Control flow integrity

Patent metadata

Field	Value
Publication number	US-10248424-B2
Application number	US-201615283370-A
Country	US
Kind code	B2
Filing date	Oct 1, 2016
Priority date	Oct 1, 2016
Publication date	Apr 2, 2019
Grant date	Apr 2, 2019

Abstract

One embodiment provides an apparatus. The apparatus includes collector circuitry to capture processor trace (PT) data from a PT driver. The PT data includes a first target instruction pointer (TIP) packet including a first runtime target address of an indirect branch instruction of an executing target application. The apparatus further includes decoder circuitry to extract the first TIP packet from the PT data and to decode the first TIP packet to yield the first runtime target address. The apparatus further includes control flow validator circuitry to determine whether a control flow transfer to the first runtime target address corresponds to a control flow violation based, at least in part, on a control flow graph (CFG). The CFG including a plurality of nodes, each node including a start address of a first basic block, an end address of the first basic block and a next possible address of a second basic block or a not found tag.

First claim

What is claimed is:

1. An apparatus comprising:
control flow graph (CFG) generator circuitry to generate a CFG for a target application, wherein the CFG comprises a plurality of nodes that each includes a start address of a first basic block, an end address of the first basic block, and a next possible address of a second basic block or a not found tag;
collector circuitry to, during execution of the target application, capture processor trace (PT) data from a PT driver, the PT data comprising a first target instruction pointer (TIP) packet comprising a first runtime target address of an indirect branch instruction of the executing target application, and cause the PT driver to configure PT circuitry to limit collected PT data to TIP packets;
decoder circuitry to extract the first TIP packet from the PT data and to decode the first TIP packet to yield the first runtime target address; and
control flow validator circuitry to determine, based at least in part on the generated CFG, whether a control flow transfer to the first runtime target address corresponds to a control flow violation.

2. The apparatus of claim 1 , wherein the PT data further comprises a second TIP packet comprising a second runtime target address, the first TIP packet and the second TIP packet sequential in the PT data, and wherein the decoder circuitry is further to decode the second TIP packet to yield the second runtime target address, and wherein determining whether the control flow transfer to the first runtime target address corresponds to a control flow violation comprises determining whether a first static target address corresponds to the first runtime target address and whether a second static target address corresponds to the second runtime target address.

3. The apparatus of claim 2 , wherein the control flow validator circuitry is further to determine whether a legitimate execution path exists in the CFG between the first static target address and the second static target address if the CFG comprises the first static target address and the second static target address or to signal a control flow violation if the CFG does not comprise the first static target address or the second static target address.

4. The apparatus of claim 1 , wherein at least one node of the CFG comprises a plurality of next possible addresses.

5. The apparatus of claim 1 , wherein the first runtime target address corresponds to a runtime return address and wherein determining whether the control flow transfer to the first runtime target address corresponds to a control flow violation comprises determining whether the runtime return address corresponds to a static return address, the runtime return address and static return address being associated with the indirect branch instruction.

6. The apparatus of claim 1 , wherein the CFG comprises a library CFG corresponding to a library associated with the target application.

7. The apparatus of claim 1 , wherein determining whether the control flow transfer to the first runtime target address corresponds to a control flow violation comprises determining whether the PT data comprises a TNT (taken/not taken) packet associated with the indirect branch instruction.

8. A control flow integrity system comprising:
a processor;
memory;
control flow graph (CFG) circuitry to generate a CFG comprising a plurality of nodes, each node comprising a start address of a first basic block, an end address of the first basic block and a next possible address of a second basic block or a not found tag;
collector circuitry to capture processor trace (PT) data from a PT driver, the PT data comprising a first target instruction pointer (TIP) packet comprising a first runtime target address of an indirect branch instruction of an executing target application, and to command the PT driver to configure PT circuitry to limit PT data to TIP packets;
decoder circuitry to extract the first TIP packet from the PT data, to decode the first TIP packet to yield the first runtime target address; and
control flow validator circuitry to determine whether a control flow transfer to the first runtime target address corresponds to a control flow violation based, at least in part, on the CFG.

9. The control flow integrity system of claim 8 , wherein the PT data further comprises a second TIP packet comprising a second runtime target address, the first TIP packet and the second TIP packet being sequential in the PT data, wherein the decoder circuitry is further to decode the second TIP packet to yield the second runtime target address, and wherein determining whether the control flow transfer to the first runtime target address corresponds to a control flow violation comprises determining whether a first static target address corresponds to the first runtime target address and whether a second static target address corresponds to the second runtime target address.

10. The control flow integrity system of claim 9 , wherein the control flow validator circuitry is further to determine whether a legitimate execution path exists in the CFG between the first static target address and the second static target address if the CFG comprises the first static target address and the second static target address or to signal a control flow violation if the CFG does not comprise the first static target address or the second static target address.

11. The control flow integrity system of claim 8 , wherein at least one node comprises a plurality of next possible addresses.

12. The control flow integrity system of claim 8 , wherein the first runtime target address corresponds to a runtime return address and wherein determining whether the control flow transfer to the first runtime target address corresponds to a control flow violation comprises determining whether the runtime return address corresponds to a static return address, the runtime return address and static return address associated with the indirect branch instruction.

13. The control flow integrity system of claim 8 , wherein to generate the CFG includes to generate a library CFG corresponding to a library associated with the target application.

14. The control flow integrity system of claim 8 , wherein determining whether the control flow transfer to the first runtime target address corresponds to a control flow violation comprises determining whether the PT data comprises a TNT (taken/not taken) packet associated with the indirect branch instruction.

15. A computer readable storage device having stored thereon instructions that when executed by one or more processors result in the following operations comprising:
generating a control flow graph (CFG) for a target application, the CFG comprising a plurality of nodes that each comprises a start address of a first basic block, an end address of the first basic block and a next possible address of a second basic block or a not found tag;
capturing processor trace (PT) data from a PT driver, the PT data comprising a first target instruction pointer (TIP) packet comprising a first runtime target address of an indirect branch instruction of the executing target application, and causing the PT driver to configure PT circuitry to limit PT data to TIP packets;
extracting the first TIP packet from the PT data;
decoding the first TIP packet to yield the first runtime target address; and
determining, based at least in part on the generated CFG for the target application, whether a control flow transfer to the first runtime target address corresponds to a control flow violation.

16. The device of claim 15 , wherein the PT data further comprises a second TIP

Assignees

• Sultana Salmin
• Bratanov Stanislav
• Durham David M
• Strong Beeman C
• Intel Corp

Inventors

• Sultana Salmin
• Bratanov Stanislav
• Durham David M
• Strong Beeman C

Classifications

• G06F9/3806 Primary

  using address prediction, e.g. return stack, branch history buffer · CPC title

• G06F11/3648

  using additional hardware · CPC title

• G06F11/3636 Primary

  by tracing the execution of the program · CPC title

• G06F9/3016

  Decoding the operand specifier, e.g. specifier format · CPC title

• G06F9/30054

  Unconditional branch instructions · CPC title