A hardware hot patch address remapping method and system for a processor instruction fetch path

Abstract

The application provides a hardware hot patch address remapping method and system for a processor instruction fetch path. The method relates to the fields of processor architecture and embedded system security technology, and comprises the following steps: configuring a comparator address of a hardware patch unit (HPU) as an original instruction address to be patched; when the processor fetches an instruction from the original instruction address, the HPU compares the instruction fetch address with the comparator address; if a hit is obtained, the HPU reads a replacement instruction from a corresponding patch slot according to the hit comparator number, and returns the replacement instruction to the processor for execution; meanwhile, an architecture-visible program counter (PC) value corresponding to the instruction fetch operation is kept as the original instruction address. The application further provides a hardware hot patch system for implementing the above method. The application realizes accurate hot patch replacement in the instruction granularity without modifying the original code of ROM or firmware, solves the problem of the traditional patch scheme damaging PC relative addressing, abnormal positioning and debugging consistency by keeping the original PC semantics, and has the advantages of low hardware overhead, transparent execution, support for long-distance patching, flexible configuration and the like.

Description

Technical Field

[0001] This invention belongs to the field of processor architecture and embedded system security technology, specifically relating to a hardware hot patch address remapping method and system for processor instruction fetching paths. Background Technology

[0002] With the rapid development of the Internet of Things, automotive electronics, industrial control, and mobile devices, embedded systems are becoming increasingly widely used. In these systems, to reduce costs, improve boot speed, and ensure code security, a large amount of core software—including the bootloader, real-time operating system (RTOS) kernel, hardware abstraction layer (HAL) library, and key algorithms—is typically stored in on-chip read-only memory (ROM), embedded flash memory (eFlash), or one-time programmable (OTP) memory. This fixed storage method makes the code an unchangeable part of the "hardware" after the product leaves the factory.

[0003] However, due to compressed development cycles and increased system complexity, design flaws or security vulnerabilities are inevitable in these fixed codes. After large-scale product deployment, fixing such issues becomes extremely difficult and costly. Traditional or existing solutions mainly include the following aspects, but they all have significant limitations:

[0004] 1. Software-level hot patching technology

[0005] This type of technology is currently the mainstream approach, primarily involving dynamically modifying code at the operating system or application level to implement patches.

[0006] Kernel function hijacking: Representative techniques such as Red Hat's kpatch and SUSE's kGraft modify the entry instructions of the function to be patched in the Linux kernel (e.g., replacing them with a jump instruction jmp), causing it to "trap" or "jump" into a pre-loaded patch function during execution. This type of approach requires the operating system to be running and relies on complex kernel mechanisms such as function stack scanning, process stop synchronization (stop_machine), or ftrace to ensure security. Its disadvantages are: first, it depends on the operating system and will not work if the system is not booted, during initial boot, or after a system crash; second, it must modify code segments in memory, which is ineffective for code written-protected by page tables or stored in true read-only memory (such as ROM); finally, its implementation mechanism is complex and may introduce new stability and performance issues.

[0007] Primary / standby failover and state machine management: Another approach (such as CN122018949A) achieves uninterrupted application-layer business updates by building a software framework that includes primary / standby machine collaboration, state machine control, and failure rollback. This approach focuses on patch deployment processes and system-level high availability, rather than replacing underlying instructions. Its core is ensuring service continuity through process management, but it also cannot solve the problem of accurately repairing individual instructions embedded in ROM, and requires complex system architecture support.

[0008] 2. Hardware patch based on memory address remapping

[0009] To address the issue of software solutions being ineffective for ROM code, some hardware-assisted solutions have been proposed.

[0010] ROM block remapping: Technical documents (such as US20040163080A1) disclose a method for patching on-chip ROM in a multi-level memory system. It uses a programmable address decoder to remap requests for accessing a specific address range in ROM (usually a "block" or "page") to another region in RAM. This approach has a coarse granularity, typically measured in KB or even MB. Its disadvantages include: it cannot precisely replace individual instructions; if patching a 4-byte instruction is required, the replacement content for the entire block (e.g., 4KB) must be prepared, which is not only inefficient but also results in a significant waste of memory space due to remapping. Furthermore, it lacks specific consideration for the processor's instruction fetch path and instruction semantics.

[0011] Debug / Breakpoint Flash Patches: In processors such as the ARM Cortex-M, the debug unit provides FlashPatch and breakpoint comparator functionality. Users can configure several registers to trigger a hardware breakpoint or perform a simple instruction substitution at a specific code address. However, this type of design is intended for debugging, not for live patching in production environments. Its main limitations include: a very limited number of supported patch points (typically 2-4); inconsistent configuration methods, often tied to complex debug interfaces; a lack of coordination mechanisms with the instruction cache (ICache), leading to unpredictable behavior under multiple patch points or complex pipelines; and, more importantly, they also fail to address the issue of preserving PC semantics, unable to guarantee the correct execution of PC-relative instructions after patching.

[0012] 3. Hardware patch based on instruction fetch address comparison and jump

[0013] This is the closest existing technology to the technical approach of this invention. For example, US Patent 5983000A discloses a processor patching device. Its core mechanism is: pre-store multiple "trap addresses" and their corresponding "patch routine addresses" in the hardware. By comparing the current program counter (PC) value with these trap addresses, if they match, the PC is forcibly modified to the corresponding patch routine address, thereby realizing a jump in control flow.

[0014] While this "comparison-jump" model is theoretically feasible, it suffers from several fundamental flaws in practical applications:

[0015] Violating PC-relative semantics: In modern RISC processors (such as RISC-V and ARM), many instructions are PC-relative addressed. When the PC is forcibly modified to the address of a patch routine, executing PC-relative instructions in the patch routine will result in a completely incorrect target address, causing the program to crash. This makes this approach unusable for patching scenarios containing PC-relative addressing code.

[0016] Disruption of Exception and Debug Context: When a patch "jump" occurs, the processor pipeline, exception handling logic, and the PC value recorded by the debug trace unit are all addresses of the patch routine, not the original error address. This makes exception localization and debugging extremely difficult, obscuring the true source of the problem.

[0017] Hardware overhead and configuration complexity: This scheme requires storing both the "trap address" and the "patch routine address" for each patch point. For systems aiming to support a large number of patch points, this significantly increases register resource overhead. Furthermore, the software manages the mapping between two random addresses, resulting in high configuration and maintenance complexity.

[0018] In summary, existing technologies, when faced with the need for ROM / firmware hot patching, are either inefficient due to coarse granularity, unable to work on the ROM due to software dependence, or compromise program execution correctness by altering PC semantics. Therefore, there is an urgent need for a solution that can implement hardware hot patching with fine instruction granularity and low hardware cost without modifying the original code or breaking the processor core semantics. This invention addresses this need. Summary of the Invention

[0019] Therefore, it is necessary to provide a hardware method and system for hot-patching instructions on the processor instruction fetch path without modifying the original read-only memory (ROM) or firmware code, in order to address the problems of the prior art.

[0020] To address the problems in the existing technology, the present invention adopts the following technical solution:

[0021] A hardware hot-patching method, applied to a system including a processor core, instruction cache, and memory subsystem, includes the following steps:

[0022] Configuration steps: The hardware patching unit (HPU) is configured by software running in machine mode or equivalent high privilege level, including: setting the comparison address of the comparator to the original instruction address to be patched, setting the patch base address register, and storing the replacement instruction in the corresponding patch slot.

[0023] Instruction fetch and replacement steps: When the processor core fetches an instruction from the original instruction address, the HPU compares the original instruction address with all enabled comparator addresses. The comparison is performed at the instruction word granularity, ignoring the lowest 2 bits of the address. If the nth comparator is hit, the HPU does not access the memory subsystem to obtain the original instruction. Instead, it generates a patch slot address based on the patch base address and the hit comparator number n, and reads the replacement instruction from that slot address.

[0024] Instruction return step: The HPU returns the read replacement instruction as the fetch result to the pipeline of the processor core, while ensuring that the architecture-visible program counter (PC) value corresponding to the fetch operation is still the original instruction address.

[0025] Enable control step: By independently setting the enable bit corresponding to each comparator, the dynamic enabling or disabling of a single patch point can be achieved; this step is executed independently of the configuration step, allowing the temporary enabling or disabling of the configured patch point without modifying the comparison address and patch slot content.

[0026] Furthermore, the patch slot address is obtained by adding the value of the patch base address register to 4*n, so that each comparator corresponds one-to-one with a fixed-size instruction slot.

[0027] Furthermore, the method also includes a long-distance patching step: when the replacement instruction in a single patch slot is an indirect jump instruction, the processor executes the indirect jump instruction, obtains the long-distance target address by querying a configurable jump structure (such as a jump table), and completes the jump, thereby achieving a jump at any distance.

[0028] Furthermore, the method also includes a conflict resolution step: when multiple enabled comparators simultaneously hit the original instruction address, the comparator that ultimately takes effect is determined according to the rule that the comparator with the smallest number has the highest priority.

[0029] Furthermore, the method also includes a capability discovery step: software running in machine mode or an equivalent high privilege level determines the number of comparators actually implemented by the HPU by writing all 1s to the comparator enable register and then reading its return value.

[0030] Furthermore, the method also includes a consistency guarantee step: after modifying the configuration register or patch slot content of the HPU, the software needs to perform an instruction cache synchronization operation (fence.i instruction in RISC-V architecture, ISB instruction in ARM architecture) to ensure that subsequent instruction fetch operations can observe the updated patch configuration.

[0031] The present invention also provides a hardware hot patching system for implementing the above method, comprising:

[0032] The instruction fetch unit interface is used to receive the instruction fetch address issued by the processor core.

[0033] An address comparator array containing multiple configurable comparators for parallel comparison of the fetch address with a preset comparison address.

[0034] The configuration register file includes at least: a comparator enable register, a patch base address register, and a comparison address register corresponding to each comparator; wherein, the comparator number indicator register is configured such that when the software writes all 1s to the comparator enable register, the number of 1s in the return value read from the register indicates the actual number of comparators implemented by the hardware.

[0035] The hit priority selection module is used to select the only valid comparator when multiple comparators hit, based on the rule that the smaller the number, the higher the priority.

[0036] The patch slot address generation module is used to calculate the patch slot address based on the hit comparator number and the patch base address.

[0037] The instruction fetch return selection module is used to select either the original instruction or the replacement instruction in the patch slot to return to the pipeline based on whether a hit occurs, and is responsible for maintaining the original instruction address as PC semantics.

[0038] The remote patching collaboration module is used to place indirect jump instructions in the patch slot to achieve jumps to remote target addresses.

[0039] The permissions and consistency control module is used to restrict access to configuration registers by machine mode or equivalent high-privilege software, and requires instruction fetch synchronization to be performed after configuration is completed in systems with ICache enabled.

[0040] Furthermore, the patching system also includes a hit priority selection module, which is used to determine the only effective comparator when multiple comparators hit simultaneously, based on the rule that the smaller the number, the higher the priority.

[0041] The present invention also provides a processor that integrates the aforementioned hardware hot patching system.

[0042] The present invention also provides a system-on-a-chip (SoC) including the aforementioned processor.

[0043] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is used to implement or configure the method described thereon.

[0044] The beneficial effects of this invention are as follows:

[0045] 1. No need to modify the original code: The patch performs address remapping and data replacement entirely on the hardware instruction fetch path, without making any changes to the original instruction content of the ROM or deployed firmware.

[0046] 2. Transparent execution and semantic integrity: The PC value visible to the architecture is the original instruction address, which solves the fundamental problem of traditional jump-based patching breaking PC relative addressing, exception context and debugging consistency.

[0047] 3. Low hardware overhead and flexible configuration: Through a deterministic mapping of "comparator number to slot," the register storing the target address is eliminated. Each patch point only requires one comparison address register and one instruction slot, resulting in extremely low cost. Software can discover hardware capabilities through write-1 read-back and independently control each patch point through the enable bit, making the configuration process simple and reliable.

[0048] 4. Supports remote patching: Through the coordination of indirect jump instructions within the slot, a single instruction's patch slot can also achieve a jump to any remote patch function, breaking through the range limitation of direct jump instructions.

[0049] 5. Behavioral determinism: Clear conflict resolution rules prioritizing lower-numbered entries ensure the predictability of hardware behavior when patch configurations overlap. Attached Figure Description

[0050] Figure 1 This is a system framework diagram of the present invention;

[0051] Figure 2 This is a system flowchart for the invention. Detailed Implementation

[0052] To further understand the features, technical means, and specific objectives and functions achieved by the present invention, the present invention will be described in further detail below with reference to the accompanying drawings and specific embodiments.

[0053] Terminology definition: In this invention, “software running in machine mode or equivalent high privilege level” refers to the highest privilege level software with write access to the processor hardware configuration registers, which includes machine mode (M-mode) in RISC-V architecture, EL3 or security monitoring mode in ARM architecture, and Ring 0 or System Management mode (SMM) in x86 architecture.

[0054] This invention is applicable to processor systems with instruction fetch units, storage subsystems, machine-mode software, and instruction caches, and is particularly suitable for repairing defects in ROM-based firmware, on-chip non-volatile firmware, boot code, or deployed embedded software. For ease of explanation, the address of the original instruction to be replaced will be referred to as the "original instruction address," the contiguous area storing the replacement instruction will be referred to as the "patch slot area," and the table that can store distant target addresses will be referred to as the "jump table."

[0055] This invention does not require rewriting the original instruction content, but instead adds a hardware hot patching unit to the processor's instruction fetch path. Before issuing or returning an instruction, this unit compares the original instruction address; if a comparator is hit, it reads the replacement instruction from the slot determined by the patch base address and the comparator number, and returns the replacement instruction as the fetch result corresponding to the original instruction address to the processor pipeline.

[0056] I. Functions of the Modules in this Invention

[0057] (1) Machine-mode patch configuration software. This module is executed by software running in machine mode or an equivalent high-privilege level (hereinafter referred to as high-privilege software) and is used to write the original instruction address to be patched, the base address of the patch slot, and the comparator enable bit. The configuration software can also discover the actual number of comparators implemented in the hardware by writing all 1s to the control register and reading back the valid bits.

[0058] (2) HPU Configuration Register. This module includes a comparator enable register, a patch base address register, and a comparison address register. Bit n in the comparator enable register corresponds to the nth comparator; the patch base address register gives the starting position of the patch slot area; and the comparison address register stores the address of the original instruction to be matched.

[0059] (3) Address comparator array. This module performs parallel or pipelined comparisons between the original instruction address in the instruction fetch path and multiple comparison addresses. The comparisons are performed at the instruction word granularity, ignoring the lower 2 bits of the original instruction address and the comparison address.

[0060] (4) Hit priority selection module. When multiple comparators hit the same original instruction address at the same time, the comparator with the lowest number is selected as the valid hit item to form a deterministic patch result and avoid the execution uncertainty caused by the overlap of multiple patch points.

[0061] (5) Patch Slot Address Generation Module. This module generates the patch slot address based on the hit comparator number n, which is the patch base address + 4 × n. This rule ensures that each comparator naturally corresponds to a fixed-size replacement instruction slot, making it easier for the software to manage patch content in a tabular manner.

[0062] (6) Fetch and return selection module. This module returns the original instruction when there is a miss and the replacement instruction in the patch slot when there is a hit. For instructions that read the PC, the architecture shows that the PC still fetches the original instruction address instead of the patch slot address.

[0063] (7) Long-distance patching coordination module. This module places indirect jump instructions (such as table jump instructions) in the patch slots, enabling a single slot to first jump to the jump table, and then be redirected by the jump table to a patch function that exceeds the scope of a normal direct jump. The indirect jump instruction can be a predefined special instruction, or it can be implemented by a general memory access instruction (such as ld t0, jump_table(index register); jr t0). Those skilled in the art can choose the appropriate method according to the specific instruction set architecture.

[0064] (8) Permission and Consistency Control Module. This module restricts access to the HPU configuration register by machine mode or equivalent high-privilege software, and requires the execution of instruction fetch synchronization instructions (such as fence.i or ISB) after configuration is completed in systems with ICache enabled, so as to ensure that the subsequent instruction fetch results are consistent with the patch configuration.

[0065] II. System Flow of the Invention

[0066] Reference Figure 2 The system flow of this invention is as follows:

[0067] The first step involves high-privilege software querying the hardware hot-patch unit's capabilities. For example, the software can write all 1s to the comparator control register, then read the return value and count the number of 1s to determine the actual number of comparators implemented. The control bits for unimplemented comparators remain at 0.

[0068] The second step involves the software selecting an idle comparator n and writing the original instruction address to be patched into the comparison address register. This address is matched at the word level, so the lower two bits can be fixed to 0 or ignored during the comparison.

[0069] Third, the software writes the base address of the patch slot area into the patch base address register and places a replacement instruction at the patch base address + 4×n position. If the replacement operation can be completed with a single instruction, arithmetic, memory access, branch, or function call replacement instructions can be placed directly. If the distance to the patch target exceeds the range of a normal direct jump, an indirect jump instruction can be placed in this slot, and the absolute target at a long distance can be given by the jump table entry.

[0070] The fourth step involves the software setting the nth enable bit in the control register to activate comparator n. If an ICache exists in the system and may cache the old fetch result corresponding to the original instruction address, the software will execute fence.i or an equivalent fetch synchronization operation after configuration.

[0071] Fifth, during processor operation, the instruction fetch unit generates the raw instruction address. The hardware hot patch unit compares this address. If no enabled comparator hits, the processor fetches and executes the raw instruction according to the original process. If one or more enabled comparators hit, the valid comparator n is determined according to the low-number priority rule, and the replacement instruction is fetched from the slot corresponding to the patch base address + 4×n.

[0072] In the sixth step, the replacement instruction is returned to the processor pipeline for execution. For cases where the execution semantics require reading the current PC, the processor provides the original instruction address as the PC value, not the patch slot address, thus maintaining consistency in PC relative semantics, exception location, and debugging context.

[0073] III. Single Command Slot and Long-Distance Patch

[0074] In RISC-V-type ISAs, the target range of some direct jump instructions is limited. For example, when the original address is far from the entry point of the patch function, a single direct jump may not cover the target address. This invention can place indirect jump instructions (such as table jump instructions) in the patch slot. These instructions carry a jump table index; after the processor executes the instruction, it reads the jump table entry according to the index and jumps to the distant patch function.

[0075] Taking the original instruction address A, comparator number n, and patch base address B as an example, after configuration:

[0076] hpcmp[n] = A;

[0077] hpremap = B;

[0078] Save the indirect jump instruction (such as cm.jt k or equivalent instruction) at B + 4×n.

[0079] The kth entry in the jump table stores the entry point F of the remote patch function.

[0080] When the processor fetches instruction A, it actually returns and executes the indirect jump instruction at B + 4×n, before jumping to F. This method keeps the patch slots fixed-length and compact, while supporting patch targets that exceed the range of normal direct jumps.

[0081] IV. Preservation of the original PC semantics

[0082] In this invention, a patch hit does not mean that the architecture-visible PC is rewritten to the patch slot address. The hardware can manage the "retrieved instruction content" and the "architecture PC corresponding to that instruction" separately: the instruction content comes from the patch slot, while the architecture PC, exception PC, debug log, or PC-relative operations still use the original instruction address. This mechanism has at least the following functions:

[0083] Maintain compatibility with PC-relative addressing or PC reading instructions;

[0084] This allows the exception handling software to still locate the original patched location;

[0085] This facilitates debugging, tracing, or logging tools in associating patch behavior back to the original firmware address;

[0086] To avoid changes in patch slot layout affecting the program's visible semantics.

[0087] V. Configuration Security and Consistency

[0088] The HPU configuration register is located in the system memory-mapped register space and should ideally only be accessible to machine-mode or equivalent high-privilege software. The system can restrict low-privilege software from writing to the HPU configuration register via PMP, page tables, or dedicated system register access control signals. For read access, high-privilege software can be allowed to read the configuration state as needed.

[0089] When ICache is enabled, old instruction caches or prefetch states may still exist in the instruction fetch path after patch configuration changes. Therefore, fence.i or equivalent synchronization operations should be performed before and after patch enabling to ensure that subsequent instruction fetches can observe the new comparator configuration and patch slot contents. Without synchronization, patch hit results may be unpredictable.

[0090] VI. Key Technical Parameters

[0091] (1) Number of comparators N: Configurable, preferably 1 to 16. The actual value of N can be obtained by writing all 1s to the control register and reading back the number of valid enable bits.

[0092] (2) Comparison granularity: instruction word granularity. When comparing the original instruction address with the comparison register address, the lower 2 bits are ignored, which is equivalent to comparing address bits [31:2].

[0093] (3) Patch slot addressing: The patch slot address corresponding to the nth comparator is PatchSlot(n) = HPREMAP + 4×n, where n is the comparator number starting from 0.

[0094] (4) Priority: When multiple comparators hit at the same time, the smaller the comparator number, the higher the priority, i.e., comparator 0 has the highest priority.

[0095] (5) Configuration registers: These include at least the comparator enable register, the patch base address register, and the compare address register. The comparator enable register can independently control each comparator bit by bit.

[0096] (6) Patch slot base address alignment: The patch base address can be aligned according to the implementation specifications. For implementations with a maximum of 16 4-byte slots, the patch slot area can be aligned to a 64-byte boundary so that all slots can be accommodated in a contiguous small table.

[0097] (7) Permission requirements: The HPU configuration register should be configured by a machine mode or equivalent high privilege level principal, and writes by other privilege levels should be restricted through a storage protection mechanism.

[0098] (8) Consistency requirements: When the processor has an ICache or instruction fetch prefetch structure, after configuring the comparator, patch base address, patch slot content or enable bit, instruction fetch synchronization operation should be performed.

[0099] VII. Examples

[0100] Example 1: Single Instruction Replacement

[0101] This embodiment describes the entire process of using the present invention to repair a single erroneous instruction located at address 0x80010004.

[0102] 1. System Initialization: Upon system power-up, the high-privilege firmware (such as the bootloader) running in machine mode performs capability discovery. It writes 0xFFFFFFFF to the HPU's comparator enable register hpctrl and then reads the return value. If the read value is 0x0000000F, it confirms that the hardware has implemented four comparators (numbered 0-3).

[0103] 2. Configure the patch point: The software selects an idle comparator 0. Write the original instruction address to be patched, 0x80010004, into the comparator 0's comparison address register hpcmp[0]. Write the pre-allocated patch slot base address, 0x20000000, into the patch base address register hpremap.

[0104] 3. Prepare replacement instructions: The software writes replacement instructions to fix errors at the location 0x20000000 + 4×0 = 0x20000000 in the patch slot area for comparator 0, such as a correct addi or li instruction.

[0105] 4. Activate the patch: The software sets bit 0 of the hpctrl register to 1, enabling comparator 0. To ensure instruction cache consistency, the software then executes a fence.i instruction (or an ISB instruction for ARM architecture).

[0106] 5. Runtime Patch Activation: When the processor executes to the original address 0x80010004, the instruction fetch unit sends this address to the HPU. The HPU's comparator array finds that the address matches hpcmp[0], resulting in a hit. The hit priority selection module confirms that the valid comparator is 0. The patch slot address generation module calculates the slot address 0x20000000 and reads the replacement instruction from this address. The instruction fetch return selection module returns the replacement instruction to the processor pipeline for execution, while the PC value corresponding to this instruction in the pipeline is still recorded as 0x80010004. The entire replacement process is completely transparent to upper-level software (such as the operating system), and PC relative addressing remains correct.

[0107] 6. Disable Patch: If you need to temporarily disable the patch, clear bit 0 of the hpctrl register to 0. Afterward, the processor will no longer hit 0x80010004 and will resume executing the original instructions.

[0108] Example 2: Long-distance function patch

[0109] This embodiment describes how to use the present invention to implement a patch function long_func (located at 0x1000f000) that is very far from the original address 0x80010008.

[0110] 1. Configure patch point: Similar to Example 1, the software selects comparator 1 and writes 0x80010008 into hpcmp[1], while hpremap remains 0x20000000.

[0111] 2. Preparing the Jump Slot: Due to the limited immediate number field of direct jump instructions (such as jal in RISC-V), it is impossible to jump directly from 0x80010008 to 0x1000f000. Therefore, the software does not place a direct jump instruction in patch slot 0x20000004, but instead places an indirect jump instruction, such as cm.jt 1 (a user-defined instruction meaning "jump from index 1"). It should be noted that this indirect jump instruction can also be implemented using a general memory access instruction (such as ld t0, jump_table+8 (zero register); jr t0). Those skilled in the art can choose the appropriate method based on the specific instruction set architecture.

[0112] 3. Prepare the jump table: Define a jump table jump_table in memory. The software writes the target address 0x1000f000 of the remote patch function into jump_table[1].

[0113] 4. Execution: When the processor fetches an instruction from 0x80010008, the HPU hits comparator 1 and returns the indirect jump instruction at 0x20000004 to the pipeline. When the processor executes this instruction, the microarchitecture reads the value 0x1000f000 from jump_table[1] and uses it as the target address for the jump. Ultimately, the processor successfully executes the remote patch function.

[0114] Example 3: Handling Conflicts Among Multiple Patch Points

[0115] Software developers may mistakenly configure two different comparators to the same raw instruction address, for example, both comparator 0 and comparator 2 might be configured as 0x80010004. In this case, when the processor accesses 0x80010004, both comparators will report a hit. The hit priority selection module of this invention forces the selection of the comparator with the smallest number (i.e., comparator 0) as the valid hit. This ensures deterministic hardware behavior and avoids execution chaos caused by misconfiguration. Software can detect such overlapping configurations by reading the status register (if any).

[0116] Example 4: Multiple patch points working independently

[0117] This embodiment demonstrates a scenario where multiple patch points are enabled simultaneously, each working independently without interfering with the others.

[0118] Assume the system implements 4 comparators (numbered 0-3), and the software configuration is as follows:

[0119] Comparator 0: Original address A → Replacement instruction A'

[0120] Comparator 1: Original address B → Replacement instruction B'

[0121] Comparator 2: Original address C → Replacement instruction C'

[0122] Comparator 3: Original address D → Replacement instruction D'

[0123] All comparator enable bits are set to 1. When the processor sequentially executes to addresses A, B, C, and D, the HPU hits the corresponding comparators 0, 1, 2, and 3 respectively, and returns replacement instructions A', B', C', and D' respectively. Each patch point takes effect independently without any interference between them. This demonstrates the hardware hot patching system of this invention's ability to support multiple patch points, simultaneously fixing multiple defects in the firmware.

[0124] Example 5: Recovery after patch deactivation

[0125] Continuing with the configuration of Example 1, with comparator 0 enabled, the fetch-back replacement instruction at address 0x80010004 is executed. When the software needs to temporarily disable the patch (e.g., to verify the original behavior or for debugging), simply clear bit 0 of the hpctrl register. Subsequently, when the processor accesses 0x80010004 again, HPU's comparator 0, being disabled, does not participate in the comparison, and the fetch-back selection module determines a miss, thus returning to the original instruction at the original memory location. This achieves dynamic enabling and disabling of the patch without reconfiguring the comparison address or reprogramming the patch slot.

[0126] This invention enables hardware-level hot patching of specific instruction addresses without modifying the original ROM / firmware instructions; reduces the configuration overhead of each patch point through a patch slot table; reduces the impact of patches on software-visible behavior by preserving the original PC semantics; expands the target range of patches through a long-distance indirect jump mechanism; and reduces the risk of misconfiguration and cache inconsistency through permissions and synchronization rules.

[0127] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A hardware hot-patching method, applied to a system including a processor core, characterized in that, Includes the following steps: Configuration steps: At least one comparator of the hardware patching unit (HPU) is configured by software running in machine mode or equivalent high privilege level, including setting the comparator's comparison address to the original instruction address to be patched; Instruction fetch and replacement step: When the processor core fetches an instruction from the original instruction address, the HPU compares the original instruction address with the address of the configured comparator; if a hit occurs, the HPU reads the replacement instruction from a patch slot corresponding to the comparator based on the hit result, instead of retrieving the original instruction from the original storage location; Instruction return step: The HPU returns the read replacement instruction to the processor core for execution, and at the same time, keeps the architecture-visible program counter (PC) value corresponding to this instruction fetch operation at the original instruction address.

2. The method according to claim 1, characterized in that, In the instruction fetch and replacement step, each comparator corresponds one-to-one with a patch slot of a fixed size. The address of the patch slot is determined by a common patch base address and the comparator number. The comparator compares the original instruction address with the comparison address at the instruction word granularity, ignoring the lowest two bits of the address.

3. The method according to claim 2, characterized in that, The address of the patch slot is determined by the following formula: Patch slot address = Patch base address + 4 × n Where n is the number of the comparator that was hit.

4. The method according to claim 1, characterized in that, It also includes a long-distance patching step: when the replacement instruction in the patch slot is an indirect jump instruction, the processor executes the indirect jump instruction, obtains the long-distance target address by querying a configurable jump structure, and completes the jump.

5. The method according to claim 1, characterized in that, It also includes a conflict resolution step: when multiple enabled comparators simultaneously hit the original instruction address, the HPU selects a single valid comparator according to a preset priority rule, wherein the comparator with the smaller number has a higher priority.

6. The method according to claim 1, characterized in that, It also includes a capability discovery step: the software running in machine mode or equivalent high privilege level determines the number of comparators actually implemented by the HPU by writing all 1s to the comparator enable register of the HPU and reading its return value.

7. The method according to claim 1, characterized in that, It also includes an enable control step: by independently setting the enable bit corresponding to each comparator, the dynamic enabling or disabling of a single patch point can be achieved; the enable control step is executed independently of the configuration step, allowing the configured patch point to be temporarily enabled or disabled without modifying the comparison address and patch slot content.

8. The method according to claim 1, characterized in that, It also includes a consistency guarantee step: after modifying the configuration or patch slot content of the HPU, the software needs to perform an instruction cache synchronization operation to ensure that subsequent instruction fetch operations can observe the updated patch configuration; wherein, the instruction cache synchronization operation is the fence.i instruction in the RISC-V architecture and the ISB instruction in the ARM architecture.

9. A hardware hot patching system, characterized in that, include: An address comparator array, containing multiple configurable comparators, is used to compare the instruction fetch address of the processor core with a preset comparison address in parallel. The configuration register includes at least: a patch base address register for storing the base address of the patch slot area, and a comparison address register for storing the preset comparison address corresponding to each comparator; The patch slot address generation module is used to generate a patch slot address based on the number of the hit comparator and the value of the patch base address register. The fetch return selection module is used to read the replacement instruction from the patch slot address and return it to the processor core when a hit occurs, while keeping the architecture-visible program counter PC value corresponding to the fetch operation at the original instruction address. The remote patching collaboration module is used to place indirect jump instructions in the patch slot to achieve jumps to remote target addresses; The permissions and consistency control module is used to restrict access permissions to configuration registers and ensure instruction cache consistency.

10. The system according to claim 9, characterized in that, It also includes a hit priority selection module, which is used to determine the only effective comparator when multiple comparators hit at the same time, based on the rule that the smaller the number, the higher the priority.

11. The system according to claim 9, characterized in that, The configuration register also includes a comparator number indicator register, which is configured such that when the software writes all 1s to the comparator enable register, the number of 1s in the return value read from the register indicates the actual number of comparators implemented in the hardware.

12. A processor, characterized in that, The system integrates the hardware hot patching system as described in any one of claims 9 to 11.

13. A system-on-a-chip (SoC), characterized in that, Includes the processor as described in claim 12.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program is used to implement the method as described in any one of claims 1 to 8, or to configure the hardware hot patching system as described in any one of claims 9 to 11.

Images