Secure speculative execution of instructions

A system including a computer storage and a processor is described. The computer storage is configured to identify a stored data as protected. The processor is configured to perform speculative execution. To perform the speculative execution, the processor is configured to determine, in response to the speculative execution of an instruction to read the stored data, whether the stored data is identified as protected. In response to a determination that the stored data attempted to be read during the speculative execution is protected, the processor is configured to disallow during the speculative execution immediate successful completion of the instruction to read the stored data.

BACKGROUND

Modern computer systems employ speculative execution to improve the processor efficiency. Speculative execution is used primarily for instructions that include one or more conditions. The sequence of instructions followed depends upon the outcome of the condition. In speculative execution, the processor(s) make an assumption about the outcome of the condition and follow an execution path corresponding to the assumption. For example, the processor(s) may assume that the condition is fulfilled and continue loading and executing instructions as though the condition has been fulfilled. If it is determined at some later time that the condition has been fulfilled, processing continues. In such a case, efficiency has been improved because the processor(s) did not wait for the determination that the condition was fulfilled before continuing processing. If it is determined at some time later that the condition has not been fulfilled, then the processor(s) discard the instructions that have been loaded and the corresponding data and reverse any logical state changes for that sequence of instructions. The processor(s) then return to the logical state prior to speculative execution. Then, the processor(s) load instructions corresponding to the condition not being fulfilled, executes these instructions, and continues operation.

Although speculative execution can improve processor efficiency, it also leaves the computer system subject to attack. When using speculative execution, a processor may perform an illegal operation if the assumption made about the condition is incorrect. For example, the processor may speculatively read protected data (e.g. data desired to be kept secret and that may have some security associated with it) from a memory location, which is not supposed to be accessed by the running program. Although the attacker might not be able to read the protected out directly (i.e. the processor could only access the protected data temporarily while it is speculatively executing the wrong path) the attacking program could change other physical state of the processor based on the contents of the memory location. This change in physical state could be measured and therefore may provide information about the protected data. Thus, an attacker may exfiltrate protected data using speculative execution. Security of the protected data may be compromised.

DETAILED DESCRIPTION

A detailed description of one or more embodiments is provided below along with accompanying figures that illustrate the principles of the disclosure. The disclosure is described in connection with such embodiments, but the disclosure is not limited to any embodiment. The scope of the disclosure is limited only by the claims and the disclosure encompasses numerous alternatives, modifications and equivalents. Numerous specific details are set forth in the following description in order to provide a thorough understanding of the disclosure. These details are provided for the purpose of example and the disclosure may be practiced according to the claims without some or all of these specific details. For the purpose of clarity, technical material that is known in the technical fields related to the disclosure has not been described in detail so that the disclosure is not unnecessarily obscured.

Computer systems may use speculative execution to improve their efficiency when executing instructions that include one or more conditions. In speculative execution, the processor(s) make an assumption about the outcome of the condition and follow an execution path corresponding to the assumption. When the outcome of the condition becomes known, if the assumption is correct, processing continues. In such a case, efficiency has been improved. If it is determined that the assumption is incorrect, then the processor(s) squash the instructions, discard corresponding data, and reverse state changes for that sequence of instructions. The processor(s) then return to the state prior to speculative execution and follow an execution path for the actual outcome of the condition.

Although speculative execution can improve processor efficiency, it also makes the computer system vulnerable. When using speculative execution, a processor may perform an illegal operation if the assumption made about the condition is incorrect. For example, the processor may speculatively read protected data (e.g. data desired to be kept secret and that may have security associated with it). Thus, an attacker may obtain information related to the protected data or the protected data itself. Security of the protected data may be compromised. Accordingly, a mechanism for improving the security of computer systems utilizing speculative execution is desired.

A system including computer storage and a processor is described. The computer storage is configured to identify certain stored data as protected. The processor is also configured to perform speculative execution. When performing speculative execution and in response to the speculative execution of an instruction to read the stored data, the processor determines whether the stored data is identified as protected. In response to a determination that the stored data attempted to be read during the speculative execution is protected, the processor disallows, during the speculative execution, immediate successful completion of the instruction to read the stored data. For example, the speculative execution may be performed for particular instruction(s) that include one or more conditions. In such embodiments, the processor disallows the read instruction during the speculative execution by stalling the execution of the read instruction until the condition(s) being determined to match assumption(s) for speculative execution. In some embodiments, the processor is configured execute a special store instruction for storing sensitive data. The special store instruction marks the sensitive data as protected.

In some embodiments, the stored data is identified as protected by a tag in the computer storage. In such embodiments, the processor is configured to determine whether the stored data is protected by determining a state of the tag. The computer storage may include data storage and error correction code storage corresponding to the data storage. The stored data is stored in the data storage. The protection status is stored in the error correction storage for the stored data being identified as protected. For example, the error correction storage may include tag storage, which includes a tag indicating the stored data is protected for the stored data being identified as protected.

A method is also described and computer program product including instructions for performing the method. The method includes determining, in response to a speculative execution of an instruction to read a stored data, whether the stored data is identified as protected by computer storage in which the stored data is stored. In response to a determination that the stored data attempted to be read during the speculative execution is protected, the method disallows immediate successful completion of the instruction to read the stored data. In some embodiments, the speculative execution may be performed for particular instruction(s) that include one or more conditions. In such embodiments, to disallow during the speculative execution, execution of the read instruction is stalled until the condition(s) being determined to match assumption(s) for speculative execution. In case the assumption(s) is incorrect, the read instruction would be squashed. In some embodiments, a special store instruction is executed for storing sensitive data. The special store instruction identifies the sensitive data as protected.

In some embodiments, the stored data is identified as protected by a tag in the computer storage. In such embodiments, determining whether the stored data is protected includes determining a state of the tag. The computer storage may include data storage and error correction code storage corresponding to the data storage. Actual error correction code may not use all of its storage space. The stored data is stored in the data storage. A protection status is stored in the error correction storage for the stored data that is identified as protected. For example, the error correction storage may include tag storage, which includes a tag indicating the stored data is protected for the stored data being identified as protected. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions used in carrying out the method is also described.

FIG.1is a diagram depicting an embodiment of system100capable of performing secure speculative execution of instructions. For simplicity, only some components are shown. System100includes storage110and one or more processors120. Processor(s)120perform speculative execution. Processor(s)120include instruction decode unit(s)122, prediction unit(s)124, execution unit(s)126, and load-store unit(s)128. However, processor(s)120may include additional, different, and/or other components and/or may have a different architecture. In some embodiments, a particular processor includes at least one of each of the units122,124,126, and128. Instruction decode unit(s)122decode instructions for execution. Prediction unit(s)124are used to perform speculation and initiate speculative execution. Thus, prediction unit124may assume an outcome for each condition of an instruction (i.e. makes the assumption or prediction) to allow processor(s)120to operate on the corresponding execution path. Execution unit(s)126execute the computer instructions decoded by instruction decode unit122. Load-store unit(s)128may be utilized to load and store data. For example, load-store unit(s)128may store data in storage110such that data for which security is desired (e.g. data which is desired to be kept secret) is identified. Load-store unit(s)128may load data in storage110, may check the security status tag, and disallow (e.g. stall) the data read during speculative execution if security is desired.

Storage110may be one or multiple tiers of memory, which is typically random access memory (RAM), or other type of storage medium. Storage110includes unprotected data111, protected data112, and status identifiers114. Unprotected data111and protected data112may be stored at one or more memory locations of storage110. Unprotected data111includes data that need not be protected from security vulnerabilities during speculative execution. Protected data112includes data that has been identified as being desired to be kept secret and for which security during speculative execution is desired. Status identifiers114store an indication of whether the data in storage110is protected (e.g. secret and desired to be kept secure). Thus, status identifiers114indicate that protected data112has protected status. In some embodiments, status identifiers114may include tags that identify protected data112.

For example,FIG.2is a diagram depicting an embodiment of a portion of memory200for performing secure speculative execution of instructions. More specifically, memory200may be part of storage110. For example, storage110may include numerous sets of memory200. Memory200includes data chunks202,204,206, and208that store data. Also shown are error correction and checking (ECC) bits210corresponding to data chunks202,204,206, and208. As an example for a particular memory technology and ECC implementation, data chunks202,204,206, and208may each be a sixty-four bit chunk of data. In such an embodiment, eight bits are used for single error correction, double error detection (SECDED) of each chunk. Thus, ECC bits210include sixty-four bits. Bits212,214,216, and218each include eight ECC bits for data chunks202,204,206, and208, respectively. Thus, there are thirty-two bits allocated for error correction of data chunks202,204,206, and208. ECC bits210thus include thirty-two spare bits. These spare bits may be used to identify whether data chunks202,204,206, and208include protected data. Tag bits220may include eight bits (two bits per chunk202,204,206, and208) of tags that identify whether the corresponding chunk202,204,206, and/or208include protected data. In another embodiment, data chunks202,204,206, and208may each include one hundred and twenty-eight bits. ECC bits210may then utilize thirty-six bits (nine bits per data chunk) for SECDED error correction of data chunks202,204,206, and208, respectively. In such an embodiment, twenty-eight spare bits remain for use in identifying whether data chunks202,204,206, and208include protected data. Tag bits220may include eight bits (two bits per chunk202,204,206, and208) of tags that identify whether the corresponding chunk202,204,206, and/or208include protected data. Thus, data chunks202,204,206, and208may be used for protected data112and/or unprotected data111. ECC bits210includes error correction bits212,213,216, and218as well as tag bits220for indicating which data chunks include protected data112. In the embodiment shown, tag bits220do not consume all of the spare bits. Consequently, ECC bits210include additional spare bits.

In operation, computer system100stores protected data112. In some embodiments, this is accomplished using load-store unit(s)128. Processor(s)120and/or load-store unit(s)128may utilize a specialized store instruction for protected data112. The specialized store instruction performed by load-store unit(s)128provides status identifiers114that identify protected data. For example, for some portion of protected data112being stored in data chunk202, the specialized store instruction performed via load-store unit128may set the corresponding tag bits220. For some portion of unprotected data111stored in data chunk208, tag bits220are not set and a regular store instruction may be executed.

Processor(s)120also perform speculative execution, initiated by prediction unit124. To do so, processor(s)120assume outcomes for conditions of conditional instructions. During speculative execution, processor(s)120disallows immediate successful completion of the instruction(s) that read protected data112. In some embodiments, processor(s)120allow immediate successful completion of the instruction(s) that read unprotected data111during speculative execution. For example, conditional instruction(s) may include one or more conditions. In such embodiments, processor(s)120completes execution of instruction(s) to read protected data112in response (e.g. only in response) to the outcome(s) of the condition(s) matching the assumption(s). To do so, processor120may check tag bits220in response to an instruction to read one or more of data chunks202,204,206, and/or208. If the tag bits are set to identify the data in one or more of data chunks202,204,206, and/or208as protected, the read instruction(s) for these data chunks is temporarily disallowed. In some embodiments, the read instruction is paused until the outcome of the condition in the conditional instruction is known. If the outcome is as assumed, processor120performs the read instruction. If the outcome is not as assumed, then the read instruction and other instructions on the incorrect execution path are discarded. Processor120returns to the state corresponding to a different (now known) outcome the conditional instruction.

Computer system100may have improved efficiency while maintaining security of stored data. Processor(s)120may perform speculative execution. Thus, processor(s)120need not wait for the outcomes of all conditions for conditional instructions in order to proceed along an execution path. Thus, efficiency of computer system100may be improved. Further, because reading of protected data112is disallowed during speculative execution, security may be enhanced. Instead, protected data112may be read once the outcomes of conditions have been determined to match the assumptions made during speculative execution. Thus, illegal operation(s) that might otherwise be performed as part of speculative execution may be prevented. Thus, security for protected data112is enhanced. Use of spare bits in ECC bits210may also be transparent to the operating system of computer system100. Thus, system memory need not be allocated to tags used in identifying protected data and processor(s)120need not utilized resources to manage a tag table. Thus, performance of system100may not be adversely impacted by the improvement in security.

FIG.3is a flow-chart depicting an embodiment of method300for storing data that may be secure during speculative execution of instructions. Method300is described in the context of system100and memory200. In some embodiments, method300may be performed by other systems having other configurations.

It is determined whether data to be stored is desired to be protected during speculative execution, at302. In some embodiments,302includes the data desired to be protected as secret being marked, for example using a pragma in programming language and corresponding compiler support.

For data identified as being desired to remain secret during speculative execution (e.g. protected data) at302, a specialized store instruction is used, at304. The specialized store instruction identifies the protected status for the data being stored. Execution of the specialized store instruction not only stores the data at the desired location in storage but also causes status identifiers for the stored data to be set to identify the data as protected. For example, a tag in the corresponding ECC bits may be set to a “1”.

For data that need not be protected during speculative execution, a regular store instruction may be executed, at306. Execution of the regular store instruction not only stores the data at the desired location in storage but does not cause status identifiers for the stored data to be set to identify the data as protected. For example, a tag in the corresponding ECC bits may be set to a “0”. Alternatively, the tag in the corresponding ECC bits may be initialized to a “0” and simply not be set to a “1” at306.

For example, suppose the password in a username/password combination is desired to be protected during speculative execution. A portion of the corresponding code in high-level programming language might include:

In the above example, the username and password are read from the input provided by the user. The password is desired to be identified as protected (e.g. #pragma tag secret password). However, username is not considered protected. The corresponding storage of the username (not protected) and password (protected) may include:

//store username in memory: regular storemov[addr1], username//store password in memory: special store writes tag= 1mov_s[addr1], password

In the above example, the username is stored using regular store instruction mov. When executing the regular store instruction, processor120may store the username with unprotected data111. If the username is stored in data chunk202, then the tag in tag bits220that corresponds to data chunk202may not be set (or may be set to 0). The password is stored using specialized store instructions mov_s. When executing the specialized store instruction, processor120may store the username with protected data112. If the password is stored in data chunk206, then the tag in tag bits220corresponding to data chunk206may be set to “1”. The specialized instruction thus stores the desired data such that the data is protected during speculative execution. As a result, security and efficiency may be improved.

FIG.4is a flow-chart depicting an embodiment of method400for securely performing speculative execution of instructions. Method400is described in the context of system100and memory200. In some embodiments, method400may be performed by other systems having other configurations. In some embodiments, process400is performed during speculative execution. For example, an instruction that has a condition that is not yet resolved may have been loaded. Speculative execution of subsequent instructions is being performed based on an assumption about an outcome of the condition (e.g. it may be assumed that the condition is fulfilled or that the condition is not fulfilled).

In response to speculative execution of an instruction to read a previously stored data, it is determined whether the stored data is identified as protected, at402. In response to a determination that the stored data attempted to be read during the speculative execution is protected, immediate successful completion of the instruction to read the stored data is disallowed, at404. Thus, the protected data is not immediately read during speculative execution. In some embodiments, to perform404, the processor waits to execute the instruction(s) to read the data until the condition causing speculative execution has been resolved. If the condition is resolved such that the protected data is still to be read, then the instruction to read the data is executed. Thus, the protected data is read and may be used by the computer system. If the condition is resolved such that the protected data is no longer to be read, then the read instruction itself is squashed.

FIG.5is a flow-chart depicting an embodiment of method500for securely performing speculative execution of load instructions. Method500is described in the context of system100and memory200. In some embodiments, method500may be performed by other systems having other configurations.

Execution of a load instruction is commenced, at502. A load includes reading and delivering data. Thus, speculative execution of such an instruction may otherwise compromise protected data. It is determined at504whether the data to be read is protected. For example, may be determined whether a tag residing in the corresponding spare ECC bits has been set to “1”. If the data is not protected, then the data is read and delivered, at508. Thus, the load instruction is executed at508. If, however, the data is determined to be protected, then it is determined whether load instruction is non-speculative, at506. An instruction is non-speculative if both speculative execution is not being performed (i.e. conditions for conditional instructions have been resolved) and the instruction is part of the correct execution path. If the load instruction is non-speculative, then at508the load instruction is executed. Thus, at508, the data is read and delivered.

If, however, it is determined at506that the load instruction is not non-speculative (i.e. the instruction is being speculatively executed), then execution of the load instruction is delayed, at510. For example, the processor may put the load instruction into a sleep state until it is determined that the condition causing speculative execution has been resolved. Based on the outcome of the condition, method500takes different paths. If it is determined at510that the outcome of the condition has been resolved such that the load instruction is to be carried out (e.g. the assumption(s) about the outcome made for speculative execution were correct), then the load instruction becomes non-speculative. Thus,502may be returned to. In this case,504and506indicate that the data are protected and the load instruction is non-speculative. Thus, protected data are read and delivered, at508. If, however, it is determined at510that the condition has been resolved and the speculation was incorrect, then the load instruction is part of the wrong execution path. Thus, the load instruction is squashed, at512.

For example, processor120(s) may execute a load instruction at502. The load instruction may be used to load protected data112and/or unprotected data111. It is determined whether the data desired to be loaded are protected, at504. At504, processor120may query tag bits220for the requested data chunks202,204,206and/or208. If the tag bits220are not set to “1”, then unprotected data111is requested. Thus, the data is read and delivered, at508. If, however, the tag bits220are set to “1”, then at506it is determined whether the load instruction is non-speculative. If the instruction is non-speculative, then the protected data112requested is read and delivered, at508. If the load instruction is speculative (i.e. is not non-speculative), then at510processor(s)120wait until the condition is resolved. If the condition is resolved such that the load instruction was part of the wrong execution path, then at512the load instruction is squashed. If, however, it is determined at510that the load instruction is non-speculative and should be executed, then502is returned to. Thus, the desired protected data112and unprotected data111may be read and delivered, at508.

Thus, using method500, efficiency of computer system100may be improved through speculative execution. In addition, the security for protected data112may be enhanced by prevention of immediate speculative execution of read/load instructions. Protected data112may only be read and delivered if the load instruction is non-speculative. Thus, the condition(s) for the instruction(s) causing speculative execution have been resolved and the load/read instructions are part of the correct execution path. Further, use of tags in spare ECC bits210by method500may provide the enhanced security without adversely affecting system performance. Consequently, security and efficiency of a computer system may be enhanced.

Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, the disclosure is not limited to the details provided. There are many alternative ways of implementing the disclosure. The disclosed embodiments are illustrative and not restrictive.