Instruction bypass method

Abstract

The invention provides an instruction bypass method, which is suitable for a CPU (Central Processing Unit) and comprises the following steps that: in the process that the CPU executes a target program in a user mode, if an exception occurs, the CPU is converted into a kernel mode; the CPU determines a bypass instruction sequence corresponding to the target instruction causing the exception in a kernel mode; after the CPU writes the bypass instruction sequence into the pilot instruction buffer area in the kernel mode, the CPU is restored to the user mode; the bypass instruction sequence comprises instructions in a delay slot of the target instruction; the CPU executes the bypass instruction sequence in the user mode and continues to execute the target program after the bypass instruction sequence is executed. By the adoption of the method, the CPU can complete instruction bypass only by entering the kernel mode once, the dwell time of the CPU in the kernel mode is shortened, and the probability of system jamming of the CPU is reduced.

Description

[0001] This application is a divisional application. The original application has the application number 202511001252.0 and the original application date is July 21, 2025. The original application is entitled "An instruction bypass method, device and storage medium". The entire contents of the original application are incorporated herein by reference. Technical Field

[0002] This application relates to the field of computer processor technology, and in particular to an instruction bypass method. Background Technology

[0003] The increasing number of attack methods targeting vulnerabilities puts many computers at potential risk. To mitigate this problem, many processors offer hardware-level security hardening features. However, new security hardening features require new processors, and older processors cannot benefit from these new technologies. Sometimes, they even require upgrades to existing software, meaning that older versions of software are still not protected by the new security hardening features.

[0004] On the other hand, modern processors are too complex, and design errors can lead to hardware vulnerabilities. Existing patching methods cannot completely prevent information leakage due to hardware vulnerabilities; they can only protect specific sensitive information, while unprotected information can still be leaked. Moreover, patching hardware vulnerabilities is difficult, usually affecting overall performance, and sometimes it is even impossible to patch them without sacrificing functionality. In rare cases, they are even completely impossible to patch.

[0005] On the other hand, many modern processors omit the Floating Point Unit (FPU) for cost-saving reasons, making it impossible to execute floating-point branch instructions. Floating-point branch instructions are branch instructions that require the use of floating-point registers or control registers in the FPU. For processors without an FPU, executing floating-point branch instructions will cause an exception. However, these processors' instruction sets still define floating-point branch instructions. Currently, a common solution is for the kernel to catch the exceptions caused by processors without an FPU executing floating-point branch instructions and thus simulate floating-point branch instructions.

[0006] However, the existence of delay slots poses a challenge to the kernel's simulation of floating-point branch instructions by catching exceptions. A delay slot is an instruction slot immediately following a branch instruction. If the width of a delay slot is n, then the n instructions following the branch instruction are the instructions in the delay slot. The instructions in the delay slot can be any instruction in the instruction set. It's unrealistic for the kernel to recognize all instructions in the instruction set. Therefore, a sequence of instructions needs to be temporarily written to a free memory address in user space to simulate the instructions in the delay slot. Thus, a free memory address needs to be found in user space before each delay slot simulation, which is inefficient. Summary of the Invention

[0007] This application provides an instruction bypass method to improve the efficiency of instruction bypass.

[0008] In a first aspect, this application provides an instruction bypass method, the method comprising: If an exception occurs while the CPU is executing the target program in user mode, it will switch to kernel mode. After the CPU determines the bypass instruction sequence corresponding to the target instruction that caused the exception in kernel mode, it returns to user mode; the bypass instruction sequence includes the instructions in the delay slot of the target instruction; The CPU executes the bypass instruction sequence in user mode, and continues to execute the target program after the bypass instruction sequence has been completed.

[0009] When the CPU transitions from user mode to kernel mode due to an exception, the kernel mode recognizes that the exception was for instruction bypassing. It then determines the bypass instruction sequence corresponding to the target instruction that caused the exception, writes the bypass instruction sequence to a pre-defined buffer, and can then return to user mode. Because the CPU can determine the bypass instruction sequence corresponding to the target instruction in kernel mode in a short time, it only needs to stay in kernel mode for a very short time before returning to user mode, reducing the time the CPU spends in kernel mode and lowering the probability of system stuttering. Furthermore, since the buffer is pre-defined, it is not necessary to search for the target write region for the bypass instruction sequence each time, allowing the CPU to quickly execute the bypass instruction sequence in user mode to complete the instruction bypass, thus improving the efficiency of instruction bypassing.

[0010] In one possible design, the target instruction is an instruction to obtain the clock. The bypass instruction sequence corresponding to the target instruction is used to generate inaccurate clock information.

[0011] After the target register or target memory address obtains the correct clock information by obtaining the clock instruction, it may use the correct clock information to carry out a side-channel attack. When the bypass instruction sequence corresponding to the target instruction is used to generate inaccurate clock information, the target register or target memory address will not be able to obtain the correct clock information, effectively mitigating the side-channel attack.

[0012] In one possible design, the target instruction is an instruction that backs up the return address of the function call to the stack after the function call is completed; The bypass instruction sequence corresponding to the target instruction is used to generate a signed pointer; the signature is generated using a key, a stack pointer, and a return address; the pointer is used to represent the return address.

[0013] In one possible design, the signature is generated using a key, a stack pointer, and a return address, including: The bypass instruction sequence corresponding to the target instruction includes a key and a first signature instruction sequence; The first signature instruction sequence is used to instruct the input of the key, stack pointer and return address into a first preset algorithm to generate a pointer authentication code (PAC) as the signature.

[0014] In one possible design, before the CPU determines the bypass instruction sequence corresponding to the target instruction that caused the exception in kernel mode, the following is also included: In kernel mode, the CPU inputs the key and stack pointer into a second preset algorithm to generate an intermediate PAC value. The bypass instruction sequence corresponding to the target instruction includes the PAC intermediate value and the second signature instruction sequence; The CPU executes the bypass instruction sequence in user mode, including: The CPU executes the second signature instruction sequence in user mode. The second signature instruction sequence is used to input the intermediate value of the PAC and the return address into a third preset algorithm to generate a PAC as a signature.

[0015] In one possible design, after the CPU inputs the key and stack pointer into the second preset algorithm in kernel mode to generate the PAC intermediate value, it also includes: In kernel mode, the CPU uses the key and the stack pointer as keys, and stores the PAC intermediate value as the value corresponding to the key.

[0016] In one possible design, the target instruction is an instruction that reads the return address from the stack after the function call is completed; The bypass instruction sequence corresponding to the target instruction is used to verify the signed pointer.

[0017] In one possible design, the bypass instruction sequence corresponding to the target instruction includes a key and a first signature verification instruction sequence; The first signature verification instruction sequence is used to instruct the input of the key, stack pointer, and the return address represented by the pointer into a first preset algorithm to obtain a reference PAC and determine whether the reference PAC is the same as the signature.

[0018] In one possible design, before the CPU determines the bypass instruction sequence corresponding to the target instruction that caused the exception in kernel mode, the following is also included: Determine the intermediate value of the reference PAC based on the key and stack pointer; The bypass instruction sequence corresponding to the target instruction includes the reference PAC intermediate value and the second signature verification instruction sequence. The second signature verification instruction sequence is used to instruct the input of the intermediate value of the reference PAC and the return address represented by the pointer into the third preset algorithm to obtain the reference PAC and determine whether the reference PAC is the same as the signature.

[0019] Since the CPU stores the key and stack pointer as keys and the PAC as the value corresponding to the key after generating the PAC intermediate value in kernel mode, the stored PAC intermediate value can be directly obtained based on the key and stack pointer. There is no need to input the key and stack pointer into the second preset algorithm to generate the PAC intermediate value, which improves the efficiency of obtaining the bypass instruction sequence.

[0020] In one possible design, the target instruction is a floating-point branch instruction with a delay slot; The CPU determines the bypass instruction sequence corresponding to the target instruction that caused the exception in kernel mode, including: Obtain the N instructions following the floating-point branch instruction as the bypass instruction sequence; N is the width of the delay slot, and N is a positive integer.

[0021] In one possible design, determining the apparent address of the first instruction in the bypass instruction sequence includes: The memory address of the first instruction following the floating-point branch instruction is determined as the apparent address of the first instruction in the bypass instruction sequence.

[0022] In one possible design, the N instructions following the floating-point branch instruction are obtained as a bypass instruction sequence, including: If the floating-point branch instruction is also used to modify a register, then the N instructions following the floating-point branch instruction and the instruction that modifies the register are taken as the bypass instruction sequence.

[0023] Secondly, this application also provides an instruction bypass device, which includes: a processor and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method described in the first aspect above.

[0024] Thirdly, this application also provides a computer-readable storage medium comprising a program that, when executed on a device, causes the device to perform the method as described in any one of the first aspects above.

[0025] Fourthly, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the method described in the first aspect above. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 A flowchart illustrating the instruction bypass method provided in an embodiment of this application; Figure 2 This is a schematic diagram illustrating the interaction of the instruction bypass method provided in the embodiments of this application; Figure 3 A diagram illustrating the function of each binary bit in a 64-bit address; Figure 4 A diagram illustrating the embedding of a PAC using pointer tags; Figure 5 A diagram illustrating the embedding of a PAC without using pointer labels; Figure 6 This is a schematic diagram of a PAC signature scheme provided in an embodiment of this application; Figure 7 This is a schematic diagram of Scheme 2 for PAC signature provided in the embodiments of this application; Figure 8 A schematic diagram of a PAC verification scheme provided in an embodiment of this application; Figure 9 This is a schematic diagram of Scheme 2 for PAC verification provided in the embodiments of this application. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0029] The application scenarios described in this application are for the purpose of more clearly illustrating the technical solutions of this application, and do not constitute a limitation on the technical solutions provided in this application. Those skilled in the art will understand that with the emergence of new application scenarios, the technical solutions provided in this application are also applicable to similar technical problems. In the description of this application, unless otherwise stated, "multiple" means two or more.

[0030] When certain instructions are executed, exceptions may occur for various reasons, requiring the Central Processing Unit (CPU) to enter kernel mode for handling. Normally, an exception indicates a defect in the currently executing program; therefore, the kernel's handling of exceptions often results in destructive actions, such as killing the current process. However, there is an exception where the exception is not caused by a program defect but by an unforeseen event unrelated to the program. In this case, it is expected that the program will still run normally. Therefore, the CPU needs to simulate the instruction that caused the exception in kernel mode, and the simulation result is as if the instruction had been executed correctly.

[0031] A typical scenario where the CPU simulates exception-causing instructions in kernel mode is the simulation of floating-point branch instructions described in the background section. To save costs, the CPU omits the FPU, causing exceptions to occur when encountering floating-point branch instructions during program execution. A well-designed operating system kernel (running in kernel mode) will then simulate these floating-point branch instructions, achieving the effect of correct execution even without an FPU. Kernel mode emphasizes a state of the CPU with high privileges (in practice, kernel mode and kernel can be equated); correspondingly, the other state of the CPU is user mode, which lacks privileges and has limited operations. In both states, software runs on the CPU. Software running in kernel mode is usually called the operating system kernel (or simply kernel), and software running in user mode is usually called a user program.

[0032] Currently, CPUs typically emulate floating-point branch instructions in kernel mode using trap and emulate, also known as capture and simulation. Trap refers to the CPU catching exceptions in kernel mode, while emulate refers to the CPU emulating the instruction that caused the exception while handling it in kernel mode. The simulated instruction is not directly executed by hardware in kernel mode (direct execution of floating-point branch instructions is impossible due to the lack of an FPU); instead, the operating system kernel simulates its correct execution effect in software. As we will see later, even if the simulated instruction could be directly executed by hardware, it must never be allowed to be executed directly in kernel mode; it must first return to user mode.

[0033] The following example uses trap and emulate to simulate floating-point branch instructions to illustrate the simulation process. The simulation of floating-point branch instructions can be divided into two scenarios: simulation of floating-point branch instructions without delay slots and simulation of floating-point branch instructions with delay slots. The simulation process of a floating-point branch instruction without a delay slot includes the following steps: For the instruction sequence shown below, where "BC1T Label" is a floating-point branch instruction and "Label:" is a note (not an instruction) for the branch target: ORI 6, 6, 7 BC1T Label ADDIU 3, 4, 88 LW 5, 0( 3) Label: SW 6, 0( 2) (1) If the branch condition is met, then jump to the branch target (i.e., the annotation "Label:"). The expected execution flow is as follows: ORI 6, 6, 7 (Jump) SW 5, 0( 2) (2) If the branch condition is not met, no jump will occur. The expected execution flow is as follows: ORI 6, 6, 7 (No redirection) ADDIU 3, 4, 88 LW 5, 0( 3) Therefore, when it is necessary to capture and simulate the floating-point branch instruction "BC1T Label", the kernel must simulate one of the above execution flows according to the branch conditions.

[0034] 1. Since the CPU does not have an FPU, an exception was triggered when executing a floating-point branch instruction (such as "BC1T Label" in the above instruction sequence), causing the CPU to enter kernel mode. 2. The CPU recognizes this exception in kernel mode as being caused by an attempt to execute a floating-point branch instruction in a CPU without an FPU; 3. The CPU parses the floating-point branch instruction in kernel mode, determines whether the branch condition is met, and then determines the target address for continuing execution: (1) If the branch condition is met, then the target address for continued execution is the branch target address (such as "SW" in the above instruction sequence). 5, 0( 2) The address where the instruction is located); (2) If the branch condition is not met, then the target address for continued execution is the address of the next instruction after the floating-point branch instruction (such as "ADDIU" in the above instruction sequence). 3, 4. The address where the 88 instruction is located). 4. The kernel modifies the Exception Program Counter (EPC) to the target address; 5. When the kernel finishes exception handling, the CPU switches from kernel mode to user mode, and the CPU will automatically resume execution from the address pointed to by EPC. 6. The CPU resumes execution in user mode, causing the execution flow to jump to the aforementioned target address.

[0035] II. The simulation process of floating-point branch instructions with delay slots specifically includes the following steps: Delay slots are a concept in computer architecture, more widely used in instruction set architectures that employ pipelined execution. A delay slot is an instruction slot that immediately follows a branch instruction. The instruction in this slot is executed before the branch instruction (in other words, the effect of the instruction in the delay slot occurs before the effect of the branch instruction). This design improves pipeline utilization because the pipeline can continue executing instructions in the delay slot while the branch instruction is being executed. The existence of delay slots is to overcome pipeline pauses caused by branch instructions, allowing subsequent instructions to continue executing before the branch instruction's result is evaluated, thus improving overall execution efficiency. Instructions placed in delay slots are typically unrelated to branch instructions to ensure program correctness.

[0036] Assuming the delay slot length is 1 instruction, for the following instruction sequence, where "BC1T Label" is a floating-point branch instruction and "ADDIU" is a floating-point branch instruction... 3, "4, 88" represents an instruction located in a delay slot, and "Label:" is a note for the branch target (not an instruction): ORI 6, 6, 7 BC1T Label ADDIU 3, 4, 88 LW 5, 0( 3) Label: SW 6, 0( 2) (1) If the branch condition is met, then jump to the branch target (i.e., the annotation "Label:"). The expected execution flow is as follows: ORI 6, 6, 7 ADDIU 3, 4, 88 (Jump) SW 6, 0( 2) (2) If the branch condition is not met, no jump will occur. The expected execution flow is as follows: ORI 6, 6, 7 ADDIU 3, 4, 88 (No redirection) LW 5, 0( 3) Note that, according to the definition of a delay slot, the effect of an instruction in the delay slot precedes the branch instruction itself. Therefore, the execution flow appears as if the instructions in the delay slot are executed first, and the instructions in the delay slot are executed regardless of whether the branch condition is met. Thus, when it is necessary to capture and simulate the floating-point branch instruction "BC1T Label", the kernel must simulate one of the above execution flows based on the branch condition; simultaneously, for instructions in the delay slot (such as the instruction "ADDIU" in the above instruction sequence)... 3, Regardless of whether the instruction is not implemented on the CPU, it must be carefully handled by the kernel when it is captured and simulated in order to accurately form the expected execution flow.

[0037] As discussed above, the instructions in the delay slot can be almost any instruction in the instruction set. It's unrealistic for the kernel to recognize all instructions in the instruction set. Therefore, the kernel cannot directly simulate the instructions in the delay slot in kernel mode. To simulate the instructions in the delay slot, a sequence of instructions containing the instructions in the delay slot needs to be temporarily written to a free memory address in user space, and execution resumes at that free memory address. Furthermore, the simulation of the instructions in the delay slot must be completed in user mode because the instructions in the delay slot can be any instruction, posing a significant security risk. Simulating them in kernel mode could introduce security vulnerabilities. Therefore, executing the instruction sequence in user mode requires first ending exception handling in kernel mode, returning to user mode, and then re-entering kernel mode for cleanup after the instruction sequence has finished executing—a very costly process.

[0038] Specifically, the simulation process of floating-point branch instructions with delay slots includes the following steps: 1. Since the CPU does not have an FPU, an exception was triggered when executing a floating-point branch instruction (such as "BC1T Label" in the above instruction sequence), causing the CPU to enter kernel mode. 2. The CPU recognizes this exception in kernel mode as being caused by an attempt to execute a floating-point branch instruction in a CPU without an FPU; 3. The CPU parses the floating-point branch instruction in kernel mode to determine whether the branch condition is met: (1) If the branch condition is satisfied: ① The kernel mode specifies the target address to continue execution upon successful emulation (i.e., the branch target address, such as "SW" in the instruction sequence above). 5, 0( 2) The address where the instruction is located is stored for later use; ② The kernel-mode generated instruction sequence is written to the location of temporary instructions in user space. The instructions in the instruction sequence are as follows: instructions in the delay slots of floating-point branch instructions (assuming the delay slot width of the instruction set architecture is n, then there are n instructions in the delay slot; for example, in the above instruction sequence, the delay slot width is 1, and the instruction in the delay slot is "ADDIU"). 3, 4,88” and an instruction that caused an exception; ③ In kernel mode, the EPC is modified to the specified location in user space where the above instruction sequence is located; ④ The CPU finishes exception handling, switches from kernel mode to user mode, and resumes execution from the address pointed to by EPC; ⑤ The above instruction sequence is executed in user mode, so that all instructions in the delay slot are executed and the expected effect is produced; ⑥ Because the end of the instruction sequence is an instruction that causes an exception, the CPU re-enters kernel mode to handle the exception. ⑦ The kernel mode identified that the anomaly was caused by the simulation of the delay slot; ⑧ In kernel mode, the EPC is modified to the target address for continued execution stored in step ①, and the instruction sequence stored at the specified location in user space is cleaned up; ⑨ The CPU finishes exception handling, switches from kernel mode to user mode, and resumes execution from the address pointed to by EPC; ⑩ The CPU resumes execution so that the execution flow starts from the jump target, and the instructions in the delay slot have already produced the expected effect. Therefore, the expected behavior when the branch condition is met is satisfied, that is, the simulation of the floating-point branch instruction with delay slot when the branch condition is met is completed. (2) If the branch condition is not met: ① In kernel mode, the EPC is modified to the address of the first instruction in the floating-point branch instruction delay slot (since instructions in the delay slot should be executed regardless of whether the branch condition is met, execution can be resumed directly from the first instruction in the delay slot when the branch condition is not met). (e.g., "ADDIU" in the instruction sequence above). 3, 4. The address where the 88 instruction is located). ②The CPU ends exception handling, switches from kernel mode to user mode, and resumes execution from the address pointed to by EPC; ③ The CPU resumes execution so that the execution flow starts from the first instruction in the delay slot, which satisfies the expected behavior when the branch condition is not met, that is, it completes the simulation of the floating-point branch instruction with delay slot when the branch condition is not met.

[0039] The simulation process of a floating-point branch instruction with a delay slot shows that the kernel mode only simulates a floating-point branch instruction with a delay slot by modifying the EPC when the branch condition is not met. However, when the branch condition is met, both the delay slot simulation and the jump simulation must be completed, which cannot be done simultaneously by simply modifying the EPC. Therefore, a temporary instruction sequence must be introduced to simulate the delay slot separately, and then re-enter kernel mode later to complete the jump.

[0040] However, allocating a segment of memory in user space to store temporary instruction sequences incurs significant overhead, noticeably slowing down the simulation speed of floating-point branch instructions. Furthermore, if the instruction in the delay slot is associated with the Program Counter (PC), the memory address of the instruction copied to the delay slot in the temporary instruction sequence is no longer its original address. This causes PC-associated instructions to fail to execute correctly. The PC is a register in the CPU that stores the memory address of the instruction the CPU is about to execute, typically a virtual address. If no branch or jump instructions are encountered during program execution, the PC value monotonically increases as the program executes. However, branch and jump instructions change the PC value, causing it to point not to the address of the next instruction, but to the destination specified by the branch or jump instruction. The effect of a PC-associated instruction depends on the PC value; in other words, the same PC-associated instruction can produce different effects under different PC values. Therefore, if there is a PC-associated instruction in the delay slot, when it is copied to the temporary instruction sequence and then executed, the value of the PC will fall within the memory address range of the temporary instruction sequence, rather than the memory address range of the original delay slot. This will cause the effect during execution to not match the expected effect.

[0041] To address the problems encountered in simulating floating-point branch instructions with delay slots, this application proposes an instruction bypass method, such as... Figure 1 As shown, the execution subject of this method can be the CPU, a chip within the CPU, or a functional module within the CPU; this application does not limit this. The following description uses the CPU as the execution subject, and the method includes: Step 101: If an exception occurs during the execution of the target program in user mode, the CPU will switch to kernel mode.

[0042] For example, the CPU is equipped with an instruction matcher. When the CPU executes any instruction in the target program in user mode, it uses the instruction matcher to determine whether the instruction is the same as the pre-configured instruction in the instruction matcher. If they are the same, an exception is raised and the CPU switches to kernel mode.

[0043] The instruction matcher consists of a matching unit and a matching item storage unit. Multiple matching units can be configured to accelerate the matching process. The matching unit receives indication information of the instruction to be processed. This instruction indication information can be the machine code of the instruction, its memory address, or its internal instruction number. The input source for the matching unit can be the output of the processor's instruction fetch unit or other units within the processor that maintain the pipeline state; this application does not impose any limitations on this. After performing the matching, the matching unit determines whether to raise an exception based on the matching result. The matching item storage unit provides matching items for the matching unit to use during the matching process.

[0044] Step 102: The CPU determines the bypass instruction sequence corresponding to the target instruction that caused the exception in kernel mode.

[0045] For example, after the CPU enters kernel mode, it will handle the exception. First, it will determine the exception type to see if a bypass instruction sequence needs to be determined to avoid wasting system resources. After determining in kernel mode that the exception is used for instruction bypassing, the CPU will determine the bypass instruction sequence corresponding to the target instruction that caused the exception.

[0046] Step 103: After the CPU writes the bypass instruction sequence into the pilot instruction buffer in kernel mode, it returns to user mode; the pilot instruction buffer is a pre-defined buffer.

[0047] For example, the pilot instruction buffer is located in the CPU; alternatively, it can be located in memory, without limitation in this application. If located in the CPU, the kernel can use privileged instructions to write bypass instruction sequences into the buffer. If located in memory, it can be located at a fixed memory address; alternatively, it can be located at a configurable memory address, without limitation in this application. If located at a configurable memory address, a configuration register that can only be read and written by kernel mode or higher privileged mode can be introduced to configure the memory address of the pilot instruction buffer and the length of the pilot instruction buffer. In this way, for frequently used bypass instruction sequences, the kernel can store them in memory and record the memory addresses of these bypass instruction sequences. When they are needed, the kernel only needs to write the address of the required bypass instruction sequence and its length to the configuration register, avoiding the overhead of repeatedly generating and writing bypass instruction sequences and improving performance.

[0048] With the introduction of the lead instruction buffer, after the CPU recovers from kernel mode to user mode, it checks whether a bypass instruction sequence exists in the lead instruction buffer. If a bypass instruction sequence exists, it is executed in user mode first. This is a purely hardware-driven behavior, not instructed by software. This ensures that when a bypass instruction sequence exists, it will definitely be executed and cannot be bypassed, thus ensuring that the normal operation of the instruction bypass function is not affected by software errors.

[0049] If a bypass instruction sequence exists, it is executed. After executing the bypass instruction sequence in user mode, the CPU clears the lead instruction buffer. Clearing the lead instruction buffer is also a purely hardware-driven action, not software-instructed. This serves several purposes: first, it ensures that sensitive data contained in the bypass instruction sequence will not be leaked after execution; second, it ensures that the bypass instruction sequence will not be accidentally executed again after its first execution (unless the kernel subsequently refills the lead instruction buffer), thus ensuring the normal operation of the instruction bypass is not affected by software errors; and third, it saves the CPU the overhead of handling exceptions unrelated to the instruction bypass in kernel mode. Otherwise, when handling exceptions unrelated to the instruction bypass in kernel mode, the CPU would need to manually clear the lead instruction buffer to prevent execution of the previous bypass instruction sequence after exception handling returns.

[0050] It should be noted that if the pre-emptive instruction buffer is set at a configurable memory address, then when the CPU executes the bypass instruction sequence in user mode and clears the pre-emptive instruction buffer, it does not need to clear the data at the corresponding memory address (i.e., the bypass instruction sequence). Instead, it only clears the configuration register used to configure the memory address where the pre-emptive instruction buffer is located and / or the configuration register used to configure the length of the pre-emptive instruction buffer. This reduces the overhead and latency of clearing the pre-emptive instruction buffer, while allowing the bypass instruction sequence in memory to be reused subsequently, improving performance.

[0051] In addition, before the CPU returns to user mode, it writes a memory address to the EPC in kernel mode. This allows the CPU to continue executing the target program through the memory address indicated by the EPC after executing the bypass instruction sequence in user mode.

[0052] In computer architecture, especially in processors with pipelining and out-of-order execution, a precise exception refers to the ability to accurately identify which instruction caused the exception. In other words, a precise exception ensures that the reported EPC value is the address of the instruction that actually caused the exception. The EPC stores the memory address of the instruction that triggered the exception. The instruction pointed to by the EPC is essentially not yet executed, or in other words, because the exception caused all states were automatically rolled back by the CPU to the state before the instruction was executed.

[0053] The existence of EPC serves several purposes: ① After handling an exception in kernel mode, the CPU needs to return to its original position. Upon returning from the exception, the CPU reads the EPC, modifies the PC, and continues normal execution. ② Sometimes, when handling an exception in kernel mode, the CPU needs to change the return position. For example, it might skip an instruction upon returning. In this case, the CPU can modify the value of the EPC in kernel mode, so that upon returning from the exception, the CPU will use the new value of the EPC to continue execution. ③ The CPU needs to read the EPC in kernel mode to determine how to handle the exception. For example, when using trap and emulate instructions, the CPU needs to read the instruction pointed to by the EPC in kernel mode to further parse and simulate the instruction.

[0054] Step 104: After the CPU executes the bypass instruction sequence in user mode, it continues to execute the target program.

[0055] As mentioned above, if the instruction in the delay slot is PC-associated, the memory address of the instruction copied to the delay slot in the temporary instruction set will no longer be its original address. This causes PC-associated instructions to fail to execute correctly. PC-associated instructions refer to instructions whose execution effect is related to the address where the instruction resides. A significant characteristic of PC-associated instructions is that even if two PC-associated instructions are identical, their execution effects may differ when they reside at different memory addresses. For example, relative branch instructions and PC-associated memory access instructions: relative branch instructions add an offset to the PC to obtain the branch target address, and then jump to the branch target address; in other words, the branch target address is the current instruction's address plus an offset. Memory access instructions all have a memory access target address; the memory access target address of a PC-associated memory access instruction is the PC plus an offset, i.e., the current instruction's address plus an offset. Therefore, even if two instructions appear identical, as long as they reside at different memory addresses (resulting in different PCs during execution), the final branch / memory access target addresses will also be different.

[0056] To address the issue of PC-associated instructions failing to execute correctly, this application introduces a configuration register that can only be read and written by kernel mode or higher privileged modes. This register is used to configure the apparent address of the first instruction in a bypass instruction sequence. Specifically, it determines the apparent address of the first instruction in the bypass instruction sequence and writes it into the configuration register. The effect of this apparent address is to treat the instruction as if it exists at a specific memory address. Furthermore, the apparent address of the first instruction in the bypass instruction sequence is determined as the apparent address of the first instruction plus the distance between the first instruction and the first instruction in the lead instruction buffer (the first instruction is any instruction in the lead instruction buffer other than the first instruction). In other words, the apparent addresses of subsequent instructions in the bypass instruction sequence can be calculated by sequentially adding the lengths of each instruction. The apparent address of a subsequent instruction is equivalent to its distance from the first instruction plus the apparent address of the first instruction. Therefore, only the apparent address of the first instruction in the bypass instruction sequence needs to be configured.

[0057] It's important to note that the apparent address does not represent the actual address of the pre-instruction buffer, as the pre-instruction buffer may not necessarily reside in memory, and even if it is, it may be located at a different address. The apparent addresses of each instruction in the bypass instruction sequence are used to: when each instruction is executed, if there is an instruction behavior associated with the program counter (PC), the apparent address is used as the PC to participate in the instruction execution, thereby ensuring that the PC-associated instruction produces the correct effect.

[0058] As a further example, when the CPU executes a bypass instruction sequence in user mode, if the bypass instruction sequence includes a PC-associated instruction, the PC-associated instruction is executed. When executing the PC-associated instruction, the PC-associated instruction is regarded as existing at the apparent address of the PC-associated instruction, and the resulting PC-associated effect is determined by the apparent address of the PC-associated instruction.

[0059] If the memory access target address or jump target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the effective memory access target or jump target still resides in the target program. This is because the configuration of the apparent address only makes the lead instruction buffer appear to be "masked" on the corresponding memory region (the original data in that memory region remains unchanged), but this masking only takes effect when the bypass instruction sequence is executed, and not on the target program itself. If the memory access target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the instruction should access the original data in that memory region, not the data in the lead instruction buffer; otherwise, if the target program accesses the lead instruction buffer, it will not only fail to obtain the expected data, but will also cause the leakage of sensitive data in the lead instruction buffer. Similarly, if the jump target address of any instruction in the target program is the same as the apparent address of any instruction in the bypass instruction sequence, the expected jump target of that instruction should still be the instruction in that memory region of the target program itself, not the instruction in the pre-instruction buffer; otherwise, if the target program jumps to the pre-instruction buffer, it will first fail to obtain the correct execution flow, and it will also cause the bypass instruction sequence in the pre-instruction buffer to be executed incorrectly. At this time, the effective memory access target or jump target is still located in the target program, which ensures that the existence of the pre-instruction buffer will not disrupt the correct execution of any existing instruction flow, and also protects the instructions in the pre-instruction buffer from being detected, improving the security of sensitive data. At the same time, it ensures that instruction bypass can only be triggered by instruction matching and kernel exception handling, and any attempt by the target program to actively jump to the pre-instruction buffer will fail, improving the security of instruction bypass.

[0060] If any jump instruction in the bypass instruction sequence points to an address that is the apparent address of the second instruction in the bypass instruction sequence (the second instruction is any instruction in the leader instruction buffer), then the jump proceeds to the second instruction. In this way, branches and loops are effectively allowed in the bypass instruction sequence, making it possible to construct complex leader instruction sequences and increasing flexibility and functionality.

[0061] This application introduces an instruction bypass framework, enabling the upgrading of processor security hardening features without hardware modifications through bypass configuration. By configuring bypass, it can fix most hardware vulnerabilities with low performance overhead, ensuring no information is leaked and significantly improving security. Simultaneously, it also provides a highly efficient method for capturing and simulating arbitrary instructions.

[0062] The interactions between steps 101 to 104 above can also be referenced. Figure 2A bypass, in this context, refers to a path different from the usual execution path. In most cases, the instructions will not be matched, and the original execution path is the usual path (which is actually the target program itself). Figure 2 As shown in the user space (common path), when an instruction is matched, it bypasses the common path; the bypass is the alternative path taken at this time, such as... Figure 2 The user mode (precursor instruction buffer) is shown in the diagram.

[0063] The following describes several application scenarios in which the instruction bypass method proposed in the embodiments of this application is applied: I. Simulation of Floating-Point Branch Instructions with Delay Slots In this scenario, the target instruction is a floating-point branch instruction with a delay slot. It's important to note that for processors without an FPU, since executing a floating-point branch instruction will trigger an exception, it's not always necessary to configure an instruction matcher to trigger an exception and enter kernel mode. When the CPU determines the bypass instruction sequence corresponding to the target instruction that caused the exception in kernel mode, it obtains the N instructions following the floating-point branch instruction as the bypass instruction sequence; N is the width of the delay slot, and N is a positive integer. If the floating-point branch instruction also modifies a register, then the N instructions following the floating-point branch instruction, along with the instruction that modifies the register, are used as the bypass instruction sequence.

[0064] Specifically, the process of simulating a floating-point branch instruction with a delay slot using the instruction bypass method proposed in this application is as follows: 1. Since the CPU does not have an FPU, executing floating-point branch instructions (such as "BC1T Label" in the instruction sequence shown above with a delay slot length of 1 instruction, and the instruction sequence cited below is the same as here) caused an exception, causing the CPU to enter kernel mode; 2. The CPU recognizes this exception in kernel mode as being caused by an attempt to execute a floating-point branch instruction in a CPU without an FPU; 3. The CPU parses the floating-point branch instruction in kernel mode to determine whether the branch condition is met: 4. In kernel mode, the CPU determines the bypass instruction sequence based on floating-point branch instructions and writes the bypass instruction sequence into the pre-instruction buffer; the instructions in the bypass instruction sequence are as follows: ① The N instructions following the floating-point branch instruction, i.e., the instructions in the delay slot of the floating-point branch instruction (such as "ADDIU" in the instruction sequence). 3, 4, 88”); ② If the floating-point branch instruction modifies some registers, such as the return address register, then an instruction to modify the corresponding register is added to the end of the bypass instruction sequence, such as an instruction to load the immediate value into the instruction register; if the floating-point branch instruction does not modify some registers, then the bypass instruction sequence only includes the instructions in the delay slot of the floating-point branch instruction. 5. The CPU modifies the EPC to the branch target address in kernel mode (such as "SW" in the instruction sequence). 5, 0( 2) The instruction is located at the address where it is located. The apparent address register of the first instruction in the bypass instruction sequence is also set to the address of the first instruction in the above delay slot (that is, the original address of the delay slot, such as "ADDIU" in the original instruction sequence). 3, (4, 88” address); If the width N of the delay slot is greater than 1, then the address of the instruction in the delay slot is the address of the first instruction in the delay slot; 6. After the kernel mode finishes exception handling, the CPU returns to user mode and determines that there is a bypass instruction sequence in the pre-instruction buffer. Therefore, the CPU resumes execution from the pre-instruction buffer. 7. The pre-instruction buffer enables the execution of instructions in the delay slot, and after the bypass instruction sequence is completed, the CPU resumes execution from the address pointed to by EPC, causing the execution flow to jump to the branch target address.

[0065] It is important to note that in step 7, the order of executing the bypass instruction sequence and resuming execution from the address pointed to by EPC cannot be changed. Execution must resume from the address pointed to by EPC only after the bypass instruction sequence has been completed. In other words, the delay slot must be simulated before the jump. This is mainly because some floating-point branch instructions have additional execution effects (including register modifications) besides jumps. According to the definition of a delay slot, instructions in the delay slot should not see the execution effects of branch instructions. If the order is reversed, and the floating-point branch instructions are simulated first, then those instructions in the delay slot will see the execution effects of the floating-point branch instructions when the delay slot is simulated, violating this rule.

[0066] The instruction bypass method proposed in this application minimizes the number of times the instruction enters kernel mode and allows the instructions in the delay slot to be executed directly by hardware without software simulation. Therefore, it efficiently simulates the execution of floating-point branch instructions with delay slots. Furthermore, since the instructions in the delay slot are simply copied to the lead instruction buffer, and properly configured so that the apparent address is the original address of the instruction in the delay slot, the bypass instruction sequence accurately produces the expected effect of the instruction in the delay slot regardless of its specific nature, without requiring the kernel to recognize these instructions. Moreover, since the bypass instruction sequence in the lead instruction buffer is executed in user mode, this simulation further ensures that it does not violate security measures or lead to kernel-mode vulnerabilities. Because this simulation method is not limited by the addressing range of unconditional jump instructions with immediate addressing, the requirement to enter kernel mode twice to achieve a jump is eliminated. In addition, due to the self-cleaning and non-reentrant nature of the lead instruction buffer, no special cleanup is required, achieving high simulation efficiency.

[0067] II. Mitigating Side-Channel Attacks: For side-channel attacks, since side-channel attacks require measuring the hardware's side effects, the following instructions are repeatedly executed during the measurement phase of a side-channel attack: ① Get and record the current clock; ② Execute instructions that may be affected by the aforementioned side effects; ③ Obtain and record the current clock; Instructions ① and ③ are used to determine the time taken to execute instruction ②. After instructions ① to ③ are executed repeatedly, attackers can use statistical analysis to analyze the time required to execute instruction ② under different conditions. The statistical characteristics obtained from the analysis can be used to leak sensitive data from the side channel, causing a side channel attack.

[0068] This attack method is possible because the side effects produced by the above instructions are related to the value of sensitive data, and the high precision of the hardware clock makes it possible to accurately measure these side effects.

[0069] If the instruction bypass method proposed in this application is to mitigate side-channel attacks, the target instruction is a clock acquisition instruction. The bypass instruction sequence corresponding to the target instruction is used to generate inaccurate clock information. This makes the time required for the execution of the above-mentioned instruction ② obtained from the analysis inaccurate, and further makes the statistical features obtained from the analysis inaccurate, so that the statistical features leaked from the side channel cannot carry information. Among them, generating inaccurate clock information can be further subdivided into: ① Generating inaccurate clock information: The EPC is modified to the address of the instruction following the target instruction, i.e., the address of the instruction following the instruction that fetches the clock. The instruction that fetches the clock is copied into the pre-instruction buffer as the first instruction. The subsequent bypass instruction sequence uses the value at the target register or target memory address to perform a calculation with a random value, and writes the result to the target register or target memory address, making the clock information obtained by the target register or target memory address inaccurate. The random value can be a random value randomly embedded into the immediate field of the instruction when the CPU determines the bypass instruction sequence in kernel mode, or it can be a random value obtained by the CPU itself during the execution of the bypass instruction sequence. This application does not limit the source of the random value.

[0070] ② Generating Incorrect Clock Information: Several instructions are inserted into the pre-fetch instruction buffer, modifying the EPC to the address of the instruction following the clock fetch instruction. This is equivalent to skipping the clock fetch instruction, thus maintaining the value in the target register or target memory address unchanged. Alternatively, the EPC can be modified to the address of the instruction following the clock fetch instruction, while a bypass instruction sequence is used to write meaningless values ​​into the target register or target memory address, effectively replacing the clock fetch instruction. Whether skipping or replacing the clock fetch instruction, the goal of generating incorrect clock information is achieved.

[0071] III. Implementing Pointer Authentication Code (PAC)

[0072] PAC (Proof-of-Act) leverages the characteristic of 64-bit architectures that they don't require the full 64-bit address space, but only use the VA_SIZE bit. An authentication code is embedded in the unused bits to authenticate the pointer; this process is the PAC signing process. The validity of the authentication is verified before the pointer is used later; this process is the PAC signature verification process. PAC can prevent the exploitation of malicious attack techniques and improve software security.

[0073] PAC is not limited to 64-bit architectures. For N-bit architectures, it is only necessary to satisfy N being greater than VA_SIZE.

[0074] Without loss of generality, taking a 64-bit architecture as an example, the function of each binary bit in a 64-bit address is as follows: Figure 3As shown, a typical 64-bit pointer has only VA_SIZE bits in effective bits (from bit 0 to bit VA_SIZE-1); the remaining bits (from bit VA_SIZE to bit 63) are used to mark high / low addresses (i.e., kernel mode / user mode). For high addresses, all bits are 1, or for low addresses, all bits are 0. Due to the aforementioned restrictions, these bits are called reserved bits.

[0075] With the introduction of PAC, reserved bits were allocated to PAC for use in embedding signatures. A pointer to the embedded PAC (also known as the signature) is shown below. Figure 4 As shown. Optionally, if it is necessary to retain the high / low address identifier in the signed pointer, then as... Figure 5 The diagram shows that one bit (HL) is selected from the reserved bits to serve as the high / low address identifier, and the remaining bits are used for embedding the signature. A pointer simply indicates that an address has been stored somewhere; therefore, pointers and addresses are equally applicable. Figure 3 , 4 5.

[0076] The timing of PAC signing can be either before or after the target instruction backs up the return address of the function call to the stack or register. Similarly, the timing of PAC verification can be either before or after the target instruction reads the return address of the function call from the stack or register; this application does not impose any limitation on this. The following describes the PAC signing and verification process: 1. Implementing the PAC signature process: Based on the timing of the PAC signature, the target instruction should be either the instruction that backs up the return address of the function call to the stack, or the instruction that backs up the return address of the function call to the return register. The bypass instruction sequence corresponding to the target instruction is used to generate a signed pointer. The signature is generated using the key, the stack pointer, and the return address; the pointer is used to represent the return address.

[0077] This application provides two PAC signature schemes: Option 1: The bypass instruction sequence corresponding to the target instruction includes the key and the first signature instruction sequence, such as... Figure 6 As shown, the key can be embedded in the first signature instruction sequence; the first signature instruction sequence is used to instruct the input of the key, the stack pointer (the stack pointer can also be called the context, which is the address read from the stack pointer register and used to represent the top of the stack) and the return address into the first preset algorithm to generate a PAC as a signature. After embedding the PAC into the reserved bits of the pointer, a pointer with a signature is obtained.

[0078] Option 2: Before the CPU determines the bypass instruction sequence corresponding to the target instruction that caused the exception in kernel mode, the CPU inputs the key and stack pointer into a second preset algorithm in kernel mode to generate an intermediate PAC value, such as... Figure 7 As shown, the intermediate PAC value is embedded in the second signature instruction sequence. The bypass instruction sequence corresponding to the target instruction includes the intermediate PAC value and the second signature instruction sequence. The CPU executes the second signature instruction sequence in user mode. The second signature instruction sequence is used to input the intermediate PAC value and the return address into a third preset algorithm to generate a PAC as a signature. After embedding the PAC into the reserved bits of the pointer, a pointer with a signature is obtained.

[0079] Compared to Scheme 2, Scheme 1 only requires the CPU to embed the key into the first signature instruction sequence in kernel mode. When the key remains unchanged, the first signature instruction sequence also remains unchanged, and the second preset algorithm is not involved. Therefore, the CPU spends very little time in kernel mode in Scheme 1, allowing it to quickly determine the first signature instruction sequence and recover from kernel mode to user mode, reducing the probability of system lag. However, the key in Scheme 1 is used in the lead instruction buffer, which may lead to leakage, making it less secure than Scheme 2.

[0080] Furthermore, in the second scheme described above, after the CPU inputs the key and stack pointer into the second preset algorithm in kernel mode, it can store the key and stack pointer as keys and the PAC intermediate value as the value corresponding to the key. When the PAC intermediate value is needed later, it can be directly looked up based on the key and stack pointer, eliminating the need to generate the PAC using the second preset algorithm again. This reduces the CPU's overhead in kernel mode and also improves the efficiency of determining the bypass instruction sequence. Alternatively, the second signature instruction sequence can be directly stored as the value corresponding to the key. In this case, when looking up the key and stack pointer as keys, the second signature instruction sequence can be directly determined, further improving the efficiency of determining the bypass instruction sequence.

[0081] 2. Implement the PAC verification process: Based on the timing of the PAC signature verification, it can be determined that the target instruction should be either the instruction that reads the return address after the function call is completed from the stack, or the instruction that reads the return address after the function call is completed from the return address register. For the PAC signature verification process, the bypass instruction sequence corresponding to the target instruction is used to verify the signed pointer.

[0082] This application also provides two PAC verification schemes: Option 1: The bypass instruction sequence corresponding to the target instruction includes the key and the first verification instruction sequence, such as... Figure 8As shown, the key can be embedded in the first signature verification instruction sequence; the first signature verification instruction sequence is used to instruct the input of the key, stack pointer, and the return address represented by the pointer into the first preset algorithm to obtain the reference PAC and determine whether the reference PAC is the same as the signature; as Figure 8 As shown, at this point, the pointer includes the signature and the return address. By removing the signature from the pointer, the return address represented by the signature and the pointer can be obtained. The key, the stack pointer, and the return address represented by the pointer are input into the first preset algorithm to obtain the reference PAC. The signature and the reference PAC are verified to see if they are consistent. If they are inconsistent, the signature verification fails. If they are consistent, the signature verification passes, and the pointer after removing the signature is put back into the original location of the pointer with the signature that was read, i.e., in the stack or the return register.

[0083] Option 2: Before the CPU determines the bypass instruction sequence corresponding to the target instruction that caused the exception in kernel mode, a reference PAC intermediate value is determined based on the key and the stack pointer. When determining the reference PAC intermediate value, the key and the stack pointer can be used as keys for searching. If the value corresponding to the key (i.e., the PAC intermediate value) is found, it is determined as the reference PAC intermediate value. Currently, the key and the stack pointer can also be input into a second preset algorithm to generate a PAC as the reference PAC intermediate value.

[0084] The bypass instruction sequence corresponding to the target instruction includes the reference PAC intermediate value and the second signature verification instruction sequence, such as... Figure 9 As shown, the intermediate value of the reference PAC can be embedded in the second signature verification instruction sequence; the second signature verification instruction sequence is used to instruct the input of the intermediate value of the reference PAC and the return address represented by the pointer into the third preset algorithm to obtain the reference PAC and determine whether the reference PAC is the same as the signature. Specifically, as Figure 9 As shown, the pointer at this point includes the signature and the return address. By removing the signature from the pointer, the return address represented by the signature and pointer can be obtained. The intermediate value of the reference PAC and the return address are input into a third preset algorithm to obtain the reference PAC. The signature and the reference PAC are then verified to be consistent. If they are inconsistent, the signature verification fails; if they are consistent, the verification passes, and the pointer after removing the signature is placed back at the location where the pointer with the signature was read, i.e., in the stack or the return register. Alternatively, the second signature verification instruction sequence can be directly stored as the value corresponding to the key. Then, when using the key and the stack pointer as keys for lookup, the second signature verification instruction sequence can be directly determined, further improving the efficiency of determining the bypass instruction sequence.

[0085] The instruction bypass method proposed in this application achieves high efficiency and flexibility in execution behavior with minimal hardware overhead. It can protect existing programs with PAC without recompiling or modifying them, thus improving security. Furthermore, it enables efficient and secure floating-point branch instruction simulation for processors without FPUs on instruction set architectures with delay slots, and has a wide range of application scenarios.

[0086] The unit division in this embodiment is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of this application can be integrated into a single processor, exist as separate physical units, or be integrated into a single unit. The integrated units described above can be implemented in hardware or as software functional units.

[0087] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0088] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An instruction bypass method, characterized by, The application is suitable for a central processing unit (CPU), comprising: If an exception occurs during execution of a target program by the CPU in a user mode, the CPU switches to a kernel mode; After determining a bypass instruction sequence corresponding to the target instruction causing the exception in the kernel mode, the CPU returns to the user mode; the bypass instruction sequence comprises instructions in a delay slot of the target instruction; The CPU executes the bypass instruction sequence in the user mode, and continues to execute the target program after the execution of the bypass instruction sequence is completed.

2. The method of claim 1, wherein, The target instruction is an instruction for obtaining a clock; The bypass instruction sequence corresponding to the target instruction is used to generate inaccurate clock information.

3. The method of claim 1, wherein, The target instruction is an instruction for backing up a return address after completion of a function call to a stack; The bypass instruction sequence corresponding to the target instruction is used to generate a signed pointer; The signature is generated by a key, a stack pointer and a return address; and the pointer is used to represent the return address.

4. The method of claim 3, wherein, The signature is generated by a key, a stack pointer and a return address, comprising: The bypass instruction sequence corresponding to the target instruction comprises a key and a first signature instruction sequence; The first signature instruction sequence is used to indicate that the key, the stack pointer and the return address are input into a first preset algorithm to generate a pointer authentication code (PAC) as a signature.

5. The method of claim 3, wherein, Before the CPU determines the bypass instruction sequence corresponding to the target instruction causing the exception in the kernel mode, further comprising: The CPU inputs the key and the stack pointer into a second preset algorithm to generate a PAC intermediate value in the kernel mode; The bypass instruction sequence corresponding to the target instruction comprises the PAC intermediate value and a second signature instruction sequence; The CPU executes the bypass instruction sequence in the user mode, comprising: The CPU executes the second signature instruction sequence in the user mode, and the second signature instruction sequence is used to input the PAC intermediate value and the return address into a third preset algorithm to generate the PAC as a signature.

6. The method of claim 5, wherein, After the CPU inputs the key and the stack pointer into the second preset algorithm to generate the PAC intermediate value in the kernel mode, further comprising: The CPU stores the key and the stack pointer as a key, and the PAC intermediate value as a value corresponding to the key in the kernel mode.

7. The method of claim 1, wherein, The target instruction is an instruction for reading a return address after completion of a function call from a stack; The bypass instruction sequence corresponding to the target instruction is used to verify a signed pointer.

8. The method of claim 7, wherein, The bypass instruction sequence corresponding to the target instruction comprises a key and a first signature instruction sequence; The first signature instruction sequence is used to indicate that the key, the stack pointer and the return address represented by the pointer are input into a first preset algorithm to obtain a reference PAC and determine whether the reference PAC is same as the signature.

9. The method of claim 7, wherein, Before the CPU determines the bypass instruction sequence corresponding to the target instruction causing the exception in the kernel mode, further comprising: A reference PAC intermediate value is determined according to the key and the stack pointer; The bypass instruction sequence corresponding to the target instruction comprises the reference PAC intermediate value and a second signature instruction sequence; The second signature instruction sequence is used to indicate that the reference PAC intermediate value and the return address represented by the pointer are input into a third preset algorithm to obtain a reference PAC and determine whether the reference PAC is same as the signature.

10. The method of claim 1, wherein, The target instruction is a floating point branch instruction with a delay slot; The CPU determines, in a kernel mode, a bypass instruction sequence corresponding to a target instruction causing the exception, comprising: Obtaining N instructions after the floating point branch instruction as the bypass instruction sequence; N is the width of the delay slot, and N is a positive integer.

11. The method of claim 10, wherein, Obtaining N instructions after the floating point branch instruction as the bypass instruction sequence, comprising: If the floating point branch instruction is also used to modify a register, then obtaining N instructions after the floating point branch instruction and instructions for modifying the register as the bypass instruction sequence.

Images