## 2 Related Work
### The Security of CISC  
Although processors are ubiquitous in our lives, the research on verifying the security of processor instruction set has just begun in recent years. The complex instruction set architecture represented by the x86 architecture has a history of more than 40 years. It has a large number of instructions and various lengths of instruction words [21]. Undocumented instruction, circuit bugs, and backdoor are major security issues for processors.  
Undocumented instructions are caused by inconsistencies between official documentation and real instructions. An error raised by the processor or an exception handled incorrectly by system software indicates the presence of undocumented instructions. Some researchers have put many efforts on mining the undocumented instructions of x86 CPU [22; 23]. In the past few years, several search tools for undocumented instruction in the x86 architecture have been proposed and gradually improved. As a pioneer work, [PERSON] proposed an undocumented instruction search tool for x86 architecture CPU called Sandsifter [24], which is the first automatic search tool for undocumented instructions. However, it suffers limitations on a high false positive rate. In 2018, [PERSON] et al. [25] proposed a comprehensive CPU security benchmark to evaluate the hardware security of processors and develop a tool mining undocumented instruction with higher speed compared to Sandsifter. UISfuzz [26] further reduces the search space based on Sandsifter. UISfuzz improves the mining efficiency by 5.57 times and reduces the memory overhead by 18.46 times compared to Sandsifter. The instruction search method named HEAM [27] proposed by [PERSON] et al. reduces its search time to 30% compared with the Sandsifter. They also proposed a classification method based on the instruction format to identify the actual function of undocumented instructions. In addition, [PERSON] et al. [28] and [PERSON] et al. [29] also have contributed to the mining of undocumented instructions in terms of processor microcode and instruction decoder, respectively.  
Bugs in the processors mean that there are involuntary implementation mistakes in the component, and these bugs are scattered in various mechanisms and functions of the processor, making it difficult to implement automated and formal detection tools. Memory Sinkhole [30] in 2015; Meltdown [31], Spectre [32], TLBLeed [33], PortSmash [34] in 2018; and MDS [35] in 2019 are all vulnerabilities that violate the security model of the processor design architecture. Some researchers have proposed some defense methods [36; 37; 38] against Specter, Meltdown, and their variants. SPECS [39] is a lightweight dynamic detection system for processor bugs with a defense efficiency of 86% and less than 5% additional hardware and no software run-time overhead.  
The backdoor of the processor has the characteristics of high authority and strong concealment. If the backdoor is implanted in the processor, it will cause great disaster to the upper information system. The backdoor in VIA C3 [18] mentioned above is a typical backdoor using undocumented instructions. In terms of processor backdoor defense, researchers have focused on the microcode level of the processor [40; 41].