WO2002027479A1 - Instructions machine - Google Patents

Instructions machine Download PDF

Info

Publication number
WO2002027479A1
WO2002027479A1 PCT/GB2001/004299 GB0104299W WO0227479A1 WO 2002027479 A1 WO2002027479 A1 WO 2002027479A1 GB 0104299 W GB0104299 W GB 0104299W WO 0227479 A1 WO0227479 A1 WO 0227479A1
Authority
WO
WIPO (PCT)
Prior art keywords
instruction
instructions
dependency
data manipulation
depend
Prior art date
Application number
PCT/GB2001/004299
Other languages
English (en)
Inventor
Nigel Paul Smart
Michael David May
Hendrik Lambertus Muller
Original Assignee
University Of Bristol
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by University Of Bristol filed Critical University Of Bristol
Priority to AU2001290112A priority Critical patent/AU2001290112A1/en
Publication of WO2002027479A1 publication Critical patent/WO2002027479A1/fr

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/30003—Arrangements for executing specific machine instructions
    • G06F9/30076—Arrangements for executing specific machine instructions to perform miscellaneous control operations, e.g. NOP
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/38—Concurrent instruction execution, e.g. pipeline or look ahead
    • G06F9/3836—Instruction issuing, e.g. dynamic instruction scheduling or out of order instruction execution
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/38—Concurrent instruction execution, e.g. pipeline or look ahead
    • G06F9/3836—Instruction issuing, e.g. dynamic instruction scheduling or out of order instruction execution
    • G06F9/3838—Dependency mechanisms, e.g. register scoreboarding
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/002—Countermeasures against attacks on cryptographic mechanisms
    • H04L9/003—Countermeasures against attacks on cryptographic mechanisms for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2207/00—Indexing scheme relating to methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F2207/72—Indexing scheme relating to groups G06F7/72 - G06F7/729
    • G06F2207/7219—Countermeasures against side channel or fault attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/12—Details relating to cryptographic hardware or logic circuitry
    • H04L2209/125—Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations

Definitions

  • This invention relates to computer instructions, and particularly to a method of executing a computer program and to a processor, the program including an ordered sequence of computer instructions.
  • DPA provides the most powerful attack using very cheap resources. Many people have started to examine this problem and S. Chari et al provides a worrying analysis regarding the weakness of AES (Advanced Encryption Standard) algorithms on Smart cards, see the article entitled “A Cautionary Note Regarding the Evaluation of AES Candidates on Smart-Cards" in the Second Advanced Encryption Standard Conference, Rome, March 1999.
  • AES Advanced Encryption Standard
  • the present invention seeks to improve tamper resistance according to the third approach, that is, by decorrelating the timing of power traces on successive program executions.
  • Kocher et al also describe two ways of producing the required temporal misalignment by introducing: i) introducing random clock signals, and ii) introducing randomness into the execution order.
  • Kocher et al in "Differential Power Analysis” mention that randomising execution order can help defeat DPA, but can lead to other problems if not done carefully.
  • One randomising approach uses the idea of randomised multi-threading at an instruction level using a set of essentially "shadow" registers. This allows auxiliary threads to execute random encryptions, hence hoping to mask the correct encryption operation.
  • the disadvantage is that additional computational tasks are again required and this requires a more complex processor architecture having separate banks of registers, one for each thread.
  • the aim of the present invention is to increase the non-deterministic nature of a processor but without unnecessarily impacting the performance.
  • a method of executing a computer program comprising an ordered sequence of instructions including an ignore instruction followed by a set of data manipulation instructions which can be executed in an arbitrary order, the method comprising: reading each instruction in the ordered sequence, checking its dependency with respect to its adjacent instructions and storing an associated dependency bit mask; responsive to detection of the ignore instruction, ignoring the dependency bit masks for subsequent data manipulation instructions issued up to detection of the depend instruction, whereby data manipulation instructions can be issued in an arbitrary order.
  • the ordered sequence of instructions can include a depend instruction after the set of data manipulation instructions which causes dependency bit masks for subsequent instructions in a sequence to be utilised.
  • the dependency bit masks associated with data manipulation instructions which have not yet issued are used to delay issue of the depend instruction until all data manipulation instructions in the set have issued.
  • the dependency bit masks associated with data manipulation instructions which have not yet issued can be combined to ensure that all data manipulation instructions in the set issue prior to instructions subsequent to the depend instruction.
  • the ignore instruction specifies at least one operand, and the dependency bit masks are ignored only for the set of data manipulation instructions which define said operand.
  • ignore instruction defines no operand and the dependencies for all subsequent data manipulation instructions are ignored.
  • a processor comprising: a program memory holding a computer program which comprises an ordered sequence of instructions including an ignore instruction followed by a set of data manipulation instructions which can be executed in an arbitrary order followed by a depend instruction; a decode unit for decoding each instruction and arranged to detect ignore and depend instructions prior to their execution; a dependency checker for checking the dependency of each instruction with respect to adjacent instructions and for generating an associated dependency bit mask; a store for holding said dependency bit masks; and means responsive to detection of the ignore instruction to cause the dependency bit masks held in the store to be ignored for data manipulation instructions up to detection of the depend instruction.
  • a computer program product comprising program code means including an ordered sequence of instructions including an ignore instruction followed by a set of data manipulation instructions which can be executed in an arbitrary order followed by a depend instruction wherein, when the program product is loaded into a computer and executed, on detection of the ignore instruction dependency bit masks associated with each instruction in the ordered sequence are ignored for subsequent data manipulation instructions issued up to detection of the depend instruction.
  • the dependency checker need only operate when necessary, so that a higher degree of non- determinism can be achieved without affecting the performance of a processor.
  • Figure 1 shows a block diagram of a generic CPU architecture
  • Figure 2 shows a non-deterministic processor executing two instructions compared to other processors
  • Figure 3 shows an embodiment of the random issue unit
  • Figure 4 shows a flow chart explaining how instructions are issued at random
  • Figure 5 shows an example of two input random selection unit
  • Figures 6A and 6B show a generic model and a 16 input random selection unit
  • Figure 7 shows a flow chart describing a method for choosing which random instruction in the issue buffer to execute.
  • Figure 8 shows how the dependency checking mechanism 33 is affected upon detection of an IGNORE or DEPEND instruction.
  • FIG. 1 is a block diagram illustrating the standard functional units that make up a pipelined computer system.
  • a program memory 2 contains program instructions, which are addressable at different memory locations.
  • An ADDRESS bus 6 and a DATA bus 4 transfer information to and from the various elements that make up the processor 8.
  • the system contains an instruction fetch unit 10 having a program counter 12 that stores the address of the next instruction to be fetched. For sequential execution of instructions the program counter will normally be incremented by a single addressing unit. However, if a branch instruction is encountered, the program flow is broken and the program counter needs to be loaded with the address of a target instruction (that is, the first instruction of the branch sequence).
  • the instructions are fetched from the program memory and stored in an instruction issue buffer 14.
  • the program counter referred to herein is used to control instruction fetches from memory. There may also be an execution counter which is used by the execution unit 18 to specify which instruction is currently being executed.
  • the instructions are decoded and supplied to relevant execution units. In this example, only one execution unit 18 or pipeline is shown, however the present invention is intended to be used in conjunction with modern processors which may have several execution units allowing parallel execution paths. Encryption algorithms need a substantial level of computational power and modern processor architectures such as superscalar, VLIW (Very Long Instruction Word) and SIMD (Single Instruction Multiple Data) are ideally suited to the present invention.
  • the results of the operations are written back by a result write stage 22 into temporary registers of a register file 20, which is used to load and store data in and out of main memory.
  • the present invention is concerned mainly with the block of functionality denoted by the reference numeral 24.
  • the present invention deals with a modified issue buffer 14 which will be described in more detail later.
  • the issue buffer generates an instruction fetch signal 13 to control which instructions are supplied from the fetch unit 10.
  • part of the decode circuitry may be used to decode the instruction dependencies. This will also be described in more detail at a later stage.
  • Non-deterministic processing as described herein means that for successive runs of the program, although the result will be the same the order of execution of the instructions will be random. This reduces the impact of a DPA-type attack in that the power traces resulting from successive program runs will be different.
  • Figure 2 serves to highlight the differences between a non-deterministic processor and other known processors when executing a simple program consisting of the following two lines of code:
  • the execution flow on the left of Figure 2 represents a standard processor having a single execution pipeline where the two instructions are executed sequentially, i.e. the ADD instruction is executed in cycle 1 followed by the XOR instruction in cycle 2.
  • the middle execution flow represents a modern Pentium processor having a plurality of execution paths, which execute independent instructions in parallel.
  • the execution flow on the right of Figure 2 represents a non-deterministic processor having a single pipeline.
  • the non-deterministic processor allows the instructions to be executed in any order provided that it has been established that the instructions are independent. So in the first cycle either the ADD or the XOR instruction can be carried out and in the second cycle the other instruction will be executed.
  • the standard processor executes instructions sequentially and although there is a little "out of order" execution to help with branch prediction, this occurs on a small scale. In any event, in such a processor each time a program is run containing a certain sequence of instructions, the execution sequence will be identical.
  • the Pentium processor has a plurality of execution units (A) and (B), which execute the independent instructions in parallel the processor is still deterministic in that the ADD and the XOR instructions are executed concurrently in pipes (A) and (B).
  • the purpose of 11 is to LOAD a value addressed by register R2 into register R9.
  • the intention of the code sequence is to add the loaded value from R8 to the value in R9. Therefore, if the ADD instruction 12 is carried out before 11 , the old value of R9 will be added to R8 yielding an incorrect value for the resulting summation R10.
  • the present invention makes use of the fact that in many code sequences a number of instructions are independent and thus can, in theory, be executed in any order. The invention exploits this by executing the instructions in a random order at run time. This causes the access patterns to memory for either data or instructions to be uncorrelated for successive program executions, and thus causes the power trace to be different each time.
  • FIG. 3 shows an example of the implementation of a random issue unit.
  • the random issue unit comprises an instruction table 32 with an associated dependency matrix table 30. Instructions are prefetched into the instruction table 32 using conventional instruction fetch circuitry.
  • the dependency matrix table has slots and columns, where the slots represent bit-masks associated with each instruction in the instruction table 32.
  • the bit-masks or dependency bits are an indication as to whether an instruction has a dependency on another instruction. Broadly speaking there are two types of dependencies that need to be considered for an instruction:
  • a particular instruction will be decoded and the mask bits will be set accordingly in a Used Registers table 34 and a Defined Registers table 36.
  • the Used and Defined Register tables 34, 36 shown in Figure 3 each comprise a number of rows and columns. Each row corresponds to a register (or operand) and each column corresponds to a particular slot (or instruction) in the instruction issue table 32. Each register comprises a plurality of slots corresponding to the number of instructions in the instruction table 32 and is the so-called bit-mask for a register.
  • the bit mask for a register is a binary stream where a "1" indicates which instruction has a dependency on that register.
  • each table has five rows corresponding to registers R1 to R5, i.e. R1 corresponds to the top row and R5 to the bottom row.
  • the processor performs a logical OR operation 38 of the bit mask of the Used Registers table 34 and the Defined Registers table 36 thereby creating a new bit-mask stored in a free slot of the dependency matrix 30.
  • a test can be performed by OR-ing with OR gates 40 each of the dependency bits of a slot of the dependency matrix. If all the dependency bits of a slot associated with a particular instruction are set to zero, then the instruction can be executed and a FIRE signal 42 is generated to the Random Selection Unit 44. Given the result of the OR for each row of the table, a number of zeros (indicating instructions to be executed) and a number of ones (indicating instructions that are blocked) are obtained. The random selection unit 44 selects one of the slots which is indicated at value zero, at random, and causes that instruction to be executed next. In the described embodiment, the dependency bits are overwritten with new values when the dependencies of the next instruction are loaded into the matrix.
  • the random issue unit supplies an instruction to be executed from the instruction table 32 along instruction supply path 50 and loads an instruction into the instruction table 32 along instruction load path 52 at the same time.
  • Figure 4 is a flow chart indicating how the instructions in the instruction issue buffer 14 are issued for execution and loaded concurrently.
  • the load operations are represented by the left branch flow (C), while the issue operations are represented by the right branch flow (D).
  • the left branch flow (C) of figure 4 relates to an instruction load operation starting at step S1 where the next instruction, specified by the program counter 12, is loaded into the instruction table 32 of the issue buffer 14.
  • the load operation will firstly be described in general terms, and then more specifically in relation to one example.
  • Each instruction defines two source operands 54 and a destination operand 56. These will nearly always be defined as registers although that is not necessary. Direct addresses or immediates are possible.
  • the source and destination operands 54,56 are simultaneously decoded.
  • the decoded information is translated into bit-masks that are set in the Used Registers and Defined Registers tables 34,36. These bit-masks are OR-ed by OR gate 38 ( Figure 3) to create dependency bits indicating on which instructions the loaded instruction depends.
  • the empty slot E associated with the loaded instruction is then selected for replacement by setting the InValid flag 58 to zero.
  • the dependency bits are loaded into the selected slot E of the dependency matrix.
  • the bit-masks in column E of the Used Registers and Defined Registers tables 34,36 are set to "1" along path 62 for the corresponding rows of these tables to ensure that future instructions that use those registers are going to wait for the instruction to finish.
  • the Used and Defined Register tables 34, 36 are set-up during the instruction fetch or LOAD sequence, as already indicated.
  • the fetched instruction is decoded and the bit-masks associated with each of the registers specified in the instruction are checked for dependencies with other instructions. For example, assume the instruction: ADD R2, R3, R4 is fetched.
  • the bit masks associated with the registers R2 and R3 in the Used Registers table 34 i.e. the source registers
  • OR gate 38 the bit mask associated with register R4 in the Defined Registers Table (i.e. the destination register) is sent to the OR gate 38.
  • each bit mask has N slots where each slot corresponds to a particular instruction.
  • the OR gate 38 receives the bit-masks and performs a bit-wise logical OR operation for each slot simultaneously. For example, assume the following bit- masks exist:
  • the first step includes simultaneously performing a second OR operation 40 across all the dependency bits for each slot of the dependency matrix 30 to determine which instructions have no dependencies. For the example, a "1" set in the third bit of the dependency mask for the instruction in question means that the OR'ed result will be a "1". Therefore this instruction still has dependencies and cannot be fired at the random selection unit 44.
  • the final step is to set the appropriate bit masks associated with the currently loaded instruction.
  • the appropriate bit-masks being the registers that cannot be used by future instructions until the current instruction has been issued.
  • register R4 in the Used Registers table 34 for the present instruction column in set to "1" to inform all future instructions that R4 cannot be used as a source register (i.e. read from), because the present instruction uses this as a destination register (i.e. write to).
  • registers R2 and R3 are source registers for the present instruction and thus these registers are set to "1" in the Defined Registers table 36 to indicate that these registers cannot be written to until the present instruction has completed.
  • the right branch flow (D) of Figure 4 relates to random instruction issue starting at S1 where the dependency bits associated with each instruction are checked using an OR operation via OR gate 40. Then all of the independent instructions are flagged as ready for issue and appropriate fire signals are sent to the Random Selection Unit.
  • the Random Selection Unit 44 selects one of the instructions 46 for example the instruction X, which is issued along instruction supply path 50 to the relevant execution unit.
  • column X is then cleared (i.e. bits are set to zero) from the dependency matrix 30 as well as from the Registers Used and Registers Defined tables 34, 36. Also, the InValid flag is set (i.e. to 1 ).
  • step S4 a pointer E is initialised for the next iteration.
  • E is a pointer that points to an empty slot which is available in the issue table. After every instruction has been loaded, E must point to another free slot. One could, for example, use the instruction previously executed to initialise E. In that way, the pointer E would follow the executed instructions around the table.
  • Figure 5 represents a two input example of how a random selection unit 44 may be implemented.
  • the truth table for the random selector is shown below:
  • Figure 5 shows two inputs 70 and 72 for the random selection unit 44. It should be apparent from figure 3 that each input l 0 or li will either be a '0' or a '1'. More generally, a '0' will appear if all of the dependency bits of the relevant slot are '0'. Thus, a '0' indicates an independent instruction, which can be selected by the Random Selection Unit 44. An inspection of truth table 2 reveals that if one of the inputs is a , then the output 46 of the random selector will always take the logical value of the other input. Input li is shown coupled to an AND gate 76 through an inverting element 75. The AND gate 76 accepts two other inputs, i.e. a random signal R 80 and an enable signal E 78. The output of the AND gate is OR-ed 74 with input l 0 to produce the selected output 46 of the random selection unit 44.
  • each input l 0 or li will either be a '0' or a
  • the random signal R does not have to be truly random. It could be typically generated using a pseudo-random generator that is reseeded regularly with some entropy.
  • the enable signal 78 allows random issue to be disabled, i.e. non- determinism can be turned off, for example to allow a programmer to debug code by stepping through the instructions.
  • Figures 6A and 6B show a slightly more complex example of a random selection unit having 16 inputs. As shown a 16 input random issue unit can be provided by adapting the simple two input structure shown in Figure 5 and connecting it in a cascaded structure.
  • Figure 6A shows a generalised stage of one of the random selection units. The inputs run from l 0 to l 2 K+1 -1. The generalised stage can be applied to the 16 input random selector shown by Figure 6B.
  • the 16 inputs are divided in half with the even inputs I0, I2...I14 being input to a first multiplexer 82 and the odd inputs 11 , 13, ...115 being input to a second multiplexer 84.
  • Each multiplexer selects 1 output from 2 k inputs (i.e. 8:1 in the final stage) and each multiplexer accepts control signals from the lower stages A 0 ...A «- ⁇ (i.e. Ao, A ⁇ , A 2 in the final stage). This is confirmed by diagram on the right, which shows the selected signals from the lower stages being feedback into the higher stages. Then the relevant stage behaves as the two input model shown in Figure 5.
  • Figure 7 is a flow chart illustrating a method to choose which instruction in the instruction buffer to execute.
  • the issue buffer is assigned the symbol B.
  • step S13a issues this instruction to the relevant execution unit and the program sequence is completed i.e. EXIT. If however, there is more than one instruction in the buffer, step S13b involves dividing the buffer into two sets of roughly equal size and assigning the symbols L and R respectively. Then at S14, the instructions within the L buffer are examined to see if any independent instructions can be issued. If not, step S15b sets the active issue buffer B to look at buffer R and the process is repeated from step S12.
  • step S15a the R buffer is examined to see if it contains any instructions ready for issue. If not, step S16b sets the active buffer B to be buffer L and the process is repeated from step S12. If both L and R contain instructions that are ready for issue, the flow proceeds to step S16a where a random bit is generated. If the random bit is '1' then the process moves to step S16b where the L buffer is selected or if the bit is a '0' then the process moves to step S15b where the R buffer is selected. In both cases, the process will be repeated until there is only one instruction in one of the buffers in which case step S13a is invoked and the program sequence is completed.
  • Such instruction sequences generally include associative and/or commutative operations where the execution order does not affect the end result.
  • the instructions that form such an instruction sequence will be referred to herein as data manipulation instructions.
  • a dependency check at run time is not needed immediately. That is, there may, prima facie, be a dependency on source or destination registers but it is one which can be ignored because the result will be the same whatever the order of execution of the instructions.
  • a compiler can identify such instruction sequences and introduce two extra instructions which are called herein IGNORE and DEPEND that demarcate the section of code containing such a set of data manipulation instructions.
  • the effect of the IGNORE R1 instruction at run-time is to cause all dependencies on R1 to be ignored for all the subsequent data manipulation instructions until the DEPEND R1 instruction is detected.
  • the DEPEND instruction causes the system to return to the default case where the dependencies on subsequent instructions having the specified operand R1 are checked.
  • the IGNORE/DEPEND pair allows the dependencies that exist on register R1 between the data manipulation instructions 11 , 12, 13 to be ignored. This means that these instructions are ready for issue and can be selected by the random selection unit 44. Therefore, the data manipulation instructions 11 , 12, 13 can be executed in a random order which increases the level of non-determinism exhibited by the processor.
  • Figure 8 shows an alternative embodiment to that of Figure 3 of the dependency checking mechanism 33' for use in the presence of the IGNORE and DEPEND instructions.
  • the Defined Registers table 36 has two bit masks for each register, allowing each register dependency to be stored in one of two categories: a dependency of crucial importance and a dependency that can be delayed.
  • reference numeral 90 denotes a bit-mask for a crucial dependency
  • numeral 92 denotes a bit-mask for a deferrable dependency.
  • each register is associated with two such bit-masks.
  • the dependency checker 33 of Figure 3 provides for only a single dependency category for each instruction, i.e. crucial.
  • Each register of the dependency checker 33' of Figure 8 also has a flag associated with it, the so-called IGNORE flag (95-99). If the IGNORE flag is set it indicates that dependencies on that register can be ignored for as long as the flag is set.
  • Figure 8 shows the case where the Defined Registers table 36 has IGNORE flags 95, 96, 97, 98, 99 associated with the row pairs holding bit masks for registers R1 , R2, R3, R4, R5 respectively.
  • the IGNORE flags are set and reset responsive to detection of the IGNORE and DEPEND instructions at the decode stage 16 by a detect unit 16a, that is prior to execution of the instructions. When executed, the IGNORE and DEPEND instructions are executed as NO OPS.
  • the Defined Register table When the Defined Register table is loaded, as in the process described above with reference to Figure 4, which one of the categories of dependencies is set, depends on the status of the IGNORE flag associated with each pair of bit-masks 90, 92 for each register.
  • the IGNORE flag 96 has been set to "1" indicating that the dependencies on the associated register R2 can be temporarily delayed. An IGNORE R2 instruction would have issued to set this flag.
  • the IGNORE flag 96 may be reset to "0" upon detection of a DEPEND R2 instruction.
  • any subsequent data manipulation instructions that specify register R2 will set the second category of bit mask 92 indicating that the instructions have dependencies that can be delayed.
  • the relevant bit-masks 90 are set in the first category defining a crucial dependency.
  • any instructions which have a prima facie dependency on register R2 will be treated as though there is no dependency for the purposes of selection of instructions by the random issue unit. That is, the bit mask sent to the dependency matrix table 30 will indicate there is no dependency. Instead these dependencies are stored in the second bit mask 92 associated with the register R2.
  • the DEPEND instruction like the other instructions in the instruction issue table 32, has an associated slot in the dependency matrix table 30. However, that slot does not contain the dependencies worked out as for the "ordinary" instructions explained above with reference to Figure 3. Instead, it takes the bit mask of deferred dependencies associated with the register defined in the DEPEND instruction. This constitutes the dependencies for instructions whose dependencies have been deferred but which have yet to be selected for issue by the random selection unit 44. Thus, two important events occur when a DEPEND instruction is loaded:
  • a selector switch 110 selects the second category of bit-mask 92 as the dependency mask for the relevant slot of the dependency matrix 32 associated with the register defined in the DEPEND instruction corresponding to the DEPEND instruction.
  • IGNORE R2 a single IGNORE instruction
  • IGNORE R4 a second IGNORE instruction
  • An IGNORE instruction can define more than one operand, in which case IGNORE flags are simultaneously set against multiple defined registers.
  • a single DEPEND instruction defining more than one register can follow, or multiple DEPEND instructions each defining a single operand.
  • the bit masks associated with the multiple defined registers need to be ORed before loading into the slot associated with the DEPEND instructions.
  • data manipulation instructions will issue normally and can occur between an IGNORE/DEPEND instruction pair provided that they do not act on the same operand specified by the IGNORE instruction.
  • an additional instruction such as ADD R7, R8, R9 is inserted between the data manipulation instructions 11 and 12 in the code sequence example of table 3.
  • the IGNORE instruction specifies the register R1 , while this ADD instruction specifies different registers R7, R8, R9. So this ADD instruction will be executed normally, meaning that if this instruction is dependent on another then the default dependency checking mechanism of figure 3 is used and the dependency will be considered crucial.
  • IGNORE and DEPEND instructions can be defined without an operand. In this case, by default all the IGNORE flags are automatically set to "1". In such a situation the dependencies on all the data manipulation instructions that exist between the IGNORE/DEPEND instruction pair will be ignored regardless of the operands specified.
  • the non-deterministic properties of a processor can be exploited without necessarily impacting its performance.
  • the IGNORE/DEPEND instruction pair allows certain types of instructions to be executed in a random order by ignoring their dependencies.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Advance Control (AREA)

Abstract

L'invention concerne un procédé d'exécution d'un programme informatique qui comprend une séquence ordonnée d'instructions comportant une instruction d'annulation suivie d'une série d'instructions de manipulation de données qui peuvent être exécutées dans un ordre arbitraire. Le procédé consiste à lire chaque instructions dans la séquence ordonnée, vérifier sa dépendance par rapport aux instructions adjacentes et stocker un masque binaire de dépendance associé, sensible à la détection de l'instruction d'annulation, ignorer les masques binaires de dépendance en vue d'instructions de manipulation de données subséquentes émises jusqu'à ce que soit détectée l'instruction de dépendance, les instructions de manipulation de données pouvant être émises dans un ordre arbitraire.
PCT/GB2001/004299 2000-09-27 2001-09-26 Instructions machine WO2002027479A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
AU2001290112A AU2001290112A1 (en) 2000-09-27 2001-09-26 Computer instructions

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
GB0023696.8 2000-09-27
GBGB0023696.8A GB0023696D0 (en) 2000-09-27 2000-09-27 Computer instructions

Publications (1)

Publication Number Publication Date
WO2002027479A1 true WO2002027479A1 (fr) 2002-04-04

Family

ID=9900248

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/GB2001/004299 WO2002027479A1 (fr) 2000-09-27 2001-09-26 Instructions machine

Country Status (3)

Country Link
AU (1) AU2001290112A1 (fr)
GB (1) GB0023696D0 (fr)
WO (1) WO2002027479A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016111778A1 (fr) * 2015-01-07 2016-07-14 Qualcomm Incorporated Dispositifs et procédés de mise en oeuvre d'opérations pour l'entrée en vigueur sélective de dépendances de tâches

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5745726A (en) * 1995-03-03 1998-04-28 Fujitsu, Ltd Method and apparatus for selecting the oldest queued instructions without data dependencies
US5881308A (en) * 1991-06-13 1999-03-09 International Business Machines Corporation Computer organization for multiple and out-of-order execution of condition code testing and setting instructions out-of-order
EP0924603A2 (fr) * 1997-12-16 1999-06-23 Lucent Technologies Inc. Planification dynamique d'instructions de programme sur commande de compilateur

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5881308A (en) * 1991-06-13 1999-03-09 International Business Machines Corporation Computer organization for multiple and out-of-order execution of condition code testing and setting instructions out-of-order
US5745726A (en) * 1995-03-03 1998-04-28 Fujitsu, Ltd Method and apparatus for selecting the oldest queued instructions without data dependencies
EP0924603A2 (fr) * 1997-12-16 1999-06-23 Lucent Technologies Inc. Planification dynamique d'instructions de programme sur commande de compilateur

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
FORREST ET AL: "Building diverse computer systems", OPERATING SYSTEMS, 1997., THE SIXTH WORKSHOP ON HOT TOPICS IN CAPE COD, MA, USA 5-6 MAY 1997, LOS ALAMITOS, CA, USA,IEEE COMPUT. SOC, US, 5 May 1997 (1997-05-05), pages 67 - 72, XP010226847, ISBN: 0-8186-7834-8 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016111778A1 (fr) * 2015-01-07 2016-07-14 Qualcomm Incorporated Dispositifs et procédés de mise en oeuvre d'opérations pour l'entrée en vigueur sélective de dépendances de tâches
US9678790B2 (en) 2015-01-07 2017-06-13 Qualcomm Incorporated Devices and methods implementing operations for selective enforcement of task dependencies

Also Published As

Publication number Publication date
AU2001290112A1 (en) 2002-04-08
GB0023696D0 (en) 2000-11-08

Similar Documents

Publication Publication Date Title
May et al. Non-deterministic processors
May et al. Random register renaming to foil DPA
US7949883B2 (en) Cryptographic CPU architecture with random instruction masking to thwart differential power analysis
EP3757854B1 (fr) Circuit de pipeline de microprocesseur pour prendre en charge le calcul cryptographique
US8417961B2 (en) Apparatus and method for implementing instruction support for performing a cyclic redundancy check (CRC)
US20100246814A1 (en) Apparatus and method for implementing instruction support for the data encryption standard (des) algorithm
RU2279123C2 (ru) Вычислительный модуль и способ выполнения арифметической операции с зашифрованными операндами
EP1398901B1 (fr) Methode et appareil de cryptage de type Feistel protégé contre attaques DPA
EP1011081B1 (fr) Dispositif de traitement de données
US9317286B2 (en) Apparatus and method for implementing instruction support for the camellia cipher algorithm
JP2012198565A (ja) 処理装置に対する特異な電力攻撃を最小限にする方法および装置
Albert et al. Combatting software piracy by encryption and key management
US20100246815A1 (en) Apparatus and method for implementing instruction support for the kasumi cipher algorithm
US7570760B1 (en) Apparatus and method for implementing a block cipher algorithm
Neve Cache-based Vulnerabilities and SPAM analysis
WO2002027478A1 (fr) Emission d'instructions par un processeur
WO2002054228A1 (fr) Renomination de registre
WO2002027474A1 (fr) Execution d'une instruction combinee
Fournier et al. Cache based power analysis attacks on AES
Boneh et al. Hardware support for tamper-resistant and copy-resistant software
WO2002027479A1 (fr) Instructions machine
Hossain et al. Hexon: Protecting firmware using hardware-assisted execution-level obfuscation
WO2002027476A1 (fr) Affectation des registres dans un processeur
WO2022029443A1 (fr) Procédé et appareil pour réduire le risque d'attaques fructueuses par canal auxiliaire et injection d'erreurs
US7711955B1 (en) Apparatus and method for cryptographic key expansion

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT TZ UA UG US UZ VN YU ZA ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
DFPE Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101)
REG Reference to national code

Ref country code: DE

Ref legal event code: 8642

122 Ep: pct application non-entry in european phase
NENP Non-entry into the national phase

Ref country code: JP