Patent application EP20163791A (EP), filed 2020-03-18
Publication number: EP3757829A1
Title: PROCESSOR INSTRUCTION SUPPORT FOR MITIGATING CONTROLLED-CHANNEL AND CACHE-BASED SIDE-CHANNEL ATTACKS
Abstract: Detailed herein are systems, apparatuses, and methods for a computer architecture with instruction set support to mitigate against page fault and/or cache-based side-channel attacks. In an embodiment, a processor includes a decoder to decode an instruction into a decoded instruction, the instruction comprising a first field that indicates an instruction pointer to a user-level event handler; and an execution unit to execute the decoded instruction to, after a swap of an instruction pointer that indicates where an event occurred from a current instruction pointer register into a user-level event handler pointer register, push the instruction pointer that indicates where the event occurred onto call stack storage, and change a current instruction pointer in the current instruction pointer register to the instruction pointer to the user-level event handler.
IPC codes: G06F  21/    12            A I
G06F  21/    55            A I
G06F   9/    30            A I
G06F  12/  0862            A I
G06F  12/    14            A I
G06F   9/    38            A I
Claims: number: 1
text: A processor comprising:
number: 2
text: The processor of claim 1, wherein the instruction further comprises a second field that indicates a number of bits by which to change a stack pointer to the call stack storage, and the execution unit is to execute the decoded instruction to also change the stack pointer by the number of bits.
number: 3
text: The processor of any one of claims 1-2, wherein the execution unit is to execute the decoded instruction to also change a stack pointer to the call stack storage to protect a stack red zone from being overwritten by the instruction pointer that indicates where the event occurred.
number: 4
text: The processor of any one of claims 1-3, wherein the execution unit is to execute the decoded instruction only when the processor is not in an event-notify mode.
number: 5
text: The processor of claim 4, wherein the event-notify mode is set in an event-notify status register.
number: 6
text: The processor of any one of claims 1-5, wherein the execution unit is to execute the decoded instruction to also, after the swap of the instruction pointer that indicates where the event occurred from the current instruction pointer register into the user-level event handler pointer register, push the instruction pointer that indicates where the event occurred onto shadow stack storage.
number: 7
text: The processor of claim 6, wherein the shadow stack storage is not user-level writable.
number: 8
text: The processor of claim 6, wherein, on completion of execution of the user-level event handler, the processor is to pull a first instruction pointer from the call stack storage and a second instruction pointer from the shadow stack storage, and execute starting from the first instruction pointer only when the first instruction pointer and the second instruction pointer match.
number: 9
text: A method comprising:
number: 10
text: The method of claim 9, wherein the instruction further comprises a second field that indicates a number of bits by which to change a stack pointer to the call stack storage, and the executing the decoded instruction with the execution unit is to also change the stack pointer by the number of bits.
number: 11
text: The method of any one of claims 9-10, wherein the executing the decoded instruction with the execution unit is also to change a stack pointer to the call stack storage to protect a stack red zone from being overwritten by the instruction pointer that indicates where the event occurred.
number: 12
text: The method of any one of claims 9-11, wherein the executing the decoded instruction with the execution unit is only when the processor is not in an event-notify mode.
number: 13
text: The method of claim 12, further comprising setting the event-notify mode in an event-notify status register of the processor.
number: 14
text: The method of any one of claims 9-13, wherein the executing the decoded instruction with the execution unit is also to, after the swap of the instruction pointer that indicates where the event occurred from the current instruction pointer register into the user-level event handler pointer register, push the instruction pointer that indicates where the event occurred onto shadow stack storage.
number: 15
text: The method of claim 14, further comprising, on completion of execution of the user-level event handler, pulling, by the processor, a first instruction pointer from the call stack storage and a second instruction pointer from the shadow stack storage, and executing starting from the first instruction pointer only when the first instruction pointer and the second instruction pointer match.
Office action: search_report, dated 2020-12-30
Rejection reasons: novelty_epc_54
Prior art cited: ref_id: - INTEL@ ARCHITECTURE INSTRUCTION SET EXTENSIONS PROGRAMMING REFERENCE, 2018
ref_type: npl
severity: background
ref_id: US2014281437A1
ref_type: patent
severity: background
ref_id: - RAOUL STRACKX ET AL: "The Heisenberg Defense: Proactively Defending SGX Enclaves against Page-Table-Based Side-Channel Attacks", ARXIV.ORG, CORNELL UNIVERSITY LIBRARY, 201 OLIN LIBRARY CORNELL UNIVERSITY ITHACA, NY 14853, 22 December 2017 (2017-12-22), XP080848034
ref_type: npl
severity: background
ref_id: US2014281437
ref_type: patent
severity: novelty_destroying
ref_id: - RAOUL STRACKX ET AL, "The Heisenberg Defense: Proactively Defending SGX Enclaves against Page-Table-Based Side-Channel Attacks", ARXIV.ORG, CORNELL UNIVERSITY LIBRARY, 201 OLIN LIBRARY CORNELL UNIVERSITY ITHACA, NY 14853, (20171222), XP080848034 [A] 1-15 * paragraphs  [0001] , [0003] *
ref_type: npl
severity: background
Final disposition: pending (2020-12-30)