A Lightweight Isolation Mechanism for Secure Branch Predictors

by   Lutan Zhao, et al.

Recently exposed vulnerabilities reveal the necessity to improve the security of branch predictors. Branch predictors record history about the execution of different programs, and such information from different processes are stored in the same structure and thus accessible to each other. This leaves the attackers with the opportunities for malicious training and malicious perception. Instead of flush-based or physical isolation of hardware resources, we want to achieve isolation of the content in these hardware tables with some lightweight processing using randomization as follows. (1) Content encoding. We propose to use hardware-based thread-private random numbers to encode the contents of the branch predictor tables (both direction and destination histories) which we call XOR-BP. Specifically, the data is encoded by XOR operation with the key before written in the table and decoded after read from the table. Such a mechanism obfuscates the information adding difficulties to cross-process or cross-privilege level analysis and perception. It achieves a similar effect of logical isolation but adds little in terms of space or time overheads. (2) Index encoding. We propose a randomized index mechanism of the branch predictor (Noisy-XOR-BP). Similar to the XOR-BP, another thread-private random number is used together with the branch instruction address as the input to compute the index of the branch predictor. This randomized indexing mechanism disrupts the correspondence between the branch instruction address and the branch predictor entry, thus increases the noise for malicious perception attacks. Our analyses using an FPGA-based RISC-V processor prototype and additional auxiliary simulations suggest that the proposed mechanisms incur a very small performance cost while providing strong protection.


page 1

page 2

page 3

page 4


Branch Prediction as a Reinforcement Learning Problem: Why, How and Case Studies

Recent years have seen stagnating improvements to branch predictor (BP) ...

Clustering case statements for indirect branch predictors

We present an O(nlogn) algorithm to compile a switch statement into jump...

By-Software Branch Prediction in Loops

Load-Dependent Branches (LDB) often do not exhibit regular patterns in t...

Mitigating Speculation-based Attacks through Configurable Hardware/Software Co-design

New speculation-based attacks that affect large numbers of modern system...

ret2spec: Speculative Execution Using Return Stack Buffers

Speculative execution is an optimization technique that has been part of...

A Survey of Techniques for Dynamic Branch Prediction

Branch predictor (BP) is an essential component in modern processors sin...

Branch Predicting with Sparse Distributed Memories

Modern processors rely heavily on speculation to keep the pipeline fille...

Please sign up or login with your details

Forgot password? Click here to reset