Intel Corporation

Rodrigo Branco

Kekai Hu

Ke Sun

Shay Gueron

Jason W Brandt

Joseph Nuzman

Lihu Rappoport

Robert S Chappell

Sergiu D Ghetie

Deepak K Gupta

Jared Warner Stark, Iv

Scott P Bobholz

Wojciech S Powiertowski

Sagar V Dalvi

Ariel Sabba

Scott J Cape

Yair Berger

Gilad Holzstein

Henrique Kawakami

Hisham Shafi

Brent Sherman

Geoffrey Scott Sidney Strongin

Yogesh Bijlani

Henrique De Medeiros Kawakami

Methods and apparatuses relating to mitigations for speculative execution side channels are described. Speculative execution hardware and environments that utilize the mitigations are also described. For example, three indirect branch control mechanisms and their associated hardware are discussed herein: (i) indirect branch restricted speculation (IBRS) to restrict speculation of indirect branches, (ii) single thread indirect branch predictors (STIBP) to prevent indirect branch predictions from being controlled by a sibling thread, and (iii) indirect branch predictor barrier (IBPB) to prevent indirect branch predictions after the barrier from being controlled by software executed before the barrier.

Apparatuses and methods for speculative execution side channel mitigation

An embodiment of an integrated circuit may comprise a branch predictor to predict whether a conditional branch is taken for one or more instructions, the branch predictor including circuitry to identify a loop branch instruction in the one or more instructions, and provide a branch prediction for the loop branch instruction based on a context of the loop branch instruction. Other embodiments are disclosed and claimed.

Context-based loop branch prediction

Various examples are directed to systems and methods for securing a data storage device. A storage controller may receive a read request directed to the data storage device. The read request may comprise address data indicating a first address of a first storage location at the data storage device. The storage controller may request from the data storage device a first encrypted data unit stored at the first memory element and a first encrypted set of parity bits, such as Error Correction Code (ECC) bits, associated with the first storage location. An encryption system may decrypt the first encrypted set of parity bits to generate a first set of parity bits based at least in part on an a first location parity key for the first address.

Secure memory

An apparatus of a computing system, a computer-readable medium, a method and a system. The apparatus comprises processing circuitry including a core, and a communication controller coupled to the core to communicate with a memory of the computing system, wherein the memory is to define a leak zone corresponding to a plurality of memory addresses including data therein, the leak zone having an identifier; and the processing circuitry is to: decode instructions including a starting leak barrier, an ending leak barrier, and a sequence of code between the starting and ending leak barriers, the sequence of code including the identifier for the leak zone, the identifier to indicate the sequence of code is to be executed only on the data within the leak zone; and execute the sequence of code only on the data within the leak zone based on the leak barriers and on the identifier.

Apparatus, system and method to define memory information leak zones in a computing system

The present disclosure is directed to systems and methods for mitigating or eliminating the effectiveness of a side-channel based attack, such as one or more classes of an attack commonly known as Spectre. Novel instruction prefixes, and in certain embodiments one or more corresponding instruction prefix parameters, may be provided to enforce a serialized order of execution for particular instructions without serializing an entire instruction flow, thereby improving performance and mitigation reliability over existing solutions. In addition, improved mitigation of such attacks is provided by randomizing both the execution branch history as well as the source address of each vulnerable indirect branch, thereby eliminating the conditions required for such attacks.

Efficient mitigation of side-channel based attacks against speculative execution processing architectures

In one embodiment, a processor comprises a decoder to decode a first instruction, the first instruction comprising an opcode and at least one parameter, the opcode to identify the first instruction as an instruction associated with an indirect branch, the at least one parameter indicative of whether the indirect branch is allowed; and circuitry to generate an error message based on the at least one parameter.

Fine grained control flow enforcement to mitigate malicious call/jump oriented programming

The present disclosure is directed to systems and methods of selectively implementing SCA mitigation elements on a per-thread basis to mitigate the effects of side channel attacks. Processor core circuits initiate a plurality of processor threads. Each of a plurality of SCA mitigation features include one or more SCA mitigation elements. SCA mitigation control circuitry associates a register circuit with each respective one of the plurality of processor threads initiated by the processor core circuits. The SCA mitigation control circuitry selectively ENABLES/DISABLES one or more SCA mitigation elements for each of the plurality of processor threads. The ENABLEMENT/DISABLEMENT of each of the SCA mitigation elements may be autonomously adjusted by the SCA mitigation control circuitry and/or manually adjusted via one or more user inputs provided to the SCA mitigation control circuitry.

Per thread side channel attack protection

A computing apparatus, including: a processor; a memory; and encoded logic to instruct the processor to: identify within the memory a payload that is suspected to be a return-oriented programming (ROP) chain; execute the suspected ROP chain in a speculative execution path within the processor; force a missed prediction of the speculative execution path; determine that the suspected ROP chain executed through; and take a security action responsive to the determining.

Mitigation of return-oriented programming exploits

There is disclosed in one example a microprocessor, including: a decoder; an execution unit; an instruction set flag vector; and logic to decode an instruction, read a binary disable flag for the instruction within the instruction set flag vector, and execute the instruction within the execution unit only if the disable flag for the instruction is not set.

Flexible instruction set disabling

Various systems and methods for memory management are described herein. A system for managing memory includes a memory management unit to: receive an indication of a memory allocation request; identify a memory region to satisfy the memory allocation request; determine whether the memory region has a tracking record in a tracking data structure, the tracking data structure configured to track whether a particular memory region has any references pointing to it; and revise the tracking record in the tracking data structure when the memory region has the tracking record.

Use-after-free exploit prevention architecture

Particular embodiments described herein provide for an electronic device that can be configured to help with the identification of a no-operation (NOP) sled attack identify. The system can be configured to receive an instruction, increment a value in a total instruction counter, increment a value in a branch instruction counter when the instruction is a branch instruction, increment a value in a memory instruction counter when the instruction is a memory instruction, create a ratio based on the value in the total instruction counter and the value in the branch instruction counter or the value in the memory instruction counter, and trigger an alert when the ratio satisfies a threshold. The ratio can indicate the presence of a NOP sled attack and the alert can be an interrupt that stops execution of the NOP sled.

Growing community of inventors

Hillsboro, OR, United States of America

Rodrigo Branco