, the processor including a processor core to request the cacheline to be loaded from the memory in a memory access request; and a cache to determine a speculated color value for the memory access request, receive the data granule from the memory, and decrypt data of the data granule using the speculated color value. In Example 15, the subject matter of Example 14 optionally includes the cache to propagate the decrypted data of the data granule to other levels of the cache. In Example 16, the subject matter of Example 14 optionally includes the processor core to speculatively access the decrypted data of the data granule. In Example 17, the subject matter of Example 16 optionally includes the processor core to set an access bit associated with the data granule and a hardware thread of the processor core when the processor core speculatively accesses the decrypted data of the data granule. In Example 18, the subject matter of Example 14 optionally includes the processor core to perform a memory safety check for accessing the decrypted data of the data granule based at least in part on the speculated color value. In Example 19, the subject matter of Example 18 optionally includes the processor core to access the decrypted data when the memory safety check passes.

Example 20 is a method including requesting a cacheline to be loaded from a memory in a memory access request; determining a speculated color value for the memory access request; receiving a data granule of the cacheline from the memory; and decrypting data of the data granule using the speculated color value. In Example 21, the subject matter of Example 20 optionally includes wherein the speculated color value is a key identifier used for decrypting the data of the data granule and a memory tag used for performing a memory safety check for accessing the decrypted data of the data granule. In Example 22, the subject matter of Example 20 optionally includes requesting by a processor core, metadata associated with the memory access request from the memory, and receiving, by a cache, the metadata and store the metadata in the cacheline. In Example 23, the subject matter of Example 22 optionally includes performing a memory safety check for accessing the decrypted data of the data granule based at least in part on a color value of the metadata and accessing the data decrypted using the color value when the memory safety check passes. In Example 24, the subject matter of Example 23 optionally includes replacing the speculated color value with the color value of the metadata and re-decrypting the data of the data granule using the color value of the metadata when the speculated color value does not match the color value of the metadata. In Example 25, the subject matter of Example 24 optionally includes speculatively accessing, by the processor core, the data decrypted using the speculative color value faster accessing, by the processor core, the data decrypted using the color value. In Example 26, the subject matter of Example 20 optionally includes requesting the cacheline to be loaded from the memory when data to be accessed, the data being referenced by a pointer in a memory access request, is not in a cache. In Example 27, the subject matter of Example 25 optionally includes determining the speculated color value based at least in part on a previous memory access request.

Example 28 is an apparatus operative to perform the method of any one of Examples 20 to 27. Example 29 is an apparatus that includes means for performing the method of any one of Examples 20 to 27. Example 30 is an apparatus that includes any combination of modules and/or units and/or logic and/or circuitry and/or means operative to perform the method of any one of Examples 20 to 27. Example 31 is an optionally non-transitory and/or tangible machine-readable medium, which optionally stores or otherwise provides instructions that if and/or when executed by a computer system or other machine are operative to cause the machine to perform the method of any one of Examples 20 to 27.