Instruction bypass method, device and storage medium

Abstract

The application provides an instruction bypass method, device and storage medium, the method is suitable for a CPU, and the method comprises the following steps: in the process that the CPU executes a target program in a user mode, the CPU is turned into a kernel mode if an exception occurs; the CPU determines a bypass instruction sequence corresponding to a target instruction causing the exception in the kernel mode; the CPU is restored to the user mode after the bypass instruction sequence is written into a leading instruction buffer in the kernel mode; the leading instruction buffer is a preset buffer; and the CPU continues to execute the target program after executing the bypass instruction sequence in the user mode. By using the method, the CPU only needs to enter the kernel mode once to complete the instruction bypass, the residence time of the CPU in the kernel mode is reduced, and the probability of system freezing of the CPU is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer processors, and in particular to an instruction bypass method, device and storage medium. BACKGROUND

[0002] More and more attack methods targeting at vulnerabilities put many computers in potential danger. In order to alleviate this problem, many processors provide security reinforcement functions at the hardware level. However, new security reinforcement functions require the use of new processors, and old processors cannot benefit from new technologies, and sometimes must require the upgrade of existing software, resulting in that the old version of the software still cannot be protected by the new security reinforcement function.

[0003] On the other hand, modern processors are too complex, and errors may occur during design, resulting in hardware vulnerabilities. Existing repair methods cannot completely avoid the leakage of information by hardware vulnerabilities, and can only protect specific sensitive information, and the unprotected information can still be leaked; and it is difficult to repair hardware vulnerabilities, which usually affects the overall performance, and sometimes it is even impossible to repair without losing functionality, and in rare cases it is even completely impossible to repair.

[0004] On the other hand, many processors today omit the floating point unit (FPU) for cost saving, resulting in the inability to execute floating point branch instructions. The so-called floating point branch instruction is a branch instruction that requires the use of a floating point register or a control register in the FPU. For processors without an FPU, executing a floating point branch instruction will trigger an exception, but the instruction set of these processors defines floating point branch instructions, and the current common solution is to simulate floating point branch instructions by kernel capturing the exception triggered by the floating point branch instruction executed by the processor without an FPU.

[0005] However, the existence of the delay slot brings certain difficulty to the above-mentioned kernel simulating floating point branch instructions by capturing exceptions. The delay slot is the instruction slot position immediately following the branch instruction. If the width of the delay slot is n, then the n instructions following the branch instruction are the instructions in the delay slot. The instructions in the delay slot can be any instruction in the instruction set. It is unrealistic for the kernel to be able to recognize all instructions in the instruction set, and therefore, a sequence of instructions is temporarily written to a free memory address in the user space to simulate the instructions in the delay slot. In this way, a free memory address in the user space needs to be found every time the delay slot is simulated, which is low in efficiency. SUMMARY

[0006] The present application provides an instruction bypass method, device and storage medium to improve the efficiency of instruction bypass.

[0007] In a first aspect, the application provides an instruction bypass method, comprising:

[0008] If an exception occurs during execution of a target program by the CPU in a user mode, the CPU switches to a kernel mode;

[0009] The CPU determines, in the kernel mode, a bypass instruction sequence corresponding to a target instruction causing the exception;

[0010] The CPU writes the bypass instruction sequence into a pre-configured buffer in the kernel mode, and then switches back to the user mode.

[0011] The CPU executes the bypass instruction sequence in the user mode, and then continues to execute the target program.

[0012] After the CPU switches from the user mode to the kernel mode due to an exception, if the kernel mode identifies that the exception is for instruction bypass, the kernel mode determines a bypass instruction sequence corresponding to a target instruction causing the exception, writes the bypass instruction sequence into a pre-configured buffer, and then switches back to the user mode. Since the CPU only needs to spend a short time in the kernel mode to determine the bypass instruction sequence corresponding to the target instruction, the CPU only needs to stay in the kernel mode for a short time, and then switches back to the user mode, thereby reducing the time for the CPU to be in the kernel mode and reducing the probability of system freezing. In addition, the buffer is pre-configured, and there is no need to find a target write area for the bypass instruction sequence each time, so that the CPU can quickly execute the bypass instruction sequence in the user mode to complete instruction bypass, thereby improving the efficiency of instruction bypass.

[0013] In a possible implementation, an instruction matcher is arranged in the CPU.

[0014] If an exception occurs during execution of a target program by the CPU in a user mode, the CPU switches to a kernel mode, comprising:

[0015] When the CPU executes any instruction in the target program in the user mode, the CPU determines, by the instruction matcher, whether the instruction is identical to a pre-configured instruction in the instruction matcher, and if so, causes an exception and switches to the kernel mode.

[0016] The preconfigured instruction in the instruction matcher can be changed according to the scene to which the instruction bypass method is applied. For example, if the preconfigured instruction is set as an instruction for obtaining a current clock to alleviate a side channel attack, or if the preconfigured instruction is set as an instruction for backing up a return address of a function call to a stack to implement a pointer authentication code (PAC), or if the preconfigured instruction is set as an instruction for reading the return address of the function call from the stack. That is, the preconfigured instruction in the instruction matcher can be changed to implement the instruction bypass in different application scenarios, and the instruction bypass method proposed in the embodiments of the present application has a wide range of application scenarios and good flexibility.

[0017] In a possible design, the CPU determines the bypass instruction sequence corresponding to the target instruction that causes the exception in the kernel mode, including:

[0018] After the CPU determines that the exception is used for instruction bypass in the kernel mode, the CPU determines the bypass instruction sequence corresponding to the target instruction that causes the exception.

[0019] After the CPU enters the kernel mode, the CPU judges the type of the exception, and determines the bypass instruction sequence only after determining that the exception is used for instruction bypass, thereby avoiding waste of system resources.

[0020] In a possible design, before the CPU recovers to the user mode, the method further includes:

[0021] The CPU writes the memory address into an exception program counter (EPC) in the kernel mode.

[0022] After the CPU executes the bypass instruction sequence in the user mode, the CPU continues to execute the target program, including:

[0023] After the CPU executes the bypass instruction sequence in the user mode, the CPU continues to execute the target program through the memory address indicated by the EPC.

[0024] In a possible design, the CPU executes the bypass instruction sequence in the user mode, including:

[0025] The CPU checks whether the bypass instruction sequence exists in the pilot instruction buffer in the user mode.

[0026] If the bypass instruction sequence exists, the CPU executes the bypass instruction sequence.

[0027] After the CPU recovers to the user mode from the kernel mode, the CPU first checks whether the bypass instruction sequence exists in the pilot instruction buffer. If the bypass instruction sequence exists, the CPU executes the bypass instruction sequence first, and then continues to execute the target program from the memory address pointed to by the EPC after the execution of the bypass instruction sequence is completed. If the bypass instruction sequence does not exist, the CPU directly continues to execute the target program from the memory address pointed to by the EPC.

[0028] In a possible design, the pilot instruction buffer is arranged in a CPU; or the pilot instruction buffer is arranged in a memory.

[0029] In a possible design, after the CPU executes the bypass instruction sequence in the user mode, the CPU further comprises the following steps of:

[0030] emptying the pilot instruction buffer.

[0031] After the CPU executes the bypass instruction sequence in the user mode, the pilot instruction buffer is cleaned in time, so that even if the pilot instruction buffer contains sensitive data, the sensitive data will not be leaked after the execution of the pilot instruction buffer is completed, and the security is improved; and the CPU can also save the overhead of processing an exception irrelevant to the instruction bypass in the kernel mode, otherwise, the CPU needs to manually empty the pilot instruction buffer when processing the exception irrelevant to the instruction bypass in the kernel mode, so as to prevent the execution of the last bypass instruction sequence after the return of the exception processing.

[0032] In a possible design, before the CPU returns to the user mode, the CPU further comprises the following steps of:

[0033] determining the apparent address of the first instruction in the bypass instruction sequence and writing the apparent address of the first instruction into a configuration register; the apparent address has an effect of regarding the instruction as existing on a specific memory address;

[0034] The CPU executes the bypass instruction sequence in the user mode, and the method comprises the following steps of:

[0035] determining the apparent address of the first instruction in the bypass instruction sequence as the apparent address of the first instruction plus the distance between the first instruction and the first instruction in the pilot instruction buffer; the first instruction is any instruction in the pilot instruction buffer except the first instruction;

[0036] If the bypass instruction sequence comprises a program counter (PC) associated instruction, the PC associated effect generated when the PC associated instruction is executed is determined by the apparent address of the PC associated instruction.

[0037] If the bypass instruction sequence comprises a PC associated instruction, the apparent address can be used as the PC to participate in the execution of the bypass instruction sequence, so that the PC associated bypass instruction sequence can generate a correct effect.

[0038] In a possible design, the method further comprises the following steps of:

[0039] If the memory access target address or the jump target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the effective memory access target or jump target is still located in the target program.

[0040] If the memory target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the memory target address should access the data on the memory, not the data in the lead instruction buffer; similarly, if the jump target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the jump target address should jump to the instruction in the target program at the jump target address, not the instruction in the lead instruction buffer. In this way, it is ensured that the existence of the lead instruction buffer does not destroy the correct execution of any existing instruction stream, and the bypass instruction sequence in the lead instruction buffer cannot be detected, improving the security of sensitive data. At the same time, it is ensured that instruction bypass can only be triggered by instruction matching and kernel exception handling, and any attempt by the target program to actively jump to the lead instruction buffer will fail, improving the security of instruction bypass.

[0041] In a possible design, the method further includes:

[0042] If the jump target address of any instruction in the bypass instruction sequence is the apparent address of a second instruction in the bypass instruction sequence, jump to the second instruction; the second instruction is any instruction in the lead instruction buffer. In this way, branches and loops are effectively allowed to exist in the bypass instruction sequence, making it possible to construct complex lead instruction sequences, increasing flexibility and functionality.

[0043] In a possible design, the target instruction is an instruction for obtaining a clock;

[0044] The bypass instruction sequence corresponding to the target instruction is configured to generate inaccurate clock information.

[0045] Through the instruction for obtaining a clock, the target register or the target memory address obtains correct clock information, which may be used for side-channel attacks. When the bypass instruction sequence corresponding to the target instruction is configured to generate inaccurate clock information, the target register or the target memory address cannot obtain correct clock information, effectively mitigating side-channel attacks.

[0046] In a possible design, the target instruction is an instruction for backing up a return address after completion of a function call to a stack;

[0047] The bypass instruction sequence corresponding to the target instruction is configured to generate a signed pointer; the signature is generated by using a key, a stack pointer, and a return address; and the pointer is used to represent the return address.

[0048] In a possible design, the signature is generated by using a key, a stack pointer, and a return address, including:

[0049] The bypass instruction sequence corresponding to the target instruction includes a key and a first signature instruction sequence;

[0050] The first signature instruction sequence is used to indicate inputting the key, a stack pointer and the return address into a first preset algorithm to generate a pointer authentication code (PAC) as a signature.

[0051] In a possible design, before the CPU determines the bypass instruction sequence corresponding to the target instruction causing the exception in the kernel mode, the method further includes:

[0052] The CPU inputs the key and the stack pointer into a second preset algorithm to generate a PAC intermediate value in the kernel mode;

[0053] The bypass instruction sequence corresponding to the target instruction includes the PAC intermediate value and a second signature instruction sequence;

[0054] The CPU executes the bypass instruction sequence in the user mode, including:

[0055] The CPU executes the second signature instruction sequence in the user mode, and the second signature instruction sequence is used to input the PAC intermediate value and the return address into a third preset algorithm to generate the PAC as a signature.

[0056] In a possible design, after the CPU inputs the key and the stack pointer into the second preset algorithm to generate the PAC intermediate value in the kernel mode, the method further includes:

[0057] The CPU stores the key and the stack pointer as a key, and the PAC intermediate value as a value corresponding to the key in the kernel mode.

[0058] In a possible design, the target instruction is an instruction for reading a return address after completion of a function call from a stack;

[0059] The bypass instruction sequence corresponding to the target instruction is used to verify a signed pointer.

[0060] In a possible design, the bypass instruction sequence corresponding to the target instruction includes a key and a first signature instruction sequence;

[0061] The first signature instruction sequence is used to indicate inputting the key, a stack pointer and a return address represented by the pointer into a first preset algorithm to obtain a reference PAC and determine whether the reference PAC is same as the signature.

[0062] In a possible design, before the CPU determines the bypass instruction sequence corresponding to the target instruction causing the exception in the kernel mode, the method further includes:

[0063] determine the reference PAC intermediate value according to the key and the stack pointer;

[0064] The bypass instruction sequence corresponding to the target instruction includes the reference PAC intermediate value and a second signature verification instruction sequence.

[0065] The second signature verification instruction sequence is used to indicate inputting the reference PAC intermediate value and a return address represented by the pointer into a third preset algorithm to obtain a reference PAC and determine whether the reference PAC is same as the signature.

[0066] Since the CPU stores the key and the stack pointer as a key and the PAC as a value corresponding to the key after generating the PAC intermediate value in the kernel mode, the stored PAC intermediate value can be directly obtained according to the key and the stack pointer, and there is no need to input the key and the stack pointer into the second preset algorithm to generate the PAC intermediate value, thereby improving the obtaining efficiency of the bypass instruction sequence.

[0067] In a possible design, the target instruction is a floating-point branch instruction with a delay slot.

[0068] The CPU determines, in the kernel mode, a bypass instruction sequence corresponding to the target instruction that triggers the exception, including:

[0069] The N instructions after the floating-point branch instruction are obtained as the bypass instruction sequence; N is the width of the delay slot, and N is a positive integer.

[0070] In a possible design, the apparent address of the first instruction in the bypass instruction sequence is determined, including:

[0071] The address of the first instruction after the floating-point branch instruction in the memory is determined as the apparent address of the first instruction in the bypass instruction sequence.

[0072] In a possible design, the N instructions after the floating-point branch instruction are obtained as the bypass instruction sequence, including:

[0073] If the floating-point branch instruction is also used to modify a register, the N instructions after the floating-point branch instruction and the instruction for modifying the register are obtained as the bypass instruction sequence.

[0074] In a second aspect, the present application further provides an instruction bypass device, including a processor and a memory connected with the processor in communication.

[0075] The memory stores computer execution instructions.

[0076] The processor executes the computer execution instructions stored in the memory to implement the method in the first aspect.

[0077] In a third aspect, the present application provides a computer readable storage medium, the readable storage medium comprising a program, which when executed on an apparatus, causes the apparatus to perform the method of any one of the first aspect.

[0078] In a fourth aspect, the present application provides a computer program product, the computer program product comprising a computer program, which when executed by a processor, implements the method of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0079] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort based on these drawings.

[0080] Figure 1 Flowchart of the instruction bypass method provided by the embodiments of the present application;

[0081] Figure 2 Interaction diagram of the instruction bypass method provided by the embodiments of the present application;

[0082] Figure 3 Diagram of the role of each binary bit of 64-bit address;

[0083] Figure 4 Diagram of the pointer embedded with PAC when using pointer tag;

[0084] Figure 5 Diagram of the pointer embedded with PAC when not using pointer tag;

[0085] Figure 6 Diagram of scheme one of PAC signature provided by the embodiments of the present application;

[0086] Figure 7 Diagram of scheme two of PAC signature provided by the embodiments of the present application;

[0087] Figure 8 Diagram of scheme one of PAC signature verification provided by the embodiments of the present application;

[0088] Figure 9 Diagram of scheme two of PAC signature verification provided by the embodiments of the present application. DETAILED DESCRIPTION

[0089] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0090] The application scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute a limitation to the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the appearance of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems. In the description of the present application, unless otherwise specified, the meaning of “multiple” is two or more than two.

[0091] When some instructions are executed, an exception may be caused for various reasons, and the central processing unit (CPU) needs to enter the kernel state to handle the exception. Generally, the occurrence of an exception means that the currently executed program has a defect, and therefore, the final result of the kernel handling the exception is often destructive, for example, killing the current process. However, there is an exception case, that is, the exception is not caused by the defect of the program, but is caused by the irresistible force unrelated to the program. In this case, it is expected that the program can still run normally, and therefore, the CPU needs to simulate the instruction causing the exception in the kernel state, and the result of the simulation is as if the instruction is executed correctly.

[0092] A typical scenario in which the CPU simulates the instruction causing the exception in the kernel state is the simulation of the floating-point branch instruction in the background art. In order to save costs, the FPU is omitted in the CPU, so that when the floating-point branch instruction is encountered during the execution of the program, an exception will be caused. The well-designed operating system kernel (running in the kernel state) will simulate the floating-point branch instruction at this time, so that the effect of the correct execution of the floating-point branch instruction can be achieved without the FPU. Among them, the kernel state emphasizes a state of the CPU, and the state has high privileges (in practice, the kernel state and the kernel can be equivalent); in contrast to the kernel state, another state of the CPU is the user state, and the user state has no privileges and the operations that can be performed are limited. In the two states, software runs on the CPU, and the software running in the kernel state is usually referred to as the operating system kernel (kernel for short), and the software running in the user state is usually referred to as the user program.

[0093] At present, the CPU in kernel mode usually adopts trap and emulate to simulate the floating point branch instruction, and trap and emulate can also be called capture and simulation. Trap refers to the CPU capturing an exception in kernel mode, and emulate refers to the CPU processing the exception in kernel mode, and simulating the instruction causing the exception. The simulated instruction will not be directly executed by hardware in kernel mode (since there is no FPU, it is impossible to directly execute the floating point branch instruction), but the operating system kernel simulates the effect that should be produced if the instruction is correctly executed in a software manner. As will be seen below, even if the simulated instruction can be directly executed by hardware, it must not be directly executed by hardware in kernel mode, but must first return to user mode.

[0094] The following takes the simulation of the floating point branch instruction by using trap and emulate as an example to illustrate the simulation process. The simulation of the floating point branch instruction can be divided into two scenarios: the simulation of the floating point branch instruction without a delay slot, and the simulation of the floating point branch instruction with a delay slot.

[0095] I. The simulation process of the floating point branch instruction without a delay slot specifically includes the following steps:

[0096] For the instruction sequence shown below, where "BC1T Label" is a floating point branch instruction, and "Label:" is a label (not an instruction) of a branch target:

[0097] ORI 6, 6, 7

[0098] BC1T Label

[0099] ADDIU 3, 4, 88

[0100] LW 5, 0( 3) ...

[0102] Label:

[0103] SW 6, 0( 2) ...

[0105] (1) If the branch condition is met, jump to the branch target (i.e. the label "Label:"), and the expected execution flow is as follows:

[0106] ORI 6, 6, 7

[0107] (jump)

[0108] SW 5, 0( 2) ...

[0110] (2) If the branch condition is not satisfied, then do not jump, and the expected execution flow is as follows:

[0111] ORI 6, 6, 7

[0112] (no jump)

[0113] ADDIU 3, 4, 88

[0114] LW 5, 0( 3) ...

[0116] Then, when the floating point branch instruction "BC1T Label" needs to be captured and emulated, the kernel emulates one of the above execution flows according to the branch condition.

[0117] 1. Since there is no FPU in the CPU, the execution of the floating point branch instruction (such as "BC1T Label" in the above instruction sequence) causes an exception, causing the CPU to enter the kernel state;

[0118] 2. The CPU recognizes in the kernel state that the exception is caused by attempting to execute a floating point branch instruction in a CPU without an FPU;

[0119] 3. The CPU parses the floating point branch instruction in the kernel state to determine whether the branch condition is satisfied, and then determines the target address for continued execution:

[0120] (1) If the branch condition is satisfied, then the target address for continued execution is the branch target address (such as the address where the "SW 5, 0( 2)" instruction in the above instruction sequence is located);

[0121] (2) If the branch condition is not satisfied, then the target address for continued execution is the address where the next instruction of the floating point branch instruction is located (such as the address where the "ADDIU 3, 4, 88" instruction in the above instruction sequence is located);

[0122] 4. The kernel modifies the Exception Program Counter (EPC) to the target address;

[0123] 5. The kernel ends the exception handling, causing the CPU to switch from kernel mode to user mode, and the CPU will automatically resume execution from the address pointed by the EPC;

[0124] 6. The CPU resumes execution in user mode, causing the execution flow to jump to the target address.

[0125] II. The simulation process of the floating point branch instruction with delay slot includes the following steps:

[0126] A delay slot is a concept in computer architecture, and is used more widely in some instruction set architectures with pipelined execution. The delay slot is a slot of instructions following the branch instruction, and the instructions in this slot are executed before the branch instruction (in other words, the instructions in the delay slot have effects earlier than the branch instruction). This design can improve the utilization of the pipeline, because when the branch instruction is executed, the pipeline can continue to execute the instructions in the delay slot. The delay slot exists to overcome the pipeline stall caused by the branch instruction, so that the subsequent instructions can be executed before the branch instruction judgment result, improving the overall execution efficiency. The instructions placed in the delay slot are usually unrelated to the branch instruction, to ensure the correctness of the program.

[0127] Suppose the length of the delay slot is 1 instruction, for the following instruction sequence, where "BC1T Label" is the floating point branch instruction, "ADDIU 3, 4, 88" is the instruction in the delay slot, and "Label:" is the label of the branch target (not an instruction):

[0128] ORI 6, 6, 7

[0129] BC1T Label

[0130] ADDIU 3, 4, 88

[0131] LW 5, 0( 3) ...

[0133] Label:

[0134] SW 6, 0( 2) ......

[0136] (1) If the branch condition is satisfied, then jump to the branch target (i.e. at the label "Label:"), the expected execution flow is as follows:

[0137] ORI 6, 6, 7

[0138] ADDIU 3, 4, 88

[0139] (jump)

[0140] SW 6, 0( 2) ......

[0142] (2) If the branch condition is not satisfied, then do not jump, the expected execution flow is as follows:

[0143] ORI 6, 6, 7

[0144] ADDIU 3, 4, 88

[0145] (no jump)

[0146] LW 5, 0( 3) ......

[0148] Note that according to the definition of the delay slot, the instruction in the delay slot produces effect before the branch instruction itself, so the execution flow looks like the instruction in the delay slot is executed first, and the instruction in the delay slot is executed regardless of whether the branch condition is satisfied or not. Therefore, when the floating point branch instruction "BC1T Label" needs to be captured and emulated, the kernel should emulate one of the above execution flows according to the branch condition; meanwhile, the instruction in the delay slot (e.g. the instruction "ADDIU 3, 4, 88" in the above instruction sequence) must be handled carefully by the kernel when capturing and emulating, in order to accurately form the expected execution flow, regardless of whether it is an instruction not implemented on the CPU or not.

[0149] As discussed above, the instructions in the delay slot can be almost any instruction in the instruction set. It's unrealistic for the kernel to recognize all instructions in the instruction set. Therefore, the kernel cannot directly simulate the instructions in the delay slot in kernel mode. To simulate the instructions in the delay slot, a sequence of instructions containing the instructions in the delay slot needs to be temporarily written to a free memory address in user space, and execution resumes at that free memory address. Furthermore, the simulation of the instructions in the delay slot must be completed in user mode because the instructions in the delay slot can be any instruction, posing a significant security risk. Simulating them in kernel mode could introduce security vulnerabilities. Therefore, executing the instruction sequence in user mode requires first ending exception handling in kernel mode, returning to user mode, and then re-entering kernel mode for cleanup after the instruction sequence has finished executing—a very costly process.

[0150] Specifically, the simulation process of floating-point branch instructions with delay slots includes the following steps:

[0151] 1. Since the CPU does not have an FPU, an exception was triggered when executing a floating-point branch instruction (such as "BC1T Label" in the above instruction sequence), causing the CPU to enter kernel mode.

[0152] 2. The CPU recognizes this exception in kernel mode as being caused by an attempt to execute a floating-point branch instruction in a CPU without an FPU;

[0153] 3. The CPU parses the floating-point branch instruction in kernel mode to determine whether the branch condition is met:

[0154] (1) If the branch condition is satisfied:

[0155] ① The kernel mode specifies the target address to continue execution upon successful emulation (i.e., the branch target address, such as "SW" in the instruction sequence above). 5, 0( 2) The address where the instruction is located is stored for later use;

[0156] ② The kernel-mode generated instruction sequence is written to the location of temporary instructions in user space. The instructions in the instruction sequence are as follows: instructions in the delay slots of floating-point branch instructions (assuming the delay slot width of the instruction set architecture is n, then there are n instructions in the delay slot; for example, in the above instruction sequence, the delay slot width is 1, and the instruction in the delay slot is "ADDIU"). 3, 4,88” and an instruction that caused an exception;

[0157] ③ In kernel mode, the EPC is modified to the specified location in user space where the above instruction sequence is located;

[0158] 4. The CPU ends the exception handling, goes from kernel mode to user mode, and resumes execution from the address pointed by EPC;

[0159] 5. The above instruction sequence is executed in user mode, so that all instructions in the delay slot are executed and the expected effect is produced;

[0160] 6. Since the end of the instruction sequence is an instruction that raises an exception, the CPU is again brought into kernel mode for exception handling;

[0161] 7. The kernel recognizes that the exception is caused by the simulation of the delay slot;

[0162] 8. The kernel modifies EPC to the target address for resuming execution stored in step 1, and cleans up the instruction sequence stored in the specified location in user space;

[0163] 9. The CPU ends the exception handling, goes from kernel mode to user mode, and resumes execution from the address pointed by EPC;

[0164] 10. The CPU resumes execution so that the execution flow starts from the jump target, and the instructions in the delay slot have already produced the expected effect, thus satisfying the expected behavior when the branch condition is not satisfied, i.e., the simulation of the floating-point branch instruction with delay slot when the branch condition is not satisfied is completed;

[0165] (2) If the branch condition is not satisfied:

[0166] 1. The kernel modifies EPC to the address of the first instruction in the delay slot of the floating-point branch instruction (since the instructions in the delay slot should be executed regardless of whether the branch condition is satisfied or not, when the branch condition is not satisfied, the execution can be resumed directly from the first instruction in the delay slot) (such as the address of the "ADDIU 3, 4, 88" instruction in the above instruction sequence);

[0167] 2. The CPU ends the exception handling, goes from kernel mode to user mode, and resumes execution from the address pointed by EPC;

[0168] 3. The CPU resumes execution so that the execution flow starts from the first instruction in the delay slot, satisfying the expected behavior when the branch condition is not satisfied, i.e., the simulation of the floating-point branch instruction with delay slot when the branch condition is not satisfied is completed.

[0169] According to the simulation process of the floating-point branch instruction with the delay slot, it can be seen that the kernel state only completes the simulation of one floating-point branch instruction with the delay slot by modifying the EPC when the branch condition is not satisfied; but when the branch condition is satisfied, the simulation of the delay slot and the simulation of the jump must be completed, and it is impossible to complete the two points at the same time by means of modifying the EPC only. Therefore, a temporary instruction sequence is introduced for simulating the delay slot alone, and the kernel state is re-entered later to complete the jump.

[0170] However, the overhead of allocating a piece of memory in the user space for storing the temporary instruction sequence is relatively large, which significantly slows down the simulation speed of the floating-point branch instruction. In addition, if the instruction in the delay slot is related to the program counter (PC), the memory address of the instruction in the delay slot copied into the temporary instruction sequence is no longer the original address, which leads to the fact that the PC-related instruction cannot be executed correctly. The PC is a register in the CPU, which stores the memory address of the instruction to be executed by the CPU, generally a virtual address; if no branch or jump instruction is encountered during the execution of the program, the value of the PC will monotonically increase with the program execution; however, the branch and jump instructions will change the value of the PC, so that it does not point to the address of the next instruction of the current instruction, but points to the destination specified by the branch or jump instruction. The effect that the PC-related instruction should produce depends on the value of the PC; in other words, the same PC-related instruction can produce different effects under different PC values. Therefore, if there is a PC-related instruction in the delay slot, when the instruction is copied into the temporary instruction sequence and then executed, the value of the PC falls within the memory address range of the temporary instruction sequence, but not within the memory address range of the original delay slot, which will cause the effect during execution to be inconsistent with the expected effect.

[0171] To solve the above-mentioned problems existing in the simulation process of the floating-point branch instruction with the delay slot, an instruction bypassing method is provided in the embodiments of the present application, as shown in the figure, the execution subject of the method can be a CPU, or a certain chip in the CPU, or a certain functional module in the CPU, which is not limited in the present application. The execution subject is taken as the CPU for example in the following description, and the method comprises the following steps: Figure 1

[0172] Step 101: the CPU is in the user state during the execution of the target program, and if an exception occurs, the CPU is converted into the kernel state.

[0173] Exemplarily, an instruction matcher is arranged in the CPU, and when the CPU executes any instruction in the target program in the user state, the instruction matcher is used to determine whether the instruction is the same as the preconfigured instruction in the instruction matcher, and if the same, an exception is caused and the CPU is converted into the kernel state.

[0174] ​The instruction matcher is composed of a matching unit and a matching item storage unit. The matching unit can be set in multiple to accelerate the matching speed. The matching unit receives the indication information of the instruction to be processed. The instruction indication information can be the machine code of the instruction, the address of the instruction in the memory, or the internal number of the instruction. The input source of the matching unit can be output to the matching unit by the instruction fetch unit in the processor or by other units maintaining the pipeline state in the processor. The application does not limit this. The matching unit performs matching according to the matching result to determine whether to trigger an exception. The matching item storage unit provides matching items for the matching unit to perform matching.

[0175] Step 102: The CPU determines the bypass instruction sequence corresponding to the target instruction triggering the exception in the kernel state.

[0176] Exemplarily, after the CPU enters the kernel state, the exception is processed. First, the type of the exception is judged to determine whether the bypass instruction sequence needs to be determined to avoid waste of system resources. After the CPU determines in the kernel state that the exception is used for instruction bypass, the bypass instruction sequence corresponding to the target instruction triggering the exception is determined.

[0177] Step 103: The CPU writes the bypass instruction sequence into the pilot instruction buffer in the kernel state and then restores to the user state. The pilot instruction buffer is a pre-set buffer.

[0178] Exemplarily, the pilot instruction buffer is set in the CPU; or the pilot instruction buffer is set in the memory, which is not limited by the application. If it is set in the CPU, the kernel can use privileged instructions to write the bypass instruction sequence into the buffer. If it is set in the memory, it can be set at a fixed memory address; or it can be set at a configurable memory address, which is not limited by the application. If it is set at a configurable memory address, a configuration register that can only be read and written in the kernel state or a higher privileged state can be introduced to configure the memory address where the pilot instruction buffer is located and the length of the pilot instruction buffer. In this way, for frequently used bypass instruction sequences, the kernel can store them in the memory and record the memory addresses of these bypass instruction sequences, and when they are needed, only the address and length of the required bypass instruction sequence need to be written into the configuration register, which saves the overhead of repeatedly generating and writing the bypass instruction sequence and enhances the performance.

[0179] Due to the introduction of the pilot instruction buffer, after the CPU is restored from the kernel mode to the user mode, it is checked whether there is a bypass instruction sequence in the pilot instruction buffer, and if there is a bypass instruction sequence, it is executed in the user mode first, which is a pure hardware behavior and not instructed by software. In this way, it can be ensured that when there is a bypass instruction sequence, it must be executed and cannot be bypassed, and the normal operation of the instruction bypass function can be ensured not to be affected by software errors.

[0180] If there is a bypass instruction sequence, the bypass instruction sequence is executed, and after the CPU executes the bypass instruction sequence in the user mode, the pilot instruction buffer is emptied. Emptying the pilot instruction buffer is also a pure hardware behavior and not instructed by software, which can ensure that if the bypass instruction sequence contains sensitive data, it will not be leaked after the execution of the bypass instruction sequence is completed; it can also ensure that the bypass instruction sequence is not accidentally executed again after being executed once (unless the kernel subsequently actively fills the pilot instruction buffer), which can ensure the normal operation of the instruction bypass not to be affected by software errors; and it can save the CPU overhead of processing exceptions unrelated to instruction bypass in the kernel mode, otherwise the CPU needs to manually empty the pilot instruction buffer when processing exceptions unrelated to instruction bypass in the kernel mode to prevent the execution of the last bypass instruction sequence after the exception handling returns.

[0181] It should be noted that if the pilot instruction buffer is set at a configurable memory address, when the CPU empties the pilot instruction buffer after executing the bypass instruction sequence in the user mode, it does not need to empty the data at the corresponding memory address (i.e., the bypass instruction sequence), but only empties the configuration register for configuring the memory address where the pilot instruction buffer is located and / or the configuration register for configuring the length of the pilot instruction buffer. In this way, the overhead and delay of emptying the pilot instruction buffer can be reduced, and at the same time, the bypass instruction sequence on the memory can be reused subsequently, improving performance.

[0182] In addition, before the CPU is restored to the user mode, the CPU writes a memory address into the EPC in the kernel mode, so that after the CPU is restored to the user mode, the CPU continues to execute the target program through the memory address indicated by the EPC after executing the bypass instruction sequence in the user mode.

[0183] In computer architecture, especially in processors with pipeline and out-of-order execution functions, the so-called precise exception refers to the need to accurately know which instruction caused the exception when the exception occurs. In other words, precise exception ensures that the reported EPC value is the address of the instruction that actually caused the exception. The EPC stores the memory address of the instruction that triggered the exception. The instruction pointed to by the EPC is actually equivalent to not having been executed, or in other words, due to the exception, all states are automatically rolled back by the CPU to the state before the instruction was executed.

[0184] The presence of EPC has the following meanings: ① CPU needs to return to the original position after handling the exception in the kernel mode, and the CPU reads the EPC and changes the PC and then continues normal execution after the exception return; ② CPU needs to change the return position when handling the exception in the kernel mode, for example, skip an instruction when returning, then the CPU in the kernel mode can modify the value of EPC, so that when the exception returns, the CPU will use the new value of EPC to continue execution; ③ CPU needs to read EPC in the kernel mode to determine how to handle the exception, for example, when using the trap and emulate emulation instruction, the CPU in the kernel mode needs to read the instruction pointed to by EPC to further analyze and emulate the instruction.

[0185] Step 104: CPU continues to execute the target program after executing the bypass instruction sequence in the user mode.

[0186] It is mentioned above that if the instruction in the delay slot is PC-associated, the memory address of the instruction in the delay slot copied into the temporary instruction sequence is no longer the original address, which leads to the fact that the PC-associated instruction cannot be executed correctly. The so-called PC-associated instruction refers to an instruction whose effect is related to the address of the instruction. The significant feature of the PC-associated instruction is that even if two PC-associated instructions are exactly the same, when the two instructions are located at different memory addresses, the execution effects of the two instructions can be different. For example, the relative branch instruction and the PC-associated memory access instruction, the relative branch instruction is to add an offset to the PC to obtain a branch target address, and then jump to the branch target address, or in other words, the branch target address is the address of the current instruction plus the offset; the memory access instruction has a memory access target address, and the memory access target address of the PC-associated memory access instruction is the PC plus the offset, that is, the address of the current instruction plus the offset. It can be seen that even if two instructions are exactly the same in appearance, as long as they are located at different memory addresses (resulting in different PCs during execution), the final branch / memory access target address will be different.

[0187] To solve the problem that the PC-associated instruction cannot be executed correctly, the application introduces a configuration register which can only be read and written by the kernel state or higher privileged state, and is used to configure the apparent address of the first instruction in the bypass instruction sequence, i.e. to determine the apparent address of the first instruction in the bypass instruction sequence and write the apparent address of the first instruction into the configuration register; the effect of the apparent address is to make the instruction exist on a specific memory address; and the apparent address of the first instruction in the bypass instruction sequence is determined as the apparent address of the first instruction plus the distance between the first instruction and the first instruction in the lead instruction buffer (the first instruction is any instruction in the lead instruction buffer except the first instruction); in other words, the apparent addresses of the subsequent instructions in the bypass instruction sequence can be calculated by sequentially accumulating the lengths of each instruction, and the apparent address of the subsequent instruction is equivalent to the distance between the subsequent instruction and the first instruction plus the apparent address of the first instruction, therefore, only the apparent address of the first instruction in the bypass instruction sequence needs to be configured.

[0188] It should be noted that the apparent address does not represent the real address of the lead instruction buffer, because the lead instruction buffer does not necessarily exist on the memory, and even if it exists on the memory, it may exist on a different address. The apparent address of each instruction in the bypass instruction sequence is used to: when each instruction is executed, if there is an instruction behavior associated with the PC, the apparent address is used as the PC to participate in the execution of the instruction, thereby ensuring that the PC-associated instruction can produce the correct effect.

[0189] Further exemplarily, when the CPU executes the bypass instruction sequence in the user state, if the bypass instruction sequence includes a PC-associated instruction, the PC-associated instruction is executed, and when the PC-associated instruction is executed, the PC-associated instruction is considered to exist on the apparent address of the PC-associated instruction, and the PC-associated effect produced by the PC-associated instruction is determined by the apparent address of the PC-associated instruction.

[0190] If the memory access target address or the jump target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the effective memory access target or jump target is still in the target program. This is because: the configuration of the apparent address only causes the leading instruction buffer to appear to "mask" on the corresponding memory region (the original data of the memory region is not changed), but the masking only takes effect when the bypass instruction sequence is executed, and does not take effect on the target program itself. If the memory access target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the instruction accesses the original data of the memory region, rather than the data in the leading instruction buffer; otherwise, if the target program accesses the leading instruction buffer, it cannot obtain the expected data first, and sensitive data in the leading instruction buffer will be leaked. Similarly, if the jump target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the expected jump target of the instruction should still be the instruction on the memory region of the target program, rather than the instruction in the leading instruction buffer; otherwise, if the target program jumps to the leading instruction buffer, it cannot obtain the correct execution flow first, and the bypass instruction sequence in the leading instruction buffer will be executed incorrectly. At this time, the effective memory access target or jump target is still in the target program, which can ensure that the existence of the leading instruction buffer does not damage the correct execution of any existing instruction flow, and can protect the instructions in the leading instruction buffer from being detected, thereby improving the security of sensitive data. At the same time, it is ensured that instruction bypass can only be triggered by instruction matching and kernel exception handling, and any attempt of active jump to the leading instruction buffer by the target program cannot be successful, thereby improving the security of instruction bypass.

[0191] If the address pointed to by any jump instruction in the bypass instruction sequence is the apparent address of the second instruction in the bypass instruction sequence (the second instruction is any instruction in the leading instruction buffer), the second instruction is jumped to; in this way, branches and loops are effectively allowed to exist in the bypass instruction sequence, so that a complex leading instruction buffer can be constructed, thereby increasing flexibility and functionality.

[0192] The present application introduces the framework of instruction bypass, and can upgrade the security reinforcement function on the processor without hardware modification by configuring the bypass, repair most hardware vulnerabilities with low performance overhead by configuring the bypass, so that no information can be leaked, and the security is significantly improved. At the same time, an efficient implementation manner of capturing and simulating any instruction is also provided.

[0193] The interaction between the above steps 101 to 104 can also be referred to Figure 2, the so-called bypass, i.e. another path different from the common path, in most cases, the instruction will not be matched, and the original execution path is the common path (in fact, it is the target program itself), as shown in the user state (common path) in Figure 2 When the instruction is matched, the instruction bypasses the common path, and the bypass is another path at this time, as shown in the user state (pilot instruction buffer) in Figure 2 .

[0194] The following introduces several application scenarios of the instruction bypass method proposed in the embodiments of the present application:

[0195] I. Simulation of floating point branch instruction with delay slot

[0196] In this scenario, the target instruction is a floating point branch instruction with a delay slot. It should be noted that for a processor without an FPU, an exception will be triggered when the floating point branch instruction is executed, so it is not necessary to configure an instruction matcher to trigger an exception to enter the kernel state. When the CPU determines the bypass instruction sequence corresponding to the target instruction that triggers the exception in the kernel state, the N instructions after the floating point branch instruction are obtained as the bypass instruction sequence; N is the width of the delay slot, and N is a positive integer. If the floating point branch instruction is also used to modify the register, the N instructions after the floating point branch instruction and the instructions for modifying the register are taken as the bypass instruction sequence.

[0197] Specifically, the process of simulating a floating point branch instruction with a delay slot using the instruction bypass method proposed in the embodiments of the present application is as follows:

[0198] 1. Since there is no FPU in the CPU, the execution of the floating point branch instruction (such as "BC1T Label" in the instruction sequence with a delay slot length of 1 instruction as shown in the foregoing) triggers an exception, causing the CPU to enter the kernel state;

[0199] 2. The CPU recognizes in the kernel state that the exception is caused by attempting to execute a floating point branch instruction in a CPU without an FPU;

[0200] 3. The CPU parses the floating point branch instruction in the kernel state to determine whether the branch condition is satisfied:

[0201] 4. The CPU determines the bypass instruction sequence according to the floating point branch instruction in the kernel state, and writes the bypass instruction sequence into the pilot instruction buffer; the instructions in the bypass instruction sequence are as follows:

[0202] ① N instructions after the floating point branch instruction, i.e. instructions in the delay slot of the floating point branch instruction (such as "ADDIU 3, 4, 88" in the instruction sequence);

[0203] If the floating point branch instruction modifies some registers, for example, the return address register, then an instruction for modifying the corresponding register, for example, an instruction for loading an immediate number into the instruction register, is added at the end of the bypass instruction sequence; if the floating point branch instruction does not modify some registers, then the bypass instruction sequence only includes the instructions in the delay slot of the floating point branch instruction.

[0204] 5. The CPU modifies the EPC to the branch target address (such as the address of the "SWI 5, 0 2)" instruction in the instruction sequence) in the kernel mode, and also sets the apparent address register of the first instruction in the bypass instruction sequence to the address of the first instruction in the delay slot (that is, the address of the delay slot originally, such as the address of the "ADDIU 3, 4, 88" instruction in the instruction sequence); if the width N of the delay slot is greater than 1, then the address of the instructions in the delay slot is the address of the first instruction in the delay slot;

[0205] 6. The kernel mode ends the exception processing, and the CPU returns to the user mode. Since the leading instruction buffer exists the bypass instruction sequence, the CPU resumes the execution from the leading instruction buffer;

[0206] 7. The leading instruction buffer makes the instructions in the delay slot be executed, and after the execution of the bypass instruction sequence is completed, the CPU resumes the execution from the address pointed by the EPC, so that the execution flow jumps to the branch target address.

[0207] It should be noted that in step 7, the order of the execution of the bypass instruction sequence and the resuming of the execution from the address pointed by the EPC cannot be changed, and the execution of the bypass instruction sequence must be completed before the resuming of the execution from the address pointed by the EPC; that is, the simulation of the delay slot must be performed before the simulation of the jump, mainly because some floating point branch instructions have some additional execution effects (including the modification of registers) besides the jump, and according to the definition of the delay slot, the instructions in the delay slot cannot see the execution effects of the branch instruction. If the order is reversed, the simulation of the floating point branch instruction is performed first, which will cause the instructions in the simulated delay slot to see the execution effects of the floating point branch instruction, which violates the rule.

[0208] The instruction bypass method proposed in the embodiments of the present application can minimize the number of times of falling into the kernel state, enable the instructions in the delay slot to be directly executed by hardware without software simulation, and thus efficiently complete the simulation execution of the floating-point branch instruction with the delay slot. On the other hand, since the instructions in the delay slot are only copied to the leader instruction buffer, and are appropriately configured so that the apparent address is the address where the instructions in the delay slot originally locate, the bypass instruction sequence accurately produces the expected effect of the instructions in the delay slot regardless of the instructions in the delay slot, without the need for the kernel to recognize these instructions. On the other hand, since the bypass instruction sequence in the leader instruction buffer is executed in the user state, it is further ensured that such simulation will not damage the security measures and will not cause the kernel state to be vulnerable. Since this simulation method is not limited by the addressing range of the unconditional jump instruction with the immediate number addressing, the need for falling into the kernel state twice to achieve the jump is eliminated. In addition, since the leader instruction buffer has the self-cleaning and non-reentrant characteristics, there is no need to clean it specially, and the efficiency of the simulation is achieved.

[0209] II. Mitigate side-channel attacks

[0210] For side-channel attacks, since the side-channel attack needs to measure the side effects of the hardware, the following instructions are repeatedly executed during the measurement phase of the side-channel attack:

[0211] ① Get and record the current clock;

[0212] ② Execute instructions that may be affected by the above side effects;

[0213] ③ Get and record the current clock;

[0214] Among them, instructions ① and ③ are used to determine the time spent by instruction ②, and after instructions ①-③ are repeatedly executed, the attacker can analyze the time required by instruction ② under different conditions through statistical analysis, and the statistical characteristics obtained by the analysis can be used to leak sensitive data from the side channel, causing a side-channel attack.

[0215] The reason why this attack method is possible is that the side effects of the above instructions are related to the value of the sensitive data, and the high precision of the hardware clock makes it possible to accurately measure such side effects.

[0216] If the instruction bypass method proposed in the embodiments of the present application is used to mitigate side-channel attacks, the target instruction is the instruction for obtaining the clock, and the bypass instruction sequence corresponding to the target instruction is used to generate inaccurate clock information, so that the time required by the above instruction ② is inaccurate, and further, the statistical characteristics obtained by the analysis are inaccurate, so that the statistical characteristics leaked from the side channel cannot carry information; wherein generating inaccurate clock information can be further divided into:

[0217] ①Generate inaccurate clock information: modify the EPC to the address of the next instruction of the target instruction, i.e. the address of the next instruction of the instruction for obtaining the clock, copy the instruction for obtaining the clock into the leading instruction buffer as the first instruction, and the next bypass instruction sequence uses the value on the target register or target memory address to operate with a random value, and writes the operation result to the target register or target memory address, so that the target register or target memory address obtains inaccurate clock information; wherein the random value can be a random value randomly embedded in the immediate number field of the instruction by the CPU in the kernel state when determining the bypass instruction sequence, or a random value obtained by the bypass instruction sequence during execution, and the source of the random value is not limited by the present application.

[0218] ②Generate incorrect clock information: insert several instructions into the leading instruction buffer, modify the EPC to the address of the next instruction of the instruction for obtaining the clock, which is equivalent to skipping the instruction for obtaining the clock, so that the value in the target register or target memory address remains unchanged; or modify the EPC to the address of the next instruction of the instruction for obtaining the clock, and the bypass instruction sequence is used to write meaningless values into the target register or target memory address, which is equivalent to replacing the instruction for obtaining the clock. Whether it is to skip the instruction for obtaining the clock or to replace the instruction for obtaining the clock, it can achieve the purpose of generating incorrect clock information.

[0219] Three, implement pointer authentication code (Pointer Authentication Code, PAC)

[0220] The PAC function takes advantage of the fact that in 64-bit architecture, the complete 64-bit address space is not needed, but only VA_SIZE bits are used, and the authentication code is embedded in the unused bits to authenticate the pointer. The process is the signature process of PAC; and the authentication is verified before the pointer is used later. The process is the signature verification process of PAC. PAC can prevent the use of malicious attack techniques and improve software security.

[0221] PAC is not limited to 64-bit architecture, for N-bit architecture, only N greater than VA_SIZE is required.

[0222] Without loss of generality, taking 64-bit architecture as an example, the role of each binary bit of the 64-bit address is as follows Figure 3As shown, the valid bits of a typical 64-bit pointer only contain VA_SIZE binary bits (from the 0th bit to the VA_SIZE-1th bit) in total; the remaining binary bits (from the VA_SIZEth bit to the 63th bit) are used to mark the high / low address (i.e. the kernel mode / user mode), and for the high address, each binary bit therein is all 1, or for the low address, each binary bit therein is all 0, which is called the reserved bit due to the aforementioned limitation.

[0223] With the introduction of the PAC, the reserved bit is allocated to the PAC for embedding the signature, and the pointer embedded with the PAC (also called the signature) is as shown in Figure 4 Optionally, if it is required to reserve the identification of the high / low address in the signed pointer, a bit (HL) is selected from the reserved bit as the high / low address identification bit, and the remaining bits are used for embedding the signature, as shown in Figure 5 The pointer is to store an address somewhere, and thus the pointer and the address are both applicable to Figure 3 、 4 、5.

[0224] The timing of the PAC signature can be before or after the target instruction backs up the return address after the function call into the stack or the register; the timing of the PAC verification can be before or after the target instruction reads the return address after the function call from the stack or the register, which is not limited in the present application. The signature and verification process of the PAC are described as follows:

[0225] 1. The signature process of the PAC:

[0226] According to the timing of the PAC signature, the target instruction should be the instruction of backing up the return address after the function call into the stack, or the instruction of backing up the return address after the function call into the return register. The bypass instruction sequence corresponding to the target instruction is used to generate the signed pointer, and the signature is generated by the key, the stack pointer and the return address; the pointer is used to represent the return address.

[0227] The present application provides two PAC signature schemes:

[0228] Scheme 1: the bypass instruction sequence corresponding to the target instruction includes the key and the first signature instruction sequence, as shown in Figure 6As shown, the key can be embedded in the first signature instruction sequence; the first signature instruction sequence is used to indicate that the key, the stack pointer (the stack pointer can also be referred to as a context, which is an address read in the stack pointer register, used to represent the top of the stack) and the return address are input into a first preset algorithm to generate a PAC as a signature, and the PAC is embedded in the reserved bit of the pointer to obtain a signed pointer.

[0229] Scheme two: before the CPU in the kernel mode determines the bypass instruction sequence corresponding to the target instruction causing the exception, the CPU in the kernel mode inputs the key and the stack pointer into a second preset algorithm to generate a PAC intermediate value, as shown in Figure 7 The PAC intermediate value is embedded in the second signature instruction sequence. The bypass instruction sequence corresponding to the target instruction includes the PAC intermediate value and the second signature instruction sequence, and the CPU executes the second signature instruction sequence in the user mode; the second signature instruction sequence is used to input the PAC intermediate value and the return address into a third preset algorithm to generate a PAC as a signature, and the PAC is embedded in the reserved bit of the pointer to obtain a signed pointer.

[0230] Compared with scheme two, in scheme one, the CPU in the kernel mode only needs to embed the key in the first signature instruction sequence; when the key does not change, the first signature instruction sequence also does not need to change, and the use of the second preset algorithm is not involved. Therefore, the CPU in the kernel mode stays for a very short time in scheme one, the CPU can quickly determine the first signature instruction sequence and recover from the kernel mode to the user mode, and the probability of system freezing is reduced. However, the key in scheme one is used in the lead instruction buffer, and leakage may occur, and the security is not as good as that of scheme two.

[0231] In addition, in scheme two, after the CPU in the kernel mode inputs the key and the stack pointer into the second preset algorithm, the key and the stack pointer can be stored as a key, and the PAC intermediate value can be stored as a value corresponding to the key. When the PAC intermediate value needs to be used later, it can be directly looked up according to the key and the stack pointer, without the need to generate the PAC by using the second preset algorithm, thereby reducing the CPU overhead in the kernel mode and improving the determination efficiency of the bypass instruction sequence. On the other hand, the second signature instruction sequence can also be directly stored as the value corresponding to the key, so that when the key and the stack pointer are looked up as the key, the second signature instruction sequence can be directly determined, further improving the determination efficiency of the bypass instruction sequence.

[0232] 2. Realize the signature verification process of the PAC:

[0233] According to the above-mentioned timing of PAC signature verification, the target instruction should be an instruction for reading the return address after the completion of the function call from the stack or an instruction for reading the return address after the completion of the function call from the return address register; for the signature verification process of the PAC, the bypass instruction sequence corresponding to the target instruction is used to verify the signed pointer.

[0234] The embodiments of the present application also provide two PAC signature verification schemes.

[0235] Scheme one: the bypass instruction sequence corresponding to the target instruction includes a key and a first signature verification instruction sequence, as shown in the following table, the key can be embedded in the first signature verification instruction sequence; the first signature verification instruction sequence is used to indicate that the key, the stack pointer and the return address represented by the pointer are input into a first preset algorithm to obtain a reference PAC and determine whether the reference PAC is same as the signature; as shown in the following table, the pointer includes the signature and the return address, the signature is stripped from the pointer, the signature and the return address represented by the pointer are obtained, the key, the stack pointer and the return address represented by the pointer are input into the first preset algorithm to obtain the reference PAC, and it is verified whether the signature and the reference PAC are consistent; if not, the signature verification fails; if yes, the signature verification passes, and the pointer after stripping the signature is returned to the original position of the pointer with the signature read, i.e. the stack or the return register. Figure 8 Figure 8 Scheme two: before the CPU determines the bypass instruction sequence corresponding to the target instruction in the kernel mode, a reference PAC intermediate value is determined according to the key and the stack pointer; when the reference PAC intermediate value is determined, the key and the stack pointer can be used as a key to search, if the value corresponding to the key (i.e. the PAC intermediate value) is found, the value is determined as the reference PAC intermediate value; currently, the key and the stack pointer can also be input into a second preset algorithm to generate a PAC as the reference PAC intermediate value.

[0236] The bypass instruction sequence corresponding to the target instruction includes the reference PAC intermediate value and a second signature verification instruction sequence, as shown in the following table, the reference PAC intermediate value can be embedded in the second signature verification instruction sequence; the second signature verification instruction sequence is used to indicate that the reference PAC intermediate value and the return address represented by the pointer are input into a third preset algorithm to obtain a reference PAC and determine whether the reference PAC is same as the signature. Specifically, as shown in the following table, the pointer includes the signature and the return address, the signature is stripped from the pointer, the signature and the return address represented by the pointer are obtained, the reference PAC intermediate value and the return address are input into the third preset algorithm to obtain the reference PAC, and it is verified whether the signature and the reference PAC are consistent, if not, the signature verification fails; if yes, the signature verification passes, and the pointer after stripping the signature is returned to the position of the pointer with the signature read, i.e. the stack or the return register. On the other hand, the second signature verification instruction sequence can also be directly stored as the value corresponding to the key, so that when the key and the stack pointer are used as the key to search, the second signature verification instruction sequence can be directly determined, and the determination efficiency of the bypass instruction sequence is further improved.

[0237] The bypass instruction sequence corresponding to the target instruction includes the reference PAC intermediate value and a second signature verification instruction sequence, as shown in the following table, the reference PAC intermediate value can be embedded in the second signature verification instruction sequence; the second signature verification instruction sequence is used to indicate that the reference PAC intermediate value and the return address represented by the pointer are input into a third preset algorithm to obtain a reference PAC and determine whether the reference PAC is same as the signature. Specifically, as shown in the following table, the pointer includes the signature and the return address, the signature is stripped from the pointer, the signature and the return address represented by the pointer are obtained, the reference PAC intermediate value and the return address are input into the third preset algorithm to obtain the reference PAC, and it is verified whether the signature and the reference PAC are consistent, if not, the signature verification fails; if yes, the signature verification passes, and the pointer after stripping the signature is returned to the position of the pointer with the signature read, i.e. the stack or the return register. On the other hand, the second signature verification instruction sequence can also be directly stored as the value corresponding to the key, so that when the key and the stack pointer are used as the key to search, the second signature verification instruction sequence can be directly determined, and the determination efficiency of the bypass instruction sequence is further improved. Figure 9 Figure 9

[0238] ​​​The instruction bypass method provided in the embodiments of the present application realizes efficient execution behavior flexibility with minimum hardware overhead, can protect the existing program from the PAC under the premise of not recompiling or modifying the existing program, and improves the security; and on the instruction set architecture with delay slots, efficient and safe floating point branch instruction simulation is realized for the processor without FPU, and has a wide application scenario.

[0239] The division of units in the embodiments of the present application is illustrative, and is only a logical functional division. In actual implementation, another division manner can be used. In addition, each functional unit in each embodiment of the present application can be integrated in one processor, or can be physically separated, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0240] Although the preferred embodiments of the present application have been described, those skilled in the art can make further changes and modifications to the embodiments once they know the basic inventive concept. Therefore, the appended claims are intended to cover all the changes and modifications falling within the scope of the present application.

[0241] Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application also intends to include these modifications and variations.

Claims

1. An instruction bypass method, characterized by, The application is suitable for a central processing unit (CPU), comprising: If an exception occurs during execution of a target program in a user mode, the CPU switches to a kernel mode; The CPU determines a bypass instruction sequence corresponding to a branch instruction causing the exception in the kernel mode; the bypass instruction sequence comprises instructions in a delay slot of the branch instruction; After the CPU writes the bypass instruction sequence into a lead instruction buffer in the kernel mode, the CPU returns to the user mode; the lead instruction buffer is a pre-configured buffer; before returning to the user mode, the CPU further determines an apparent address of a first instruction in the bypass instruction sequence and writes the apparent address of the first instruction into a configuration register; the apparent address has an effect of making the instruction appear to exist at a specific memory address; the specific memory address is an address of a first instruction in the delay slot; After the CPU executes the bypass instruction sequence in the user mode, the CPU continues to execute the target program; when the CPU executes the bypass instruction sequence in the user mode, the CPU determines an apparent address of a first instruction in the bypass instruction sequence as the apparent address of the first instruction plus a distance between the first instruction and the first instruction in the lead instruction buffer; the first instruction is any instruction in the lead instruction buffer except the first instruction; if the bypass instruction sequence comprises a program counter (PC) associated instruction, a PC associated effect is determined by an apparent address of the PC associated instruction when the PC associated instruction is executed.

2. The method of claim 1, wherein, The CPU is provided with an instruction matcher; If an exception occurs during execution of a target program in a user mode, the CPU switches to a kernel mode, comprising: When the CPU executes any instruction in the target program in the user mode, the CPU determines whether the instruction is identical to a pre-configured instruction in the instruction matcher through the instruction matcher; if the instruction is identical to the pre-configured instruction, an exception is caused and the CPU switches to the kernel mode.

3. The method of claim 1, wherein, The CPU determines a bypass instruction sequence corresponding to a branch instruction causing the exception in the kernel mode, comprising: After the CPU determines that the exception is used for instruction bypassing in the kernel mode, the CPU determines a bypass instruction sequence corresponding to a branch instruction causing the exception.

4. The method of claim 1, wherein, Before returning to the user mode, the CPU further comprises: The CPU writes a memory address into an exception program counter (EPC) in the kernel mode; After the CPU executes the bypass instruction sequence in the user mode, the CPU continues to execute the target program, comprising: After the CPU executes the bypass instruction sequence in the user mode, the CPU continues to execute the target program through the memory address indicated by the EPC.

5. The method of claim 1, wherein, The CPU executes the bypass instruction sequence in the user mode, comprising: The CPU checks whether a bypass instruction sequence exists in the lead instruction buffer in the user mode; If the bypass instruction sequence exists, the CPU executes the bypass instruction sequence.

6. The method of claim 1, wherein, The lead instruction buffer is arranged in the CPU or the lead instruction buffer is arranged in a memory.

7. An instruction bypass apparatus characterized by comprising: Comprising: A processor and a memory connected to the processor in communication; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to implement the method in any one of claims 1-6.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer-executable instructions which, when executed by a processor, implement the method of any one of claims 1-6.

9. A computer program product, characterised in that, A computer program which, when executed by a processor, implements the method of any one of claims 1-6.

Images