// Description: all valid pack contains an word size load. For -O0 there is store with load, we suppose if store to the same addr, the next load can be conclude in the same slow cycle.
@@ -145,7 +145,7 @@ class DetectPatternPrimeInternal(params: DetectPatternPrimeParams)(implicit mp:
}
valatk_primemix_1=Wire(Bool())
atk_primemix_1:=Mux(count_pack_valid_dec,!atk_prime_4,atk_prime_4)&&in.isMonitoring// if dec=true, dec1 if atk0, dec0 if atk1; if dec=false, inc1 if atk1, inc0 if atk0.
atk_primemix_1:=Mux(count_pack_valid_dec,!atk_prime_1,atk_prime_1)&&in.isMonitoring// if dec=true, dec1 if atk0, dec0 if atk1; if dec=false, inc1 if atk1, inc0 if atk0.
// Debug Signals
...
...
@@ -155,10 +155,10 @@ class DetectPatternPrimeInternal(params: DetectPatternPrimeParams)(implicit mp:
@@ -27,7 +27,7 @@ class DetectPatternRopInternal(params: DetectPatternRopParams)(implicit mp: Mata
// Attack Pattern
// Description: Jalr chained short instruction sequence.
// 3) jalr + jalr = c+1, other jump = c-2 (window size 1) (thresh proably 10 as in mispredict1) (window size 2 has high false positive rate)
// 1) jalr + jalr = c+1, other jump = c-2 (window size 1) (thresh proably 10 as in mispredict1) (window size 2 has high false positive rate)
// Note:
// 1) clockDiv will impact the pattern on window size, smaller clockDiv is perhaps more accurate.
// 2) ROP gadget destination is likely not in cache, so jalr will take longer and will probably be visible in different clockDiv pack. But this property may increase false positive as legal chain will now seems to be shorter.
...
...
@@ -39,15 +39,15 @@ class DetectPatternRopInternal(params: DetectPatternRopParams)(implicit mp: Mata