WO2021000847A1

WO2021000847A1 - Processor and return address processing method

Info

Publication number: WO2021000847A1
Application number: PCT/CN2020/099168
Authority: WO
Inventors: 钱雅超; 章庆隆; 汤倩莹
Original assignee: 华为技术有限公司
Priority date: 2019-07-01
Filing date: 2020-06-30
Publication date: 2021-01-07
Also published as: CN112181491A

Abstract

Embodiments of the present application provide a processor and a return address processing method. A conversion circuit of hardware is provided in the processor; when a return address needs to be stored, the return address is converted by means of the conversion circuit, and the obtained converted return address is output to a memory; when the return address needs to be used, the converted return address in the memory is converted by means of the conversion circuit to obtain the return address. Because an attacker cannot know the conversion operations carried out by the conversion circuit, the attack is unable to modify the converted return address in the memory as a converted return address corresponding to a malicious instruction, so that a malicious change to a program control flow by an attacker can be prevented. Moreover, because the conversion process is implemented by the conversion circuit of the hardware in a program running process, there is no need to identify an invoking instruction and a return instruction in a compiling stage, and no need to insert an additional encryption instruction and decryption instruction, and the running performance of the processor is prevented from being affected.

Description

Processing method of processor and return address

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office, the application number is 201910586325.5, and the application name is "Processing Method of Processor and Return Address" on July 1, 2019, the entire content of which is incorporated into this application by reference in.

Technical field

The embodiments of the present application relate to the field of computer technology, and in particular, to a processor and a method for processing a return address.

Background technique

While the processor is running the program, an attacker may maliciously hijack the program control flow. Specifically, the attacker modifies the normal return address to the malicious return address by modifying the return address of the subprogram, so that the processor jumps to the code segment pointed to by the malicious return address after executing the subprogram code, thereby changing the program control flow The purpose of this is to destroy the control flow integrity (CFI) of the program.

At present, in order to prevent the program control flow from being maliciously changed, it is usually necessary to monitor the control flow of the program when the program is running. If the program control flow is changed, an alarm is issued. In a related technology, in the program compilation stage, the call instruction and the return instruction corresponding to the subroutine are identified, an encryption instruction is inserted before the call instruction, and a decryption instruction is inserted before the return instruction. Furthermore, in the program running stage, before the processor calls the subroutine, the return address of the subroutine is encrypted by the encryption instruction, and the obtained encrypted address is pushed onto the stack. After the subroutine is executed, the decryption instruction is used to decrypt the encrypted address that was popped out of the stack to obtain the original return address, so that the processor can continue to execute from the return address.

After the above defense technology is adopted, even if the attacker hijacks the encrypted address from the stack, because the attacker does not know the key used in the encryption instruction, the encrypted address cannot be tampered with the encrypted malicious address. In other words, the attacker cannot control the jump position of the program after hijacking the program control flow. Therefore, it can prevent the attacker from making malicious changes to the program control flow and realize the protection of the integrity of the program control flow.

However, in the above technology, it is necessary to insert multiple additional instructions into the program, which reduces the running performance of the program.

Summary of the invention

The embodiment of the present application provides a processor and a method for processing a return address to protect the control flow integrity of the program without reducing the running performance of the program.

In the first aspect, an embodiment of the present application provides a processor, including: a processing core and a conversion circuit;

The processing core is used to output a return address;

The conversion circuit is configured to convert the return address output by the processing core to obtain the conversion return address, and output the conversion return address to a stack in the memory;

The conversion circuit is also configured to perform the conversion on the converted return address in the stack when the processing core needs to use the return address to obtain the return address, and output the return address to The processing core.

In this embodiment, before the return address is stored in the memory, the conversion circuit performs a conversion on the return address. Therefore, the converted return address is stored in the memory. Since the attacker cannot know the conversion operation performed in the conversion circuit, the attacker cannot modify the conversion return address in the memory to the conversion return address corresponding to the malicious instruction, thereby preventing the attacker from maliciously changing the program control flow. After the converted return address is popped from the memory, the conversion circuit performs another conversion on the converted return address to obtain the original return address, so that the processing core can execute subsequent instructions according to the original return address, ensuring the program control flow Completeness. Since the above conversion process is implemented by the hardware conversion circuit during the program running, there is no need to identify call instructions and return instructions in the compilation stage, and there is no need to insert additional encryption instructions and decryption instructions, thus avoiding the impact on the operating performance of the processor. influences. At the same time, the risk of software theft is also avoided.

Optionally, the processor further includes a register;

The conversion circuit is specifically configured to convert the return address output by the processing core to obtain a conversion return address, and output the conversion return address to the register, so that the conversion return address is output to the register via the register Stack in memory;

The conversion circuit is also specifically configured to perform the conversion on the converted return address in the stack when the processing core needs to use the return address to obtain the return address, and output the return address To the register, so that the return address is output to the processing core via the register.

In this embodiment, a hardware conversion circuit is provided on the write path of the register. The conversion circuit is used to convert the return address of the register, that is, all inputs that need to enter the register will be converted by the conversion circuit first, and then Input the conversion result into the register. In this way, the return address can be automatically identified without changing the control flow of the processor, which is easy to implement.

Optionally, the processor further includes a register;

When the processing core outputs the return address, the register is used to register the return address output by the processing core;

The conversion circuit is specifically configured to convert the return address output by the register to obtain a conversion return address, and output the conversion return address to a stack in the memory;

When the processing core needs to use the return address, the register is also used to register the conversion return address output by the stack;

The conversion circuit is further specifically configured to perform the conversion on the conversion return address output by the register to obtain the return address, and output the return address to the processing core.

In this embodiment, a hardware conversion circuit is provided on the readout path of the register, and the conversion circuit is used to convert the return address output by the register, that is, all the values output from the register will be converted by the conversion circuit first. In this way, the return address can be automatically identified without changing the control flow of the processor, which is easy to implement.

Optionally, the conversion satisfies the following conditions:

B=IP(A), A=IP(B)

Where, A is the return address, B is the conversion return address, and IP() is the conversion model used in the conversion.

Optionally, the conversion circuit is specifically used for:

At least one conversion model is used to convert at least one bit of the return address to obtain the converted return address.

Wherein, the at least one bit includes the bit corresponding to the change section of the code address of the program and the bit corresponding to the unchanged section; the code address of the program includes the instruction addresses of multiple instructions, and the invariant section is multiple Bits with the same bits in each instruction address, and the change section is bits with different bits in multiple instruction addresses.

By storing the conversion model and conversion parameters in the hardware circuit, the attacker cannot obtain these sensitive information, which improves the defense reliability of the program control flow; when the conversion circuit converts at least one bit of the return address, the change section and the Changing the sections at the same time can improve the difficulty of brute force cracking by attackers and ensure the security of program control flow.

Optionally, the conversion circuit is specifically used for:

Group at least one bit of the return address to obtain multiple bit groups;

The conversion model is used to convert the bits in each bit group to obtain a conversion result corresponding to each bit group, wherein at least two bit groups in the multiple bit groups have different conversion models , Or, the conversion models adopted by the multiple bit groups are the same;

According to the conversion result corresponding to each bit group, the conversion return address is obtained.

Optionally, the number of the bit groups is two, wherein one bit group includes bits corresponding to odd-numbered bits of the return address, and the other bit group includes bits corresponding to even-numbered bits of the return address.

Optionally, the types of the conversion model include: modular multiplication conversion model and modular addition conversion model.

Optionally, the register is a register for storing the return address.

Optionally, the processor is a processor based on an ARM instruction set, and the register is an LR register.

Optionally, the processor is a processor based on a RISC V instruction set, and the register is an RA register.

In the second aspect, an embodiment of the present application provides a method for processing a return address, which is applied to a processor, the processor includes a processing core and a conversion circuit, and the method includes:

When the processing core outputs the return address, the return address is converted by the conversion circuit to obtain a conversion return address, and the conversion return address is output to a stack in the memory;

When the return address needs to be used, the conversion circuit performs the conversion on the converted return address in the stack to obtain the return address, and outputs the return address to the processing core.

Optionally, the processor further includes a register, and the conversion of the return address by the conversion circuit to obtain the conversion return address, and outputting the conversion return address to a stack in the memory includes:

Converting the return address by the conversion circuit to obtain a conversion return address, and outputting the conversion return address to the register, so that the conversion return address is output to the stack in the memory via the register;

The performing the conversion on the conversion return address in the stack by the conversion circuit to obtain the return address, and outputting the return address to the processing core includes:

Perform the conversion on the conversion return address in the stack by the conversion circuit to obtain the return address, and output the return address to the register, so that the return address is output through the register To the processing core.

Optionally, the processor further includes a register, the return address is output to the register by the processing core, the return address is converted by the conversion circuit to obtain a converted return address, and the The output of the conversion return address to the stack in memory includes:

Converting the return address output by the register by the conversion circuit to obtain a conversion return address, and output the conversion return address to a stack in the memory;

The conversion circuit performs the conversion on the conversion return address output by the register to obtain the return address, and outputs the return address to the processing core.

Optionally, the conversion satisfies the following conditions:

B=IP(A), A=IP(B)

Optionally, the converting the return address to obtain the converted return address includes:

Optionally, the conversion of at least one bit of the return address using at least one conversion model to obtain the conversion return address includes:

Group at least one bit of the return address to obtain multiple bit groups;

Optionally, the register is a register for storing the return address.

In a third aspect, an embodiment of the present application provides an electronic device, including: the processor according to any one of the first aspect.

In a fourth aspect, an embodiment of the present application provides a chip, including the processor according to any one of the first aspect.

In the processor and return address processing method provided by the embodiments of the application, a hardware conversion circuit is set in the processor, and when the return address needs to be saved, the conversion circuit is used to convert the return address, and the obtained converted return address is output to the memory Medium; when the return address needs to be used, the conversion circuit is used to convert the conversion return address in the memory to obtain the return address. In the embodiment of the present application, since the attacker cannot know the conversion operation performed in the conversion circuit, the attacker cannot modify the conversion return address in the memory to the conversion return address corresponding to the malicious instruction, thereby preventing the attacker from controlling the flow of the program. Malicious changes. Moreover, since the above conversion process is implemented by a hardware conversion circuit during the running of the program, compared with the above related technology, there is no need to identify call instructions and return instructions at the compilation stage, and there is no need to insert additional encryption instructions and decryption instructions. Avoid the impact on the operating performance of the processor.

Description of the drawings

FIG. 1 is a schematic diagram of the structure of an electronic device provided by an embodiment of the application;

2 is a schematic structural diagram of a processor provided by an embodiment of the application;

FIG. 3 is a schematic diagram of the processing process of the return address provided by the embodiment of the application;

4A and 4B are schematic diagrams of the processing procedure of the existing return address;

5A and 5B are schematic diagrams of the processing process of the return address provided by the embodiment of the application;

FIG. 6 is a schematic diagram of a program running process provided by an embodiment of the application;

7A and 7B are schematic diagrams of the processing process of the return address provided by an embodiment of the application;

FIG. 8 is a schematic flowchart of a method for processing a return address provided by an embodiment of the application.

Detailed ways

In order to facilitate the understanding of the present application, first, with reference to FIG. 1, the structure of the electronic device to which the processor of the present application is applicable is described.

FIG. 1 is a schematic structural diagram of an electronic device provided by an embodiment of the application. As shown in FIG. 1, the electronic device 10 includes a processor 100 and a memory (memory) 200. Among them, the memory 200 is used to store computer programs and data. There are many types of storage, which can be divided into main storage and auxiliary storage according to their use. Main memory is also called "internal memory" or "memory" for short. The memory is used to temporarily store computer programs and data during the operation of the processor. Auxiliary storage is also called "external storage" or "external storage" for short. External storage is used to store computer programs and data that are temporarily not used during the operation of the processor. The processor 100 is configured to execute a computer program stored in the memory 200.

Among them, the processor is the core device of electronic equipment. The processor usually includes at least one processing core, a cache, and an input and output interface for communicating with other devices of the electronic device. Among them, the processing core refers to the processing unit used to perform data processing tasks in the processor. The processing core is the main component responsible for computing in the processor.

The processor in this application may be a central processing unit (CPU), a graphics processing unit (GPU), etc.

The processor can be used to execute a computer program in an electronic device. The processor can recognize and execute the instructions in the computer program, so that the electronic device can perform a certain function or obtain a certain result.

A computer program is a sequence of instructions composed of multiple instructions. The computer program can also call subroutines. Subroutines can also be called "subroutines" or "subfunctions". A subroutine is composed of one or more instructions, responsible for completing a specific task, and has relative independence. Usually, the program containing the calling subroutine is called the main program. The main program and the subprogram are relative. For example, program B is called in program A, and program C is called in program B. Then, compared to program A, program B is a subprogram, and compared to program C, program B is the main program.

The normal execution flow of a computer program is called program control flow. In the process of executing the computer program, the processor executes each instruction according to the program control flow. However, during the execution of the computer program by the processor, an attacker may maliciously hijack the program control flow. The purpose of these malicious attacks is usually to change the control flow of the program, thereby destroying the Control Flow Integrity (CFI) of the program. Exemplarily, a common CFI malicious attack event that destroys programs is a return-oriented programming (ROP) attack.

The following describes the process of the processor executing the computer program under normal conditions with a specific example, and the process of executing the computer program under the ROP attack.

Assume that the computer program includes: instruction A, instruction B, and instruction C. Among them, instruction B is a subroutine call instruction. Among them, the address of instruction A is 0x0000, the address of instruction B is 0x0004, and the address of instruction C is 0x0008. The normal program execution flow is to execute instruction A, instruction B, and instruction C in sequence. The normal flow of the processor executing the program is as follows.

1) The processor executes instruction A.

Since instruction B is a subroutine call instruction, when the processor executes instruction B, it will jump to the address of the subroutine corresponding to instruction B. In order to ensure that the processor can correctly return to the address of instruction C after executing the subroutine corresponding to instruction B, the processor saves the address of instruction C before executing instruction B. which is,

2) The processor writes the address of instruction C into the memory. In the embodiment of this application, the address of command C is called the return address.

Exemplarily, the processor may write the return address to the stack in the memory.

3) The processor executes instruction B, jumps to the address of the subroutine corresponding to instruction B, and executes the subroutine.

4) When the execution of the subroutine ends, read the return address (0x0008) from the memory, jump to address 0x0008 and execute instruction C.

When there is a ROP attack, the attacker tampered with the return address stored in the memory. Exemplarily, the attacker uses remote software to modify the address (0x0008) of instruction C stored in the memory to a malicious address. After executing the subroutine corresponding to instruction B, the processor reads the malicious address from the memory and jumps to the malicious address for execution. Thus, the purpose of destroying the integrity of the program control flow is achieved.

At present, in order to prevent the program control flow from being maliciously changed, it is usually necessary to monitor the control flow of the program when it is running. If the program control flow is changed, an alarm is issued.

In a related technology, software is used to defend against malicious changes in program control flow. Specifically, in the program compilation stage, first identify the call instruction and return instruction corresponding to the subroutine. Exemplarily, the call instruction is a call instruction, and the return instruction is a ret instruction. Then, insert an encrypted instruction before the call instruction. Exemplarily, the encryption instruction is an instruction to encrypt the return address using a preset key. At the same time, insert a decryption instruction before the return instruction. Exemplarily, the decryption instruction is an instruction to decrypt the encrypted return address using the same key.

After such compilation, in the program running stage, before the processor calls the subroutine, it first executes the encryption instruction to encrypt the return address of the subroutine, and stores the obtained encrypted address in the memory. After the subroutine is executed, the decryption instruction is used to decrypt the encrypted address read from the memory to obtain the original return address, so that the processor can continue to execute from the return address.

The specific encryption and decryption method can be to define a special register in the processor, which is specially used for storing the key and cannot be used for other purposes. During encryption, the original return address is XORed with the key in the special register to obtain the encrypted return address, which is stored in the memory. During decryption, the encrypted return address read from the memory and the key in the special register are XORed again to get the original return address. That is, both the encryption instruction and the decryption instruction need to perform an exclusive OR operation.

After adopting the above defense technology, even if the attacker hijacks the encrypted return address from the memory, because the attacker does not know the key used in the encryption instruction, the encrypted return address cannot be tampered with the encrypted malicious address. In other words, the attacker cannot control the jump position of the program after hijacking the program control flow. Therefore, it can prevent the attacker from making malicious changes to the program control flow and realize the protection of the integrity of the program control flow.

However, the above-mentioned related technologies have at least the following problems: 1) In the program compilation stage, it is necessary to identify the call instruction and the return instruction, and insert multiple additional encryption instructions and decryption instructions into the program, which reduces the running performance of the program. 2) Since the key is stored in the register, and software is used for encryption and decryption, there is a risk of software theft, and the protection security is poor. 3) The exclusive OR operation is used to operate each bit individually, which makes brute force cracking less difficult. Each brute force cracking can make the program jump to the code area, which poses a security risk. 4) Since a special register is needed to store the key, the special register cannot be used by other functions, which limits the application scenarios.

In order to solve at least one of the above problems, an embodiment of the present application provides a processor. A hardware conversion circuit is provided in the processor. When the return address needs to be saved, the conversion circuit is used to convert the return address, and the obtained conversion is returned. The address is output to the memory; when the return address needs to be used, a conversion circuit is used to convert the conversion return address in the memory to obtain the return address. In the embodiment of the present application, since the attacker cannot know the conversion operation performed in the conversion circuit, the attacker cannot modify the conversion return address in the memory to the conversion return address corresponding to the malicious instruction, thereby preventing the attacker from controlling the flow of the program. Malicious changes. Moreover, since the above conversion process is implemented by a hardware conversion circuit during the running of the program, compared with the above related technology, there is no need to identify call instructions and return instructions at the compilation stage, and there is no need to insert additional encryption instructions and decryption instructions. Avoid the impact on the operating performance of the processor.

Hereinafter, the technical solutions shown in this application will be described in detail through specific embodiments. It should be noted that the following embodiments may exist alone or combined with each other, and the same or similar content will not be repeated in different embodiments.

FIG. 2 is a schematic structural diagram of a processor provided by an embodiment of the application. As shown in FIG. 2, the processor 100 of this embodiment includes: a processing core 110 and a conversion circuit 120.

Among them, the processing core 110 is used to output the return address.

The conversion circuit 120 is configured to convert the return address output by the processing core 110 to obtain the conversion return address, and output the conversion return address to the stack in the memory.

The conversion circuit 120 is further configured to perform the conversion on the converted return address in the stack when the processing core 110 needs to use the return address to obtain the return address, and output the return address to the processing core 110.

The embodiment of the present application does not specifically limit the type of the processor. The processors in the embodiments of the present application may be, but are not limited to, the following types: processors based on the ARM instruction set and processors based on the RISC-V instruction set.

The embodiment of the present application does not specifically limit the bit width of the processor. The processor may be a 32-bit processor or a 64-bit processor, of course, it may also be a processor with other bit widths.

The number of processing cores in the processor may be one or more. The processing core refers to the processing unit used to perform data processing tasks in the processor. When the number of processing cores is one, the processor is a single-core processor. When the number of processing cores is multiple, the processor is a multi-core processor. The processing core is used to output the return address. The return address is the address of the next instruction to be executed by the processing core.

In this application, the processing core is any circuit that needs to store the return address in the memory and obtain the return address from the memory. Exemplarily, the processing core is a program counter (Program Counter, PC). PC can also be called instruction counter. PC is used to store the address of the next instruction to be executed by the processor. Before the program starts to execute, the processor sends the start address of the program, that is, the address of the first instruction of the program into the PC. When an instruction is executed, the processor will automatically modify the value in the PC, that is, every time an instruction is executed, the value in the PC is increased by an amount so that the value in the PC always points to the address of the next instruction to be executed.

In this application, the conversion circuit is arranged on the data path between the processing core and the memory. The processing of the return address by the conversion circuit is described below in conjunction with FIG. 3.

FIG. 3 is a schematic diagram of the processing process of the return address provided by the embodiment of the application. As shown in Figure 3, when the processing core needs to store the return address in the memory, the return address output by the processing core passes through the conversion circuit, and the conversion circuit converts the return address to obtain the conversion return address, and then outputs the conversion return address to the memory In the stack. When the processing core needs to use the return address, the converted return address popped from the memory passes through the conversion circuit, and the conversion circuit performs the same conversion on the converted address to obtain the original return address, and then the original return address Output to the processing core.

Among them, the processing core needs to store the return address in the memory, which may mean that the processing core needs to store the return address corresponding to the call instruction in the memory before executing the call instruction.

Correspondingly, the processing core needs to use the return address, which may mean that when the processing core returns from the subroutine corresponding to the call instruction, it needs to obtain the return address corresponding to the call instruction from the memory.

It can be understood that, in the embodiment of the present application, the conversion circuit may adopt one or more conversion models to convert the return address. This embodiment does not specifically limit this. For several possible conversion modes, refer to the detailed description of the subsequent embodiments.

In this application, before the return address is stored in the memory, the conversion circuit performs a conversion on the return address. Therefore, the converted return address is stored in the memory. Since the attacker cannot know the conversion operation performed in the conversion circuit, the attacker cannot modify the conversion return address in the memory to the conversion return address corresponding to the malicious instruction, thereby preventing the attacker from maliciously changing the program control flow.

After the converted return address is popped from the memory, the conversion circuit performs another conversion on the converted return address to obtain the original return address, so that the processing core can execute subsequent instructions according to the original return address, ensuring the program control flow Completeness.

In this application, since the above conversion process is implemented through a hardware conversion circuit during program operation, compared with the above related technology, there is no need to identify call instructions and return instructions at the compilation stage, and there is no need to insert additional encryption instructions and decryption instructions. Instructions, to avoid the impact on the operating performance of the processor. At the same time, compared with the above-mentioned related technology, no special special register is needed to store the key, which avoids the risk of software theft.

In a possible implementation manner, the processor further includes a control circuit, which can identify whether the address output by the processing core is a return address, and when the control circuit recognizes that the address output by the processing core is a return address, it controls the return address Input the conversion circuit. The conversion circuit obtains the conversion return address after converting the return address, and outputs the conversion return address to the stack in the memory. When the control circuit recognizes that the processing core needs to use the return address, under the control of the control circuit, the converted return address popped from the memory is input to the conversion circuit. The conversion circuit converts the conversion return address to obtain the original return address, and outputs the original return address to the processing core.

In another possible implementation manner, the processor does not perceive the existence of the conversion circuit. The conversion circuit sets the data path between the processing core and the memory, that is, when the return address is transferred from the processing core to the memory and from the memory to the processing core, it will pass through the conversion circuit. This implementation mode only needs to provide a conversion circuit on the data path between the processing core and the memory, without changing the existing control flow of the processor, and is easy to implement.

Optionally, the processor further includes a register, which is a register specially used for storing the return address.

For this type of processor, the above-mentioned register is the only way between the return address from the processing core to the memory. Exemplarily, when the return address of the subroutine needs to be output to the memory, the processing core first outputs the return address to the aforementioned register, and then the register outputs the return address to the memory. When the return address needs to be used, the return address popped from the memory is also output to the aforementioned register first, and then the register outputs the return address to the processing core.

It can be understood that for processors with different instruction sets, the registers used to store the return address may be different.

Exemplarily, the processor is a processor based on an ARM instruction set, and the register is a link register (LR).

Exemplarily, the processor is a processor based on a RISC V instruction set, and the register is a return address (return address, RA) register.

The following takes the processor of the ARM instruction set as an example to describe the structure of the processor and the processing process of the return address. 4A and 4B are schematic diagrams of the conventional return address processing process. Among them, FIG. 4A illustrates a schematic diagram of the process of pushing the return address into the stack, and FIG. 4B illustrates a schematic diagram of the process of popping the return address from the stack.

Before the processing core executes the call instruction, the return address corresponding to the call instruction needs to be stored in the memory. Exemplarily, as shown in FIG. 4A, under the control of the processing core, the return address output by the PC enters the LR register. Then, the return address output by the LR register is stored in the memory stack.

When the processing core returns from the subroutine corresponding to the call instruction, it needs to read the return address from the memory. Exemplarily, as shown in FIG. 4B, the return address from the stack from the memory enters the LR register. Then, the LR register outputs the return address to the processing core.

The conversion circuit in this embodiment can be set before the above-mentioned register or after the above-mentioned register.

It should be noted that, in this embodiment, that the conversion circuit is set before the register means that the conversion circuit is set on the write path of the register, that is, set at the input end of the register. When the conversion circuit is set before the register, it means that all return addresses entering the register will pass through the conversion circuit before entering the register. In this embodiment, the conversion circuit is arranged after the register, which means that the conversion circuit is arranged on the readout path of the register, that is, arranged at the output terminal of the register. When the conversion circuit is set after the register, it means that all return addresses output from the register will pass through the conversion circuit.

The above two embodiments are described separately below.

5A and 5B are schematic diagrams of the processing procedure of the return address provided by the embodiment of the application. In this embodiment, the conversion circuit is set on the write path of the LR register. Among them, FIG. 5A illustrates the process of pushing the return address into the stack, and FIG. 5B illustrates the process of popping the return address from the stack.

The conversion circuit is specifically configured to convert the return address output by the processing core to obtain a conversion return address, and output the conversion return address to the register, so that the conversion return address is output to the register via the register The stack in memory.

As shown in FIG. 5A, since the conversion circuit is arranged on the write path of the register, the return address output by the processing core will pass through the conversion circuit first during the output to the LR register. The conversion circuit converts the return address output by the processing core to obtain the conversion return address, so that what is actually stored in the LR register is the conversion return address. Then, the LR register outputs the conversion return address to the stack in the memory, that is, what is actually pushed onto the stack is the conversion return address. Since the attacker cannot know the conversion operation performed in the conversion circuit, the attacker cannot modify the conversion return address in the memory to the conversion return address corresponding to the malicious instruction, thereby preventing the attacker from maliciously changing the program control flow.

As shown in Figure 5B, when the processing core needs to use the return address, since the conversion circuit is set on the write path of the LR register, the converted return address from the memory stack will pass through the conversion circuit before entering the LR register. The conversion circuit converts the conversion return address to obtain the original return address, so that what is actually stored in the LR register is the original return address. Then, the LR register outputs the original return address to the processing core. So as to ensure the normal control flow of the program.

The following takes a processor based on the ARM instruction set as an example, combined with the running process of an actual program, for example.

Fig. 6 is a schematic diagram of a program running process provided by an embodiment of the application. As shown in Figure 6, the program includes the following ARM instructions: SUB, STP, ADD, LDP, ADD, and RET.

The control flow is ready to enter the subroutine, that is, when the processing core executes the STP instruction, it outputs the return address to the LR (0x30) register. Before the return address enters the LR register, the return address passes through the conversion circuit, and the conversion circuit converts the return address to obtain the conversion return address, so that what actually enters the LR register is the conversion return address. After that, the LR register outputs the converted return address to the stack in the memory.

When the control flow returns from the end of the subroutine, that is, when the processing core executes the LDP instruction, the conversion return address is read from the memory stack. The conversion return address will pass through the conversion circuit before entering the LR (0x30) register, and the conversion circuit will convert the conversion return address again to obtain the original return address. The original return address is stored in the LR register and used when the processing core executes the RET instruction.

In this embodiment, a hardware conversion circuit is set on the write path of the LR register. The conversion circuit is used to convert the return address entering the LR register, that is, all inputs that need to enter the LR register will pass through the conversion circuit first. Convert, and then enter the conversion result into the LR register. In this way, the return address can be automatically identified without changing the control flow of the processor, which is easy to implement.

FIG. 7A and FIG. 7B are schematic diagrams of the processing process of the return address provided by the embodiment of the application. In this embodiment, the conversion circuit is arranged on the readout path of the LR register. Among them, FIG. 7A illustrates the process of pushing the return address into the stack, and FIG. 7B illustrates the process of popping the return address from the stack.

When the processing core outputs the return address, the register is used to register the return address output by the processing core. The conversion circuit is specifically configured to convert the return address output by the register to obtain a conversion return address, and output the conversion return address to a stack in the memory.

When the processing core needs to use the return address, the register is also used to register the conversion return address output by the stack. The conversion circuit is further specifically configured to perform the conversion on the conversion return address output by the register to obtain the return address, and output the return address to the processing core.

As shown in Figure 7A, the return address output by the processing core is output to the LR register. Since the conversion circuit is arranged on the readout path of the LR register, the LR register will pass through the conversion circuit during the process of outputting the return address to the stack in the memory. The conversion circuit converts the return address output by the LR register to obtain the conversion return address, so that the actual conversion return address is pushed onto the stack. Since the attacker cannot know the conversion operation performed in the conversion circuit, the attacker cannot modify the conversion return address in the memory to the conversion return address corresponding to the malicious instruction, thereby preventing the attacker from maliciously changing the program control flow.

As shown in FIG. 7B, when the processing core needs to use the return address, the converted return address from the memory stack enters the LR register. Since the conversion circuit is arranged on the readout path of the LR register, the conversion circuit will pass through the conversion circuit when the LR register outputs the conversion return address to the processing core. The conversion circuit converts the converted return address to obtain the original return address, so that what is actually input to the processing core is the original return address. So as to ensure the normal control flow of the program.

In this embodiment, a hardware conversion circuit is set on the readout path of the LR register. The conversion circuit is used to convert the return address output by the LR register, that is, all the values output from the LR register will first pass through the conversion circuit. Conversion. In this way, the return address can be automatically identified without changing the control flow of the processor, which is easy to implement.

It should be noted that, in the foregoing embodiment, a processor based on an ARM instruction set is taken as an example for description. However, the processor to which the embodiment of the present application is adapted is not limited to this. The embodiments of the present application are also applicable to processors of other instruction sets, as long as there is a register dedicated to storing the return address in the processor.

It should be noted that in the foregoing embodiments, for processors based on the ARM instruction set and processors based on the RISC-V instruction set, if the compiler supports the leaf subroutine optimization option (that is, the leaf subroutine does not change The return address is saved from the LR/RA register to the stack in the memory, but it is always saved in the LR/RA register), you need to turn off this optimization function to ensure the use of LR/RA in the leaf subroutine and the general branch ( There is no difference in subroutine. Otherwise, the return address is not decrypted when it is read from the LR/RA register, which will affect the normal return of the subroutine.

The specific conversion process of the conversion circuit in the foregoing embodiments will be introduced below.

In the embodiment of the present application, the conversion performed by the conversion circuit on the return address satisfies the following conditions:

B=IP(A), A=IP(B)

It is understandable that there may be many conversion models that satisfy the above conditions, including but not limited to: exclusive-or conversion model, modular multiplication conversion model, and modular addition conversion model.

In a possible implementation manner, multiple conversion models are stored in the conversion circuit, and different conversion models correspond to one or more sets of optional conversion parameters. By storing the conversion model and conversion parameters in the hardware circuit, the attacker cannot obtain this sensitive information, and the reliability of the defense of the program control flow is improved.

When the conversion circuit converts the return address, at least one conversion model is used to convert at least one bit of the return address to obtain the converted return address.

Exemplarily, taking the code area of libc as an example, due to the limited number of instructions in the program, comparing the start address and end address of the code address of the program, you can find that several high-order bits of the code address, even more than ten or dozens The high-order bits will not change. In this application, these unchanging bits are referred to as the unchanged section of the code address. Correspondingly, the bits where the code address will change are called the change section of the code address.

In the embodiment of the present application, when the conversion circuit converts at least one bit of the return address, it converts the changed section and the unchanged section at the same time, which can increase the difficulty of brute force cracking by an attacker and ensure the security of program control flow.

Exemplarily, before running the program, the conversion circuit randomly selects a conversion model and randomly selects a set of conversion parameters to convert the return address during the program operation. If an error occurs in the program operation, that is, in the case of a ROP attack, when re-running the program, change the conversion model and/or conversion parameters, so that the attacker cannot perform multiple attacks on the same conversion model and conversion parameters, and further improve program control Stream security.

The following describes the processing process of the return address by the processor in conjunction with several specific implementation manners.

In a possible implementation manner, it is assumed that the processor is a 32-bit processor based on the ARM instruction set, the conversion circuit is set on the write path of the LR register, and the analog multiplication conversion model is adopted in the conversion circuit. The processor's processing of the return address is as follows:

1) Before the processing core executes the call instruction (such as calling the func function), the return address is stored in the LR register. Since the conversion circuit is set on the write path of the register, the return address will first be converted by the conversion circuit to obtain the conversion return address, so that what actually enters the LR register is the conversion return address.

For the convenience of presentation, in this embodiment, the return address (that is, the original return address) output by the processing core is recorded as a[31:0]. The conversion return address obtained by the conversion circuit (that is, the return address actually entered into the LR register) is recorded as b[31:0]. The conversion circuit performs the modular multiplication operation as shown below:

a×q≡b mod p

Among them, p and q are the conversion parameters corresponding to the modular multiplication conversion model. It can be seen from the above formula that the return address a and the parameter q in the conversion circuit are modulo multiplied, the modulus is p, and the output is the conversion return address b. Among them, q and p satisfy the following relationship:

q ² ≡1 mod p

It is understandable that there can be multiple combinations of p and q that satisfy the above relationship. For example: if p=2^{32}, then q can be selected as any of the following:

4294967295, 2147483649, 2147483647

In practical applications, p should be larger than the maximum code address but not too large to save the chip area of the conversion circuit. In addition, when q=p-1 or q=1, the above requirements are always met, but for safety, 1 is not selected for q.

In this embodiment, since the modular multiplication conversion model uses the 32-bit return address a[31:0] to perform the overall operation, that is, the change section and the unchanged section of the code address are operated at the same time, so that the attacker cannot only target the change. Segments perform specific attacks, and attackers cannot guarantee that they can jump to the code area every time brute force cracking, which improves the security of program control flow.

2) Read the conversion return address from the LR register and store it in the memory stack.

3) Execute the function func.

4) Before returning from the function func, read the conversion return address from the memory, and store the popped conversion return address in the LR register. Since a conversion circuit is set on the write path of the LR register, the converted return address from the stack will pass through the conversion circuit first. The conversion circuit performs another conversion on the conversion return address to obtain the original return address, and then the original return address is stored in the LR register. The conversion circuit performs the same modular multiplication operation as follows:

b×q≡a mod p

Among them, p and q are the conversion parameters corresponding to the modular multiplication conversion model, which are the same as the parameters used in the first conversion process described above. The conversion return address b is the input of the conversion model, and the return address a is the output of the conversion model.

It can be seen from the above two conversion processes that the return address changes back to the original value after the same conversion twice.

5) Perform a return operation.

If the conversion return address b is not maliciously tampered with in the memory stack, after conversion by the conversion circuit, the obtained return address a is the correct return address, and the program executes normally. If the conversion return address b is maliciously tampered with in the memory stack, the attacker cannot know the sensitive information p and q, and cannot construct a legitimate malicious conversion return address. Therefore, after conversion by the conversion circuit, the return address a obtained is Garbled, when the return operation is executed, the program will execute the code at the garbled address, which will cause a memory error with a high probability. Therefore, the attacker cannot achieve the purpose of changing the control flow of the program.

In another possible implementation manner, it is assumed that the processor is a 32-bit processor based on the ARM instruction set, the conversion circuit is arranged on the read path of the LR register, and the conversion circuit adopts a modulus addition conversion model. The processor's processing of the return address is as follows:

1) Before the processing core executes the call instruction (for example, calling the func function), the return address is stored in the LR register.

2) Read the return address from the LR register and store it in the memory stack.

Since the conversion circuit is set on the readout path of the LR register, the return address output by the LR register will be converted by the conversion circuit first to obtain the conversion return address, so that the actual stack is the conversion return address.

For the convenience of presentation, the return address (that is, the original return address) output by the LR register is recorded as a[31:0] in this embodiment. The conversion return address obtained by the conversion circuit (that is, the return address actually pushed onto the stack) is recorded as b[31:0]. The conversion circuit performs the modulo addition operation as shown in the following equation:

a+q≡b mod p

Among them, p and q are the conversion parameters corresponding to the modular addition conversion model. It can be seen from the above formula that the return address a and the parameter q in the conversion circuit are modulo addition, the modulus is p, and the output is the conversion return address b. Among them, q and p satisfy the following relationship:

q≡p/2

It is understandable that there can be multiple combinations of p and q that satisfy the above relationship. For example: if p=2^{32}+2, then q=2^{31}+1.

In practical applications, p should be larger than the maximum code address but not too large to save the chip area of the conversion circuit.

In this embodiment, since the modulus addition conversion model uses the 32-bit return address a[31:0] to perform the overall operation, that is, the change section and the unchanged section of the code address are operated at the same time, so that the attacker cannot only target the change. Segments perform specific attacks, and attackers cannot guarantee that they can jump to the code area every time brute force cracking, which improves the security of program control flow.

3) Execute the function func.

4) Before returning from the function func, read the conversion return address from the memory, and store the popped conversion return address in the LR register.

5) Read the conversion return address from the LR register and output it to the processing core to perform the return operation.

Since a conversion circuit is set on the readout path of the LR register, the converted return address from the stack will pass through the conversion circuit first. The conversion circuit performs another conversion on the converted return address to obtain the original return address, and then the original return address is output to the processing core. The conversion circuit performs the same modular addition operation, as follows:

b+q≡a mod p

Among them, p and q are the conversion parameters corresponding to the modular addition conversion model, which are the same as the parameters used in the first conversion process described above. The conversion return address b is the input of the conversion model, and the return address a is the output of the conversion model.

In yet another possible implementation manner, the conversion circuit groups at least one bit of the return address to obtain multiple bit groups; and uses the conversion model to convert the bits in each bit group to obtain each bit The conversion result corresponding to the bit group, wherein at least two of the multiple bit groups adopt different conversion models, or the multiple bit groups adopt the same conversion model; then, according to each of the The conversion result corresponding to the bit group obtains the conversion return address.

It is understandable that there may be multiple ways to group at least one bit of the return address, which is not specifically limited in this embodiment. Taking a 32-bit processor system as an example, the 32 bits of the return address can be divided into two bit groups or three bit groups, of course, it can also be divided into more bit groups.

Exemplarily, when divided into two bit groups, the first 16 bits may be used as a group, and the last 16 bits may be used as a group; the first 8 bits may be used as a group, and the last 24 bits may be used as a group ; It is also possible to use odd-numbered bits as a group and even-numbered bits as a group. It is understandable that there are other grouping methods, which are not listed here. When divided into two bit groups, the conversion models adopted by the two bit groups may be the same or different. For example, two bit groups use the modular multiplication conversion model, or both bit groups use the modular addition conversion model, or one bit group uses the modular multiplication conversion model, and one bit group uses the modular addition conversion model.

Exemplarily, when divided into three bit groups, the first 8 bits can be used as a group, the middle 16 bits can be used as a group, and the last 8 bits can be used as a group; the first 10 bits can also be used as a group , Set the middle 8 bits as a group, and the last 14 bits as a group; you can also use the 1, 4, 7, 10, 13, 16, 19, 22, 25, 28, and 31 bits as a group, Set the 2, 5, 8, 11, 14, 17, 20, 23, 26, and 29 bits as a group, and set the 0, 3, 6, 9, 12, 15, 18, 21, 24, 27, 30 Bits as a group. It is understandable that there are other grouping methods, which are not listed here. When divided into three bit groups, the conversion models adopted by the three bit groups can be the same or different.

The following is a description with examples.

Assuming that the processor is a 32-bit processor based on the ARM instruction set, the conversion circuit is set on the write path of the LR register. The conversion circuit divides the 32 bits of the return address into two bit groups, one bit group includes the bits corresponding to the odd bits of the return address, and the other bit group includes the bits corresponding to the even bits of the return address . One bit group adopts the modular multiplication conversion model, and the other bit group adopts the modular addition conversion model. Then the processor processes the return address as follows:

For the convenience of presentation, in this embodiment, the return address (that is, the original return address) output by the processing core is recorded as a[31:0]. Divide a[31:0] into two bit groups, namely a ₁ [15:0] and a ₂ [15:0], where,

a ₁ [15:0]≡{a[31],a[29],a[27],…,a[1]}

a ₂ [15:0]≡{a[30],a[28],a[26],…,a[0]}

Correspondingly, the conversion return address (that is, the return address actually entering the LR register) obtained by the conversion of the conversion circuit is recorded as b[31:0]. Divide b[31:0] into two bit groups, b ₁ [15:0] and b ₂ [15:0], where,

b ₁ [15:0]≡{b[31],b[29],b[27],…,b[1]}

b ₂ [15:0]≡{b[30],b[28],b[26],…,b[0]}

When converting circuit for converting the return address of a ₁ [15: 0] using modular multiplication conversion model, a ₂ [15: 0] using modula add transformation model, as follows:

a ₁ ×q ₁ ≡b ₁ mod p ₁

a ₂ +q ₂ ≡b ₂ modp ₂

Among them, p ₁ and q ₁ are conversion parameters corresponding to the modular multiplication conversion model, and p ₂ and q ₂ are conversion parameters corresponding to the modular addition conversion model. It can be seen from the above formula that a ₁ is modulo multiplied with the parameter q ₁ in the conversion circuit, the modulus is p ₁ , and the output is b ₁ . A ₂ and the parameter q ₂ in the conversion circuit are modulo addition, the modulus is p ₂ , and the output is b ₂ .

Among them, p ₁ and q ₁ satisfy the following relationship:

q ₁ ² ≡1 mod p ₁

It can be understood that there can be multiple combinations of p ₁ and q ₁ that satisfy the above relationship. For example: if p ₁ =2^{16}+8, then q ₁ can be selected as any of the following:

65543, 60083, 54619, 49159,..., 5461

p ₂ and q ₂ satisfy the following relationship:

q ₂ ≡p ₂ /2

It can be understood that there can be multiple combinations of p ₂ and q ₂ that satisfy the above relationship. For example: if p ₂ =2^{32}+6, then q ₂ =2^{31}+3.

In practical applications, p ₁ and p ₂ should be larger than the maximum code address, but should not be too large to save the chip area of the conversion circuit.

In this embodiment, for the 32-bit return address a, the 32 bits are divided into two groups according to odd-numbered bits and even-numbered bits. One group adopts a modular multiplication conversion model, and the other group adopts a modular addition conversion model. It can be seen that the simultaneous operation of the change section and the unchanged section of the code address makes it impossible for an attacker to perform a specific attack on the changed section only, and the attacker cannot guarantee that every brute force cracking can jump to the code area, which improves the program Security of control flow.

3) Execute the function func.

4) Before returning from the function func, read the conversion return address from the memory, and store the popped conversion return address in the LR register. Since a conversion circuit is set on the write path of the LR register, the converted return address from the stack will pass through the conversion circuit first. The conversion circuit performs another conversion on the conversion return address to obtain the original return address, and then the original return address is stored in the LR register.

When the return address conversion circuit for converting the conversion of b ₁ [15: 0] using modular multiplication conversion model, b ₂ [15: 0] using modula add transformation model, as follows:

b ₁ ×q ₁ ≡a ₁ mod p ₁

b ₂ +q ₂ ≡a ₂ mod p ₂

Among them, p ₁ and q ₁ are the conversion parameters corresponding to the modular multiplication conversion model, which are the same as the parameters used in the first conversion process described above. p ₂ and q ₂ are the conversion parameters corresponding to the modulo addition conversion model, which are the same as the parameters used in the first conversion process described above.

5) Perform a return operation.

If the conversion return address b is not maliciously tampered with in the memory stack, after conversion by the conversion circuit, the obtained return address a is the correct return address, and the program executes normally. If the conversion return address b is maliciously tampered with in the memory stack, the attacker cannot know the sensitive information p ₁ , q ₁ , p ₂ and q ₂ , and cannot construct a legal malicious conversion return address. Therefore, the conversion circuit is converted After that, the return address a is garbled. When the return operation is performed, the program will execute the code at the garbled address, which will cause a memory error with a high probability. Therefore, the attacker cannot achieve the purpose of changing the control flow of the program.

FIG. 8 is a schematic flowchart of a method for processing a return address provided by an embodiment of the application. The method in this embodiment is executed by a processor, where the processor includes a processing core and a conversion circuit. As shown in FIG. 8, the method of this embodiment includes:

S801: When the processing core outputs the return address, convert the return address through the conversion circuit to obtain a conversion return address, and output the conversion return address to a stack in the memory.

S802: When the return address needs to be used, perform the conversion on the converted return address in the stack by the conversion circuit to obtain the return address, and output the return address to the processing core .

In a possible implementation manner, the processor further includes a register, the return address is converted by the conversion circuit to obtain a conversion return address, and the conversion return address is output to a stack in the memory, include:

In a possible implementation manner, the processor further includes a register, the return address is output to the register by the processing core, and the return address is converted by the conversion circuit to obtain a converted return address , And output the conversion return address to the stack in the memory, including:

In a possible implementation manner, the conversion satisfies the following conditions:

B=IP(A), A=IP(B)

In a possible implementation manner, the converting the return address to obtain the converted return address includes:

In a possible implementation manner, the using at least one conversion model to convert at least one bit of the return address to obtain the converted return address includes:

Group at least one bit of the return address to obtain multiple bit groups;

In a possible implementation manner, the number of the bit groups is two, one of the bit groups includes the bits corresponding to the odd bits of the return address, and the other bit group includes the even bits of the return address The corresponding bit.

In a possible implementation manner, the types of the conversion model include: modular multiplication conversion model and modular addition conversion model.

In a possible implementation manner, the register is a register for storing the return address.

In a possible implementation manner, the processor is a processor based on an ARM instruction set, and the register is an LR register.

In a possible implementation manner, the processor is a processor based on a RISC V instruction set, and the register is an RA register.

The method for processing the return address provided in this embodiment can be applied to the processor described in any of the foregoing embodiments, and its implementation principles and technical effects are similar, and will not be repeated here.

An embodiment of the present application also provides an electronic device, including: a processor, where the processor may adopt the structure of the processor in any of the above embodiments, and its implementation principles and technical effects are similar, and this embodiment will not be repeated here. .

An embodiment of the present application also provides a chip, including a processor, and the processor may adopt the structure of the processor in any of the foregoing embodiments, and its implementation principles and technical effects are similar, and will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed device and method may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the modules is only a logical function division, and there may be other divisions in actual implementation, for example, multiple modules can be combined or integrated. To another system, or some features can be ignored, or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or modules, and may be in electrical, mechanical or other forms.

The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional modules in the various embodiments of the present application may be integrated into one processing unit, or each module may exist alone physically, or two or more modules may be integrated into one unit. The units formed by the above-mentioned modules can be realized in the form of hardware, or in the form of hardware plus software functional units.

The above-mentioned integrated modules implemented in the form of software function modules may be stored in a computer readable storage medium. The above-mentioned software function module is stored in a storage medium and includes several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to execute the various embodiments of the present application Part of the method.

It should be understood that the foregoing processor may be a central processing unit (English: Central Processing Unit, abbreviated: CPU), or other general-purpose processors, digital signal processors (English: Digital Signal Processor, abbreviated: DSP), and application-specific integrated circuits (English: Application Specific Integrated Circuit, referred to as ASIC) etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like. The steps of the method disclosed in combination with the application can be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk storage, and may also be a U disk, a mobile hard disk, a read-only memory, a magnetic disk, or an optical disk.

The bus can be an Industry Standard Architecture (ISA) bus, Peripheral Component (PCI) bus, or Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, the buses in the drawings of this application are not limited to only one bus or one type of bus.

The above-mentioned storage medium can be implemented by any type of volatile or non-volatile storage device or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable Except for programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic memory, flash memory, magnetic disks or optical disks. The storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and can write information to the storage medium. Of course, the storage medium may also be an integral part of the processor. The processor and the storage medium may be located in Application Specific Integrated Circuits (ASIC for short). Of course, the processor and the storage medium may also exist as discrete components in the electronic device or the main control device.

Claims

A processor, characterized by comprising: a processing core and a conversion circuit;

The processing core is used to output a return address;

The conversion circuit is configured to convert the return address output by the processing core to obtain the conversion return address, and output the conversion return address to a stack in the memory;

The conversion circuit is also configured to perform the conversion on the converted return address in the stack when the processing core needs to use the return address to obtain the return address, and output the return address to The processing core.
The processor of claim 1, further comprising a register;

The conversion circuit is specifically configured to convert the return address output by the processing core to obtain a conversion return address, and output the conversion return address to the register, so that the conversion return address is output to the register via the register Stack in memory;

The conversion circuit is also specifically configured to perform the conversion on the converted return address in the stack when the processing core needs to use the return address to obtain the return address, and output the return address To the register, so that the return address is output to the processing core via the register.
The processor of claim 1, further comprising a register;

When the processing core outputs the return address, the register is used to register the return address output by the processing core;

The conversion circuit is specifically configured to convert the return address output by the register to obtain a conversion return address, and output the conversion return address to a stack in the memory;

When the processing core needs to use the return address, the register is also used to register the conversion return address output by the stack;

The conversion circuit is further specifically configured to perform the conversion on the conversion return address output by the register to obtain the return address, and output the return address to the processing core.
The processor according to claim 2 or 3, wherein the conversion satisfies the following conditions:

B=IP(A), A=IP(B)

Where, A is the return address, B is the conversion return address, and IP() is the conversion model used in the conversion.
The processor according to claim 4, wherein the conversion circuit is specifically configured to:

At least one conversion model is used to convert at least one bit of the return address to obtain the converted return address.
The processor according to claim 5, wherein the conversion circuit is specifically configured to:

Group at least one bit of the return address to obtain multiple bit groups;

The conversion model is used to convert the bits in each bit group to obtain a conversion result corresponding to each bit group, wherein at least two bit groups in the multiple bit groups have different conversion models , Or, the conversion models adopted by the multiple bit groups are the same;

According to the conversion result corresponding to each bit group, the conversion return address is obtained.
The processor according to claim 6, wherein the number of the bit group is two, wherein one bit group includes the bit corresponding to the odd bit of the return address, and the other bit group includes the bit Returns the bit corresponding to the even bit of the address.
The processor according to any one of claims 4 to 7, wherein the types of the conversion model include: modular multiplication conversion model and modular addition conversion model.
The processor according to any one of claims 2 to 8, wherein the register is a register for storing a return address.
The processor according to claim 9, wherein the processor is a processor based on an ARM instruction set, and the register is an LR register.
The processor according to claim 9, wherein the processor is a processor based on a RISC V instruction set, and the register is an RA register.
A method for processing a return address is characterized by being applied to a processor, the processor comprising: a processing core and a conversion circuit, the method comprising:

When the processing core outputs the return address, the return address is converted by the conversion circuit to obtain a conversion return address, and the conversion return address is output to a stack in the memory;

When the return address needs to be used, the conversion circuit performs the conversion on the converted return address in the stack to obtain the return address, and outputs the return address to the processing core.
The method of claim 12, wherein the processor further comprises a register, and the return address is converted by the conversion circuit to obtain a conversion return address, and the conversion return address is output to The stack in memory, including:

Converting the return address by the conversion circuit to obtain a conversion return address, and outputting the conversion return address to the register, so that the conversion return address is output to the stack in the memory via the register;

The performing the conversion on the conversion return address in the stack by the conversion circuit to obtain the return address, and outputting the return address to the processing core includes:

Perform the conversion on the conversion return address in the stack by the conversion circuit to obtain the return address, and output the return address to the register, so that the return address is output through the register To the processing core.
The method according to claim 12, wherein the processor further comprises a register, the return address is output to the register by the processing core, and the return address is converted by the conversion circuit To obtain the conversion return address, and output the conversion return address to the stack in the memory, including:

Converting the return address output by the register by the conversion circuit to obtain a conversion return address, and output the conversion return address to a stack in the memory;

The performing the conversion on the conversion return address in the stack by the conversion circuit to obtain the return address, and outputting the return address to the processing core includes:

The conversion circuit performs the conversion on the conversion return address output by the register to obtain the return address, and outputs the return address to the processing core.
The method according to claim 13 or 14, wherein the conversion satisfies the following conditions:

B=IP(A), A=IP(B)

Where, A is the return address, B is the conversion return address, and IP() is the conversion model used in the conversion.
The method according to claim 15, wherein the converting the return address to obtain the converted return address comprises:

At least one conversion model is used to convert at least one bit of the return address to obtain the converted return address.
The method according to claim 16, wherein the converting at least one bit of the return address by using at least one conversion model to obtain the conversion return address comprises:

Group at least one bit of the return address to obtain multiple bit groups;

The conversion model is used to convert the bits in each bit group to obtain a conversion result corresponding to each bit group, wherein at least two bit groups in the multiple bit groups have different conversion models , Or, the conversion models adopted by the multiple bit groups are the same;

According to the conversion result corresponding to each bit group, the conversion return address is obtained.
The method according to claim 17, wherein the number of the bit groups is two, wherein one bit group includes the bit corresponding to the odd-numbered bits of the return address, and the other bit group includes the return address. The bits corresponding to the even bits of the address.
The method according to any one of claims 15 to 18, wherein the types of the conversion model include: modular multiplication conversion model and modular addition conversion model.
The method according to any one of claims 13 to 19, wherein the register is a register for storing a return address.
The method according to claim 20, wherein the processor is a processor based on an ARM instruction set, and the register is an LR register.
The method according to claim 20, wherein the processor is a processor based on a RISC V instruction set, and the register is an RA register.
An electronic device, characterized by comprising the processor according to any one of claims 1 to 11.