# US 2025/0094567 A1 · Consistent Speculation of Pointer Authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0094567 A1 - Document ID: US20250094567A1 - Status: Published application - Kind: A1 - Application number: 18/510,540 - Filed: 2023-11-15 - Published: 2025-03-20 - Earliest claimed: 2023-09-18 - Assignees: Apple Inc. - Applicants: Apple Inc. - Inventors: John D Pape; Deepankar Duggal; Christopher M Tsay; Andrew H Lin; Corey C Stappenbeck - Web page: https://patentgrep.com/patent/US20250094567A1 ## CPC - G06F 21/54: by adding security routines or objects to programs - G06F 9/3806: {using address prediction, e.g. return stack, branch history buffer} - G06F 9/3842: {Speculative instruction execution} - G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)} - G06F 21/75: by inhibiting the analysis of circuitry or operation - G06F 2207/7219: Countermeasures against side channel or fault attacks - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In an embodiment, a processor includes hardware circuitry which may be used to authenticate instruction operands. The processor may execute instructions that perform operand authentication both speculatively and non-speculatively. During speculative execution of such instructions, the processor may execute authentication such that no differences in observable state of the processor, relative to authentication result, are detectable via a side channel. During speculative execution, a result of authentication may be deferred until speculative execution of the instruction, and additional instructions, may be completed. Upon resolution of a condition that indicates acceptance of the speculative execution, a speculative execution result may cause a processor exception and stalling of execution at the instruction to be performed. ## Claims ### Claim 1 A processor, comprising: an authentication circuit configured to authenticate instruction operands; and an execution circuit configured to speculatively execute, responsive to an unresolved condition, an instruction stream comprising a plurality of instructions including an instruction comprising authentication of an instruction operand, wherein to speculatively execute the instruction stream the execution circuit is configured to: perform, using the authorization circuit, the authentication of the instruction operand, as part of speculatively executing the instruction, to generate an authentication result; continue speculative execution of the instruction stream to generate an observable state of the processor independent of the generated authentication result, wherein to continue speculative execution the execution circuit is configured to: complete speculative execution of the instruction; and speculatively execute at least one additional instruction of the plurality of instructions subsequent to completing speculative execution of the instruction; and defer reporting the generated authentication result until resolution of the condition. ### Claim 2 (depends on 1) The processor as recited in claim 1, wherein the execution circuit is further configured to execute, responsive to resolution of the unresolved condition, the instruction stream, wherein to execute the instruction stream the execution circuit is further configured to: responsive to the authentication result indicating an authentication failure: suspend processor execution at the instruction; and generate a processor fault. ### Claim 3 (depends on 1) The processor as recited in claim 1, wherein the observable state of the processor comprises a cumulative state of processor circuitry detectable by an instrumented side channel of the processor, and wherein the observable state of the processor is independent of the generated authentication result based on an absence of detectable differences in respective cumulative states of processor circuitry being observable by the instrumented side channel of the processor for different generated authentication result values including a passing authentication result value and a failing authentication result value. ### Claim 4 (depends on 1) The processor as recited in claim 1, wherein the authentication result indicates an authentication failure, wherein the deferred reporting of the authentication result is a speculative fault source of a plurality of speculative fault sources of the speculative execution of the plurality of instructions, and wherein, subsequent to resolution of the condition, a processor fault is generated according to an oldest fault source of the plurality of speculative fault sources. ### Claim 5 (depends on 1) The processor as recited in claim 1, wherein to speculatively execute the one or more of the plurality of instructions the execution circuit is configured to stall the speculative execution responsive to receiving a fault signal. ### Claim 6 (depends on 1) The processor as recited in claim 1, wherein the instruction operand is a signed memory pointer comprising a memory address and a signature stored in a single memory word of the processor. ### Claim 7 (depends on 6) The processor as recited in claim 6, wherein the instruction is an authorized load instruction, and wherein to speculatively execute the instruction the processor is configured to: generate an unsigned memory pointer comprising the memory address of the signed memory pointer; and load a value without authentication of the instruction operand according to the unsigned memory pointer. ### Claim 8 (depends on 6) The processor as recited in claim 6, wherein the instruction is an authorized branch instruction, and wherein to execute the instruction the processor is configured to: generate an unsigned memory pointer comprising the memory address of the signed memory pointer; and transfer control of execution to the memory address of the unsigned memory pointer. ### Claim 9 (depends on 1) The processor as recited in claim 1, wherein the instruction operand comprises a memory address and a memory tag, and wherein the authentication result comprises a comparison of the memory tag with an associated memory tag of a memory region comprising the memory address. ### Claim 10 A method, comprising: speculatively executing, by an execution circuit of a processor responsive to an unresolved condition, an instruction stream comprising a plurality of instructions including an instruction comprising authentication of an instruction operand, the speculatively executing comprising: performing the authentication of the instruction operand as part of speculatively executing the instruction to generate an authentication result; continuing speculative execution of the instruction stream to generate an observable state of the processor independent of the generated authentication result, wherein continuing speculative execution comprises: completing speculative execution of the instruction; and speculatively executing at least one additional instruction of the plurality of instructions subsequent to completing speculative execution of the instruction; and deferring reporting the generated authentication result until resolution of the condition. ### Claim 11 (depends on 10) The method as recited in claim 10, further comprising executing the instruction stream responsive to resolution of the condition indicating that the instruction stream is to be executed, the executing comprising: responsive to the authentication result indicating an authentication failure: suspending processor execution at the instruction; and generating a processor fault. ### Claim 12 (depends on 10) The method as recited in claim 10, wherein the observable state of the processor comprises a cumulative state of processor circuitry detectable by an instrumented side channel of the processor, and wherein the observable state of the processor is independent of the generated authentication result based an absence of no detectable differences in respective cumulative states of processor circuitry being observable by the instrumented side channel of the processor for different generated authentication result values including a passing authentication result value and a failing authentication result value. ### Claim 13 (depends on 12) The method as recited in claim 12, wherein the authentication result indicates an authentication failure, wherein the deferred reporting of the authentication failure is a speculative fault source of a plurality of speculative fault sources of the speculative execution of the plurality of instructions, and wherein a processor fault is generated according to an oldest fault source of the plurality of speculative fault sources. ### Claim 14 (depends on 12) The method as recited in claim 12, wherein speculatively executing the one or more of the plurality of instructions comprises stalling speculative execution responsive to receiving a fault signal. ### Claim 15 (depends on 12) The method as recited in claim 12, wherein the instrumented side channel of the processor comprises another instruction stream executing on the processor to measure latency of execution of the instruction stream. ### Claim 16 (depends on 10) The method as recited in claim 10, wherein the instruction operand is a signed memory pointer comprising a memory address and a signature stored in a single memory word of the processor. ### Claim 17 (depends on 16) The method as recited in claim 16, wherein the instruction is an authorized load instruction, and wherein speculatively executing the instruction comprises: generating an unsigned memory pointer comprising the memory address of the signed memory pointer; and loading a value without authentication of the instruction operand according to the unsigned memory pointer. ### Claim 18 (depends on 16) The method as recited in claim 16, wherein the instruction is an authorized branch instruction, and wherein speculatively executing the instruction comprises: generating an unsigned memory pointer comprising the memory address of the signed memory pointer; and transferring control of execution to the memory address of the unsigned memory pointer. ### Claim 19 A system, comprising: a memory configured to store a plurality of instructions; and a processor comprising: an authentication circuit configured to authenticate instruction operands; and an execution circuit configured to: speculatively execute, responsive to an unresolved condition, an instruction stream comprising a plurality of instructions including an instruction comprising authentication of an instruction operand, wherein to speculatively execute the instruction stream the execution circuit is configured to: perform, using the authorization circuit, the authentication of the instruction operand as part of speculatively executing the instruction to generate an authentication result; continue speculative execution of the instruction stream to generate an observable state of the processor independent of the generated authentication result, wherein to continue speculative execution the execution circuit is configured to: complete speculative execution of the instruction; and speculatively execute one or more of the plurality of instructions subsequent to completing speculative execution of the instruction; and execute, responsive to resolution of the condition indicating that the instruction stream is to be executed, the instruction stream, wherein to execute the instruction stream the execution circuit is configured to: responsive to the authentication result indicating an authentication failure: suspend processor execution at the instruction; and generate a processor fault. ### Claim 20 (depends on 19) The system as recited in claim 19, wherein the instruction operand is a signed memory pointer comprising a memory address and a signature stored in a single memory word of the processor, wherein the instruction is an authorized load instruction, and wherein to speculatively execute the instruction the processor is configured to: generate an unsigned memory pointer comprising the memory address of the signed memory pointer; and load a value without authentication of the instruction operand according to the unsigned memory pointer.