US 12,111,913 B2
Core processor and redundant branch processor with control flow attack detection
Lizy Kurian John, Austin, TX (US); Heonchul Park, Pleasanton, CA (US); and Venkat Mattela, San Jose, CA (US)
Assigned to Ceremorphic, Inc., San Jose, CA (US)
Filed by Ceremorphic, Inc., San Jose, CA (US)
Filed on Sep. 26, 2021, as Appl. No. 17/485,436.
Prior Publication US 2023/0098640 A1, Mar. 30, 2023
Int. Cl. G06F 21/52 (2013.01); G06F 9/30 (2018.01)
CPC G06F 21/52 (2013.01) [G06F 9/3001 (2013.01); G06F 9/30076 (2013.01); G06F 2221/033 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A fault-detecting pipeline processor comprising a core processor and a redundant branch processor;
the core processor configured to execute control instructions, branch control instructions which are a subset of the control instructions, the branch control instructions including at least one of: variable initialization instructions, branch instructions, variable arithmetic instructions associated with branch instructions, and no operation (NOP) instructions;
the core processor also configured to execute control instructions and data instructions, the core processor comprising, in sequence, a fetch stage coupled to a decode stage coupled to a decode-execute stage coupled to an execute stage coupled to a load-store stage coupled to a writeback stage;
the redundant branch processor configured to execute only branch control instructions, the redundant branch processor comprising, in sequence, a fetch stage coupled to a decode stage coupled to a decode-execute stage coupled to an execute stage coupled to a load-store stage coupled to a writeback stage;
a fault detector receiving branch status values from the core processor and branch status values from the redundant branch processor, the branch status values comprising at least one of: a branch target, a branch direction, and a branch taken/not taken;
the fault detector asserting an output when at least one of a branch status comprising: a branch target, branch direction, or a branch taken/not taken of the core processor does not match a branch status comprising at least one of: a branch target, branch direction, or branch taken/not taken of the redundant branch processor;
where the core processor and redundant branch processor are configured to operate concurrently during a first time interval and are configured to operate separately during a second time interval.