Hidden PMU reverse engineering general framework based on differential analysis and simulation verification

Abstract

The invention provides a hidden PMU reverse engineering general framework based on differential analysis and simulation verification. The framework can efficiently analyze the function of hiding the PMU event by the Intel processor and the underlying micro-architecture behavior. The underlying micro-architecture behavior associated with the events is inferred by observing the count variation throughout the event space during execution of well-designed instruction segments. Based on the initial inferences, a logically equivalent simulator is implemented to model the events. Through difference analysis between simulator counting and real CPU counting, the simulator is gradually optimized to keep consistent with real CPU behaviors, so that we can reveal micro-system structure features behind hidden PMU events. The method has wide application prospects in the fields of performance monitoring, micro-architecture research, safety detection and the like, the hardware resource utilization efficiency of the performance counter is improved, and the capacity range of processor performance analysis is remarkably expanded.

Description

Technical Field

[0001] The present invention relates to the computer field, and in particular to hidden PMU reverse engineering based on differential analysis and simulation verification in the processor hardware field. Background Art

[0002] Performance Monitoring Unit (PMU) is an indispensable hardware component in modern high-performance CPUs. Its core function is to monitor the performance events of the CPU during operation. This component has been widely used in the past few decades with its sophisticated monitoring capabilities, covering multiple key areas, including performance optimization, reverse engineering, malicious behavior detection, fuzz testing, etc. For example, in performance optimization, PMU can be used to capture bottlenecks and guide code optimization; in reverse engineering, it provides an important basis for analyzing the underlying hardware behavior; and in the security field, PMU is used to detect malicious attack patterns. In addition, the study of PMU has also revealed the potential security risks it may bring, such as inferring encryption keys through performance data, building covert communication channels, and implementing side channel attacks. These functions make PMU play an important role in computer architecture and information security research, and it is regarded as a "magnifying glass" for researchers to gain in-depth insights into CPU behavior.

[0003] Intel CPUs usually have two types of PMUs, one is the FixedPerformance Counter, which is specifically used to record specific performance events. The other is a programmable counter, which is generally composed of a one-to-one Event Select Register and a Performance Counter. Developers can search for the events they want to monitor in the official documentation of the processor vendor, configure the event code in the event select register according to their own needs, and then read the event count from the corresponding performance counter. This process can help developers monitor the performance of the target code, identify performance bottlenecks and optimize.

[0004] Intel's programmable PMU consists of pairs of Model-Specific Registers (MSRs), namely the Event Select MSR (IA32_PERFEVTSELx) and the Performance Count MSR (IA32_PMCx). The PMU events are mainly configured through the lower 16 bits of the Event Select register. The lower 8 bits determine the basic type of the event, which is called EventSelect (or EventCode). The upper 8 bits are the Unit Mask (UMask) field, which determines the selection conditions of the event.

[0005] Existing research indicates that the types of PMU events officially disclosed by Intel only account for a small part of the entire event selection space. Although existing studies have proven the existence of these hidden events, the analysis of the specific microarchitectural behavior of hidden events and their specific performance monitoring functions is still very limited. This limitation significantly reduces the possibility of using these hidden events in actual scenarios, thereby limiting the further development and application potential of PMU. Therefore, how to explore and utilize the capabilities of these hidden events has become one of the important directions of current research, which may bring breakthrough progress to CPU performance optimization and security research. Summary of the invention

[0006] The present invention provides a general framework for reverse engineering of hidden PMU based on differential analysis and simulation verification. The method can automatically, efficiently, reliably and stably analyze the micro-architecture behavior and specific functions behind the hidden PMU events in Intel CPU. The overall architecture diagram of the method is shown in the figure. Figure 1 shown.

[0007] The present invention provides the following hidden PMU reverse engineering framework based on differential analysis and simulation verification, a reverse engineering method for hidden PMU events related to branches on Intel CPU, and a method for accelerating the reverse process by using the UMask Combination mode on Intel CPU:

[0008] A general framework for reverse engineering of hidden PMU based on differential analysis and simulation verification. Since the main function of PMU is to monitor various architectural / microarchitectural behaviors of CPU during operation, and CPU behavior is often closely related to the instructions it executes. Therefore, this framework uses the counts of CPU when executing different instructions as the characteristics of hidden PMU to analyze its corresponding specific behavior. This process is mainly divided into three steps:

[0009] S1. Generation of random instruction fragments: Some behaviors of the CPU may not be triggered by a single instruction, and often require a combination of multiple instructions to trigger specific behaviors. Therefore, the main purpose of step S1 is to randomly generate instruction fragments that can trigger target events. Obviously, the instruction fragments generated by step S1 for different target events are also different. Therefore, it is necessary to provide different meta-instructions for step S1. Meta-instructions refer to basic instruction fragments that contain a single target event count. That is, when the CPU only executes meta-instructions, one count of one or more target events will be triggered. Thereafter, step S1 is randomly combined according to the meta-instructions. This random combination includes two types of random instruction fragments. One is an instruction fragment that only contains a variety of random numbers of meta-instructions. For this random instruction fragment, we can logically know the count value of the corresponding event that it can trigger (because the event that each meta-instruction can trigger is known). The second is to insert an instruction fragment of a random legal instruction into the above instruction fragment. The purpose of this instruction fragment is to prevent the omission of any factors that may trigger hidden PMU events.

[0010] S2, hidden event enumeration: The purpose of step S2 is to comprehensively and systematically explore and enumerate the 256 UMask spaces of the target event EvenctCode to search for hidden PMU events. Specifically, step S2 receives two types of random instruction fragments generated from step S1. For each instruction fragment, step S2 captures the PMU event count value composed of the target EventCode and its 256 possible UMask combinations when it is executed. Then, these random instruction fragments are used as an independent feature of the event, and the corresponding event count value is used as the value of the feature. In other words, the final output result of step S2 is a feature matrix with a dimension of 256*N. 256 represents the PMU event (including hidden and public) composed of the entire UMask space and the target EventCode. N represents the number of instruction fragments generated by step S1.

[0011] S3, simulation verification: The purpose of step S3 is to give a preliminary inference of the function of the hidden PMU event by differential analysis based on the feature matrix generated in step S2. Based on the preliminary inference results, a logical equivalence model is implemented. Then, the first type of random instruction fragment generated in step S1, that is, the instruction fragment that logically grasps the count value that may be triggered, is input into the equivalent model to obtain the simulated count. Through differential analysis of the simulated count and the real CPU count, the implementation of the equivalent model is continuously adjusted to fit the real CPU, so that we can determine the specific behavior of the hidden PMU event.

[0012] A reverse engineering method for hidden PMU events related to branches on Intel CPUs. This method is mainly one of the specific implementation examples of the above reverse engineering framework. It mainly includes three modules:

[0013] Random branch instruction generator, this module is responsible for generating random branch instruction fragments to trigger the counting of hidden branch related PMU events. It mainly includes ordinary meta-branch instructions and meta-branch instructions that can trigger various branch prediction errors, which are collectively referred to as meta-branches below. By randomly combining meta-branch pairs, this module can generate three types of random branch fragments, such as Figure 1 As shown in the figure: a single type of meta-branch fragment, including a combination of a single type with different numbers of meta-branch instructions; a random meta-branch fragment, including a combination of a random number of meta-branches of a random type; a random instruction fragment, which is composed by inserting legal instructions into a random meta-branch fragment. Single type meta-branch fragments and random meta-branch fragments can generate controllable PMU count values. Random instruction fragments can prevent us from missing any factors that may trigger the count.

[0014] Branch event enumerator, the main function of this module is to enumerate the event space composed of 4 EventCodes (0x88, 0x89, 0xC4, 0xC5) related to branches on Intel CPU and their 256 UMasks. At the same time, the enumerator receives three types of instruction fragments from the random branch generator. For each instruction fragment, record the event count value under the combination of the target EventCode and its 256 UMasks. We regard each instruction fragment as a feature of the event, and its corresponding event count value as the feature value. Finally, for each EventCode, the event enumerator will output a feature matrix M:

[0015]

[0016] Each row represents the characteristics of the event combined with the EventCode and its 256 UMasks, and each column represents the count value of different events under the instruction fragment. This matrix is ​​the core input for subsequent analysis and provides a sufficient basis for the inference of hidden event functions.

[0017] Event simulator, the core function of the simulator is to confirm the specific behavior of hidden PMU events through simulation verification and differential analysis. This module receives the feature matrix from the enumerator and makes a preliminary guess on the event behavior based on the features. Before making a preliminary guess, we need to remove redundant events. That is, analyze whether there are hidden PMU events with similar or identical features based on the feature matrix. Then use machine learning clustering methods to remove redundant events. After this, I can make a preliminary guess and then implement a logical equivalent model based on the guess results. This model does not rely on actual hardware, but outputs simulation counts by inputting a single type of meta-branch fragment and a random meta-branch fragment generated by a random branch instruction generator. Finally, by performing differential analysis on the simulation counts and the count values ​​of the real CPU, the output of the simulator is continuously adjusted to fit the results of the real CPU, and the specific behavior of the hidden PMU is finally determined.

[0018] A method for accelerating the reverse process using the UMask combination mode. Based on the aforementioned reverse method for hidden PMU events related to branches on Intel CPUs, we first completed the reverse engineering of hidden PMU events with EventCode 0xC4 on Intel i7-7700 (Skylake). Because it has a small number of hidden PMU events during event enumeration, the workload of reverse analysis is low. Other EventCodes (0xC5, 0x88, 0x89) have a large number of hidden events, which brings great challenges to our detailed reverse analysis and simulation verification of each event.

[0019] Fortunately, during the analysis, we observed a specific UMask combination pattern, that is, some PMU events can be obtained by combining other events, such as Figure 2 As shown. We define events that cannot be obtained through combination as parent events (Parent Event), and events that can be obtained through combination as child events (Child Event). Based on this rule, we designed a method to accelerate the reverse process using the UMask combination mode. This method shifts all attention to the Parent Event, which allows us to only perform detailed reverse engineering on the Parent Event. For the Child Event, it is only necessary to combine the implemented Parent Event equivalent model to obtain it, which greatly reduces the workload of reverse analysis. The following Table 1 shows all the Parent Events of 0xC4 on Intel i7-7700:

[0020] Table 1 All Parent Events of 0xC4 on Inteli7-7700

[0021]

[0022] Table 2 below shows the reverse engineering results of all hidden PMU events on Intel i7-7700:

[0023] Table 2 Reversing results of all hidden PMU events on Intel i7-7700

[0024]

[0025]

[0026] Through this reverse engineering acceleration method based on the UMask combination mode, we quickly completed the reverse engineering of other EventCodes. Figure 4 The matching rate of all PMU event equivalent models with the real CPU is shown. At the same time, we extended the reverse engineering of branch-related hidden PMUs to other Intel CPUs, such as Haswell and the latest Raptor Lake. Table 3 below shows the number of all branch-related hidden PMUs on three different microarchitecture CPUs obtained using our reverse engineering framework:

[0027] Table 3 Number of branch-related hidden PMU events on three different microarchitecture Intel CPUs

[0028]

[0029] The hidden PMU events related to branches on Haswell are basically consistent with the results on Skylake. On RaptorLake, we only observed one hidden Parent Event on E-CORE. In addition, there are only 60 child events with event codes 0xC4 and 0xC5 on P-CORE, while there are no events with EventCode 0x88 and 0x89 on Raptor Lake. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some example drawings of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 This is the framework diagram of hidden PMU reverse engineering based on differential analysis and simulation verification;

[0032] Figure 2This is a schematic diagram of the UMask combination mode;

[0033] Figure 3 The results are the fitting between the Parent Event equivalent model of some branches on Skylake and the real CPU;

[0034] Figure 4 The matching ratio between the hidden PMU equivalent model and the real CPU for all branches on Skylake; DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] Figure 2 The UMask combination pattern diagram is shown. For Child Event 0x03C4, we found that its count value is always equal to the sum of Parent Event 0x01C4 and Parent Event 0x02C4. At the same time, there is an OR operation relationship between their UMasks. Therefore, we speculate that the ChildEvent can be obtained through the OR operation of the Parent Event's UMask.

[0037] Figure 3 The results of fitting some branch-related Parent Event equivalent models on Skylake to the real CPU are shown. These events mainly include branch-related events recorded in the Haswell document but not in the Skylake document. The x-axis represents different random instruction fragments, a total of 1000. The y-axis represents different PMU events. The color bar shows the difference between the count values ​​output by the equivalent model for different events and the count values ​​output by the real CPU for different random instruction fragments. The y-axis on the right shows the evaluation matching rate of each equivalent model with the real CPU.

[0038] Figure 4 The matching rate between the hidden PMU equivalent model and the real CPU for all branches on Skylake is shown. For 0xC4, since it is not easily affected by transient execution and branch prediction errors, we can complete the simulation verification well. For other events, they are more or less affected by transient execution and branch prediction errors, so the matching rate shows a certain degree of fluctuation.

[0039] Those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A hidden PMU event reverse engineering framework based on differential analysis and simulation verification, characterized in that: By analyzing the changes in PMU event counts when the processor executes a specific instruction fragment and combining it with the simulation verification process, the functions of hidden PMU events and the underlying microarchitecture behavior are analyzed. The content of this method includes: Randomly generate instruction snippets containing specific trigger characteristics, where the instruction snippets consist of a single meta-instruction or other legal x86 instructions randomly inserted. Then systematically enumerate all UMask combinations of the target EventCode and record the event counts of each instruction snippet under different UMask values. Based on the recorded event counts, construct a feature matrix containing the target EventCode and 256 UMask combinations and random instruction snippets; finally, through differential analysis and simulation verification, gradually optimize the simulator model so that its output matches the count of the real CPU, thereby analyzing the function of hidden PMU events.

2. A reverse engineering method for branch-related hidden PMU events, characterized in that: The framework described in claim 1 is used to parse the specific functions of branch-related hidden PMU events on Intel CPUs. The content of this method includes: Meta-branch instructions are generated according to different types of branch instructions, including conditional branches, indirect jumps, function calls, and returns. Then, meta-branch instructions are randomly combined to generate multiple types of random branch instruction fragments, and random legal x86 instructions are added to cover potential triggering scenarios. A feature matrix of branch-related events is constructed, and the event triggering function of branch instruction fragments is verified through the simulator model. Combined with the differential analysis optimization model, the microarchitectural behavior of hidden events related to branches is gradually determined.

3. A method for accelerating the reverse process of hiding PMU events using UMask combined mode, characterized in that: By identifying the UMask combination pattern in hidden PMU events, the event parsing process is simplified. The content of this method includes: Define parent events as independent events that cannot be generated by combining other events, and sub-events as events generated by combining multiple parent events through UMask. By modeling parent events first, and then quickly generating sub-event models by logically combining parent event models, the workload of independently modeling sub-events is significantly reduced.

4. A reverse engineering method extended to other hidden PMU events, characterized in that: By adjusting the basic instruction set and trigger conditions of the generator for different types of hidden events, combined with the framework described in claims 1 to 4, the scope of application of reverse engineering is expanded. The content of this method includes: The meta-instruction snippets are adjusted for different microarchitecture events to adapt to the triggering conditions of other hidden events. The feature matrix matching the target event features is constructed through the event enumerator. Then, the UMask combination mode is used to group and simplify the processing of other hidden events to reduce the workload and improve efficiency. Finally, the parsing results of different types of events are optimized through the simulation verification process, providing extensive support for performance monitoring and microarchitecture research.

Images