Data processing method, branch predictor and related equipment

Abstract

The embodiment of the invention provides a data processing method, a branch predictor and related equipment, the method is applied to the branch predictor, prediction data are stored in the branch predictor, and the prediction data comprise prediction data belonging to a host mode and prediction data belonging to a virtual machine mode; the method comprises the following steps: acquiring a data disabling command, wherein the data disabling command is sent out in a mode switching process of a host mode and a virtual machine mode; and based on the data disabling command, disabling prediction data belonging to a virtual machine mode in the branch predictor, and keeping prediction data belonging to a host mode in the branch predictor in an available state. According to the embodiment of the invention, the instruction prediction efficiency can be improved on the premise of ensuring the data security.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of processor technology, and specifically to a data processing method, a branch predictor, and related equipment. Background Art

[0002] In the instruction processing flow of the processor, instructions can be executed based on the processing processes of instruction fetch, decoding, execution and writeback. In order to improve the processing efficiency of instructions, the processor generally uses the instruction pipeline technology to execute the various processing processes of instructions in parallel to improve the processing efficiency of instructions. When processing branch instructions, it is necessary to predict the instruction branches based on the branch prediction mechanism to reduce instruction delay.

[0003] However, in the existing instruction prediction process, the instruction prediction efficiency needs to be improved. Summary of the invention

[0004] In view of this, an embodiment of the present application provides a data processing method, a branch predictor and related devices to improve instruction prediction efficiency.

[0005] To achieve the above objectives, the embodiments of the present application provide the following technical solutions.

[0006] In a first aspect, an embodiment of the present application provides a data processing method, which is applied to a branch predictor, wherein the branch predictor stores prediction data, and the prediction data includes prediction data belonging to a host mode and prediction data belonging to a virtual machine mode; the method includes:

[0007] Acquire a data disabling command, wherein the data disabling command is used to be issued during a mode switching process between a host mode and a virtual machine mode;

[0008] Based on the data disabling command, the prediction data belonging to the virtual machine mode in the branch predictor is disabled, and the prediction data belonging to the host mode in the branch predictor is kept in an available state.

[0009] Optionally, the prediction data includes data recorded in each item of the branch target buffer and / or data recorded in each item of the return address stack buffer.

[0010] Optionally, when the predicted data is data in a branch target buffer, the predicted data includes a mode identifier, and the mode identifier is used to mark the mode to which the predicted data belongs;

[0011] The disabling of the prediction data belonging to the virtual machine mode in the branch predictor and keeping the prediction data belonging to the host mode in the branch predictor in an available state is specifically: invalidating the prediction data in the branch target buffer whose mode is marked as the virtual machine mode, and keeping the prediction data in the branch target buffer whose mode is marked as the host mode in a valid state.

[0012] Optionally, when the predicted data is data in a branch target buffer, the predicted data includes a logical core identifier, and the logical core identifier is used to mark the logical core to which the predicted data belongs; the data disable command includes the logical core identifier of the command issuer, and the invalidation of the predicted data in the branch target buffer whose mode identifier is a virtual machine mode is specifically:

[0013] Invalidate prediction data in the branch target buffer whose mode identifier is the virtual machine mode and whose logical core identifier is the same as the logical core identifier of the logical core where the virtual machine performing mode switching is located.

[0014] Optionally, when the predicted data is data in the return address stack buffer, the predicted data is divided into stack data belonging to the host mode and stack data belonging to the virtual machine mode;

[0015] The disabling of the prediction data belonging to the virtual machine mode in the branch predictor and keeping the prediction data belonging to the host mode in the branch predictor in an available state is specifically: clearing the stack data belonging to the virtual machine mode in the return address stack buffer and retaining the stack data belonging to the host mode in the return address stack buffer.

[0016] Optionally, when the predicted data is data in a return address stack buffer, the predicted data is divided into different stack data based on different logical core identifiers and modes to which they belong; the data disabling command includes the logical core identifier of the command issuer, and the clearing of the stack data belonging to the virtual machine mode in the return address stack buffer is specifically:

[0017] The stack data corresponding to the logical core identifier of the command issuer and belonging to the virtual machine mode in the return address stack buffer is cleared, and the pointer of the virtual machine mode data stack corresponding to the logical core identifier of the command issuer is set to an initial state.

[0018] Optionally, the data processing method further includes:

[0019] In the instruction prediction process of the branch predictor, when the instruction to be predicted is a virtual machine mode, access to prediction data belonging to the virtual machine mode is allowed, and access to prediction data belonging to the host mode is prohibited.

[0020] Optionally, the data processing method further includes:

[0021] In the instruction prediction process of the branch predictor, when the instruction to be predicted is in virtual machine mode, access to prediction data belonging to both virtual machine mode and host mode is allowed; and, for the instruction to be predicted in host mode, access to prediction data belonging to virtual machine mode is prohibited.

[0022] Optionally, after obtaining the data disable command, before disabling the prediction data belonging to the virtual machine mode in the branch predictor based on the data disable command and keeping the prediction data belonging to the host mode in the branch predictor in an available state, the method further includes:

[0023] Determine virtual machine information corresponding to the data disabling command;

[0024] Determine whether the virtual machine information of the virtual machine is consistent with the historical virtual machine information, and if so, prohibit execution of the data disabling command;

[0025] The historical virtual machine information is the virtual machine information of the virtual machine in the previous switching process.

[0026] Optionally, the step of determining whether the virtual machine information of the virtual machine is consistent with the historical virtual machine information further includes:

[0027] If not, execute the step of disabling the prediction data belonging to the virtual machine mode in the branch predictor based on the data disable command, and keeping the prediction data belonging to the host mode in the branch predictor in an available state, and update the historical virtual machine information to the virtual machine information corresponding to the data disable command.

[0028] Optionally, the obtaining data disabling command includes:

[0029] Get the indirect branch prediction barrier IBPB enable command;

[0030] Based on the command information of the IBPB enabling command, determining whether the IBPB enabling command is issued during the mode switching process;

[0031] If so, the IBPB enable command is the data disable command; if not, the IBPB enable command is not the data disable command.

[0032] Optionally, the historical virtual machine information is stored in a switching information storage component, and the switching information storage component is configured in the branch predictor; or, the historical virtual machine information is configured in a microcode.

[0033] In a second aspect, an embodiment of the present invention further provides a data processing method, which is applied to a processor core, and the method includes:

[0034] During the mode switching process between the host mode and the virtual machine mode, a data disable command is issued so that the branch predictor disables the prediction data belonging to the virtual machine mode in the branch predictor based on the data disable command, and keeps the prediction data belonging to the host mode in the branch predictor in an available state; wherein the branch predictor stores prediction data, and the prediction data includes prediction data belonging to the host mode and prediction data belonging to the virtual machine mode.

[0035] Optionally, before issuing the data disable command, the method further includes:

[0036] Determine virtual machine information of the virtual machine of the current switching process;

[0037] Determine whether the virtual machine information of the virtual machine is consistent with the historical virtual machine information, and if so, prohibit issuing the data disabling command;

[0038] The historical virtual machine information is the virtual machine information of the virtual machine in the previous switching process.

[0039] Optionally, the virtual machine information is a virtual machine identifier, and determining the virtual machine information of the virtual machine of the current switching process specifically includes: determining the virtual machine identifier of the current switching process and the address information of the virtual machine control block from the virtual machine control block.

[0040] Optionally, the step of determining whether the virtual machine information of the virtual machine is consistent with the historical virtual machine information further includes:

[0041] If not, the step of issuing the data disabling command is executed, and the historical virtual machine information is updated to the virtual machine information of the virtual machine in the current switching process.

[0042] Optionally, the historical virtual machine information is stored in a switching information storage component, and the switching information storage component is configured in the processor core; or, the historical virtual machine information is configured in a microcode.

[0043] Optionally, issuing the data disabling command is specifically, triggering the data disabling command based on a disabling command identification bit in the virtual machine control block.

[0044] In a third aspect, an embodiment of the present invention further provides a branch predictor, wherein prediction data is stored in the branch predictor, and the prediction data includes prediction data belonging to a host mode and prediction data belonging to a virtual machine mode; the branch predictor includes:

[0045] A command information acquisition logic, used to acquire a data disabling command, wherein the data disabling command is used to be issued during a mode switching process between a host mode and a virtual machine mode;

[0046] The prediction data disabling logic is used to disable the prediction data belonging to the virtual machine mode in the branch predictor based on the data disabling command, and keep the prediction data belonging to the host mode in the branch predictor in an available state.

[0047] In a fourth aspect, an embodiment of the present invention further provides a processor core, the processor core comprising the branch predictor described in the third aspect;

[0048] Furthermore, the branch predictor in the processor core is used to execute the data processing method described in the first aspect, and / or the processor core is used to execute the data processing method described in the second aspect.

[0049] Optionally, the virtual machine control block configured in the processor core includes a disable command flag bit, and the disable command flag bit is used to trigger the data disable command.

[0050] In a fifth aspect, an embodiment of the present invention further provides a chip, comprising the processor core as described in the fourth aspect.

[0051] In a sixth aspect, an embodiment of the present invention further provides an electronic device, comprising the chip as described in the fifth aspect.

[0052] In the seventh aspect, an embodiment of the present invention further provides a computer program product, comprising one or more computer executable instructions, which, when executed, implement the data processing method as described in the first aspect, and / or implement the data processing method as described in the second aspect.

[0053] The data processing method, branch predictor and related equipment provided by the embodiment of the present invention are applied to the branch predictor, wherein the branch predictor stores prediction data, and the prediction data includes prediction data belonging to the host mode and prediction data belonging to the virtual machine mode; the method comprises: obtaining a data disable command, wherein the data disable command is used to be issued during the mode switching process between the host mode and the virtual machine mode; based on the data disable command, disabling the prediction data belonging to the virtual machine mode in the branch predictor, and keeping the prediction data belonging to the host mode in the branch predictor in an available state.

[0054] It can be seen that the data processing scheme described in the embodiment of the present invention, by distinguishing the mode to which the prediction data belongs in the prediction data, disables the prediction data belonging to the virtual machine mode in the branch predictor based on the data disable command when the data disable command is obtained, and keeps the prediction data belonging to the host mode in the branch predictor in an available state. Among them, by disabling the prediction data belonging to the virtual machine mode in the branch predictor, attacks that may be launched by the data trained by the virtual machine are avoided, thereby ensuring the data security of the virtual machine; by keeping the prediction data belonging to the host mode in the branch predictor in an available state, the prediction efficiency of the instruction is improved. Therefore, the embodiment of the present invention can improve the instruction prediction efficiency under the premise of ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0056] Figure 1 An alternative flow diagram for branch instruction prediction.

[0057] Figure 2 An alternative architectural diagram of a computing device.

[0058] Figure 3 An alternative architectural diagram of another computing device.

[0059] Figure 4 A schematic diagram of a predictive controlled process.

[0060] Figure 5 A schematic diagram of an optional structure of a BTB item.

[0061] Figure 6 A schematic diagram of an optional structure of an RSB data stack.

[0062] Figure 7 An optional flowchart diagram of a data processing method provided by an embodiment of the present invention.

[0063] Figure 8 A schematic diagram of an optional structure of a BTB item provided in an embodiment of the present invention.

[0064] Fig. 9 A schematic diagram of an optional structure of an RSB item provided in an embodiment of the present invention.

[0065] Fig.10 A schematic diagram of data access permission provided by an embodiment of the present invention.

[0066] Fig.11 An optional flow chart of another data processing method provided by an embodiment of the present invention.

[0067] Fig.12 An optional flow chart of another data processing method provided by an embodiment of the present invention.

[0068] Fig.13 An optional structural diagram of a branch predictor provided by an embodiment of the present invention.

[0069] Fig.14 An optional structural diagram of another branch predictor provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0070] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0071] In a general instruction processing flow, instructions usually need to go through the processes of instruction fetching, decoding, execution, and write-back in sequence. Among them, in order to improve the processing efficiency of instructions, the processor generally uses the instruction pipeline technology to implement instruction processing to improve the processing efficiency of instructions. In this technology, different processing processes are configured with different hardware modules. In the pipeline operation of the processor, multiple instructions in different processing processes can be processed and circulated in the corresponding hardware modules in sequence, thereby improving the processing efficiency of instructions.

[0072] However, when processing branch instructions (a type of instruction), it is necessary to use a branch prediction mechanism to reduce instruction latency. It is understandable that a branch instruction is an instruction that can change the direction of the program flow. In a specific program flow, a branch instruction can execute different instruction sequences (i.e., enter different branch flows) based on different instruction results. Figure 1 The figure shows an optional flow diagram of branch instruction prediction, in which branch instruction N needs to enter different branch processes, namely branch N1 and branch N2, based on the result of instruction M. At this time, if the instruction is executed according to normal logic, branch instruction N needs to wait for the result of instruction M, such as result M1 or result M2. However, in the pipeline operation of the processor, multiple instructions at different processing stages are processed simultaneously in different hardware logics, and the delay of one instruction will block the processing of multiple other instructions on the subsequent pipeline, thereby causing pipeline delay.

[0073] In order to reduce the pipeline delay caused by the processor waiting for the instruction result of the branch instruction to determine the next instruction fetch, the branch prediction mechanism of the instruction can be used to predict which instruction to execute next (such as Figure 1 The branch Ni shown, where i can be 1 or 2), reduces the waiting time of the processor when executing the branch instruction.

[0074] Specifically, the branch prediction of the instruction can be performed based on the branch predictor. The branch predictor may include a branch target buffer (BTB) and a return stack buffer (RSB), which are two different hardware structures used for branch prediction in the processor. The BTB is mainly used to predict the target address of the branch instruction jump based on historical jump information, while the RSB is used to predict the return address of the calling function based on historical call information.

[0075] refer to Figure 2 and Figure 3 An alternative architecture diagram of a computing device is shown, wherein: Figure 2 is an optional architecture diagram of a computing device, Figure 3 FIG. 1 is an alternative architecture diagram of another computing device; the computing device includes a processor core (i.e., a hardware physical core) and a branch predictor configured in the processor core. Figure 2 and Figure 3 In the example, a processor core can provide multiple logical cores (see logical core 0 and logical core 1 in the figure) for software use by sharing some physical devices to improve the utilization rate of physical devices. The logical cores appear as the same hardware resources as the processor cores at the software level, so they can be regarded as processor cores at the software level.

[0076] At the same time, the logical core can also configure a virtual machine manager in software form, and virtualize multiple virtual machines (see VM1 and VM2 in the figure) through virtualization technology. The virtual machine manager can manage the allocation of computing resources of the logical core or processor core. Among them, the computing resources allocated to a virtual machine can also be configured as one or more virtual cores (VCPU, Virtual CPU), so that the virtual machine processes instructions based on its allocated virtual core.

[0077] However, during the operation of the virtual machine system, branch predictor resources (including BTB and RSB) configured in the processor core are shared by the virtual machines running in the processor core, thereby bringing security risks to the data security of the virtual machines.

[0078] Among them, reference Figure 2 and Figure 3 ,in, Figure 2In the illustrated architecture, virtual machines VM1, VM2, virtual machine manager, and VCPUs in virtual machines running on the same logical core are used as different security domains, based on virtualization technology and process domain isolation (such as VCPU isolation), or, Figure 3 In the illustrated architecture, virtual machines VM1, VM2, and VCPUs within virtual machines running on different logical cores are treated as different security domains and are isolated based on logical cores, virtualization technology, and process domains.

[0079] However, these security domains can be breached by speculative execution vulnerabilities. For example, in the Spectre Variant 2 vulnerability, an attacker (such as Figure 2 A virtual machine on the same logical core in , or, Figure 3 In the Spectre-RSB vulnerability, attackers can control the return address stored in the RSB through training, guide the victim to speculatively execute certain malicious code when executing the RET instruction, and use the cache side channel technology similar to Spectre Variant2 to extract confidential data.

[0080] Take Spectre Vulnerability Variant 2 as an example, refer to Figure 4 As shown in the schematic diagram of the predictive controlled flow, the attacker can use the branch instruction at the PC1 address to train a BTB entry in the attacker's address space. For example, the attacker can control the branch instruction at PC1 to jump to a target address PC4, so that the target address corresponding to the branch instruction stored in the BTB entry is the victim address PC4 that meets the attacker's intention. The attacker can control the address information of the branch instruction of PC1 recorded in the entry to be equal to the address information of the branch instruction at the victim PC2.

[0081] When the victim executes the branch instruction at PC2, since the address information of the branch instruction at PC2 collides with the address information of the branch instruction at PC1 of the attacker, the branch predictor will index the branch instruction at PC2 to the BTBentry trained by the attacker. At this time, the original branch instruction at PC2 of the victim is architecturally jumping to the instruction at PC3, but based on the prediction information of this record in the BTB, the target address PC4 is predicted, and the instruction at PC4 will be used as the target instruction based on the prediction, thereby executing the instruction at the malicious branch PC4 trained by the attacker. Afterwards, the instruction at PC4 executed based on the prediction will access confidential information and leave traces in the cache, which can be recovered by side channel technology, resulting in the leakage of confidential information.

[0082] It can be seen that attacks using speculative execution vulnerabilities can break through multiple security domain isolations, resulting in data leakage.

[0083] In some security technologies, the predicted data in the branch predictor (i.e., the data in the BTB and RSB) can be isolated based on privilege level, logical core and other information. Therefore, when access to the data in the BTB and RSB is performed, it can be determined based on the corresponding isolation mechanism whether the data to be accessed is credible, thereby determining whether to access the data, and promptly disabling (for example, clearing or invalidating) the historical data retained in the BTB and RSB, thereby achieving effective isolation of the security domain and effective protection against vulnerabilities.

[0084] refer to Figure 5 An optional structural diagram of a BTB item is shown, wherein the BTB includes multiple items (entries), wherein in addition to recording the target address used for prediction, the identification information (also referred to as a tag) of the historical branch instruction for obtaining the target address may also be recorded, wherein the identification information may include, for example, a logical core identification, a privilege identification, a valid identification, etc. Among them, the data recorded in each BTB item (also referred to as BTB data) is the corresponding prediction data, and accordingly, the identification information is used to indicate the identification category to which the prediction data belongs, for example, the logical core identification is used to indicate the logical core to which the prediction data belongs, the privilege identification is used to indicate the privilege category to which the prediction data belongs (for example, whether it is a privileged level), and the valid identification is used to indicate whether the prediction data is valid (when marked as invalid, the prediction data is no longer accessed and is allowed to be overwritten by new prediction data, and accordingly, marking the prediction data as invalid can be understood as the prediction data being disabled).

[0085] Similarly, reference Figure 6An optional structural diagram of an RSB data stack is shown, where RSB is usually a stack structure, wherein multiple return addresses can be pushed into the stack in sequence, and the return addresses are popped out of the corresponding return addresses in sequence based on the corresponding stacking order and the first-in-last-out mechanism, and at the same time, the stack is also configured with a call pointer (Call Ptr) and a return pointer (RetnPtr), wherein the call pointer is used to point to the entry that is about to store the return address (i.e., the empty entry adjacent to the latest storage return address entry), and the return pointer is used to point to the entry that is about to take out the return address (i.e., the entry that stores the return address adjacent to the empty entry). Wherein, for different logical cores, a corresponding data stack can be configured, with the data in the stack (hereinafter referred to as stack data) as the corresponding prediction data. That is to say, in the return address stack buffer, the prediction data can be divided into different stack data based on different logical core identifiers.

[0086] When accessing the predicted data, it is possible to determine whether the data to be accessed is credible based on a preset mechanism, thereby determining whether to access the data. For example, when accessing BTB data, if the predicted data whose identified logical core is the same as the instruction to be predicted and whose identified privilege level is the same as the instruction to be predicted is considered credible, the instruction to be predicted may be allowed to access the predicted data marked with the same logical core and the same privilege level.

[0087] At the same time, when a security domain change occurs, the prediction data (such as the data in the BTB and RSB) is disabled (such as cleared or invalidated) to prevent the prediction data such as the data in the BTB and RSB from speculatively guiding the victim to execute malicious code. In order to achieve HOST / GUEST domain isolation, when the virtual machine switches between Host (host) and Guest (virtual machine) modes (such as when the virtual machine executes the automatic start VMRUN / automatic exit VMEXIT command), the prediction data corresponding to the logical core where the virtual machine is located can be disabled to achieve the purpose of preventing vulnerabilities.

[0088] However, the inventor believes that the instruction processing efficiency under the above-mentioned hardware defense mechanism needs to be improved. After analysis, it is believed that the main reason is that in the process of clearing prediction data of the above-mentioned hardware defense mechanism, all data will be disabled indiscriminately. However, in the above-mentioned prediction data, in addition to the prediction data in the virtual machine mode, there is also prediction data in the host mode. In the process for the purpose of disabling the prediction data of the virtual machine, indiscriminately disabling all prediction data will obviously lead to the loss of prediction data in the host mode, thereby reducing the instruction processing efficiency in the host mode.

[0089] The inventor considers that an attempt can be made to distinguish instructions of different modes, and disable data based on the mode to which the prediction data belongs, thereby keeping the prediction data that does not need to be cleared available, thereby improving the processing efficiency of instructions.

[0090] In view of this, an embodiment of the present invention provides a data processing method, a branch predictor and related equipment, wherein the data processing method is applied to a branch predictor, wherein prediction data is stored in the branch predictor, and the prediction data includes prediction data belonging to a host mode and prediction data belonging to a virtual machine mode; the method comprises: obtaining a data disable command, wherein the data disable command is used to be issued during a mode switching process between a host mode and a virtual machine mode; based on the data disable command, disabling the prediction data belonging to the virtual machine mode in the branch predictor, and keeping the prediction data belonging to the host mode in the branch predictor in an available state.

[0091] It can be seen that the data processing scheme described in the embodiment of the present invention, by distinguishing the mode to which the prediction data belongs in the prediction data, disables the prediction data belonging to the virtual machine mode in the branch predictor based on the data disable command when the data disable command is obtained, and keeps the prediction data belonging to the host mode in the branch predictor in an available state. Among them, by disabling the prediction data belonging to the virtual machine mode in the branch predictor, attacks that may be launched by the data trained by the virtual machine are avoided, thereby ensuring the data security of the virtual machine; by keeping the prediction data belonging to the host mode in the branch predictor in an available state, the prediction efficiency of the instruction is improved. Therefore, the embodiment of the present invention can improve the instruction prediction efficiency under the premise of ensuring data security.

[0092] The following is a detailed introduction to the data processing solution provided by the embodiment of the present invention.

[0093] Figure 7 This is an optional flow chart of a data processing method provided by an embodiment of the present invention. The architecture of the computing device used in the data processing method can refer to Figure 2 and Figure 3 ,refer to Figure 7 , the data processing method comprises:

[0094] Step S100: the processor core issues a data disable command, wherein the data disable command is issued during a mode switching process between a host mode and a virtual machine mode;

[0095] The data disable command may be a microcode instruction executed by hardware, for example, an IBPB (Indirect Branch Prediction Barrier) enable command. The data disable command may be triggered and issued by the processor core when the host mode is switched to the virtual machine mode (i.e., the automatic start VMRUN instruction is executed), or may be triggered and issued by the processor core when the virtual machine is switched to the host mode (i.e., the automatic exit VMEXIT instruction is executed). Alternatively, in other examples, the corresponding data disable command may also be sent based on software, for example, code may be inserted into the entry function or process scheduling function during mode switching to send the data disable command.

[0096] Among them, when the host mode is switched to the virtual machine mode (i.e., the automatic start VMRUN instruction is executed), the data disable command can be issued by the host running on the processor core. For example, the code can be inserted at a fixed position where the host mode enters the virtual machine mode, so that the data disable command is issued by the host, but when the host is considered to be untrustworthy, the data disable command should be avoided from being issued by the host. Alternatively, in some examples, when the host mode is switched to the virtual machine mode (i.e., the automatic start VMRUN instruction is executed), the data disable command is issued by the processor core, for example, a disable command identification bit is added to the virtual machine control block (VMCB, Virtual Machine Control Block), and based on the disable command identification bit, the data disable command is triggered, thereby realizing the issuance of the data disable command.

[0097] In a specific example, the data disable command may include an identity identifier of a virtual machine performing a mode switch, such as a virtual machine identifier / host identifier, to indicate the subject or identity of the command issuer, or a logical core identifier of a logical core where the virtual machine performing a mode switch is located, to indicate the logical core where the virtual machine performing a mode switch is located.

[0098] It should be noted that in scenarios with higher security requirements, such as virtual machines with specific security mechanisms (hereinafter referred to as secure virtual machines), the host is in an untrusted state by default, and the corresponding data disable command can be issued by the processor core when the host mode is switched to the virtual machine mode.

[0099] In an optional example, when the data disable command is an IBPB enable command, the corresponding timing should be issued during the mode switching process between the host mode and the virtual machine mode. Accordingly, in this step, it is necessary to confirm whether the IBPB enable command is issued during the mode switching process to determine whether the IBPB enable command is the data disable command issued during the mode switching process between the host mode and the virtual machine mode as described in an embodiment of the present invention.

[0100] Specifically, the specific process of this step can be: obtain the IBPB enable command; based on the command information of the IBPB enable command, determine whether the enable command is issued during the mode switching process, if so, the IBPB enable command is the data disable command, and execute subsequent steps to disable the prediction data belonging to the virtual machine mode in the branch predictor, and keep the prediction data belonging to the host mode in the branch predictor in an available state; if not, the IBPB enable command is not the data disable command, and executes the corresponding IBPB command based on the normal process to disable all prediction data corresponding to the IBPB command in the branch predictor.

[0101] Accordingly, the branch predictor may obtain the data disable command issued by the processor core.

[0102] Step S110: the branch predictor disables the prediction data belonging to the virtual machine mode in the branch predictor based on the data disable command, and keeps the prediction data belonging to the host mode in the branch predictor in an available state.

[0103] It can be understood that after obtaining the data disable command, the branch predictor can execute the task of disabling the predicted data in the branch predictor based on the data disable command.

[0104] The predicted data may include BTB data and / or RSB data. In combination with the above, it can be seen that the BTB is mainly used to predict the target address of the branch instruction jump based on historical jump information, while the RSB is used to predict the return address of the calling function based on historical call information; accordingly, the BTB data is the data recorded in each item of the BTB, and the RSB data is the data recorded in each item of the RSB.

[0105] In an embodiment of the present invention, the prediction data is distinguished based on the mode to which it corresponds. For example, the prediction data may include prediction data belonging to a virtual machine mode and prediction data belonging to a host mode. When the prediction data is data in a branch target buffer, the prediction data may include a mode identifier, and the mode identifier is used to mark the mode to which the prediction data belongs; and when the prediction data is data in a return address stack buffer, the prediction data may be divided into stack data belonging to a host mode and stack data belonging to a virtual machine mode. It can be understood that by distinguishing prediction data belonging to different modes, prediction data with security risks can be deleted in a targeted manner.

[0106] refer to Figure 8An optional structural diagram of a BTB item is shown, wherein the BTB includes multiple entries, wherein the entry records a target address for prediction, and a mode identifier corresponding to the item, wherein the mode identifier is used to mark the mode to which the historical branch instruction that obtained the target address belongs. Among them, the mode identifier can be understood as a type of identification information, and in an optional example, the identification information in the item can further include one or more of a logical core identifier, a privilege identifier, and a valid identifier. Among them, the logical core identifier is used to indicate the logical core to which the historical branch instruction that obtained the target address belongs, the privilege identifier is used to indicate the privilege category (for example, whether it is a privileged level) corresponding to the historical branch instruction that obtained the target address, and the valid identifier is used to indicate whether the predicted data in the item is valid.

[0107] Similarly, reference Fig. 9 The figure shows an optional structure diagram of an RSB item. RSB is usually a stack structure. Based on different modes, the data in the RSB can be configured with corresponding data stacks, such as a host mode data stack and a virtual machine mode data stack. The data in the stack (hereinafter referred to as stack data) is the corresponding predicted data. Multiple return addresses can be pushed into the stack in sequence, and a return address can also be recorded in an entry as a predicted return address. For different modes, the corresponding stack pointer is also different. Fig. 9 For example, the call pointer in the host mode data stack is Call Ptr1, the return pointer is Retn Ptr1, the call pointer in the virtual machine mode data stack is Call Ptr2, and the return pointer is RetnPtr2, so that the stack data of different modes can be pointed to based on the corresponding stack pointer.

[0108] In an optional example, given that the predicted data in the host mode is usually system management data, the instructions to be predicted in the virtual machine mode are allowed to access the predicted data with access modes identified as both the virtual machine mode and the host mode; at the same time, to ensure data security, the instructions to be predicted in the host mode are prohibited from accessing the predicted data with access modes identified as the virtual machine mode.

[0109] In scenarios with higher security requirements, such as running secure virtual machines, the host is assumed to be untrusted by default, and the corresponding predicted instructions are not allowed to access the predicted data whose mode is marked as host mode. Fig.10 A schematic diagram of data access rights is shown. In the instruction prediction process of the branch predictor, when the instruction to be predicted is in virtual machine mode, access to prediction data with a mode identification as virtual machine mode is allowed, and access to prediction data with a mode identification as host mode is prohibited. That is to say, the virtual machine only accesses prediction data with a mode identification as virtual machine mode, and the host only accesses prediction data with a mode identification as host mode.

[0110] Among them, when the prediction data in the branch predictor is divided based on the mode, by disabling the prediction data belonging to the virtual machine mode in the branch predictor and keeping the prediction data belonging to the host mode in the branch predictor in an available state, it is possible to avoid attacks that may be launched by the data trained by the virtual machine and ensure the data security of the device. By retaining the prediction data marked as the host mode, the host mode can still use its corresponding prediction data, thereby improving the prediction efficiency of instructions.

[0111] In an optional example, if the data disable command is an IBPB enable command, accordingly, when the predicted data is data in a branch target buffer, the corresponding IBPB command disables the predicted data by configuring the valid flag in the predicted data to invalid. Accordingly, when it is determined that the enable command is issued during the mode switching process, the IBPB command is started to configure the predicted data with a mode identifier of a virtual machine mode to invalid, and at the same time, the configuration operation of the predicted data with a mode mark of a host mode in the branch predictor is ignored.

[0112] When the predicted data is data in the return address stack buffer, the corresponding IBPB command can disable the predicted data by clearing the data in the data stack and setting the pointer of the data stack to the initial state. Correspondingly, when it is determined that the enable command is issued during the mode switching process, the IBPB command is started to clear the data in the virtual machine mode data stack and set the pointer of the virtual machine mode data stack to the initial state. At the same time, the corresponding operations of the host mode data stack in the return address stack buffer are ignored.

[0113] In a specific example, the prediction data targeted by the IBPB command includes both BTB data and RSB data, thereby disabling the corresponding prediction data as a whole and ensuring the security defense effect of the present solution.

[0114] In a further example, the prediction data in the branch predictor is isolated based on the logical core, that is, the prediction data is distinguished based on the logical core identifier. At the same time, the instruction to be predicted is configured with a logical core identifier to indicate the logical core where the instruction issuer is located. During the branch prediction process, the prediction data in the branch predictor only allows access to the instruction to be predicted with the same logical core identifier, and does not allow access to the instruction to be predicted with different logical core identifiers, thereby reducing possible security risks.

[0115] It is understandable that in a scenario where prediction data is isolated based on logical cores, the clearing of prediction data in an embodiment of the present invention may also be subdivided based on logical cores, thereby clearing as little prediction data as possible and improving instruction prediction efficiency.

[0116] In the scenario based on logical core isolation, the predicted data is only allowed to be accessed by the instructions to be predicted with the same logical core identifier, and is not allowed to be accessed by the instructions to be predicted with different logical core identifiers, so that the predicted data will not pose a security threat to the instructions to be predicted with different logical core identifiers. Accordingly, in the process of disabling the predicted data, it is not necessary to disable the predicted data with different logical core identifiers from the command issuer.

[0117] The prediction data can distinguish the logical core to which the prediction data belongs. It can be understood that in the BTB, the logical cores can be distinguished based on the logical core identifier, and the logical core identifier is used to indicate the logical core to which the historical branch instruction that obtained the target address belongs. In the RSB, the logical cores can be distinguished based on different data stacks, wherein different logical cores correspond to different data stacks.

[0118] At the same time, when the data disabling command includes the logical core identifier of the logical core where the virtual machine performing the mode switch is located, for the data in the BTB, in step S110 described in the embodiment of the present invention, the prediction data belonging to the virtual machine mode in the disabled branch predictor is specifically, the mode identifier is the virtual machine mode, and the logical core identifier is the same as the logical core identifier of the logical core where the virtual machine performing the mode switch is located.

[0119] In an optional example, if the data disabling command is an IBPB enable command, correspondingly, in the branch target buffer, the IBPB command configures the valid identifier in the predicted data to be invalid to achieve the disabling of the predicted data. Specifically, after obtaining the IBPB enable command, based on the command information of the enable command, the logical core identifier of the command issuer of the enable command is determined, and it is determined whether the enable command is issued during the mode switching process. If so, the IBPB command is started to invalidate the predicted data in the branch target buffer whose mode identifier is the virtual machine mode and whose logical core identifier is the same as the logical core identifier of the logical core where the virtual machine performing the mode switching is located. At the same time, the disabling operation of the predicted data in the branch target buffer whose mode is marked as the host mode is ignored. If not, the IBPB command can be started to invalidate the predicted data in the branch target buffer whose logical core identifier is the same as the logical core identifier of the logical core where the command issuer is located.

[0120] In a further optional example, if the data disable command is an IBPB enable command, correspondingly, in the return address stack buffer, the IBPB command clears the data in the data stack and sets the pointer of the data stack to the initial state to achieve the disablement of the predicted data. Specifically, after obtaining the IBPB enable command, based on the command information of the enable command, the logical core identifier of the command issuer of the enable command is determined, and it is determined whether the enable command is issued during the mode switching process. If so, the IBPB command is started to clear the stack data corresponding to the logical core identifier of the command issuer and belonging to the virtual machine mode in the return address stack buffer, and set the pointer of the virtual machine mode data stack corresponding to the logical core identifier of the command issuer to the initial state. At the same time, the disablement operation of other predicted data in the return address stack buffer is ignored. If not, the IBPB command can be started to clear the stack data corresponding to the logical core identifier of the command issuer in the return address stack buffer, and set the pointer of the data stack under the logical core identifier to the initial state.

[0121] In a specific example, the prediction data targeted by the IBPB command includes both BTB data and RSB data, thereby disabling the corresponding prediction data as a whole and ensuring the security defense effect of the present solution.

[0122] It can be seen that the embodiment of the present invention distinguishes the mode to which the prediction data belongs in the prediction data, so that when a data disable command is obtained, based on the data disable command, the prediction data belonging to the virtual machine mode in the branch predictor is disabled, and the prediction data belonging to the host mode in the branch predictor is kept in an available state. Among them, by disabling the prediction data belonging to the virtual machine mode in the branch predictor, attacks that may be launched by the data trained by the virtual machine are avoided, thereby ensuring the data security of the virtual machine; by keeping the prediction data belonging to the host mode in the branch predictor in an available state, the prediction efficiency of the instruction is improved. Therefore, the embodiment of the present invention can improve the instruction prediction efficiency under the premise of ensuring data security.

[0123] In a further example, consider some scenarios where a virtual machine is continuously running on a logical core without running other virtual machines. In this case, the prediction data in the corresponding virtual machine mode can be understood as not being contaminated by other virtual machines, so the prediction data can be considered safe and usable. In this case, retaining the corresponding prediction data can further improve the instruction prediction efficiency while ensuring data security.

[0124] Accordingly, in an optional implementation, it is possible to determine whether the prediction data is retained based on historical information of mode switching. In a specific example, the historical information may be historical virtual machine information, which is virtual machine information of a virtual machine in a previous switching process. The historical virtual machine information is stored in a switching information storage component, which may be configured in a processor core, configured in a branch predictor, or the historical virtual machine information is configured in a microcode.

[0125] Specifically, refer to Fig.11 Another optional flow chart of a data processing method shown in FIG. 1 may further include between step S100 and step S110:

[0126] Step S200: The branch predictor determines the virtual machine information corresponding to the data disable command;

[0127] The virtual machine information corresponding to the data disabling command is information corresponding to the virtual machine in the switching process, which may be identity information, such as a virtual machine identifier, or information used to reflect the virtual core of the virtual machine, such as virtual machine control block address information (one virtual core corresponds to one virtual machine control block address, wherein the virtual machine control block address information may be a physical address of the virtual machine control block). By determining the virtual machine information, it is determined whether the virtual machine in the current switching process is the virtual machine of the previous switching process.

[0128] The data disabling command may carry virtual machine information, or, based on the source of the data disabling command, the virtual machine information corresponding to the data disabling command may be determined. In a specific example, the data disabling command may carry corresponding virtual machine information, so that the corresponding virtual machine information may be extracted based on the data disabling command.

[0129] Step S210: the branch predictor determines whether the virtual machine information of the virtual machine is consistent with the historical virtual machine information;

[0130] Among them, the historical virtual machine information is the virtual machine information of the virtual machine in the previous switching process, so that the source of the existing prediction data can be judged, and it can be determined whether the existing prediction data is obtained based on a continuously running virtual machine (that is, both the virtual machine of the current switching process and the virtual machine of the previous switching process), so that it can be judged whether the existing prediction data is credible data.

[0131] It should be noted that when the virtual machine information is the virtual machine control block address information, the judgment of step S210 can not only determine whether the existing prediction data is obtained based on the continuously running virtual machine, but also determine whether the existing prediction data is obtained based on the virtual core of the continuously running virtual machine (that is, both the virtual core of the virtual machine of the current switching process and the virtual core of the virtual machine of the previous switching process), thereby determining whether the existing prediction data is credible data.

[0132] It should be noted that, based on the execution of the judgment process for each switching process, the historical virtual machine information only needs to record the historical virtual machine information of the previous switching process to achieve the retention of the data of the continuously running virtual machine, that is, in each switch, it can be confirmed that the virtual machine of the switching process is the virtual machine in the previous switching process, thereby continuously maintaining the corresponding prediction data.

[0133] In the judgment process, if the judgment result is yes, step S220 is executed, so that the corresponding prediction data is no longer cleared; if not, step S110 is executed to disable the prediction data belonging to the virtual machine mode in the branch predictor, and keep the prediction data belonging to the host mode in the branch predictor in an available state, and execute step S230 to update the virtual machine information.

[0134] Step S220: the branch predictor prohibits execution of the data disable command;

[0135] It can be understood that based on the historical information of mode switching, it is determined whether the virtual machine at the time of the last mode switch is the current virtual machine. If so, it indicates that during the period from the last mode switch to the current mode switch, the prediction data under the virtual machine mode stored in the branch predictor is based on the current virtual machine. Accordingly, the prediction data can be understood as safe data and does not need to be cleared, thereby prohibiting the execution of the data disabling command.

[0136] Step S230: the branch predictor updates the historical virtual machine information to the virtual machine information corresponding to the data disable command.

[0137] After executing or prohibiting the execution of the data disabling command, the corresponding virtual machine information is updated to mark the source basis of the predicted data (i.e., based on which virtual machine or virtual core it is obtained), providing an information comparison basis for the subsequent switching process.

[0138] It can be seen that in the embodiment of the present invention, based on a scenario in which a virtual machine is continuously running on a logical core while no other virtual machines are running, it is determined whether the virtual machine information of the virtual machine is consistent with the historical virtual machine information to determine whether the predicted data in the corresponding virtual machine mode is data that is not contaminated by other virtual machines. In this way, when the predicted data is not contaminated, the corresponding predicted data can be retained, thereby further improving the instruction prediction efficiency while ensuring data security.

[0139] In a further example, historical virtual machine information may be judged before a data disable command is issued, so that when it is shown that the predicted data is not contaminated by other virtual machines, the data disable command is prohibited from being sent, thereby retaining the uncontaminated predicted data.

[0140] Specifically, a switching information storage component may be configured for the logic core, and the historical virtual machine information may be stored in the switching information storage component; or, in other examples, the historical virtual machine information may also be configured in the microcode. Accordingly, when the virtual machine is automatically started, it may be determined whether to issue a data disable command based on the historical virtual machine information.

[0141] Accordingly, reference Fig.12 The optional flow chart of another data processing method shown in the figure further includes:

[0142] Step S300: the processor core determines the virtual machine information of the virtual machine of the current switching process;

[0143] Wherein, when the virtual machine information includes a virtual machine identifier, the virtual machine of the current switching process can be determined based on the virtual machine control block configured in the processor core. When the virtual machine information includes virtual machine control block address information, it can be directly determined based on the virtual core configuration information of the virtual machine.

[0144] It can be understood that the virtual machine control block is a core component in virtualization technology, which is used to manage the state and configuration of the virtual machine, wherein a virtual machine control block corresponds to a virtual core of the virtual machine running in the processor core. The virtual machine control block can store the control information, state information of the virtual machine, and processing information when the virtual machine automatically exits and automatically starts. Therefore, when the virtual machine automatically exits or automatically starts, the virtual machine information of the virtual machine of the current switching process can be determined based on the virtual machine control block.

[0145] As described above, by determining the virtual machine information, it is determined whether the virtual machine in the current switching process is the virtual machine in the previous switching process.

[0146] Step S310: the processor core determines whether the virtual machine information of the virtual machine is consistent with the historical virtual machine information.

[0147] As mentioned above, based on the fact that the historical virtual machine information is the virtual machine information of the virtual machine in the previous switching process, it is possible to judge the source of the existing prediction data and determine whether the existing prediction data is obtained based on a continuously running virtual machine (that is, both the virtual machine of the current switching process and the virtual machine of the previous switching process), so that it can be judged whether the existing prediction data is credible data.

[0148] In an optional example, when the virtual machine information is the virtual machine control block address information, the judgment of step S310 can not only determine whether the existing prediction data is obtained based on the continuously running virtual machine, but also determine whether the existing prediction data is obtained based on the virtual core of the continuously running virtual machine (that is, both the virtual core of the virtual machine of the current switching process and the virtual core of the virtual machine of the previous switching process), thereby determining whether the existing prediction data is credible data.

[0149] In the judgment process, if the judgment result is yes, step S320 is executed, so that the corresponding prediction data is no longer cleared, and step S330 is executed at the same time to update the historical virtual machine information to the virtual machine information of the virtual machine of the current switching process; if not, step S100 is executed to disable the prediction data belonging to the virtual machine mode in the branch predictor, and keep the prediction data belonging to the host mode in the branch predictor in an available state, and execute step S330 to update the virtual machine information.

[0150] Step S320: the processor core is prohibited from issuing the data disable command;

[0151] It can be understood that based on the historical information of mode switching, it is determined whether the virtual machine at the time of the last mode switch is the current virtual machine. If so, it indicates that during the period from the last mode switch to the current mode switch, the prediction data under the virtual machine mode stored in the branch predictor is based on the current virtual machine. Accordingly, the prediction data can be understood as safe data and does not need to be cleared, thereby prohibiting the issuance of the data disable command.

[0152] Step S330: the processor core updates the historical virtual machine information to the virtual machine information of the virtual machine in the current switching process.

[0153] After executing or prohibiting the issuance of the data disable command, the corresponding virtual machine information is updated to mark the source basis of the predicted data (i.e., based on which virtual machine or virtual core it is obtained), providing an information comparison basis for the subsequent switching process.

[0154] It can be seen that the embodiment of the present invention can retain the prediction data that is not contaminated by other virtual machines, thereby further improving the instruction prediction efficiency while ensuring data security.

[0155] It should be noted that the above processing method can be implemented based on hardware logic or preset fixed microcode, so that no software instructions are required and it can be automatically executed directly during the mode switching process between the virtual machine and the host.

[0156] In an alternative implementation, reference Fig.13 An optional structural diagram of a branch predictor provided by an embodiment of the present invention is shown, and the branch predictor may be an optional hardware structure for implementing the above-mentioned data processing method, wherein the branch predictor stores prediction data, and the prediction data includes prediction data belonging to a host mode and prediction data belonging to a virtual machine mode, and the branch predictor includes:

[0157] The command information acquisition logic 400 is used to acquire a data disable command, wherein the data disable command is used to be issued during a mode switching process between a host mode and a virtual machine mode;

[0158] The prediction data disabling logic 410 is used to disable the prediction data belonging to the virtual machine mode in the branch predictor based on the data disabling command, and keep the prediction data belonging to the host mode in the branch predictor in an available state.

[0159] Optionally, the prediction data includes data recorded in each item of the branch target buffer and / or data recorded in each item of the return address stack buffer.

[0160] Optionally, when the predicted data is data in a branch target buffer, the predicted data includes a mode identifier, and the mode identifier is used to mark the mode to which the predicted data belongs;

[0161] The prediction data disabling logic 410 is used to disable the prediction data belonging to the virtual machine mode in the branch predictor, and keep the prediction data belonging to the host mode in the branch predictor in an available state, specifically: invalidate the prediction data in the branch target buffer whose mode is marked as the virtual machine mode, and keep the prediction data in the branch target buffer whose mode is marked as the host mode in a valid state.

[0162] Optionally, when the predicted data is data in a branch target buffer, the predicted data includes a logical core identifier, and the logical core identifier is used to mark the logical core to which the predicted data belongs; the data disable command includes the logical core identifier of the command issuer, and the predicted data disable logic 410 is used to invalidate the predicted data in the branch target buffer whose mode identifier is a virtual machine mode, specifically:

[0163] Invalidate prediction data in the branch target buffer whose mode identifier is the virtual machine mode and whose logical core identifier is the same as the logical core identifier of the logical core where the virtual machine performing mode switching is located.

[0164] Optionally, when the predicted data is data in the return address stack buffer, the predicted data is divided into stack data belonging to the host mode and stack data belonging to the virtual machine mode;

[0165] The prediction data disabling logic 410 is used to disable the prediction data belonging to the virtual machine mode in the branch predictor, and keep the prediction data belonging to the host mode in the branch predictor in an available state, specifically: clearing the stack data belonging to the virtual machine mode in the return address stack buffer, and retaining the stack data belonging to the host mode in the return address stack buffer.

[0166] Optionally, when the predicted data is data in the return address stack buffer, the predicted data is divided into different stack data based on different logical core identifiers and modes; the data disabling command includes the logical core identifier of the command issuer, and the predicted data disabling logic 410 is used to clear the stack data belonging to the virtual machine mode in the return address stack buffer, specifically:

[0167] The stack data corresponding to the logical core identifier of the command issuer and belonging to the virtual machine mode in the return address stack buffer is cleared, and the pointer of the virtual machine mode data stack corresponding to the logical core identifier of the command issuer is set to an initial state.

[0168] Optionally, the branch predictor further includes:

[0169] The data access logic 420 is used to allow access to prediction data with a mode identification of virtual machine mode and prohibit access to prediction data with a mode identification of host mode when the instruction to be predicted is in virtual machine mode in the instruction prediction process of the branch predictor.

[0170] Optionally, the branch predictor further includes:

[0171] The data access logic 420 is used to allow access to the prediction data with the mode identification as the virtual machine mode and the host mode at the same time when the instruction to be predicted is in the virtual machine mode in the instruction prediction process of the branch predictor; and, for the instruction to be predicted in the host mode, it is prohibited to access the prediction data with the mode identification as the virtual machine mode.

[0172] Optional, reference Fig.14 Another optional structural diagram of a branch predictor provided by an embodiment of the present invention is shown, wherein the branch predictor further includes:

[0173] The command execution judgment logic 430 is used to determine the virtual machine information corresponding to the data disabling command; determine whether the virtual machine information of the virtual machine is consistent with the historical virtual machine information. If so, the execution of the data disabling command is prohibited, and the historical virtual machine information is updated to the virtual machine information corresponding to the data disabling command; wherein the historical virtual machine information is the virtual machine information of the virtual machine in the previous switching process.

[0174] Optionally, the command execution judgment logic 430 is also used to update the historical virtual machine information to the virtual machine information corresponding to the data disable command when it is determined that the virtual machine information of the virtual machine is inconsistent with the historical virtual machine information, and to enable the prediction data disable logic 410 to disable the prediction data belonging to the virtual machine mode in the branch predictor based on the data disable command, and keep the prediction data belonging to the host mode in the branch predictor in an available state.

[0175] Optionally, the command information acquisition logic 400 is used to acquire a data disable command, including:

[0176] Get the indirect branch prediction barrier IBPB enable command;

[0177] Based on the command information of the IBPB enabling command, determining whether the IBPB enabling command is issued during the mode switching process;

[0178] If so, the IBPB enable command is the data disable command; if not, the IBPB enable command is not the data disable command.

[0179] Optionally, the historical virtual machine information is stored in a switching information storage component, and the switching information storage component is configured in the branch predictor; or, the historical virtual machine information is configured in a microcode.

[0180] The solution provided by the embodiment of the present invention distinguishes the mode to which the prediction data belongs in the prediction data, so that when a data disable command is obtained, based on the data disable command, the prediction data belonging to the virtual machine mode in the branch predictor is disabled, and the prediction data belonging to the host mode in the branch predictor is kept in an available state. Among them, by disabling the prediction data belonging to the virtual machine mode in the branch predictor, attacks that may be launched by the data trained by the virtual machine are avoided, thereby ensuring the data security of the virtual machine; by keeping the prediction data belonging to the host mode in the branch predictor in an available state, the prediction efficiency of the instruction is improved. Therefore, the embodiment of the present invention can improve the instruction prediction efficiency under the premise of ensuring data security.

[0181] An embodiment of the present application also provides a processor core, which may include the above-mentioned branch predictor; and the branch predictor in the processor core is used to execute the above-mentioned data processing method based on the branch predictor, and / or the processor core is used to execute the above-mentioned data processing method based on the processor core.

[0182] Optionally, the virtual machine control block configured in the processor core includes a disable command identification bit, and the disable command identification bit is used to trigger the data disable command

[0183] A chip is also provided in an embodiment of the present application, and the chip may include the above-mentioned processor core.

[0184] An embodiment of the present application also provides an electronic device, which may include the above-mentioned chip.

[0185] An embodiment of the present application also provides a computer program product, comprising one or more computer executable instructions, which, when executed, implement the above-mentioned data processing method based on branch predictor execution and / or the data processing method based on processor core execution.

[0186] The above describes multiple implementation schemes provided by the embodiments of the present application. The various optional methods introduced in each implementation scheme can be combined and cross-referenced with each other without conflict, thereby extending a variety of possible implementation schemes, which can all be considered as implementation schemes disclosed and open in the embodiments of the present application.

[0187] Although the embodiments of the present application are disclosed above, the present application is not limited thereto. Any person skilled in the art may make various changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be subject to the scope defined by the claims.

Claims

1. A data processing method, characterized in that: Applied to a branch predictor, the branch predictor stores prediction data, the prediction data including prediction data belonging to a host mode and prediction data belonging to a virtual machine mode; the method comprises: Acquire a data disabling command, wherein the data disabling command is used to be issued during a mode switching process between a host mode and a virtual machine mode; Based on the data disabling command, the prediction data belonging to the virtual machine mode in the branch predictor is disabled, and the prediction data belonging to the host mode in the branch predictor is kept in an available state.

2. The data processing method according to claim 1, characterized in that: The prediction data includes data recorded in each item of the branch target buffer and / or data recorded in each item of the return address stack buffer.

3. The data processing method according to claim 2, characterized in that: When the predicted data is data in a branch target buffer, the predicted data includes a mode identifier, and the mode identifier is used to mark the mode to which the predicted data belongs; The disabling of the prediction data belonging to the virtual machine mode in the branch predictor and keeping the prediction data belonging to the host mode in the branch predictor in an available state is specifically: invalidating the prediction data in the branch target buffer whose mode is marked as the virtual machine mode, and keeping the prediction data in the branch target buffer whose mode is marked as the host mode in a valid state.

4. The data processing method according to claim 3, characterized in that: When the predicted data is data in a branch target buffer, the predicted data includes a logical core identifier, and the logical core identifier is used to mark the logical core to which the predicted data belongs; the data disable command includes the logical core identifier of the command issuer, and the invalidation of the predicted data in the branch target buffer whose mode identifier is a virtual machine mode is specifically: Invalidate prediction data in the branch target buffer whose mode identifier is the virtual machine mode and whose logical core identifier is the same as the logical core identifier of the logical core where the virtual machine performing mode switching is located.

5. The data processing method according to claim 2, characterized in that: When the predicted data is data in the return address stack buffer, the predicted data is divided into stack data belonging to the host mode and stack data belonging to the virtual machine mode; The disabling of the prediction data belonging to the virtual machine mode in the branch predictor and keeping the prediction data belonging to the host mode in the branch predictor in an available state is specifically: clearing the stack data belonging to the virtual machine mode in the return address stack buffer and retaining the stack data belonging to the host mode in the return address stack buffer.

6. The data processing method according to claim 5, characterized in that: When the predicted data is data in a return address stack buffer, the predicted data is divided into different stack data based on different logical core identifiers and modes; the data disabling command includes the logical core identifier of the command issuer, and the clearing of stack data belonging to the virtual machine mode in the return address stack buffer is specifically: The stack data corresponding to the logical core identifier of the command issuer and belonging to the virtual machine mode in the return address stack buffer is cleared, and the pointer of the virtual machine mode data stack corresponding to the logical core identifier of the command issuer is set to an initial state.

7. The data processing method according to claim 1, characterized in that: Also includes: In the instruction prediction process of the branch predictor, when the instruction to be predicted is a virtual machine mode, access to prediction data belonging to the virtual machine mode is allowed, and access to prediction data belonging to the host mode is prohibited.

8. The data processing method according to claim 1, characterized in that: Also includes: In the instruction prediction process of the branch predictor, when the instruction to be predicted is in virtual machine mode, access to prediction data belonging to both virtual machine mode and host mode is allowed; and, for the instruction to be predicted in host mode, access to prediction data belonging to virtual machine mode is prohibited.

9. The data processing method according to claim 1, characterized in that: After obtaining the data disable command, before disabling the prediction data belonging to the virtual machine mode in the branch predictor based on the data disable command and keeping the prediction data belonging to the host mode in the branch predictor in an available state, the method further includes: Determine virtual machine information corresponding to the data disabling command; Determine whether the virtual machine information of the virtual machine is consistent with the historical virtual machine information, and if so, prohibit execution of the data disabling command; The historical virtual machine information is the virtual machine information of the virtual machine in the previous switching process.

10. The data processing method according to claim 9, characterized in that: The step of determining whether the virtual machine information of the virtual machine is consistent with the historical virtual machine information further includes: If not, execute the step of disabling the prediction data belonging to the virtual machine mode in the branch predictor based on the data disable command, and keeping the prediction data belonging to the host mode in the branch predictor in an available state, and update the historical virtual machine information to the virtual machine information corresponding to the data disable command.

11. The data processing method according to claim 9, characterized in that: The obtaining data disabling command comprises: Get the indirect branch prediction barrier IBPB enable command; Based on the command information of the IBPB enabling command, determining whether the IBPB enabling command is issued during the mode switching process; If so, the IBPB enable command is the data disable command; if not, the IBPB enable command is not the data disable command.

12. The data processing method according to claim 9, characterized in that: The historical virtual machine information is stored in a switching information storage component, and the switching information storage component is configured in the branch predictor; or, the historical virtual machine information is configured in a microcode.

13. A data processing method, characterized in that: Applied to a processor core, the method comprises: During the mode switching process between the host mode and the virtual machine mode, a data disable command is issued so that the branch predictor disables the prediction data belonging to the virtual machine mode in the branch predictor based on the data disable command, and keeps the prediction data belonging to the host mode in the branch predictor in an available state; wherein the branch predictor stores prediction data, and the prediction data includes prediction data belonging to the host mode and prediction data belonging to the virtual machine mode.

14. The data processing method according to claim 13, characterized in that: Before issuing a data disable command, also include: Determine virtual machine information of the virtual machine of the current switching process; Determine whether the virtual machine information of the virtual machine is consistent with the historical virtual machine information, and if so, prohibit issuing the data disabling command; The historical virtual machine information is the virtual machine information of the virtual machine in the previous switching process.

15. The data processing method according to claim 14, characterized in that: The virtual machine information is a virtual machine identifier, and the determining of the virtual machine information of the virtual machine of the current switching process is specifically: determining the virtual machine identifier of the current switching process and the address information of the virtual machine control block from the virtual machine control block.

16. The data processing method according to claim 14, characterized in that: The step of determining whether the virtual machine information of the virtual machine is consistent with the historical virtual machine information further includes: If not, the step of issuing the data disabling command is executed, and the historical virtual machine information is updated to the virtual machine information of the virtual machine in the current switching process.

17. The data processing method according to claim 14, characterized in that: The historical virtual machine information is stored in a switching information storage component, and the switching information storage component is configured in the processor core; or, the historical virtual machine information is configured in a microcode.

18. The data processing method according to claim 13, characterized in that: The issuing of the data disabling command specifically includes triggering the data disabling command based on a disabling command identification bit in the virtual machine control block.

19. A branch predictor, characterized in that: The branch predictor stores prediction data, the prediction data including prediction data belonging to the host mode and prediction data belonging to the virtual machine mode; the branch predictor includes: A command information acquisition logic, used to acquire a data disabling command, wherein the data disabling command is used to be issued during a mode switching process between a host mode and a virtual machine mode; The prediction data disabling logic is used to disable the prediction data belonging to the virtual machine mode in the branch predictor based on the data disabling command, and keep the prediction data belonging to the host mode in the branch predictor in an available state.

20. A processor core, characterized in that: The processor core includes the branch predictor of claim 19; Furthermore, the branch predictor in the processor core is used to execute the data processing method described in any one of claims 1 to 12, and / or the processor core is used to execute the data processing method described in any one of claims 13 to 18.

21. The processor core according to claim 20, characterized in that: The virtual machine control block configured in the processor core includes a disable command identification bit, and the disable command identification bit is used to trigger the data disable command.

22. A chip, characterized in that: Comprising a processor core as claimed in claim 20 or claim 21.

23. An electronic device, characterized in that: Comprising the chip as claimed in claim 22.

24. A computer program product, characterized in that The method comprises one or more computer executable instructions, which, when executed, implement the data processing method according to any one of claims 1 to 12, and / or implement the data processing method according to any one of claims 13 to 18.

Images