Processor with in-band fault-injection detection in the presence of exceptions
An apparatus for protecting a processor includes an input interface and protection circuitry. The input interface is configured to monitor code instructions that are processed by the processor. One or more of the code instructions include one or more error-detection bits. The protection circuitry is configured to detect one or more errors in the program code using the error-detection bits, and to initiate responsive actions in response to detecting the errors, while accounting for exception events occurring in the processor.
1 . An apparatus for protecting a processor, the apparatus comprising:
an input interface, configured to monitor code instructions that are processed by an instruction pipeline of the processor, one or more of which code instructions comprising one or more error-detection bits inserted at respective bit locations within the code instructions; and
protection circuitry, configured to:
detect one or more errors in the program code using the error-detection bits in the code instructions, and initiate responsive actions in response to detecting the errors, while accounting for exception events occurring in the processor; and
cause the instruction pipeline to ignore the error-detection bits while processing the code instructions, by notifying the instruction pipeline of the bit locations of the error-detection bits.
2 . The apparatus according to claim 1 ,
wherein the program code comprises a code section that (i) has a deterministic code flow and (ii) comprises at least one of the error-detection bits having been calculated over at least part of the code section, and
wherein the protection circuitry is configured to act upon an exception event occurring during processing of the code section by the processor.
3 . The apparatus according to claim 2 , wherein, in response to the exception event, the protection circuitry is configured to abort checking for the errors in the code section.
4 . The apparatus according to claim 2 , wherein the protection circuitry is configured to defer handling of the exception event by the processor at least until completion of checking for the errors in the code section.
5 . The apparatus according to claim 1 , wherein, in response to an exception event, the protection circuitry is configured to:
suspend checking for the errors, and save a state of the checking; and
after handling of the exception event by the processor, resume the checking from the saved state.
6 . The apparatus according to claim 1 , wherein, in detecting the errors, the protection circuitry is configured to detect a fault-injection attack.
7 . The apparatus according to claim 1 , wherein one or more of the error-detection bits are inserted at reserved bit locations in one or more of the code instructions, and wherein the protection circuitry is configured to extract the error-detection bits from the reserved bit locations.
8 . The apparatus according to claim 1 , wherein one or more of the error-detection bits are inserted, in one or more of the code instructions, at de-facto reserved bit locations that do not affect execution of the code instructions, and wherein the protection circuitry is configured to extract the error-detection bits from the de-facto reserved bit locations.
9 . The apparatus according to claim 1 , wherein one or more of the error-detection bits are inserted, in one or more jump instructions, at one or more bit locations (i) that are specified to indicate a jump offset but (ii) that the processor is configured to ignore.
10 . The apparatus according to claim 1 , wherein one or more of the error-detection bits are inserted in one or more additional code instructions that are added to the program code for error detection, and wherein the protection circuitry is configured to identify the additional code instructions and to extract the error-detection bits from the additional code instructions.
11 . The apparatus according to claim 1 , wherein the protection circuitry is configured to hold a definition of locations of the error-detection bits in the code instructions, and to extract the error-detection bits from the code instructions in accordance with the definition.
12 . The apparatus according to claim 1 , wherein a given set of one or more error-detection bits is calculated over at least part of a given code instruction and is inserted into the given code instruction.
13 . The apparatus according to claim 1 , wherein a given set of one or more error-detection bits is calculated over multiple selected bits in the program code, and wherein at least one of the selected bits and at least one of the error-detection bits in the set are located in different code instructions.
14 . The apparatus according to claim 1 , further comprising insertion circuitry, which is configured to insert one or more of the error-detection bits into one or more of the code instructions that are provided to the processor for processing.
15 . A processor, comprising:
an instruction pipeline, configured to fetch and execute program code comprising code instructions, one or more of which code instructions comprising one or more error-detection bits inserted at respective bit locations within the code instructions; and
protection circuitry, configured to:
monitor at least the error-detection bits in the code instructions, to detect one or more errors in the program code using the error-detection bits while accounting for exception events occurring in the processor, and to initiate a responsive action in response to detecting the errors; and
cause the instruction pipeline to ignore the error-detection bits while processing the code instructions, by notifying the instruction pipeline of the bit locations of the error-detection bits.
16 . A method for protecting a processor, the method comprising:
monitoring code instructions that are processed by an instruction pipeline of the processor, one or more of which code instructions comprising one or more error-detection bits inserted at respective bit locations within the code instructions;
detecting one or more errors in the program code using the error-detection bits in the code instructions, while accounting for exception events occurring in the processor;
initiating a responsive action in response to detecting the errors; and
causing the instruction pipeline to ignore the error-detection bits while processing the code instructions, by notifying the instruction pipeline of the bit locations of the error-detection bits.
17 . The method according to claim 16 ,
wherein the program code comprises a code section that (i) has a deterministic code flow and (ii) comprises at least one of the error-detection bits having been calculated over at least part of the code section, and
wherein accounting for the exception events comprises acting upon an exception event occurring during processing of the code section by the processor.
18 . The method according to claim 17 , wherein acting upon the exception event comprises aborting checking for the errors in the code section.
19 . The method according to claim 17 , wherein acting upon the exception event comprises deferring handling of the exception event by the processor at least until completion of checking for the errors in the code section.
20 . The method according to claim 16 , wherein accounting for the exception events comprises, upon occurrence of an exception event:
suspending checking for the errors in the code section, and saving a state of the checking; and
after handling of the exception event by the processor, resuming the checking from the saved state.