Method for controlling a program pipeline, processing device and storage medium

Abstract

A control method of a program pipeline, a processing device and a storage medium. The method comprises: receiving a first instruction; obtaining first memory mark information corresponding to the first instruction, wherein the first memory mark information comprises a first memory mark corresponding to a first storage location storing the first instruction; obtaining second memory mark information corresponding to a target address, wherein the second memory mark information comprises a second memory mark corresponding to a second storage location of the target address in the memory space, and the second storage location stores a return address or a jump target instruction in the program pipeline; determining whether the first memory mark and the second memory mark match based on the first memory mark information and the second memory mark information; and in response to the first memory mark and the second memory mark matching, allowing the first instruction to continue to execute, otherwise, entering an exception handling. The control method of the program pipeline improves the security of the system.

Description

Technical Field

[0001] Embodiments of this disclosure relate to a control method, processing apparatus, and storage medium for a process pipeline. Background Technology

[0002] Memory security is a critical aspect of computer host security, and control flow integrity protection is a vital means of maintaining memory security and preventing hacker attacks. In recent years, various hardware processor manufacturers have launched their own hardware extensions and software solutions, providing varying degrees of support for control flow integrity protection. These solutions include Intel's CET (Control-flow Enforcement Technology) and ARM's PACBTI (Pointer Authentication Code & Branch Target Identification) extension. However, these commercial system solutions require a comprehensive consideration of factors such as performance, compatibility, and security, making trade-offs in security features to select the optimal solution within the design space of each system architecture. Therefore, while each vendor's security solution has its own advantages, it also exposes certain weaknesses to some extent.

[0003] Intel CET has the following disadvantages: (1) It has limited tag types and only supports one type of landing point tag. It cannot distinguish between multiple landing point tags, which may mean that code reuse attacks such as ROP (return-oriented programming) still have reusable code segments; (2) The shadow stack needs to allocate dedicated memory space. If the memory granularity is large, it will cause space waste; (3) The shadow stack needs to keep updated and accessed in sync with the original stack, which will lead to reduced efficiency. For example, the original return address push and pop operations have changed from one memory access request to two memory access requests, and these two address requests are distributed far apart in memory.

[0004] The ARM PACBTI extension has the following disadvantages: (1) ARM PAC uses pointer space to store the verification code, but this technology is not suitable for architectures where pointers do not have space, such as 32-bit architecture; (2) The landing point marker type in ARM BTI only distinguishes two types (function call and indirect branch), which cannot meet the needs of more landing point distinctions. For example, ARM BTI cannot distinguish the landing points of different functions.

[0005] With the emergence of new architectures (such as RISC-V) and new applications (such as AIoT), the design space for software and hardware systems has increased unprecedentedly, which is conducive to designing safer and more efficient solutions than traditional ones. Summary of the Invention

[0006] At least one embodiment of this disclosure provides a method for controlling a program pipeline. The method includes: receiving a first instruction; obtaining first memory marker information corresponding to the first instruction, wherein the first memory marker information includes a first memory marker, and the first memory marker corresponds to a first storage location in memory space where a first storage address of the first instruction is stored; obtaining second memory marker information corresponding to the target address, wherein the second memory marker information includes a second memory marker, and the second memory marker corresponds to a second storage location in memory space where the target address of the first instruction is stored, and the second storage location stores a return address or a jump target instruction in the program pipeline; determining whether the first memory marker and the second memory marker match based on the first memory marker information and the second memory marker information; allowing the first instruction to continue execution in response to the first memory marker and the second memory marker matching, or entering exception handling in response to the first memory marker and the second memory marker not matching.

[0007] At least one embodiment of this disclosure provides a processing apparatus, comprising: a receiving unit configured to receive a first instruction; a first acquiring unit configured to acquire first memory marker information corresponding to the first instruction, wherein the first memory marker information includes a first memory marker, the first memory marker corresponding to a first storage location in memory space where a first storage address of the first instruction is stored; a second acquiring unit configured to acquire second memory marker information corresponding to the target address, wherein the second memory marker information includes a second memory marker, the second memory marker corresponding to a second storage location in memory space where the target address of the first instruction is stored, the second storage location storing a return address or a jump target instruction in the program pipeline; a determining unit configured to determine whether the first memory marker and the second memory marker match based on the first memory marker information and the second memory marker information; and an operating unit configured to allow the first instruction to continue execution in response to a match between the first memory marker and the second memory marker, or to enter exception handling in response to a mismatch between the first memory marker and the second memory marker.

[0008] At least one embodiment of this disclosure provides a processing apparatus comprising: a processing unit and a memory, wherein one or more computer program modules are stored in the memory; wherein the one or more computer program modules are configured to implement the control method described in the above embodiments when executed by the processing unit.

[0009] At least one embodiment of this disclosure provides a non-transitory readable storage medium, wherein computer instructions are stored on the non-transitory readable storage medium, wherein the computer instructions, when executed by a processor, implement the control method described in the above embodiments.

[0010] The memory-marked program pipeline control scheme of this invention is more efficient and safer than the pure software scheme. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings of the embodiments will be briefly described below. Obviously, the drawings described below only relate to some embodiments of this disclosure and are not intended to limit this disclosure.

[0012] Figure 1A A schematic diagram of memory space in a computer system according to an embodiment of the present disclosure is shown;

[0013] Figure 1B A schematic diagram of memory space in a computer system according to another embodiment of the present disclosure is shown;

[0014] Figure 2A A flowchart illustrating the protection of access to memory space using memory tags according to embodiments of the present disclosure is shown;

[0015] Figure 2B A schematic diagram illustrating the implementation of program pipeline control using memory marking in an embodiment of this disclosure is shown;

[0016] Figure 3A A schematic diagram illustrating a memory tagging implementation of program pipeline control using an example of an embodiment of this disclosure is shown;

[0017] Figure 3B A schematic diagram illustrating a memory tagging implementation of program pipeline control using an example of an embodiment of this disclosure is shown;

[0018] Figure 4 A schematic diagram illustrating a memory tag implementation of program pipeline control using another example of an embodiment of this disclosure is shown.

[0019] Figure 5A A schematic diagram illustrating a memory-marked implementation of program pipeline control using another example of an embodiment of this disclosure is shown;

[0020] Figure 5B An example of a memory address including a memory tag is shown according to at least one embodiment of the present disclosure;

[0021] Figure 6 A schematic diagram illustrating a memory-marked implementation of program pipeline control using another example of an embodiment of this disclosure is shown;

[0022] Figure 7 An exemplary configuration scheme for implementing memory tags corresponding to memory granularity is shown;

[0023] Figure 8 A schematic diagram of a processing apparatus according to at least one embodiment of the present disclosure is shown;

[0024] Figure 9 A schematic block diagram of an electronic device provided for at least one embodiment of this disclosure. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the described embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0026] Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms “first,” “second,” and similar terms used in this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Similarly, terms such as “comprising” or “including” mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as “connected” or “linked” are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as “upper,” “lower,” “left,” and “right” are used only to indicate relative positional relationships, which may change accordingly when the absolute position of the described objects changes.

[0027] To address the memory security issues faced by computers, several embodiments of this disclosure provide a memory tagging scheme. This scheme protects the computer system at a lower cost by tagging memory and the fine-grained memory protection it provides, such as through hardware and software co-processing to protect access to computer memory, thereby mitigating or avoiding threats posed by memory security violations.

[0028] Figure 1A A schematic diagram of memory space in a computer system according to an embodiment of the present disclosure is shown. In the marked memory scheme provided by at least one embodiment of the present disclosure, such as... Figure 1AAs shown, the computer system's memory space 10 includes a secure memory space 100 and a non-secure memory space 200. For example, the computer system's memory space 10 can be divided into a secure memory space 100 and a non-secure memory space 200. Both the secure memory space 100 and the non-secure memory space 200 can serve as runtime spaces for traditional programs, used to store data, instructions, and traditional runtime status information. The proportion of the secure memory space 100 and the non-secure memory space 200 within the memory space 10 can be fixed or dynamic. In the case of a dynamic proportion, the operating system can increase or decrease the secure memory space 100 based on the running processes.

[0029] Figure 1B A schematic diagram of memory space in a computer system according to another embodiment of the present disclosure is shown. For example, in another embodiment, memory space 10 includes only secure memory space 100 (i.e., all program execution space is marked), or for example, a separate marking space can be allocated outside of secure memory space 100 to store only the marking itself and the marking's related management data (marking metadata) rather than as the program's execution space.

[0030] In the secure memory space 100, the corresponding memory space is divided into multiple memory subspaces 101_1…101_n, etc., according to a predetermined size, and each memory subspace 101 is marked and assigned a memory label. Therefore, the secure memory space 100 is also referred to in this disclosure as a "labeled memory space" or "labeled memory," that is, a memory space that has been assigned a memory label. Thus, the data or instructions stored in the secure memory space 100 are correspondingly assigned memory labels.

[0031] like Figure 1A and Figure 1B As shown, in the secure memory space 100, memory subspace 101_1 is assigned the label La1, memory subspace 101_2 is assigned the label La2, and so on, with memory subspace 101_n assigned the label Lan. Thus, memory subspaces 101_1, 101_2, etc., have a mapping relationship with their corresponding memory labels La1, La2, etc. That is, one or more memory addresses pointing to memory subspace 101_1 have this mapping relationship with their corresponding memory label La1, one or more memory addresses pointing to memory subspace 101_2 have this mapping relationship with their corresponding memory label La2, and so on. The physical addresses of memory subspaces 101_1, 101_2, etc., can be contiguous or scattered.

[0032] As described below, the values ​​of memory markers La1, La2, etc., can be obtained, for example, based on random numbers or based on preset rules. For instance, the marker values ​​of adjacent memory subspaces may differ from each other, or the memory marker values ​​of each memory subspace within a predetermined space size range (e.g., within an address segment consisting of 4, 8, or 16 consecutive memory subspaces) may differ from each other, or, for example, the marker values ​​of all memory subspaces within a secure memory space may differ from each other (although this requires a large number of possible values ​​for the memory markers themselves). In the non-secure memory space 200, it behaves the same as the regular memory space, without being divided into portions or marked.

[0033] The minimum granularity of the secure memory space 100 (i.e., the predetermined size of a memory subspace 101, also known as "memory granularity" (MG)) can be fixed or set as needed. For example, it can be determined according to the processor's hardware specifications. For instance, the minimum granularity of the memory space can be set to one word, or it can be set to two words, four words, eight words, etc.

[0034] In at least one embodiment of this disclosure, the memory markers and memory markers are mapped using either physical addresses or virtual addresses. If physical address mapping is used, when the system runs a program that uses virtual addresses, the virtual address needs to be translated into a physical address by the processor's memory management unit (MMU) during execution, and then the system uses the physical address to read and write the memory markers.

[0035] As described above, the granularity of the secure memory space can be fixed or set as needed; this granularity setting is stored, for example, in a predetermined storage location or a predetermined register in the system, for the processor to access as needed during operation. The size of the storage space occupied by the memory tag itself (i.e., the tag width) can also be fixed or set as needed; this tag size is stored, for example, in a predetermined storage location (e.g., a separately allocated tag storage space) or a predetermined register, for the processor to access as needed during operation.

[0036] For example, in at least one embodiment of this disclosure, a security register (SEC register) is provided, which is configured as a control and status register (CSR) register. This register is used to store the tag memory granularity (MG) and tag width (LS) in the system. The register can also be used to store the security policy corresponding to the current tag, so as to control the change of the tag or the behavior of the instruction based on the value, such as the handling method when an exception occurs.

[0037] In embodiments of this disclosure, for example, each memory space in the secure memory space can be marked by instructions, and memory addresses, pointers, etc. (collectively referred to as "target addresses" in this disclosure for simplicity) that need to be protected can also be marked, that is, memory addresses, pointers, etc. are also assigned marks. Such memory marking can also be called "security marking".

[0038] Thus, in the embodiments of this disclosure, a computer system (e.g., a processor) can distinguish different regions of memory into memory spaces with different security configurations by identifying the values ​​of memory tags corresponding to memory content. Each secure memory space's subspace can be contiguous or non-contiguous. For example, when a program is configured to run in a secure memory space, the system can create its secure memory subspace when the program's process is started, assigning specific memory tags to the secure memory subspaces corresponding to memory granularity, thereby assigning memory tags to the data and instructions stored therein. When another program runs, the system can create memory subspaces with different security tags, ensuring that the two programs are isolated from each other and can only execute within their respective isolated environments without interfering with each other. For example, during the compilation process of a program, the relationship between memory access instructions in the program code and the object data operated on by those instructions is determined and recorded. Therefore, when creating a safe memory space, the storage location of the memory access instruction and the storage location of the object data can be assigned the same memory tag or the same type of memory tag (e.g., a memory tag for the same user). That is, the safe memory subspace where the memory access instruction resides and the safe memory subspace where the object data resides are assigned the same memory tag or the same type of memory tag. Furthermore, if different program instructions are classified, grouped, and marked with different safety tags during the compilation process, these instructions of different classes and groups can also be isolated from each other using tag matching rules.

[0039] In different embodiments of this disclosure, memory tags can be stored in different ways. For example, a separate space can be allocated in memory for storing memory tags (this space can be addressed and accessed independently of the aforementioned secure memory space and insecure memory space), or a separate storage device can be set up in the system for storing memory tags.

[0040] During the execution of a computer program, it proceeds in a pipeline manner. Within a program pipeline, a segment of the program includes sequential structures, IF selection structures (if...then), WHILE repetition structures (repeating when the condition is met), UNTIL loop structures (repeating until the condition is met), CASE multi-branch structures, etc. It will also jump due to subroutine calls or function (or subfunction) calls, and return to the original program after the subroutine or function has finished executing.

[0041] Figure 2A A flowchart illustrating the implementation of program pipeline control using memory markings according to at least one embodiment of this disclosure is shown. Figure 2A As shown, the control method of this pipeline includes the following steps 210 to 260:

[0042] Step 210: Receive the first instruction.

[0043] Step 220: Obtain the first memory tag information corresponding to the first instruction.

[0044] The first memory tag information includes a first memory tag, which corresponds to the first storage location in memory space of the first storage address storing the first instruction.

[0045] Step 230: Obtain the second memory tag information corresponding to the target address.

[0046] The second memory tag information includes a second memory tag, which corresponds to the second storage location of the target address of the first instruction in the memory space.

[0047] The second storage location corresponding to the target address of the first instruction stores the return address (target jump address) or the jump target instruction (also referred to as the "target instruction" in the diagram) in the program pipeline. For example, the program counter (PC) value is set through this target address, thereby realizing the jump in the program pipeline. The value is retrieved through the reset program counter value to execute the target instruction.

[0048] Step 240: Based on the first memory tag information and the second memory tag information, determine whether the first memory tag and the second memory tag match;

[0049] Step 250: In response to the first memory tag and the second memory tag matching, allow the first instruction to continue execution, or,

[0050] Step 260: In response to the mismatch between the first memory tag and the second memory tag, enter exception handling.

[0051] The exception handling procedure or process may include operations such as ignoring errors and resuming execution according to a predetermined security policy, recording abnormal behavior and resuming execution, or stopping the execution of memory access instructions.

[0052] For example, after stopping the execution of the memory access instruction, an alarm may be triggered, etc. The embodiments of this disclosure do not limit this. Figure 2A The illustrated embodiment uses a memory tag matching process to implement program pipeline control, thereby improving the security of the computer system.

[0053] Figure 2BA schematic diagram illustrating the implementation of program pipeline control using memory tags according to at least one embodiment of this disclosure is shown. Figure 2B As shown, the first instruction has a target address, opcode, etc. The storage address of the first instruction itself in the memory space (first storage address) is located in the secure memory subspace (first storage location) 311, and memory tag information L11 (first memory tag information) is provided corresponding to the secure memory subspace 311. The memory tag information L11 includes the memory tag (first memory tag) corresponding to the secure memory subspace 311, thereby allowing the first memory tag to be obtained.

[0054] The first instruction 201 can be a memory load / store instruction. The target address of the first instruction 201 can be used to obtain the memory address to be loaded or stored. For example, this target address might be the storage address of the return address on the stack. Corresponding to the target address, for the safe memory subspace (second storage location) 321 in the memory space, memory tag information L21 (second memory tag information) is provided. The memory tag information L21 includes the memory tag (second memory tag) corresponding to the safe memory subspace 321, thereby allowing the second memory tag to be obtained. For example, the safe memory subspace 321 can correspond to a stack frame, and therefore stores the return address corresponding to the pushed (program call) address.

[0055] The first instruction 201 can also be a jump instruction. The target jump instruction can be obtained from the target address of the first instruction 201. For example, this target address is the storage address of the target jump instruction. Corresponding to the target address, for the safe memory subspace (second storage location) 321 in the memory space, memory tag information L21 (second memory tag information) is provided. The memory tag information L21 includes the memory tag (second memory tag) corresponding to the safe memory subspace 321, thereby obtaining the second memory tag. For example, the safe memory subspace 321 can correspond to the code segment where the target function (or code branch) is located, and therefore stores the relevant instructions of the function entry (or branch entry), which are the target jump instructions.

[0056] Based on the first memory tag information and the second memory tag information, it is determined whether the first memory tag and the second memory tag match. If they match, the first instruction is allowed to continue execution; otherwise, exception handling is entered, such as stopping the execution of the first instruction.

[0057] And, as Figure 2BAs shown, memory tagging information L10, L12, L13, etc., is provided for other safe memory subspaces adjacent to safe memory subspace 311, and these safe memory subspaces can be used to store instructions that the program (or process) will use during execution. Similarly, memory tagging information L20, L22, L23, etc., is provided for other safe memory subspaces adjacent to safe memory subspace 321, and these safe memory subspaces are used to store instructions that the program (or process) will use during execution.

[0058] In one example, the safe memory subspaces corresponding to memory tag information L10, L12, L13, etc., and the safe memory subspaces corresponding to memory tag information L20, L22, L23, etc., may be adjacent to each other or far apart. The tag values ​​of the two safe subspaces may be the same or different. For example, memory tag information L12 and L22 are the same tag.

[0059] For example, a first memory tag is extracted from the first memory tag information L11, and a second memory tag is extracted from the second memory tag information L21; then, the first memory tag and the second memory tag are compared to determine whether the first memory tag and the second memory tag match.

[0060] like Figure 2B As shown, extracting the first memory tag from the first memory tag information and extracting the second memory tag from the second memory tag information may include: obtaining tag width information corresponding to the first memory tag or the second memory tag; extracting a portion of data bits from the first memory tag information to obtain the first memory tag based on the tag width information, and extracting a portion of data bits from the second memory tag information to obtain the second memory tag.

[0061] For example, a tag checking module can obtain tag width information corresponding to either a first memory tag or a second memory tag. Then, it can extract partial data bits from the first memory tag information using this tag width information to obtain the first memory tag, and vice versa. Afterward, it can be determined whether the obtained first and second memory tags match. For example, tag metadata includes tag width information, meaning the tag checking module can obtain the necessary tag width information from the tag metadata. Tag metadata can also include memory granularity information. The tag checking module can not only select tag width / memory granularity but also check for match between tags according to tag checking rules.

[0062] In different examples, the widths of the first and second memory tags used for comparison can be different or the same.

[0063] In at least one example, if the widths of the first and second memory tags used for comparison are defined as different, the system can flexibly define specific matching rules to determine whether two tags with different widths match. For example, defining a pattern inclusion relationship between a longer tag and a shorter tag as a match allows the same longer tag to match multiple shorter tags with different values.

[0064] In at least one instance, if the widths of the first and second memory tags used for comparison are defined as requiring them to be equal, then only the width information of one of the first and second memory tags can be obtained and used as the width information for both the first and second memory tags. Conversely, if the widths of the first and second memory tags are not equal, then the obtained first and second memory tags will be incorrect, leading to a mismatch in subsequent comparisons. Alternatively, in at least one example, the width information of both the first and second memory tags can be obtained simultaneously and compared. If they are not equal, then the processing of the first instruction is terminated directly, and exception handling is initiated, without further checking whether the first and second memory tags match; otherwise, the subsequent processing described above continues.

[0065] The aforementioned "partial data bits" are, for example, predetermined data bits (offsets) starting from a predetermined base address in the memory tag information. This base address may be, for example, the most significant bit, the least significant bit, or a bit in the middle. When a bit in the middle is selected, the direction of the offset needs to be further predetermined.

[0066] In at least one example of this disclosure, the first instruction may be a forward jump instruction, in which the target address of the jump instruction points to a storage location containing the jump target instruction; or, the first instruction may be a storage instruction that writes the target address back to memory included in the preamble of the program calling code, or a load instruction that loads the target address into a register included in the end portion of the program calling code, i.e., the target address is the corresponding address of the stack frame, and the storage location pointed to by the target address contains the return address of the program calling code.

[0067] For example, forward jump instructions include branch instructions or jump instructions; and in this case, the program pipeline also includes an instruction prefetching process, such as the branch prediction process during processor execution. The following explanation uses branch instructions as an example; the case for jump instructions is similar.

[0068] Figure 3A This diagram illustrates the process of checking memory markers during the execution of branch instructions. Figure 3AAs shown, after fetching the current instruction, the memory tag corresponding to the current instruction (i.e., the first memory tag) is obtained; after decoding the current instruction, it is determined whether the current instruction is a branch instruction.

[0069] If the current instruction is a branch instruction (i.e., the first instruction), the target address pointed to by the branch instruction is obtained, and the memory marker of that target address (i.e., the second memory marker) is obtained. A memory marker check is performed to determine if the first and second memory markers match. If they match, the branch instruction is actually executed, the jump target instruction pointed to by the target address is obtained, and the jump target instruction pointed to by the branch is fetched to perform the instruction jump, thus implementing program pipeline control. Alternatively, if instruction prefetching is required, the corresponding jump target instruction is prefetched. Otherwise, exception handling is initiated.

[0070] If the current instruction is not a branch instruction, then the processing flow corresponding to the current instruction will be entered, such as executing the current instruction normally.

[0071] The memory mark check process described above can be performed after the first instruction has been decoded and entered the issue queue. For example, it can be performed before the register corresponding to the target address of the first instruction becomes available (i.e., the first instruction meets the issue conditions), or it can be performed after the register corresponding to the target address of the first instruction becomes available (i.e., the first instruction meets the issue conditions) but before the instruction is issued.

[0072] For example, in the RISC-V instruction set, the main jump instructions are JAL and JALR.

[0073] For example, the instruction format of JAL is JAL rd, offset, where x[rd] = pc + 4; pc += sext(offset). This instruction stores the address of the next instruction (PC + 4) into the rd register as the return address, and then sets the PC (program counter) to the current value plus the offset of sign-extended to obtain the jump address, that is, jumps to execute the instruction stored at that location. Here, sext is an abbreviation for sign-extend, indicating that the immediate value is extended to 32 bits.

[0074] The instruction format of JALR is JALR rd, offset(rs1), where t = pc + 4; pc = (x[rs1] + sext(offset)) & ~1; x[rd] = t. This instruction sets the PC to the value in the rs1 register plus the offset by the sign bit extension, sets the least significant bit of the calculated address to 0 to obtain the jump address, that is, jumps to execute the instruction stored at that location, and writes the original PC + 4 value into the rd register as the return address. If the destination register is not needed, rd can be set to x0.

[0075] For example, in the RISC-V instruction set, the branch instructions mainly include BEQ, BNE, BLT, BLTU, BGE, and BGEU, where:

[0076] · The instruction format of BEQ (branch when equal) is BEQ rs1, rs2, offset, where if (rs1 = rs2), then pc += sext(offset);

[0077] · The instruction format of BNE (branch when not equal) is BNE rs1, rs2, offset, where if (rs1 ≠ rs2), then pc += sext(offset);

[0078] · The instruction format of BLT (branch when less) is BLT rs1, rs2, offset, where if (rs1 < rs2), then pc += sext(offset);

[0079] · The instruction format of BLTU (branch when unsigned less) is BLTU rs1, rs2, offset, where if (rs1 < rs2), then pc += sext(offset);

[0080] · The instruction format of BGE (branch when greater than or equal) is BGE rs1, rs2, offset, where

[0081] if (rs1 ≥ rs2), then pc += sext(offset);

[0082] · The instruction format of BGEU (branch when unsigned greater than or equal) is BGEU rs1, rs2, offset, where if (rs1 ≥ rs2), then pc += sext(offset).

[0083] During the process of calling a function or subroutine, operations such as storing the contents of registers onto the stack (pushing onto the stack) and reading data from the stack into registers (popping from the stack) are involved. These operations are usually fixed. The operations performed at the beginning of a function are called the prologue part, and the operations performed before the function returns are called the epilogue part. For example, the prologue part and the epilogue part in the program call code are usually added by the compiler itself when generating the target code. For example, in the following assembly code involving the X86 instruction set for calling the function functionX, the prologue part includes the first three lines below, and the epilogue part includes the last three lines below:

[0084] push ebp / / Push the register ebp onto the stack

[0085] mov ebp,esp / / Assign the current stack pointer to register ebp

[0086] sub esp,local_size / / Assign a value to the stack top pointer

[0087] …

[0088] mov esp,ebp / / Modify the stack pointer to the value of register ebp

[0089] pop ebp / / Pop register ebp from the stack

[0090] ret / / Return

[0091] In the code above, `pop / push` involves memory read / write operations, the `call` instruction pushes the return address onto the stack, and the `ret` instruction pops the return address from the stack. For example, for such paired memory-register read / write operations targeting addresses, the microinstructions generated after instruction decoding typically include `store` and `load` instructions to implement pushing and popping onto the stack. Different data on the stack, such as the return address, and the corresponding instructions operating on this data, can all be protected using the marking scheme provided in at least one embodiment of this disclosure to prevent unauthorized modification. For example, if there is a stack overflow vulnerability in the function body, causing instructions in the function body to overwrite the return address stored on the stack in the preamble, an exception will occur during unauthorized modification because the markings of the instructions in the function body and the return address on the stack do not match; or in another embodiment, unauthorized modification of instructions in the function body can be allowed, but an exception will occur when the markings are inconsistent during loading of the return address at the end of the function.

[0092] Figure 3B This diagram illustrates the process of checking memory markers during the execution of store or load instructions when a program returns. This process can be used to protect different types of information, such as return addresses, stored on the stack.

[0093] For example, during a program call or return, after fetching the current instruction, the memory marker corresponding to the current instruction (i.e., the first memory marker) is obtained; after decoding the current instruction, it is determined whether the current instruction is a store instruction or load instruction for a function stack frame.

[0094] If the current instruction is a store instruction or a load instruction (i.e., the first instruction), obtain the target address pointed to by the store instruction or load instruction (e.g., the stack address used to store the return address), and obtain the memory tag of the target address (i.e., the second memory tag); perform a memory tag check to determine whether the first memory tag and the second memory tag match. If they match, actually execute the store instruction or load instruction and access the stack (memory); otherwise, enter exception handling.

[0095] If the current instruction is not a store instruction or a load instruction, then the processing flow corresponding to the current instruction will be entered, such as executing the current instruction normally.

[0096] Figure 4 A schematic diagram illustrating a memory tag implementation of program pipeline control using an example of an embodiment of this disclosure is shown.

[0097] For example, in at least one example, obtaining the tag width information corresponding to the first memory tag or the second memory tag includes: obtaining the tag storage location corresponding to the first memory tag information or the second memory tag information; and obtaining tag metadata (including tag width information) based on the tag storage location.

[0098] like Figure 4 As shown, in Figure 2B Based on the example shown, the tag storage location corresponding to the first memory tag information and the tag storage location corresponding to the second memory tag information are obtained. The stored tag metadata can be obtained from the corresponding tag storage location, thereby obtaining the tag width information.

[0099] Similarly, based on the assumption that the widths of the first and second memory tags used for comparison should be equal under normal circumstances, the stored tag metadata (including width information) can be obtained from the selected tag storage location, based on either the tag storage location corresponding to the first or second memory tag information. For example... Figure 4 As shown, the storage location (i.e., L11.Addr) corresponding to the first memory tag information L11 is selected to obtain the stored tag width information. For example... Figure 4 As shown, the tag storage location and the corresponding tag metadata can be stored in the form of a two-dimensional table, similar to a page table.

[0100] Alternatively, in at least one example, based on the tag storage location corresponding to the first memory tag information and the tag storage location corresponding to the second memory tag information, the tag metadata stored in the two tag storage locations, such as tag width information, are obtained respectively. The two tag width information obtained are compared. If the system requires the tag width to match, but the two are not equal, then the subsequent determination of whether the first memory tag and the second memory tag match is no longer made. Instead, the processing of the memory access instruction is directly terminated and the exception handling is entered. Otherwise, the subsequent processing described above continues.

[0101] In at least one example, the tag storage location can be located in a memory page or segment specifically selected for storing memory tag information, or in a memory-independent storage device. For example, this memory-independent storage device could be isolated for a dedicated physical memory isolation region such as a RISC-V PMP or ARM MPU.

[0102] In at least one instance, the marked storage location can be independent of ordinary memory space. Examples include dedicated DRAM devices, SRAM devices, or specific physical partitions of DRAM, specific partitions of cache, etc. In such implementations, dedicated devices can be isolated through dedicated hardware design without requiring the use or definition of memory pages or segments for protection.

[0103] In at least one instance, the transmission path for the tag value can share an existing data path, or it can use a dedicated data path for access, such as using an existing bus to transmit the tag, or using a separate bus signal dedicated to transmitting the tag.

[0104] Figure 5A A schematic diagram illustrating a memory tag implementation of program pipeline control using an example of an embodiment of this disclosure is shown.

[0105] For example, in at least one example, obtaining the tag metadata corresponding to the first memory tag or the second memory tag, such as tag width information, includes: obtaining the tag metadata, such as tag width information, from the redundant bits in the first memory address or the target address of the memory access instruction itself.

[0106] like Figure 5A As shown, in Figure 2B Based on the example shown, the high-order part of the target address itself includes the corresponding memory tag metadata, such as memory tag width information (while the low-order part includes the effective address part of the target address), so the width information of the target tag can be extracted from the target address itself.

[0107] Memory tags assigned to memory addresses can be integrated with the memory address itself. For example, spare bits in the system-defined memory address space can be reused to store the memory tag or memory tag width corresponding to each memory address, pointer, etc. For instance, in a 64-bit processor architecture, the system bit width is 64 bits; however, the virtual address in the system typically does not use all 64 bits. For example, in the RISC-V instruction set, virtual addresses currently typically use three paging modes: sv32, sv39, and sv48. Therefore, in a 64-bit system, under these three paging modes, the lower 32, lower 39, and lower 48 bits of the virtual address record all valid addresses (page table number + page offset). Thus, the system's virtual address contains unused bits in the higher bits (e.g., these unused bits are usually 0), while the lower bits already record all valid address information. Therefore, the spare bits in the higher bits of the virtual address space in a 64-bit architecture can be used to record the memory tag or memory tag width corresponding to that address. In at least one example, when using such address space to store tag-related information, access control permissions are set for accessing the used address space to prevent ordinary programs from reading and writing, which could lead to the leakage or tampering of the tag information.

[0108] Figure 5B An example of a memory address including a memory tag according to at least one embodiment of the present disclosure is shown; such as Figure 5B As shown, a memory address includes a high-order part and a low-order part. For example, for a 64-bit address, if it corresponds to the sv48 paging mode, the high-order part can be selected as the highest 16 bits (i.e., [63:48]), while the remaining low-order part is the lowest 48 bits (i.e., [47:0]). For example, all or part of the high-order part is used to record memory tags or memory tag metadata. For example, 8 bits from the highest 16 bits are selected as memory tag bits, such as [63:56] as memory tag bits to record the corresponding memory tag or memory tag metadata; the low-order part is used to record the effective address, which has a total of 48 bits, corresponding to a theoretical maximum of 2 48 A memory space of bytes.

[0109] Figure 6 A schematic diagram illustrating a memory tag implementation of program pipeline control using an example of an embodiment of this disclosure is shown.

[0110] For example, in at least one example, obtaining tag metadata, such as tag width information, corresponding to the first memory tag or the second memory tag includes: obtaining tag metadata, such as tag width information, from a memory address adjacent to the first memory address or the target address in the memory space.

[0111] like Figure 6 As shown, in Figure 2BBased on the example shown, in the memory space, the target address and the memory tag metadata corresponding to the target address, for example, the memory tag metadata includes tag width information, and the storage addresses of these memory tag metadata are adjacent to each other (for example, the address offset between them can be pre-set to a certain fixed value, thereby facilitating addressing), for example, they fall into adjacent double words or adjacent memory blocks, etc., for example, the storage location corresponding to the target address (for example, as...). Figure 1A and Figure 1B The secure memory subspace shown (second storage location) and the storage location where the tag width information corresponding to the target address is located (e.g., as shown) Figure 1A and Figure 1B The safe memory subspaces shown are adjacent to each other.

[0112] Correspondingly, the storage address of the memory access instruction and the storage address of the tag width information of the memory tag corresponding to the storage address of the memory access instruction are adjacent to each other (for example, the address offset between them can be pre-set to a certain fixed value, thereby facilitating addressing), for example, they fall into adjacent double words or memory blocks, etc., for example, the storage location corresponding to the storage address of the memory access instruction (for example, such as... Figure 1A and Figure 1B The safe memory subspace shown (first storage location) and the storage location of the tag width information corresponding to the storage address of the memory access instruction (e.g., as shown) Figure 1A and Figure 1B The secure memory subspaces shown are adjacent to each other. The size of the storage block can be, for example, 32 words or 64 words.

[0113] For example, in at least one example, obtaining tag metadata, such as tag width information, corresponding to a first memory tag or a second memory tag includes: obtaining the tag metadata (e.g., tag width information) from a first register, wherein the tag metadata is set in the first register by the system. This first register may be the aforementioned security register (SEC register).

[0114] For example, based on the examples described above, such as those mentioned above... Figure 2B , Figure 4 , Figure 5A and Figure 6Based on the example shown, the marker memory granularity (MG) information in the memory space is obtained simultaneously with the marker width information corresponding to the first or second memory marker. For example, the marker width information and the marker memory granularity information are stored together, thus obtaining the marker memory granularity information in the memory space while obtaining the marker width information corresponding to the first or second memory marker. Based on the marker memory granularity information, the size of the marker memory granularity can be determined. Therefore, when it is currently determined that, for example, two target addresses or storage addresses are in the same memory subspace, the memory marker corresponding to the other target address or storage address is also obtained when the memory marker corresponding to one target address or storage address is obtained.

[0115] In at least one embodiment of this disclosure, the first memory tag information further includes first type information indicating that the first memory tag is for an instruction, and the second memory tag information further includes second type information indicating that the second memory tag is for data. For example, the memory tag information includes one bit (type indicator bit) to indicate whether the corresponding memory tag is for data (jump address or return address) or for an instruction. For example, the type indicator bit is 0 when it represents data, and 1 when it represents an instruction. Alternatively, the memory tag information can use multiple bits to represent multiple types, or different types can be set for different functions / programs.

[0116] At least in the above embodiments of this disclosure, comparing a first memory tag and a second memory tag to determine whether the first memory tag and the second memory tag match includes: determining whether the first memory tag and the second memory tag conform to tag checking rules. For example, determining whether the first memory tag and the second memory tag conform to tag checking rules includes: determining whether the first memory tag and the second memory tag are the same; or determining whether the first memory tag and the second memory tag are within the same value range.

[0117] For example, in at least one example, corresponding to the case where the first memory tag and the second memory tag are within the same value range, the high n bits of each of the first and second memory tags are set according to the user settings of the current system, where n is a positive integer. For example, a 3-bit numeric identifier (e.g., a random value) is assigned to each user or process in the system, i.e., n is 3. This 3-bit numeric identifier is used as the high 3 bits of the memory tag, while the low bits of the memory tag (e.g., 5 or more bits) are, for example, values ​​allocated by the system according to the secure memory subspace (e.g., random values). Therefore, the high 3 bits of the memory tag are the same for the tagged memory space allocated to the same user, thereby enabling access control and improving the security of the computer system.

[0118] In embodiments of this disclosure, both the tag width and the tag memory granularity can be configured by the system, for example, at system startup or dynamically during system operation.

[0119] In at least one example, to simplify hardware implementation, the memory granularity and tag width can be combined into one in the implementation. The hardware allows the software to define different memory granularities and tag widths during tag usage. For example, if the minimum memory granularity in the hardware implementation is 4 bytes and the minimum tag width is 2 bits, then the most basic memory / tag bit ratio is 32:2. During compilation and runtime, the software can choose memory granularities ranging from 4 to 12 bytes, and the corresponding tag width can also be chosen (limited by the maximum hardware tag width) from 2 to 6 bits. Alternatively, the memory granularity and tag width can remain at their default values. With the default configuration, the tag memory granularity can be determined first, and then the corresponding tag width can be determined based on the tag memory granularity.

[0120] Figure 7 A schematic diagram illustrating an example of defining a landing point marker / return address marker using variable-length memory markers according to at least one embodiment of the present disclosure.

[0121] In another embodiment of this disclosure, such as Figure 7 As shown in the table on the left, for the landing point `function1_start`, its type (code type) is "1", corresponding to a tag width of 8 bits and a tag value of 0x01; for the landing point `function2_start`, its type is "0", corresponding to a tag width of 4 bits and a tag value of 0x2; for the landing point `bar_start`, its type is "1", corresponding to a tag width of 8 bits and a tag value of 0x13; and for the landing point `foo_start`, its type is "2", corresponding to a tag width of 16 bits and a tag value of 0x0119. Here, `function1`, `function2`, `bar`, and `foo` refer to different functions, and `_start` refers to the address of the entry instruction (landing point) of these functions.

[0122] In another embodiment of this disclosure, such as Figure 7 As shown in the table on the right, for the return address ret-addr-1, its type (tag type) is "0", corresponding to a tag width of 8 bits, and the corresponding tag value is 0x01; ret-addr-1 has a type of "0", corresponding to a tag width of 8 bits, and the corresponding tag value is 0x0A.

[0123] In the embodiments of this disclosure, after the marker width is determined by the code type or the marker type, the value range of different markers is determined. Then, based on the value of different markers, the distinction between different function landing points (i.e. different jump targets) and different function return addresses is achieved.

[0124] In the embodiments of this disclosure, memory marking in the system can be operated by one or more instructions for marking memory. For example, these instructions for marking memory include instructions for generating marks, storing marks, reading marks, assigning marks, memory access instructions, modifying marks, etc. These instructions can be constructed in different instruction sets (ISAs) according to the specifications of the corresponding ISAs, which will not be elaborated here.

[0125] A processing apparatus is provided according to at least one embodiment of the present disclosure. Figure 8 A schematic diagram of the processing device is shown. Figure 8 As shown, the processing device 800 includes a receiving unit 801, a first acquisition unit 802, a second acquisition unit 803, a determining unit 804, and an operation unit 805.

[0126] The receiving unit 801 is configured to receive the first instruction;

[0127] The first acquisition unit 802 is configured to acquire the first memory tag information corresponding to the first instruction, wherein the first memory tag information includes a first memory tag, and the first memory tag corresponds to the first storage location in the memory space of the first storage address storing the first instruction;

[0128] The second acquisition unit 803 is configured to acquire the second memory tag information corresponding to the target address, wherein the second memory tag information includes a second memory tag, the second memory tag corresponds to the second storage location of the target address of the first instruction in the memory space, and the second storage location stores the return address or jump target instruction in the program pipeline;

[0129] The determining unit 804 determines whether the first memory tag and the second memory tag match based on the first memory tag information and the second memory tag information.

[0130] The operation unit 805 responds to the first memory tag and the second memory tag matching by allowing the first instruction to continue execution, or responds to the first memory tag and the second memory tag not matching by entering exception handling.

[0131] For example, in at least one example, in the above-described processing apparatus, the determining unit includes a memory tag extraction subunit and a comparison subunit. The memory tag extraction subunit is configured to extract a first memory tag from first memory tag information and extract a second memory tag from second memory tag information; the comparison subunit is configured to compare the first memory tag and the second memory tag to determine whether the first memory tag and the second memory tag match.

[0132] For example, in at least one example, in the above-described processing apparatus, the memory tag extraction subunit includes a tag checking module and an extraction module. The tag checking module is configured to obtain tag width information corresponding to a first memory tag or a second memory tag; the extraction module is configured to extract a portion of data bits from the first memory tag information to obtain a first memory tag based on the tag width information, and to extract a portion of data bits from the second memory tag information to obtain a second memory tag.

[0133] For example, in at least one example, the tag checking module is further configured to obtain the tag storage location corresponding to the first memory tag information or the second memory tag information, and obtain tag width information based on the tag storage location. For example, the tag storage location is located in a storage page or storage segment in the memory space that is selected specifically for storing memory tag information, or in a storage device independent of the memory space.

[0134] Alternatively, the marker checking module can be further configured to obtain marker width information from the redundant bits in the target address of the first instruction itself.

[0135] Alternatively, the marker checking module can be further configured to obtain marker width information from a memory address adjacent to the first memory address or the target address.

[0136] Alternatively, the marker checking module may be further configured to obtain marker width information from a first register, wherein the marker width information is set in the first register by the system. For example, the first register may be the aforementioned security register (SEQ register).

[0137] In at least one example, the tag checking module is further configured to acquire tag memory granularity information in the memory space simultaneously with acquiring tag width information corresponding to the first memory tag or the second memory tag. For example, the tag width information and tag memory granularity information are stored together. For example, the tag metadata includes tag width information and tag memory granularity information, through which the tag width information and / or tag memory granularity information can be obtained.

[0138] In at least one example, the comparison subunit is further configured to determine whether the first memory tag and the second memory tag are the same, or to determine whether the first memory tag and the second memory tag are within the same value range.

[0139] In at least one embodiment of this disclosure, the basic elements of the tag format definition may include a combination of one or more of the following features: a) tag width; b) whether the tagged memory subspace is code (instructions); c) a specific identifier of the tagged memory subspace. For example, the tag parsing rules are closely bound to the tag format, with a one-to-one correspondence.

[0140] In at least one embodiment of this disclosure, the program can be modified during process creation and loading to mark the code and data in the program with memory tags for controlling the program pipeline. This can be achieved, for example, by extending the compiler and toolchain. Alternatively, through automated program analysis, modification of the application source code can be completely avoided.

[0141] In at least one embodiment of this disclosure, the tags used for program pipeline control can be stored in system memory along with ordinary data. For example, the specific implementation may be a combination of one or more of the following: a) the memory space used for tags has a fixed ratio or a dynamic ratio with the memory space used for ordinary data or instructions; b) the memory space used for tags is stored adjacently or separately from the memory space used for ordinary data or instructions; c) the memory tags and part of the tag parsing logic are stored in the source code or binary program; d) the access to the memory space used for tags is accelerated through caching mechanisms, shadow hardware, etc.; e) the fast access to the memory space used for tags and the memory space used for ordinary data or instructions is accelerated through concurrent design.

[0142] The control method and corresponding processing apparatus for the program pipeline of at least one embodiment of the present disclosure have at least one or more of the following advantages:

[0143] (1) It supports the definition of multiple landing point markers, so that it can distinguish various types of landing points and can support the maximum differentiation of all different function entry points and different branch entry points.

[0144] (2) The width of the marker can be customized and is not limited by the number of empty bits of the pointer. Therefore, a smaller marker can be used when the system requires fewer landing points, while a larger marker can be used to distinguish more code landing points.

[0145] (3) It can realize fine-grained access control of the internal storage of the stack, and parse the memory labels at the byte / word level. It can set different permissions for the space inside the stack for different instructions inside the function, thereby protecting key data such as return address and avoiding memory waste and performance loss caused in a class of methods based on shadow stack.

[0146] Some embodiments of this disclosure also provide a processing apparatus including a processing unit and a memory, wherein one or more computer program modules are stored in the memory; the one or more computer program modules are configured to implement the control method as described in any embodiment of this disclosure when executed by the processing unit.

[0147] Some embodiments of this disclosure also provide a non-transitory readable storage medium, wherein computer instructions are stored on the non-transitory readable storage medium, wherein the computer instructions, when executed by a processor, implement the control method as described in any embodiment of this disclosure.

[0148] For example, the processing unit can be a central processing unit (CPU), a digital signal processor (DSP), or the like. For example, the non-transiently readable storage medium can be implemented as a memory, such as volatile memory and / or non-volatile memory. In the above embodiments, the memory can be volatile memory, for example, it may include random access memory (RAM) and / or cache, etc. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, erasable programmable read-only memory (EPROM), portable compact disc read-only memory (CD-ROM), USB memory, flash memory, etc.

[0149] The memory can also store various applications (code, instructions) and various data, as well as various data used and / or generated by the applications. In some examples, it can also store memory tag information (and memory tags) corresponding to the data or instructions.

[0150] Some embodiments of this disclosure also provide an electronic device that includes the computer device described above, which includes the processing device described above or is capable of executing the memory access method described above.

[0151] Figure 9 This is a schematic block diagram of an electronic device provided for at least one embodiment of the present disclosure. The electronic device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers.

[0152] Figure 9 The illustrated electronic device 1000 is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein. For example, such as Figure 9As shown, in some examples, electronic device 1000 includes a processing unit that may include the processing unit of any of the above embodiments, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1008 into random access memory (RAM) 1003. RAM 1003 also stores various programs and data required for the operation of the computer system. Processor 1001, ROM 1002, and RAM 1003 are connected via bus 1004. Input / output (I / O) interface 1005 is also connected to bus 1004.

[0153] For example, the following components can be connected to I / O interface 1005: input devices 1006 including, for example, touch screens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 1007 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1008 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009, such as network interface cards like LAN cards and modems, etc. Communication device 1009 allows electronic device 1000 to communicate wirelessly or wiredly with other devices to exchange data and perform communication processing via networks such as the Internet. Drive 1010 is also connected to I / O interface 1005 as needed. Removable storage media 1011, such as disks, optical disks, magneto-optical disks, semiconductor memories, etc., are installed on drive 1010 as needed so that computer programs read from them can be installed into storage device 1008 as needed.

[0154] Although Figure 9 An electronic device 1000 including various devices is shown; however, it should be understood that implementation or inclusion of all shown devices is not required. More or fewer devices may be implemented or included alternatively.

[0155] For example, the electronic device 1000 may further include a peripheral interface (not shown in the figure). This peripheral interface can be various types of interfaces, such as a USB interface, a Lightning interface, etc. The communication device 1009 can communicate wirelessly with a network and other devices, such as the Internet, an intranet, and / or a wireless network such as a cellular telephone network, a wireless local area network (LAN), and / or a metropolitan area network (MAN). Wireless communication can use any of a variety of communication standards, protocols, and technologies, including but not limited to Global System for Mobile Communications (GSM), Enhanced Data GSM Environment (EDGE), Wideband Code Division Multiple Access (W-CDMA), Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Bluetooth, Wi-Fi (e.g., based on IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, and / or IEEE 802.11n standards), Voice over Internet Protocol (VoIP), Wi-MAX, protocols for email, instant messaging, and / or Short Message Service (SMS), or any other suitable communication protocol.

[0156] For example, the electronic device 1000 can be any device such as a mobile phone, tablet computer, laptop computer, e-book, game console, television, digital photo frame, navigator, home appliance, communication base station, industrial controller, server, etc., or any combination of data processing device and hardware. The embodiments disclosed herein do not limit this.

[0157] The following points should be noted regarding this disclosure:

[0158] (1) The accompanying drawings of the embodiments of this disclosure only involve the structures involved in the embodiments of this disclosure. Other structures can be referred to the general design.

[0159] (2) Where there is no conflict, the embodiments of this disclosure and the features in the embodiments can be combined with each other to obtain new embodiments.

[0160] The above are merely exemplary embodiments of this disclosure and are not intended to limit the scope of protection of this disclosure, which is determined by the appended claims.

Claims

1. A method for controlling a program pipeline, comprising: Receive the first instruction; Obtain the first memory tag information corresponding to the first instruction, wherein the first memory tag information includes a first memory tag, and the first memory tag corresponds to the first storage location in the memory space where the first storage address of the first instruction is stored; Obtain the second memory tag information corresponding to the target address, wherein the second memory tag information includes a second memory tag, the second memory tag corresponds to the second storage location of the target address of the first instruction in the memory space, and the second storage location stores the return address or jump target instruction in the program pipeline; Based on the first memory tag information and the second memory tag information, determine whether the first memory tag and the second memory tag match; If the first memory tag and the second memory tag match, the first instruction is allowed to continue execution; otherwise, if the first memory tag and the second memory tag do not match, exception handling is initiated.

2. The control method according to claim 1, wherein, Based on the first memory tag information and the second memory tag information, determining whether the first memory tag and the second memory tag match includes: Extract the first memory tag from the first memory tag information and extract the second memory tag from the second memory tag information; The first memory tag and the second memory tag are compared to determine whether the first memory tag and the second memory tag match.

3. The control method according to claim 2, wherein, Extracting the first memory tag from the first memory tag information and extracting the second memory tag from the second memory tag information includes: Obtain the tag width information corresponding to the first memory tag or the second memory tag. Based on the marker width information, a portion of data bits are extracted from the first memory marker information to obtain the first memory marker, and a portion of data bits are extracted from the second memory marker information to obtain the second memory marker.

4. The control method according to claim 3, wherein, Obtaining the tag width information corresponding to the first memory tag or the second memory tag includes: Obtain the storage location of the tag corresponding to the first memory tag information or the second memory tag information; The tag width information is obtained based on the tag storage location.

5. The control method according to claim 3, wherein, Obtaining the tag width information corresponding to the first memory tag or the second memory tag includes: The tag width information is obtained from the redundant bits in the target address itself.

6. The control method according to claim 3, wherein, Obtaining the tag width information corresponding to the first memory tag or the second memory tag includes: The mark width information is obtained from the memory address adjacent to the first storage address or the target address in the memory space.

7. The control method according to claim 3, wherein, Obtaining the tag width information corresponding to the first memory tag or the second memory tag includes: The mark width information is obtained from the first register, wherein the mark width information is set in the first register by the system.

8. The control method according to any one of claims 4-7, wherein, While acquiring the tag width information corresponding to the first memory tag or the second memory tag, the tag memory granularity information in the memory space is also acquired.

9. The control method according to any one of claims 2-7, wherein, Comparing the first memory tag and the second memory tag to determine whether the first memory tag and the second memory tag match includes: Determine whether the first memory tag and the second memory tag conform to the tag checking rules.

10. The control method according to claim 1, wherein, The first instruction is a forward jump instruction, and the target address points to the jump target instruction, or The first instruction is either a storage instruction that writes the target address back to memory included in the preamble of the program calling code, or a load instruction that loads the target address into a register included in the end of the program calling code, wherein the target address points to the return address of the program calling code.

11. The control method according to claim 10, wherein, The forward jump instruction includes a branch instruction or a jump instruction.

12. The control method according to claim 11, wherein, For the forward jump instruction, the program pipeline includes an instruction prefetching process.

13. A processing apparatus, comprising: The receiving unit is configured to receive the first instruction; The first acquisition unit is configured to acquire first memory tag information corresponding to the first instruction, wherein the first memory tag information includes a first memory tag, and the first memory tag corresponds to a first storage location in memory space where the first storage address of the first instruction is stored; The second acquisition unit is configured to acquire second memory tag information corresponding to the target address, wherein the second memory tag information includes a second memory tag, the second memory tag corresponds to a second storage location of the target address of the first instruction in the memory space, and the second storage location stores a return address or jump target instruction in the program pipeline; The determining unit determines whether the first memory tag and the second memory tag match based on the first memory tag information and the second memory tag information; The operation unit, in response to a match between the first memory marker and the second memory marker, allows the first instruction to continue execution, or, in response to a mismatch between the first memory marker and the second memory marker, enters exception handling.

14. The processing apparatus according to claim 13, wherein, The determining unit includes: A memory tag extraction subunit is configured to extract the first memory tag from the first memory tag information and extract the second memory tag from the second memory tag information; The comparison subunit is configured to compare the first memory tag and the second memory tag to determine whether the first memory tag and the second memory tag match.

15. The processing apparatus according to claim 14, wherein, The memory tag extraction subunit includes: The marker checking module is configured to obtain the marker width information corresponding to the first memory marker or the second memory marker. The extraction module is configured to extract a portion of data bits from the first memory tag information to obtain the first memory tag based on the tag width information, and to extract a portion of data bits from the second memory tag information to obtain the second memory tag.

16. A processing apparatus, comprising: Processing unit A memory on which one or more computer program modules are stored; The one or more computer program modules are configured to implement the control method as described in any one of claims 1-12 when executed by the processing unit.

17. A non-transitory readable storage medium, wherein, The non-transiently readable storage medium stores computer instructions, wherein the computer instructions, when executed by a processor, implement the control method as described in any one of claims 1-12.

Images