Abstract:
A data processing apparatus comprises branch prediction circuitry adapted to store at least one branch prediction state entry in relation to a stream of instructions, input circuitry to receive at least one input to generate a new branch prediction state entry, wherein the at least one input comprises a plurality of bits; and coding circuitry adapted to perform an encoding operation to encode at least some of the plurality of bits based on a value associated with a current execution environment in which the stream of instructions is being executed. This guards against potential attacks which exploit the ability for branch prediction entries trained by one execution environment to be used by another execution environment as a basis for branch predictions.
Abstract:
A buffer (72), (74), (76), (60), (78), (20), (82-90) has a number of entries for buffering items associated with data processing operations. Buffer control circuitry (100) has a redundant allocation mode in which, on allocating a given item to the buffer, the item is allocated to two or more redundant entries of the buffer. On reading or draining an item from the buffer, the redundant entries are compared and an error handling response is triggered if a mismatch is detected. By effectively reducing the buffer capacity, this simplifies testing for faults in buffer entries.
Abstract:
A data processing apparatus and method are provided for executing a vector scan instruction. The data processing apparatus comprises a vector register store configured to store vector operands, and processing circuitry configured to perform operations on vector operands retrieved from said vector register store. Further, control circuitry is configured to control the processing circuitry to perform the operations required by one or more instructions, said one or more instructions including a vector scan instruction specifying a vector operand comprising N vector elements and defining a scan operation to be performed on a sequence of vector elements within the vector operand. The control circuitry is responsive to the vector scan instruction to partition the N vector elements of the specified vector operand into P groups of adjacent vector elements, where P is between 2 and N/2, and to control the processing circuitry to perform a partitioned scan operation yielding the same result as the defined scan operation. The processing circuitry is configured to perform the partitioned scan operation by performing separate scan operations on those vector elements of the sequence contained within each group to produce intermediate results for each group, and to perform a computation operation to combine the intermediate results into a final result vector operand containing a sequence of result vector elements. The partitioned scan operation approach of the present invention enables a balance to be achieved between energy consumption and performance.
Abstract:
A method to mitigate an attack initiated by a malicious actor by migration of the attacked process is provided. The method includes monitoring a process being executed from a first computing location on a computing device for a trigger indicating a potential attack and detecting the trigger indicating the potential attack. Responsive to detecting the trigger indicating the potential attack, initiating an attack countermeasure by migrating the process to execute in a second computing location isolated from the first computing location, thereby breaking access to information at the first computing location. A computing device is also provided that includes a processor, a memory, and instructions stored on the memory that when executed by the processor direct the computing device to monitor a process being executed from a first computing location on the computing device for a trigger indicating a potential attack and detect the trigger indicating the potential attack.
Abstract:
To protect the integrity of data stored in a protected area of memory, data in the protected area of memory is retrieved in data blocks and an authentication code is associated with a memory granule contiguously comprising a first data block and a second data block. Calculation of the authentication code comprises a cryptographic calculation based on a first hash value determined from the first data block and a second hash value determined from the second data block. A hash value cache is provided to store hash values determined from data blocks retrieved from the protected area of the memory. When the first data block and its associated authentication code are retrieved from memory, a lookup for the second hash value in the hash value cache is performed, and a verification authentication code is calculated for the memory granule to which that data block belongs. The integrity of the first data block is contingent on the verification authentication code matching the retrieved authentication code.
Abstract:
Analytics processing circuitry can include a data scavenger and a data analyzer coupled to receive the data from the data scavenger. The data scavenger collects data from at least one element of interest of a plurality of elements of interest of an IC. The data analyzer identifies patterns in the data from the data scavenger over a time frame or for a snapshot of time based on a predefined metric. The analytics processing circuitry can further include a moderator and a risk predictor. The risk predictor generates a risk assessment regarding whether the data collected by the data scavenger is indicative of normal behavior or abnormal behavior based at least on the output of the data analyzer and a behavioral model for the IC, which can be device and application specific. A threat response can be performed based on the risk assessment.
Abstract:
An apparatus and method are provided for maintaining a counter value. The apparatus has first counter control circuitry for maintaining a first counter value representing a first portion of a hybrid counter value, and second counter control circuitry for maintaining a second counter value representing a second portion of the hybrid counter value, wherein the second portion is a higher order portion of the hybrid counter value than the first portion. The first counter control circuitry is arranged to maintain the first counter value as a binary value that indicates a magnitude of the first counter value, the first counter control circuitry comprising adder circuitry that is responsive to an adjustment value to update the first counter value by performing an addition operation to add the adjustment value to a current binary value of the first counter value, and to generate a carry out signal which is set when a carry out is generated by the addition operation. The second counter control circuitry is arranged to maintain the second counter value as a bit sequence having N discrete states, and is responsive to the carry out signal being set to transition the second counter value from the current discrete state to a new discrete state. This allows an arbitrary value to be used as the adjustment value, that is smaller than or equal to the maximum value of the first counter, whilst avoiding the need for the generation and handling of carry bits to be managed across the entire bit range of the hybrid counter value.
Abstract:
An apparatus comprising data processing circuitry for processing data in one of a plurality of operating states, an instruction decoder for decoding instructions and error checking circuitry for performing error checking operations. In response to a touch instruction being decoded by the instruction decoder, error checking operation is performed on selected architectural state. The architectural state is architecturally inaccessible to the operating state. As a result of the touch instruction, the architectural state remains unchanged, at least when no error is detected.
Abstract:
Data processing apparatus comprises vector processing circuitry to apply a vector processing instruction to data vectors having a data vector length, each data vector comprising a plurality of data items equal in number to the data vector length, the vector processing circuitry having circuitry defining a plurality of processing lanes, there being at least as many processing lanes as a maximum data vector length; and control circuitry to selectively vary the data vector length used by the vector processing circuitry amongst a plurality of possible data vector length values up to the maximum data vector length and to disable operation of a subset of the processing lanes so that the disabled subset of processing lanes are unavailable for use by the vector processing circuitry and there remain at least as many enabled processing lanes as the data vector length set by the control circuitry.