Instruction bypass method and device and storage medium

Abstract

The invention provides an instruction bypass method and device and a storage medium, the method is suitable for a CPU, and the method comprises the steps that in the process that the CPU executes a target program in a user mode, if an exception occurs, the CPU is converted into a kernel mode; the CPU determines a bypass instruction sequence corresponding to the target instruction causing the exception in a kernel mode; after the CPU writes the bypass instruction sequence into the pilot instruction buffer area in the kernel mode, the CPU is restored to the user mode; the pilot instruction buffer area is a preset buffer area; after the CPU executes the bypass instruction sequence in the user mode, the target program continues to be executed. By the adoption of the method, the CPU can complete instruction bypass only by entering the kernel mode once, the dwell time of the CPU in the kernel mode is shortened, and the probability of system jamming of the CPU is reduced.

Description

Technical Field

[0001] The present application relates to the field of computer processor technology, and in particular to an instruction bypass method, device, and storage medium. Background Art

[0002] A growing number of attack methods targeting vulnerabilities are putting many computers at risk. To mitigate this problem, many processors offer hardware-level security enhancements. However, these new security enhancements require new processors, and older processors cannot benefit from these new technologies. Sometimes, these enhancements also require upgrading existing software, leaving older versions vulnerable to the new security enhancements.

[0003] On the other hand, modern processors are too complex, and design errors can lead to hardware vulnerabilities. Existing fixes cannot completely prevent information leakage from hardware vulnerabilities; they can only protect specific sensitive information, while unprotected information can still be leaked. Furthermore, fixing hardware vulnerabilities is difficult, often affecting overall performance. Sometimes, it is impossible to fix without losing functionality, and in rare cases, it is completely impossible to fix.

[0004] On the other hand, many current processors omit a floating-point unit (FPU) for cost-saving reasons, making it impossible to execute floating-point branch instructions. Floating-point branch instructions are those that require the use of floating-point registers or control registers within the FPU. For processors without an FPU, executing floating-point branch instructions will cause an exception, but these processors' instruction sets do define floating-point branch instructions. A common solution is for the kernel to trap the exception caused by executing floating-point branch instructions on processors without an FPU and emulate floating-point branch instructions.

[0005] However, the presence of the delay slot presents certain difficulties for the kernel's ability to simulate floating-point branch instructions by catching exceptions. The delay slot is the instruction slot immediately following a branch instruction. If the width of the delay slot is n, then the n instructions following the branch instruction are the instructions in the delay slot. The instruction in the delay slot could be any instruction in the instruction set, but it is unrealistic for the kernel to recognize all instructions in the instruction set. Therefore, a temporary instruction sequence must be written to an idle memory address in user space to simulate the instructions in the delay slot. This requires searching for an idle memory address in user space before each delay slot simulation, which is inefficient. Summary of the Invention

[0006] The present application provides an instruction bypass method, device, and storage medium to improve the efficiency of instruction bypass.

[0007] In a first aspect, the present application provides an instruction bypass method, the method comprising: When the CPU is executing the target program in user mode, if an exception occurs, it will switch to kernel mode; The CPU determines, in kernel mode, a bypass instruction sequence corresponding to the target instruction causing the exception; After the CPU writes the bypass instruction sequence into the leading instruction buffer in the kernel state, it returns to the user state; the leading instruction buffer is a pre-set buffer; After executing the bypass instruction sequence in the user mode, the CPU continues to execute the target program.

[0008] After the CPU transitions from user state to kernel state due to an exception, the kernel state recognizes that the exception is for instruction bypass. It then determines the bypass instruction sequence corresponding to the target instruction that caused the exception based on the target instruction. After writing the bypass instruction sequence into a pre-set buffer, it can then return to user state. Because the CPU takes a relatively short time to determine the bypass instruction sequence corresponding to the target instruction in kernel state, the CPU only needs to stay in kernel state for a short time before returning to user state. This shortens the time the CPU falls into kernel state and reduces the probability of system freezes. Furthermore, the buffer is pre-set, eliminating the need to search for a target write area for the bypass instruction sequence each time. This allows the CPU to quickly execute the bypass instruction sequence in user state, thereby completing instruction bypass and improving the efficiency of instruction bypass.

[0009] In one possible implementation, an instruction matcher is provided in the CPU; When the CPU is executing the target program in user mode, if an exception occurs, it will switch to kernel mode, including: When the CPU executes any instruction in the target program in the user state, the instruction matcher determines whether the instruction is the same as the pre-configured instruction in the instruction matcher. If they are the same, an exception is triggered and the state is switched to the kernel state.

[0010] The preconfigured instructions in the instruction matcher can be changed according to the scenario in which the instruction bypass method is applied. For example, if the purpose is to mitigate side-channel attacks, the preconfigured instructions can be set to instructions for obtaining the current clock; if the purpose is to implement a Pointer Authentication (PAC), the preconfigured instructions can be set to instructions for backing up the return address of a function call to the stack, or the preconfigured instructions can be set to instructions for reading the return address of a function call from the stack. In other words, by changing the preconfigured instructions in the instruction matcher, instruction bypass can be achieved in different application scenarios. The instruction bypass method proposed in the embodiment of the present application has a wide range of application scenarios and good flexibility.

[0011] In one possible design, the CPU determines, in kernel mode, a bypass instruction sequence corresponding to the target instruction that caused the exception, including: After the CPU determines in kernel mode that the exception is used to perform instruction bypass, it determines a bypass instruction sequence corresponding to the target instruction that caused the exception.

[0012] After the CPU enters the kernel state, it determines the exception type and determines the bypass instruction sequence only after determining that the exception is for instruction bypass, thereby avoiding waste of system resources.

[0013] In a possible design, before restoring to user mode, the following is also included: The CPU writes the memory address to the exception program counter EPC in kernel mode; After the CPU executes the bypass instruction sequence in the user mode, the CPU continues to execute the target program, including: After the CPU executes the bypass instruction sequence in the user mode, it continues to execute the target program through the memory address indicated by the EPC.

[0014] In one possible design, the CPU executes the bypass instruction sequence in user mode, including: The CPU checks in user mode whether there is a bypass instruction sequence in the preceding instruction buffer; If a bypass instruction sequence exists, the bypass instruction sequence is executed.

[0015] After the CPU recovers from kernel state to user state, it first checks whether there is a bypass instruction sequence in the leading instruction buffer; if so, the bypass instruction sequence is executed first. After the bypass instruction sequence is executed, the target program is continued to be executed from the memory address pointed to by the EPC; if not, the target program is continued to be executed directly from the memory address pointed to by the EPC.

[0016] In one possible design, the leading instruction buffer is set in the CPU; or, the leading instruction buffer is set in the memory.

[0017] In a possible design, after the CPU executes the bypass instruction sequence in user mode, the following steps are further included: The preceding instruction buffer is cleared.

[0018] After the CPU executes the bypass instruction sequence in user mode, it promptly clears the leading instruction buffer. This ensures that even if the leading instruction buffer contains sensitive data, it will not be leaked after its execution is completed, thereby improving security. It also saves the CPU the overhead of handling exceptions unrelated to instruction bypass in kernel mode. Otherwise, when the CPU handles exceptions unrelated to instruction bypass in kernel mode, it is necessary to manually clear the leading instruction buffer to prevent the previous bypass instruction sequence from being executed after the exception handling returns.

[0019] In a possible design, before restoring to user mode, the following is also included: Determining an apparent address of a first instruction in the bypassed instruction sequence and writing the apparent address of the first instruction into a configuration register; the apparent address having the effect of treating the instruction as if it were present at a specific memory address; The CPU executes the bypass instruction sequence in user mode, including: Determining the apparent address of the first instruction in the bypass instruction sequence as the apparent address of the first instruction plus the distance between the first instruction and the first instruction in the predecessor instruction buffer; the first instruction is any instruction in the predecessor instruction buffer except the first instruction; If the bypass instruction sequence includes a program counter PC-related instruction, when the PC-related instruction is executed, the PC-related effect generated is determined by the apparent address of the PC-related instruction.

[0020] If there are PC-associated instruction behaviors in the bypass instruction sequence, the apparent address can be used as the PC to participate in the execution of the bypass instruction sequence, thereby ensuring that the PC-associated bypass instruction sequence can produce correct effects.

[0021] In one possible design, it also includes: If the memory access target address or jump target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the effective memory access target or jump target is still located in the target program.

[0022] If the memory access target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, then the memory access target address should access the data on the memory, rather than the data in the leading instruction buffer; similarly, if the memory access target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, then the jump target address should jump to the instruction in the target program located at the jump target address, rather than the instruction in the leading instruction buffer. In this way, it is ensured that the existence of the leading instruction buffer will not destroy the correct execution of any existing instruction stream, and it can also protect the bypass instruction sequence in the leading instruction buffer from being detected, thereby improving the security of sensitive data. At the same time, it is ensured that instruction bypass can only be triggered by instruction matching and kernel exception handling, and any attempt by the target program to actively jump to the leading instruction buffer will not succeed, thereby improving the security of instruction bypass.

[0023] In one possible design, it also includes: If the jump target address of any instruction in the bypass instruction sequence is the apparent address of a second instruction in the bypass instruction sequence, the jump is to the second instruction; the second instruction is any instruction in the predecessor instruction buffer. This effectively allows branches and loops in the bypass instruction sequence, enabling the construction of complex predecessor instruction sequences, increasing flexibility and functionality.

[0024] In a possible design, the target instruction is an instruction for acquiring a clock; The bypass instruction sequence corresponding to the target instruction is used to generate inaccurate clock information.

[0025] After the target register or target memory address obtains the correct clock information through the clock acquisition instruction, the correct clock information may be used to carry out a side-channel attack. When the bypass instruction sequence corresponding to the target instruction is used to generate inaccurate clock information, the target register or target memory address cannot obtain the correct clock information, effectively mitigating the side-channel attack.

[0026] In a possible design, the target instruction is an instruction for backing up a return address after a function call is completed to a stack; The bypass instruction sequence corresponding to the target instruction is used to generate a pointer with a signature; the signature is generated by a key, a stack pointer and a return address; and the pointer is used to represent the return address.

[0027] In one possible design, the signature is generated using a key, a stack pointer, and a return address, including: The bypass instruction sequence corresponding to the target instruction includes a key and a first signature instruction sequence; The first signature instruction sequence is used to instruct the key, stack pointer and return address to be input into a first preset algorithm to generate a pointer authentication code PAC as a signature.

[0028] In a possible design, before the CPU determines, in kernel mode, a bypass instruction sequence corresponding to the target instruction that causes the exception, the following further includes: The CPU inputs the key and stack pointer into a second preset algorithm in kernel mode to generate a PAC intermediate value; The bypass instruction sequence corresponding to the target instruction includes the PAC intermediate value and the second signature instruction sequence; The CPU executes the bypass instruction sequence in user mode, including: The CPU executes the second signature instruction sequence in user mode, where the second signature instruction sequence is used to input the PAC intermediate value and the return address into a third preset algorithm to generate a PAC as a signature.

[0029] In one possible design, after the CPU inputs the key and the stack pointer into the second preset algorithm in kernel mode to generate the PAC intermediate value, the following steps are further included: In the kernel state, the CPU uses the key and the stack pointer as a key, and stores the PAC intermediate value as a value corresponding to the key.

[0030] In one possible design, the target instruction is an instruction for reading a return address after a function call is completed from a stack; The bypass instruction sequence corresponding to the target instruction is used to verify the signed pointer.

[0031] In one possible design, the bypass instruction sequence corresponding to the target instruction includes a key and a first signature verification instruction sequence; The first signature verification instruction sequence is used to instruct the key, stack pointer, and return address represented by the pointer to be input into a first preset algorithm to obtain a reference PAC and determine whether the reference PAC is identical to the signature.

[0032] In a possible design, before the CPU determines, in kernel mode, a bypass instruction sequence corresponding to the target instruction that caused the exception, the following is further included: Determine the reference PAC intermediate value based on the key and stack pointer; The bypass instruction sequence corresponding to the target instruction includes the reference PAC intermediate value and the second signature verification instruction sequence; The second signature verification instruction sequence is used to instruct to input the reference PAC intermediate value and the return address represented by the pointer into a third preset algorithm to obtain a reference PAC and determine whether the reference PAC is identical to the signature.

[0033] After the CPU generates the PAC intermediate value in kernel mode, it uses the secret key and stack pointer as keys, and stores the PAC as the value corresponding to the key. In this way, the stored PAC intermediate value can be directly obtained based on the secret key and stack pointer, without having to input the secret key and stack pointer into the second preset algorithm to generate the PAC intermediate value, thereby improving the efficiency of obtaining the bypass instruction sequence.

[0034] In one possible design, the target instruction is a floating-point branch instruction with a delay slot; The CPU determines, in kernel mode, a bypass instruction sequence corresponding to the target instruction causing the exception, including: N instructions following the floating-point branch instruction are obtained as the bypass instruction sequence; N is a width of a delay slot, and N is a positive integer.

[0035] In one possible design, determining the apparent address of the first instruction in the bypass instruction sequence includes: The address of the first instruction after the floating-point branch instruction in the memory is determined as the apparent address of the first instruction in the bypass instruction sequence.

[0036] In one possible design, obtaining N instructions following the floating-point branch instruction as a bypass instruction sequence includes: If the floating-point branch instruction is also used to modify a register, the N instructions following the floating-point branch instruction and the instruction for modifying the register are used as the bypass instruction sequence.

[0037] In a second aspect, the present application further provides an instruction bypass device, the device comprising: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method described in the first aspect above.

[0038] In a third aspect, the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium includes a program. When the program is executed on a device, the device executes the method as described in any one of the above-mentioned first aspects.

[0039] In a fourth aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the method described in the first aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0041] Figure 1 A flowchart of the instruction bypass method provided in an embodiment of the present application; Figure 2 An interactive diagram of the instruction bypass method provided in an embodiment of the present application; Figure 3 Schematic diagram of the function of each binary bit of a 64-bit address; Figure 4 Schematic diagram of a pointer embedded in PAC when using pointer tags; Figure 5 Schematic diagram of a pointer embedded in PAC without using a pointer tag; Figure 6 Schematic diagram of the first solution of PAC signature provided in an embodiment of the present application; Figure 7 Schematic diagram of the second scheme of PAC signature provided in the embodiment of this application; Figure 8 Schematic diagram of the first solution of PAC signature verification provided in an embodiment of the present application; Figure 9 Schematic diagram of Solution 2 of PAC signature verification provided in an embodiment of this application. DETAILED DESCRIPTION

[0042] To make the objectives, technical solutions, and advantages of this application more clear, this application will be further described in detail below with reference to the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0043] The application scenarios described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Persons skilled in the art will appreciate that, as new application scenarios emerge, the technical solutions provided by the embodiments of this application are equally applicable to similar technical problems. In the description of this application, unless otherwise specified, "multiple" means two or more.

[0044] When executing certain instructions, for various reasons, exceptions may occur, requiring the Central Processing Unit (CPU) to enter kernel mode for processing. Typically, an exception indicates a bug in the currently executing program. Therefore, the kernel's handling of the exception is often destructive, such as killing the current process. However, there are exceptions where the exception is not caused by a program bug but by an unrelated force majeure. In this case, the program is expected to continue running normally. Therefore, the CPU simulates the instruction that caused the exception in kernel mode, resulting in the same result as if the instruction had been executed correctly.

[0045] A typical scenario where the CPU simulates exception-causing instructions in kernel mode is the simulation of floating-point branch instructions mentioned in the background section. To save costs, the CPU omits the FPU, resulting in exceptions when encountering floating-point branch instructions during program execution. A well-designed operating system kernel (running in kernel mode) simulates floating-point branch instructions in this situation, ensuring correct execution of floating-point branch instructions even without an FPU. Kernel mode emphasizes a highly privileged CPU state (in practice, kernel mode and kernel are equivalent). In contrast, user mode is a non-privileged CPU state with limited operations. In both states, software runs on the CPU. Software running in kernel mode is typically called the operating system kernel (kernel for short), while software running in user mode is typically called user programs.

[0046] Currently, CPUs typically simulate floating-point branch instructions in kernel state using trap and emulate, also known as capture and emulate. Trapping refers to the CPU capturing exceptions in kernel state, while emulating refers to the CPU emulating the instruction that caused the exception while handling the exception in kernel state. The emulated instruction is not directly executed by the hardware in kernel state (due to the lack of an FPU, direct execution of floating-point branch instructions is impossible). Instead, the operating system kernel simulates the effects of its correct execution in software. As we'll see below, even if the emulated instruction can be executed directly by the hardware, it must never be executed directly in kernel state; it must first return to user state.

[0047] The following uses trap and emulate to simulate floating-point branch instructions as an example to illustrate the simulation process. The simulation of floating-point branch instructions can be divided into two scenarios: simulation of floating-point branch instructions without delay slots and simulation of floating-point branch instructions with delay slots. 1. The simulation process of floating-point branch instructions without delay slots specifically includes the following steps: For the following instruction sequence, where "BC1T Label" is a floating-point branch instruction and "Label:" is a note (not an instruction) for the branch target: ORI 6, 6, 7 BC1T Label ADDIU 3, 4, 88 LW 5, 0( 3) ...... Label: SW 6, 0( 2) ...... (1) If the branch condition is met, jump to the branch target (i.e., the "Label:"), and the expected execution flow is as follows: ORI 6, 6, 7 (Jump) SW 5, 0( 2) ...... (2) If the branch condition is not met, no jump occurs. The expected execution flow is as follows: ORI 6, 6, 7 (Do not jump) ADDIU 3, 4, 88 LW 5, 0( 3) ...... Then, when the floating-point branch instruction "BC1T Label" needs to be captured and simulated, the kernel will simulate one of the above execution flows based on the branch condition.

[0048] 1. Because the CPU does not have an FPU, executing a floating-point branch instruction (such as "BC1T Label" in the above instruction sequence) causes an exception, causing the CPU to enter kernel mode; 2. The CPU recognizes in kernel mode that the exception is caused by an attempt to execute a floating-point branch instruction in a CPU without an FPU. 3. The CPU parses the floating-point branch instruction in kernel mode to determine whether the branch condition is met, and then determines the target address for continued execution: (1) If the branch condition is met, the target address for continued execution is the branch target address (such as the "SW 5, 0( 2)" the address where the instruction is located); (2) If the branch condition is not met, the target address for continued execution is the address of the next instruction after the floating-point branch instruction (such as the "ADDIU 3, 4, 88" instruction address); 4. The kernel modifies the Exception Program Counter (EPC) to the target address; 5. The kernel ends exception handling, causing the CPU to switch from kernel mode to user mode. The CPU will automatically resume execution from the address pointed to by the EPC; 6. The CPU resumes execution in user mode, causing the execution flow to jump to the above target address.

[0049] 2. The simulation process of floating-point branch instructions with delay slots specifically includes the following steps: The delay slot is a concept in computer architecture, particularly in some instruction set architectures that employ pipelined execution. A delay slot is the instruction slot immediately following a branch instruction. The instructions in this slot are executed before the branch instruction (in other words, the delay slot's instructions take effect before the branch instruction). This design improves pipeline utilization because the pipeline can continue executing instructions in the delay slot while the branch instruction is executing. The delay slot exists to overcome pipeline stalls caused by branch instructions, allowing subsequent instructions to continue executing before the branch instruction's result is determined, thereby improving overall execution efficiency. Instructions placed in the delay slot are typically unrelated to the branch instruction to ensure program correctness.

[0050] Assuming the delay slot length is 1 instruction, for the following instruction sequence, where "BC1T Label" is a floating-point branch instruction, "ADDIU 3, 4, 88" is the instruction in the delay slot, and "Label:" is the annotation of the branch target (not the instruction): ORI 6, 6, 7 BC1T Label ADDIU 3, 4, 88 LW 5, 0( 3) ...... Label: SW 6, 0( 2) ...... (1) If the branch condition is met, jump to the branch target (i.e., the "Label:"), and the expected execution flow is as follows: ORI 6, 6, 7 ADDIU 3, 4, 88 (Jump) SW 6, 0( 2) ...... (2) If the branch condition is not met, no jump occurs. The expected execution flow is as follows: ORI 6, 6, 7 ADDIU 3, 4, 88 (Do not jump) LW 5, 0( 3) ...... Note that according to the definition of the delay slot, the instructions in the delay slot take effect before the branch instruction itself, so the execution flow looks as if the instructions in the delay slot are executed first, and regardless of whether the branch condition is met, the instructions in the delay slot must be executed. So, when it is necessary to capture and simulate the floating-point branch instruction "BC1T Label", the kernel must simulate one of the above execution flows based on the branch condition; at the same time, for the instructions in the delay slot (such as the instruction "ADDIU 3, 4, 88”), regardless of whether they are unimplemented instructions on the CPU, they must be carefully handled by the kernel when captured and emulated to accurately form the expected execution flow.

[0051] As can be seen from the above, the instruction in the delay slot could be almost any instruction in the instruction set. It's unrealistic for the kernel to recognize all instructions in the instruction set. Therefore, the kernel can't directly simulate the instructions in the delay slot in kernel mode. To simulate the instructions in the delay slot, it's necessary to temporarily write an instruction sequence containing the instructions in the delay slot to an idle memory address in user space and then resume execution at the idle memory address where the instruction sequence was written. Furthermore, simulation of the instructions in the delay slot must be completed in user mode, as the instructions in the delay slot can be any instruction, posing significant security risks. Simulating them in kernel mode could potentially create security vulnerabilities. Therefore, to execute the above instruction sequence in user mode, kernel mode exception handling must be terminated first, followed by a return to user mode. After the instruction sequence is executed, kernel mode must be reentered to perform finishing work, resulting in significant overhead.

[0052] Specifically, the simulation process of floating-point branch instructions with delay slots includes the following steps: 1. Because the CPU does not have an FPU, executing a floating-point branch instruction (such as "BC1T Label" in the above instruction sequence) causes an exception, causing the CPU to enter kernel mode; 2. The CPU recognizes in kernel mode that the exception is caused by an attempt to execute a floating-point branch instruction in a CPU without an FPU. 3. The CPU parses the floating-point branch instruction in kernel mode to determine whether the branch condition is met: (1) If the branch condition is met: ① The kernel state is the target address to be continued when the simulation is successful (i.e. the branch target address, such as the "SW 5, 0( 2)” instruction) for subsequent use; ② The kernel generates an instruction sequence and writes it to the temporary instruction location in the user space. The instructions in the instruction sequence are: the instruction in the delay slot of the floating-point branch instruction (assuming that the delay slot width of the instruction set architecture is n, then there are n instructions in the delay slot. For example, in the above instruction sequence, the delay slot width is 1, and the instruction in the delay slot is "ADDIU 3, 4,88") and an instruction that raises an exception; ③ The kernel modifies the EPC to the specified location in the user space where the above instruction sequence is located; ④The CPU finishes exception handling, switches from kernel mode to user mode, and resumes execution from the address pointed to by the EPC; ⑤ The above instruction sequence is executed in user mode, so that the instructions in the delay slot are executed and produce the expected effect; ⑥ Since the end of the instruction sequence is an instruction that causes an exception, the CPU falls into kernel mode again for exception handling; ⑦ The kernel recognizes that the exception is caused by the simulation of the delay slot; ⑧The kernel modifies the EPC to the target address for continued execution stored in step ①, and cleans up the instruction sequence stored at the specified location in the user space; ⑨The CPU completes exception handling, switches from kernel mode to user mode, and resumes execution from the address pointed to by the EPC; ⑩ The CPU resumes execution so that the execution flow starts from the jump target, and the instructions in the delay slot have already produced the expected effect. Therefore, the expected behavior when the branch condition is met is met, that is, the simulation of the floating-point branch instruction with a delay slot when the branch condition is met is completed; (2) If the branch condition is not met: ① In kernel mode, modify EPC to the address of the first instruction in the delay slot of the floating-point branch instruction (since the instructions in the delay slot should be executed regardless of whether the branch condition is met, when the branch condition is not met, execution can be resumed directly from the first instruction in the delay slot) (such as the "ADDIU 3, 4, 88" instruction address); ②The CPU completes exception handling, switches from kernel mode to user mode, and resumes execution from the address pointed to by the EPC; ③The CPU resumes execution so that the execution flow starts from the first instruction in the delay slot, satisfying the expected behavior when the branch condition is not met, that is, completing the simulation of the floating-point branch instruction with delay slot when the branch condition is not met.

[0053] The simulation of floating-point branch instructions with delay slots shows that kernel state only simulates a floating-point branch instruction with delay slots by modifying the EPC when the branch condition is not met. However, when the branch condition is met, both the delay slot and the jump must be simulated, and it is impossible to achieve both simultaneously by simply modifying the EPC. Therefore, a temporary instruction sequence is introduced to simulate the delay slot alone and then re-enter kernel state to complete the jump.

[0054] However, allocating a section of user-space memory to store a temporary instruction sequence is expensive, significantly slowing down the simulation of floating-point branch instructions. Furthermore, if the instructions in the delay slot are relative to the program counter (PC), the memory addresses of the instructions copied to the delay slot in the temporary instruction sequence are no longer their original addresses, preventing PC-related instructions from executing correctly. The PC is a register in the CPU that stores the memory address of the instruction to be executed, typically a virtual address. If no branch or jump instructions are encountered during program execution, the value of the PC increases monotonically as the program executes. However, branch and jump instructions change the PC value, causing it to point not to the address of the next instruction after the current one, but to the destination specified by the branch or jump instruction. The effect of a PC-related instruction depends on the value of the PC; in other words, the same PC-related instruction can have different effects under different PC values. Therefore, if there is a PC-associated instruction in the delay slot, when it is copied to the temporary instruction sequence and then executed, the value of PC falls within the memory address range where the temporary instruction sequence is located, but not within the memory address range where the original delay slot is located, which will cause the effect during execution to not match the expected effect.

[0055] In order to solve the above problems in the simulation process of floating-point branch instructions with delay slots, the embodiment of the present application proposes an instruction bypass method, such as Figure 1 As shown, the execution subject of the method can be a CPU, a chip in the CPU, or a functional module in the CPU, and this application does not limit this. The following takes the execution subject as an example to illustrate that the method includes: Step 101: When the CPU is executing a target program in user mode, if an exception occurs, the CPU switches to kernel mode.

[0056] Exemplarily, an instruction matcher is provided in the CPU. When the CPU executes any instruction in the target program in user mode, the instruction matcher determines whether the instruction is the same as the pre-configured instruction in the instruction matcher. If they are the same, an exception is caused and the CPU switches to kernel mode.

[0057] The instruction matcher is composed of a matching unit and a matching item storage unit, wherein multiple matching units can be set to speed up the matching speed. The matching unit receives the indication information of the instruction to be processed. The instruction prompt information can be the machine code of the instruction, the address of the instruction in the memory, or the internal number of the instruction. The input source of the matching unit can be output from the instruction fetch unit inside the processor to the matching unit, or from other units in the processor that maintain the pipeline state to the matching unit. This application does not limit this. After the matching unit performs the match, it decides whether to trigger an exception based on the match result. The matching item storage unit provides matching items for use by the matching unit when performing the match.

[0058] Step 102: The CPU determines, in kernel mode, a bypass instruction sequence corresponding to the target instruction causing the exception.

[0059] For example, after entering kernel mode, the CPU processes the exception by first determining the exception type and whether a bypass instruction sequence is required to avoid wasting system resources. After the CPU determines in kernel mode that the exception is for instruction bypass, it determines the bypass instruction sequence corresponding to the target instruction that caused the exception.

[0060] Step 103: After the CPU writes the bypass instruction sequence into the leading instruction buffer in the kernel state, it returns to the user state; the leading instruction buffer is a pre-set buffer.

[0061] Exemplarily, the leader instruction buffer is set in the CPU; or, the leader instruction buffer is set in the memory, which is not limited in this application. If it is set in the CPU, the kernel can use privileged instructions to write the bypass instruction sequence into the buffer. If it is set in the memory, it can be set at a fixed memory address; or, it can be set at a configurable memory address, which is not limited in this application. If it is set at a configurable memory address, a configuration register that can only be read and written by the kernel state or a higher privileged state can be introduced to configure the memory address where the leader instruction buffer is located and the length of the leader instruction buffer. In this way, for frequently used bypass instruction sequences, the kernel can store them in the memory and record the memory addresses of each of these bypass instruction sequences, and when they are needed, only the address of the required bypass instruction sequence and its length need to be written into the configuration register, eliminating the overhead of repeatedly generating and writing bypass instruction sequences and enhancing performance.

[0062] With the introduction of the Precursor Instruction Buffer, after the CPU returns from kernel mode to user mode, it checks the Precursor Instruction Buffer for bypass instruction sequences. If a bypass instruction sequence exists, it is first executed in user mode. This is a purely hardware-based behavior, not directed by software. This ensures that if a bypass instruction sequence exists, it is executed and cannot be bypassed, ensuring the normal operation of the instruction bypass function is not affected by software errors.

[0063] If a bypass instruction sequence exists, the bypass instruction sequence is executed. After the CPU executes the bypass instruction sequence in user mode, it clears the leading instruction buffer. Clearing the leading instruction buffer is also a purely hardware behavior and is not instructed by software. First, it ensures that even if the bypass instruction sequence contains sensitive data, it will not be leaked after the bypass instruction sequence is executed. Second, it ensures that the bypass instruction sequence will not be accidentally executed again after being executed once (unless the kernel actively fills the leading instruction buffer later), ensuring that the normal operation of instruction bypass is not affected by software errors. Third, it saves the CPU the overhead of handling exceptions unrelated to instruction bypass in kernel mode. Otherwise, when the CPU handles exceptions unrelated to instruction bypass in kernel mode, it will need to manually clear the leading instruction buffer to prevent the previous bypass instruction sequence from being executed after the exception handling returns.

[0064] It's important to note that if the leader instruction buffer is set at a configurable memory address, then after the CPU executes the bypass instruction sequence in user mode, when clearing the leader instruction buffer, it doesn't need to clear the data at the corresponding memory address (i.e., the bypass instruction sequence). Instead, it only clears the configuration register for the memory address of the leader instruction buffer and / or the configuration register for the length of the leader instruction buffer. This reduces the overhead and latency of clearing the leader instruction buffer, while allowing the bypass instruction sequence in memory to be reused later, improving performance.

[0065] In addition, before the CPU is restored to the user state, the CPU writes the memory address to the EPC in the kernel state, so that after the CPU is restored to the user state, the CPU executes the bypass instruction sequence in the user state and continues to execute the target program through the memory address indicated by the EPC.

[0066] In computer architecture, especially processors with pipeline and out-of-order execution capabilities, precise exceptions mean that when an exception occurs, it is necessary to know exactly which instruction caused the exception. In other words, precise exceptions ensure that the reported EPC value is the address of the instruction that actually caused the exception. The EPC stores the memory address of the instruction that caused the exception. The instruction pointed to by the EPC is actually equivalent to not being executed, or in other words, because the exception was caused, all states are automatically rolled back by the CPU to the state before the instruction was executed.

[0067] The existence of EPC has the following significance: ① The CPU needs to return to its original position after handling an exception in kernel state. When returning from an exception, the CPU reads the EPC and changes the PC to continue normal execution; ② When handling an exception in kernel state, the CPU sometimes needs to change the return position. For example, when returning from an instruction, the CPU can modify the value of EPC in kernel state. In this way, when returning from an exception, the CPU will use the new value of EPC to continue execution; ③ The CPU needs to read the EPC in kernel state to determine how to handle the exception. For example, when using trap and emulate to simulate instructions, the CPU needs to read the instruction pointed to by EPC in kernel state in order to further parse and simulate the instruction.

[0068] Step 104: After executing the bypass instruction sequence in the user mode, the CPU continues to execute the target program.

[0069] As mentioned above, if the instructions in the delay slot are PC-relative, the memory addresses of the instructions copied into the temporary instruction sequence will no longer be their original addresses, causing PC-relative instructions to fail to execute correctly. A PC-relative instruction is one whose execution effect is tied to the address where the instruction resides. A notable characteristic of PC-relative instructions is that even if two PC-relative instructions are identical, their execution effects can differ when they reside at different memory addresses. For example, relative branch instructions and PC-relative memory access instructions: relative branch instructions add an offset to the PC to obtain the branch target address, then jump to the branch target address. In other words, the branch target address is the address of the current instruction plus the offset. Memory access instructions all have a memory target address, and the memory target address of PC-relative memory access instructions is the PC plus the offset, that is, the address of the current instruction plus the offset. Therefore, even if two instructions appear to be identical, if they reside at different memory addresses (resulting in different PCs at execution time), the final branch / memory access target address will be different.

[0070] To solve the problem that PC-associated instructions cannot be executed correctly, the present application introduces a configuration register that can only be read and written in kernel mode or a higher privileged state, which is used to configure the apparent address of the first instruction in the bypass instruction sequence, that is, to determine the apparent address of the first instruction in the bypass instruction sequence and write the apparent address of the first instruction into the configuration register; the effect of the apparent address is to regard the instruction as existing at a specific memory address; and the apparent address of the first instruction in the bypass instruction sequence is determined to be the apparent address of the first instruction plus the distance between the first instruction and the first instruction in the predecessor instruction buffer (the first instruction is any instruction in the predecessor instruction buffer other than the first instruction); in other words, the apparent addresses of subsequent instructions in the bypass instruction sequence can be calculated by sequentially adding the lengths of each instruction, and the apparent address of the subsequent instruction is equivalent to the distance between it and the first instruction plus the apparent address of the first instruction. Therefore, it is only necessary to configure the apparent address of the first instruction in the bypass instruction sequence.

[0071] It's important to note that the apparent address doesn't represent the actual address of the predecessor instruction buffer, as the predecessor instruction buffer isn't necessarily located in memory, and even if it is, it might be at a different address. The apparent address of each instruction in the bypass instruction sequence is used to: When each instruction is executed, if there are instructions associated with the PC, the apparent address is used as the PC to participate in the execution of the instruction, thereby ensuring that the PC-associated instructions produce the correct effect.

[0072] Further exemplarily, when the CPU executes a bypass instruction sequence in user mode, if the bypass instruction sequence includes a PC-associated instruction, the PC-associated instruction is executed, and when the PC-associated instruction is executed, the PC-associated instruction is deemed to exist at the apparent address of the PC-associated instruction, and the resulting PC-associated effect is determined by the apparent address of the PC-associated instruction.

[0073] If the memory access target address or jump target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the effective memory access target or jump target is still located in the target program. This is because: the configuration of the apparent address only causes the leading instruction buffer to appear to be "obscured" on the corresponding memory area (the original data in the memory area has not changed), but the obscuration is only effective when the bypass instruction sequence is executed, and it does not take effect on the target program itself. If the memory access target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the instruction should access the original data in the memory area, not the data in the leading instruction buffer; otherwise, if the target program accesses the leading instruction buffer, it will not be able to obtain the expected data in the first place, and it will also cause the leakage of sensitive data in the leading instruction buffer. Similarly, if the jump target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the expected jump target of the instruction should still be the instruction on the memory area of the target program itself, rather than the instruction in the leading instruction buffer; otherwise, if the target program jumps to the leading instruction buffer, first of all, it will not be able to obtain the correct execution flow, and it will also cause the bypass instruction sequence in the leading instruction buffer to be executed incorrectly. At this time, the effective memory access target or jump target is still in the target program, which can ensure that the existence of the leading instruction buffer will not destroy the correct execution of any existing instruction flow, and can also protect the instructions in the leading instruction buffer from being detected, thereby improving the security of sensitive data. At the same time, it ensures that instruction bypass can only be triggered by instruction matching and kernel exception handling, and any attempt by the target program to actively jump to the leading instruction buffer will not succeed, thereby improving the security of instruction bypass.

[0074] If the address pointed to by any jump instruction in the bypass instruction sequence is the apparent address of the second instruction in the bypass instruction sequence (the second instruction is any instruction in the predecessor instruction buffer), then jump to the second instruction; in this way, branches and loops are effectively allowed to exist in the bypass instruction sequence, making it possible to construct complex predecessor instruction sequences, thereby increasing flexibility and functionality.

[0075] This application introduces an instruction bypass framework that allows processor security enhancements to be upgraded without hardware modifications. By configuring bypass, most hardware vulnerabilities can be fixed with minimal performance overhead, preventing any information from being leaked, significantly improving security. It also provides an efficient way to capture and emulate arbitrary instructions.

[0076] The interaction between steps 101 to 104 can also be referred to Figure 2 The so-called bypass is another path different from the common path. In most cases, the instruction will not be matched, and the original execution path is the common path (actually the target program itself). Figure 2 As shown in the user state (common path) in , when the instruction is matched, the instruction bypasses the common path. The bypass is another path taken at this time, as shown in Figure 2 As shown in the user mode (precursor instruction buffer) in .

[0077] The following describes several application scenarios of the instruction bypass method proposed in the embodiments of the present application: 1. Simulation of floating-point branch instructions with delay slots In this scenario, the target instruction is a floating-point branch instruction with a delay slot. It should be noted that for processors without an FPU, since executing a floating-point branch instruction will cause an exception, it is not necessary to configure an instruction matcher to trigger an exception and enter kernel mode. When the CPU determines the bypass instruction sequence corresponding to the target instruction that caused the exception in kernel mode, it obtains the N instructions following the floating-point branch instruction as the bypass instruction sequence; N is the width of the delay slot, and N is a positive integer. If the floating-point branch instruction is also used to modify a register, the N instructions following the floating-point branch instruction and the instruction that modifies the register are used as the bypass instruction sequence.

[0078] Specifically, the process of implementing the simulation of a floating-point branch instruction with a delay slot using the instruction bypass method proposed in the embodiment of the present application is as follows: 1. Because the CPU does not have an FPU, executing a floating-point branch instruction (such as "BC1T Label" in the instruction sequence shown above with a delay slot length of 1 instruction, and the instruction sequence referenced below is the same) causes an exception, causing the CPU to enter kernel mode; 2. The CPU recognizes in kernel mode that the exception is caused by an attempt to execute a floating-point branch instruction in a CPU without an FPU. 3. The CPU parses the floating-point branch instruction in kernel mode to determine whether the branch condition is met: 4. In kernel state, the CPU determines the bypass instruction sequence based on the floating-point branch instruction and writes the bypass instruction sequence into the leading instruction buffer. The instructions in the bypass instruction sequence are: ① N instructions after the floating-point branch instruction, that is, the instructions in the delay slot of the floating-point branch instruction (such as "ADDIU 3, 4, 88"); ② If the floating-point branch instruction modifies some registers, such as the return address register, then add instructions for modifying the corresponding registers at the end of the bypass instruction sequence, such as instructions for loading an immediate value into the instruction register; if the floating-point branch instruction does not modify some registers, then the bypass instruction sequence only includes instructions in the delay slot of the floating-point branch instruction; 5. The CPU modifies the EPC to the branch target address in the kernel state (such as the "SW 5, 0( 2)" instruction is located at the address where it is located), and the apparent address register of the first instruction in the bypass instruction sequence is set to the address where the first instruction in the delay slot is located (that is, the original address where the delay slot is located, such as the "ADDIU 3, 4, 88"); if the width N of the delay slot is greater than 1, the address of the instruction in the delay slot is the address of the first instruction in the delay slot; 6. The kernel state completes the exception handling, and the CPU returns to the user state. It is determined that there is a bypass instruction sequence in the predecessor instruction buffer. Therefore, the CPU resumes execution from the predecessor instruction buffer. 7. The predecessor instruction buffer allows the instructions in the delay slot to be executed, and after the bypass instruction sequence is executed, the CPU resumes execution from the address pointed to by the EPC, causing the execution flow to jump to the branch target address.

[0079] One thing that needs to be explained is that in step 7, the order of executing the bypass instruction sequence and resuming execution from the address pointed to by the EPC cannot be changed. The bypass instruction sequence must be executed first, and then the execution from the address pointed to by the EPC must be resumed. In other words, the delay slot must be simulated before the jump is simulated. This is mainly because some floating-point branch instructions have some additional execution effects (including register modification, etc.) in addition to the jump. According to the definition of the delay slot, the instructions in the delay slot cannot see the execution effect of the branch instruction. Therefore, if the order is reversed and the floating-point branch instruction is simulated first, the instructions in the delay slot will see the execution effect of the floating-point branch instruction when they are simulated, which violates this rule.

[0080] The instruction bypass method proposed in the embodiments of the present application minimizes the number of kernel state traps and enables instructions in the delay slot to be directly executed by hardware without software emulation, thus efficiently completing the simulated execution of floating-point branch instructions with delay slots. Furthermore, because the instructions in the delay slot are simply copied to the predecessor instruction buffer and properly configured so that the apparent address is the address of the original instruction in the delay slot, the bypass instruction sequence accurately produces the expected effect of the instructions in the delay slot regardless of the instruction in the delay slot, without requiring the kernel to recognize these instructions. Furthermore, because the bypass instruction sequence in the predecessor instruction buffer is executed in user mode, this further ensures that this simulation does not violate security measures or cause kernel state vulnerabilities. Because this simulation method is not limited by the addressing range of immediately addressed unconditional jump instructions, it eliminates the need for a second kernel state trap to achieve the jump. Furthermore, due to the self-cleaning and non-reentrant nature of the predecessor instruction buffer, no special cleanup is required, achieving efficient simulation.

[0081] 2. Mitigating Side Channel Attacks: For side channel attacks, since side channel attacks need to measure the side effects of hardware, the following instructions are repeatedly executed during the measurement phase of the side channel attack: ①Get and record the current clock; ②Execute instructions that may be affected by the above side effects; ③Get and record the current clock; Among them, instructions ① and ③ are used to determine the time it takes to execute instruction ②. After instructions ① to ③ are repeatedly executed, the attacker can use statistical analysis to analyze the time required to execute instruction ② under different conditions. The statistical characteristics obtained from the analysis can be used to leak sensitive data through the side channel, causing a side channel attack.

[0082] This attack is possible because the side effects of the above instructions are related to the value of sensitive data, and the high precision of the hardware clock makes it possible to accurately measure such side effects.

[0083] If the instruction bypass method proposed in the embodiment of the present application is used to mitigate side channel attacks, the target instruction is a clock acquisition instruction, and the bypass instruction sequence corresponding to the target instruction is used to generate inaccurate clock information. This makes the time required for the execution of the above-mentioned instruction ② obtained by analysis inaccurate. Furthermore, the statistical features obtained by analysis are inaccurate, making the statistical features leaked from the side channel unable to carry information. The generation of inaccurate clock information can be further divided into: ① Generate inaccurate clock information: modify the EPC to the address of the next instruction after the target instruction, that is, the address of the next instruction after the instruction for obtaining the clock, copy the instruction for obtaining the clock to the leading instruction buffer as the first instruction, and the subsequent bypass instruction sequence uses the value on the target register or target memory address to perform an operation with a random value, and writes the operation result to the target register or target memory address, so that the clock information obtained by the target register or target memory address is inaccurate; wherein, the random value can be a random value randomly embedded in the immediate field of the instruction when the CPU determines the bypass instruction sequence in the kernel state, or it can be a random value obtained by itself during the execution of the bypass instruction sequence. This application does not limit the source of the random value.

[0084] ② Generating incorrect clock information: Inserting several instructions into the preceding instruction buffer modifies the EPC to the address of the instruction following the instruction that acquires the clock. This is equivalent to skipping the instruction that acquires the clock. This maintains the value in the target register or target memory address. Alternatively, the EPC is modified to the address of the instruction following the instruction that acquires the clock, while the bypass instruction sequence writes a meaningless value to the target register or target memory address, effectively replacing the instruction that acquires the clock. Whether skipping the instruction that acquires the clock or replacing the instruction that acquires the clock, both methods can achieve the goal of generating incorrect clock information.

[0085] 3. Implementing Pointer Authentication Code (PAC)

[0086] The PAC feature utilizes the fact that the 64-bit architecture doesn't require the full 64-bit address space, using only the VA_SIZE bits. It embeds authentication code in the unused bits to authenticate a pointer, a process known as PAC signing. It then verifies the validity of the authentication code before using the pointer, a process known as PAC signature verification. PAC can prevent malicious attacks and improve software security.

[0087] PAC is not limited to 64-bit architectures. For N-bit architectures, it only needs to satisfy that N is greater than VA_SIZE.

[0088] Without loss of generality, taking the 64-bit architecture as an example, the functions of each binary bit of the 64-bit address are as follows: Figure 3As shown, the valid bits of a typical 64-bit pointer only contain a total of VA_SIZE binary bits (from bit 0 to bit VA_SIZE-1); the remaining binary bits (from bit VA_SIZE to bit 63) are used to mark high / low addresses (i.e. kernel mode / user mode). For high addresses, all the binary bits are 1, or, for low addresses, all the binary bits are 0. Since the values are subject to the aforementioned restrictions, we call them reserved bits.

[0089] With the introduction of PAC, reserved bits are allocated to PAC for use in embedding signatures. The pointer embedded with PAC (also called signature) is as follows Figure 4 Optionally, if you need to keep the high / low address identity in the signed pointer, then Figure 5 As shown, one of the reserved bits (HL) is selected as the high / low address identification bit, and the remaining bits are used to embed the signature. A pointer means that an address is stored somewhere, so pointers and addresses are also applicable. Figure 3 、 4 、5.

[0090] The timing for performing PAC signing can be before the target instruction backs up the return address after the function call is completed to the stack or register, or after the target instruction backs up the return address after the function call is completed to the stack or register; the timing for performing PAC signature verification can be before the target instruction reads the return address after the function call is completed from the stack or register, or after the target instruction reads the return address after the function call is completed from the stack or register. This application does not limit this. The following describes the PAC signing and signature verification process: 1. Implement the PAC signature process: Based on the timing of the PAC signature, the target instruction should be one that backs up the return address after a function call to the stack or to the return register. The bypass instruction sequence corresponding to the target instruction is used to generate a signed pointer. The signature is generated using the key, the stack pointer, and the return address; the pointer represents the return address.

[0091] This application embodiment provides two PAC signature solutions: Solution 1: The bypass instruction sequence corresponding to the target instruction includes the key and the first signature instruction sequence, such as Figure 6 As shown, the key can be embedded in the first signature instruction sequence; the first signature instruction sequence is used to instruct the key, stack pointer (the stack pointer can also be called context, which is the address read in the stack pointer register and used to represent the top of the stack) and return address to be input into the first preset algorithm to generate a PAC as a signature. After the PAC is embedded in the reserved bit of the pointer, a pointer with a signature is obtained.

[0092] Solution 2: Before the CPU determines the bypass instruction sequence corresponding to the target instruction that caused the exception in kernel state, the CPU inputs the key and stack pointer into the second preset algorithm in kernel state to generate a PAC intermediate value, such as Figure 7 As shown, the PAC intermediate value is embedded in the second signature instruction sequence. The bypass instruction sequence corresponding to the target instruction includes the PAC intermediate value and the second signature instruction sequence. The CPU executes the second signature instruction sequence in user mode. The second signature instruction sequence is used to input the PAC intermediate value and return address into a third preset algorithm to generate a PAC as a signature. After the PAC is embedded in the reserved bit of the pointer, a signed pointer is obtained.

[0093] Compared to Option 2, Option 1 mentioned above, in Option 1, the CPU only needs to embed the key into the first signature instruction sequence in kernel state. If the key remains unchanged, the first signature instruction sequence also does not need to be changed, and the use of the second preset algorithm is not involved. Therefore, in Option 1, the CPU stays in kernel state for a very short time, and the CPU can quickly determine the first signature instruction sequence and restore from kernel state to user state, reducing the probability of system freezes. However, in Option 1, the key is used in the leader instruction buffer, which may be leaked, making it less secure than Option 2.

[0094] Furthermore, in the second solution described above, after the CPU inputs the key and stack pointer into the second preset algorithm in kernel mode, it can use the key and stack pointer as the key, and store the PAC intermediate value as the value corresponding to the key. When the PAC intermediate value is subsequently needed, it can be directly searched based on the key and stack pointer, eliminating the need to use the second preset algorithm to generate the PAC. This reduces CPU overhead in kernel mode and improves the efficiency of determining bypass instruction sequences. Alternatively, the second signature instruction sequence can be directly stored as the value corresponding to the key. In this case, the second signature instruction sequence can be directly determined when the key and stack pointer are used as the key for search, further improving the efficiency of determining bypass instruction sequences.

[0095] 2. Implement the PAC signature verification process: Based on the timing of the above-mentioned PAC signature verification, it can be determined that the target instruction should be the instruction that reads the return address after the function call is completed from the stack, or the instruction that reads the return address after the function call is completed from the return address register; for the PAC signature verification process, the bypass instruction sequence corresponding to the target instruction is used to verify the signed pointer.

[0096] This application embodiment also provides two PAC signature verification solutions: Solution 1: The bypass instruction sequence corresponding to the target instruction includes the key and the first signature verification instruction sequence, such as Figure 8As shown, the key can be embedded in the first signature verification instruction sequence; the first signature verification instruction sequence is used to instruct the key, stack pointer and return address represented by the pointer to be input into the first preset algorithm to obtain the reference PAC and determine whether the reference PAC is the same as the signature; Figure 8 As shown, at this time, the pointer includes a signature and a return address. The signature is stripped from the pointer to obtain the signature and the return address represented by the pointer. The key, stack pointer and the return address represented by the pointer are input into the first preset algorithm to obtain a reference PAC, and the consistency of the signature and the reference PAC is verified; if they are inconsistent, the signature verification fails; if they are consistent, the signature verification passes, and the pointer after stripping the signature is placed back to the original location of the pointer with the signature read, that is, in the stack or return register.

[0097] Solution 2: Before the CPU determines the bypass instruction sequence corresponding to the target instruction that caused the exception in kernel mode, it determines a reference PAC intermediate value based on the key and the stack pointer. When determining the reference PAC intermediate value, the key and the stack pointer can be used as keys for search. If the value corresponding to the key (i.e., the PAC intermediate value) is found, it is determined as the reference PAC intermediate value. Currently, the key and the stack pointer can also be input into a second preset algorithm to generate a PAC as the reference PAC intermediate value.

[0098] The bypass instruction sequence corresponding to the target instruction includes the reference PAC intermediate value and the second signature verification instruction sequence, such as Figure 9 As shown, the reference PAC intermediate value can be embedded in the second signature verification instruction sequence; the second signature verification instruction sequence is used to instruct the reference PAC intermediate value and the return address represented by the pointer to be input into the third preset algorithm to obtain the reference PAC and determine whether the reference PAC is the same as the signature. Specifically, Figure 9 As shown, the pointer now includes a signature and a return address. By stripping the signature from the pointer, the return address represented by the signature and pointer can be obtained. The reference PAC intermediate value and the return address are input into a third preset algorithm to obtain a reference PAC. The signature and reference PAC are verified to be consistent. If they are inconsistent, the signature verification fails; if they are consistent, the signature verification passes, and the pointer with the signature stripped is placed back to the pointer with the signature read, that is, in the stack or return register. On the other hand, the second signature verification instruction sequence can also be directly stored as the value corresponding to the key. When the key and stack pointer are used as keys for search, the second signature verification instruction sequence can be directly determined, further improving the efficiency of determining the bypass instruction sequence.

[0099] The instruction bypass method proposed in the embodiment of the present application achieves efficient execution behavior flexibility with minimal hardware overhead, and can protect existing programs with PAC without recompiling or modifying existing programs, thereby improving security; and on an instruction set architecture with delay slots, it implements efficient and secure floating-point branch instruction simulation for processors without FPU, and has a wide range of application scenarios.

[0100] The division of units in the embodiments of the present application is illustrative and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of the present application may be integrated into a single processor, or may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0101] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0102] Obviously, those skilled in the art may make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include these modifications and variations.

Claims

1. An instruction bypass method, characterized in that: Applicable to central processing unit CPU, including: When the CPU is executing the target program in user mode, if an exception occurs, it will switch to kernel mode; The CPU determines, in kernel mode, a bypass instruction sequence corresponding to the target instruction causing the exception; After the CPU writes the bypass instruction sequence into the leading instruction buffer in the kernel state, it returns to the user state; the leading instruction buffer is a pre-set buffer; After executing the bypass instruction sequence in the user mode, the CPU continues to execute the target program.

2. The method according to claim 1, wherein An instruction matcher is provided in the CPU; When the CPU is executing the target program in user mode, if an exception occurs, it will switch to kernel mode, including: When the CPU executes any instruction in the target program in the user state, the instruction matcher determines whether the instruction is the same as the pre-configured instruction in the instruction matcher. If they are the same, an exception is triggered and the state is switched to the kernel state.

3. The method according to claim 1, wherein The CPU determines, in kernel mode, a bypass instruction sequence corresponding to the target instruction causing the exception, including: After the CPU determines in kernel mode that the exception is used to perform instruction bypass, it determines a bypass instruction sequence corresponding to the target instruction that caused the exception.

4. The method according to claim 1, wherein Before restoring to user mode, it also includes: The CPU writes the memory address to the exception program counter EPC in kernel mode; After the CPU executes the bypass instruction sequence in the user mode, the CPU continues to execute the target program, including: After the CPU executes the bypass instruction sequence in the user mode, it continues to execute the target program through the memory address indicated by the EPC.

5. The method according to claim 1, wherein The CPU executes the bypass instruction sequence in user mode, including: The CPU checks in user mode whether there is a bypass instruction sequence in the preceding instruction buffer; If a bypass instruction sequence exists, the bypass instruction sequence is executed.

6. The method according to claim 1, wherein The leading instruction buffer is set in the CPU; or, the leading instruction buffer is set in the memory.

7. The method according to any one of claims 1 to 6, wherein: Before restoring to user mode, it also includes: Determining an apparent address of a first instruction in the bypassed instruction sequence and writing the apparent address of the first instruction into a configuration register; the apparent address having the effect of treating the instruction as if it were present at a specific memory address; The CPU executes the bypass instruction sequence in user mode, including: Determining the apparent address of the first instruction in the bypass instruction sequence as the apparent address of the first instruction plus the distance between the first instruction and the first instruction in the predecessor instruction buffer; the first instruction is any instruction in the predecessor instruction buffer except the first instruction; If the bypass instruction sequence includes a program counter PC-related instruction, when the PC-related instruction is executed, the PC-related effect generated is determined by the apparent address of the PC-related instruction.

8. An instruction bypass device, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when executed by a processor.

Images