Processors, methods, systems, and instructions to protect shadow stacks

Patent metadata

Field	Value
Publication number	US-12229453-B2
Application number	US-202318200544-A
Country	US
Kind code	B2
Filing date	May 22, 2023
Priority date	Jun 26, 2015
Publication date	Feb 18, 2025
Grant date	Feb 18, 2025

Abstract

A processor of an aspect includes a decode unit to decode an instruction. The processor also includes an execution unit coupled with the decode unit. The execution unit, in response to the instruction, is to determine that an attempted change due to the instruction, to a shadow stack pointer of a shadow stack, would cause the shadow stack pointer to exceed an allowed range. The execution unit is also to take an exception in response to determining that the attempted change to the shadow stack pointer would cause the shadow stack pointer to exceed the allowed range. Other processors, methods, systems, and instructions are disclosed.

First claim

What is claimed is:

1. A processor comprising:
a shadow stack pointer (SSP) register to store a current SSP to identify a current shadow stack;
a decode unit to decode a shadow stack protection instruction, the shadow stack protection instruction to indicate a first SSP, the first SSP to identify a first shadow stack; and
an execution unit coupled with the decode unit, the execution unit, in response to the shadow stack protection instruction, to:
perform a plurality of security checks, including to determine whether a value derived from the first SSP, based on a transformation of the first SSP, is equal to a value accessed from the first shadow stack;
cause an exception, if at least one of the security checks fails; and
restore SSP state information to the SSP register, if all of the security checks succeed.

2. The processor of claim 1 , wherein, if said at least one of the security checks fails, the execution unit is further to not restore the SSP state information to the SSP register.

3. The processor of claim 1 , wherein the SSP state information comprises bits of the first SSP.

4. The processor of claim 1 , wherein the first shadow stack is one of a plurality of shadow stacks for different privilege levels.

5. The processor of claim 1 , wherein, if all of the security checks succeed, the execution unit is further to perform a store to the first shadow stack.

6. The processor of claim 1 , wherein the decode unit is to decode a second instruction, and the processor further to execute the second instruction to store the SSP state information to the first shadow stack.

7. The processor of claim 1 , wherein the first SSP is a linear address.

8. The processor of claim 1 , wherein the decode unit is to decode a call instruction, and the processor further comprising an execution unit to execute the call instruction, including to store a return address for the call instruction on a current shadow stack.

9. A processor comprising:
a shadow stack pointer (SSP) register to store a current SSP to identify a current shadow stack;
a decode unit to decode a shadow stack protection instruction, the shadow stack protection instruction to indicate a first SSP, the first SSP to identify a first shadow stack, wherein the first shadow stack is one of a plurality of shadow stacks for different privilege levels; and
an execution unit coupled with the decode unit, the execution unit, in response to the shadow stack protection instruction, to:
perform a plurality of security checks, including to determine whether a value derived from the first SSP, based on a transformation of the first SSP, is equal to a value accessed from the first shadow stack;
cause an exception and not restore bits of the first SSP to the SSP register, if at least one of the security checks fails; and
restore the bits of the first SSP to the SSP register and perform a store to the first shadow stack, if all of the security checks succeed.

10. A system comprising:
a dynamic random access memory (DRAM); and
a processor coupled with the dynamic random access memory, the processor comprising:
a shadow stack pointer (SSP) register to store a current SSP to identify a current shadow stack;
a decode unit to decode a shadow stack protection instruction, the shadow stack protection instruction to indicate a first SSP, the first SSP to identify a first shadow stack; and
an execution unit coupled with the decode unit, the execution unit, in response to the shadow stack protection instruction, to:
perform a plurality of security checks, including to determine whether a value derived from the first SSP, based on a transformation of the first SSP, is equal to a value accessed from the first shadow stack;
cause an exception, if at least one of the security checks fails; and
restore SSP state information to the SSP register, if all of the security checks succeed.

11. The system of claim 10 , further comprising a coprocessor coupled with the processor, and wherein, if said at least one of the security checks fails, the execution unit is further to not restore the SSP state information to the SSP register.

12. The system of claim 11 , further comprising a graphics processing unit coupled with the processor, and wherein the SSP state information comprises bits of the first SSP.

13. The system of claim 10 , further comprising a mass storage device coupled with the processor, and wherein the first shadow stack is one of a plurality of shadow stacks for different privilege levels.

14. The system of claim 13 , wherein the mass storage device comprises a disk drive, and wherein, if all of the security checks succeed, the execution unit is further to perform a store to the first shadow stack.

15. The system of claim 10 , further comprising a coprocessor coupled with the processor, and wherein the decode unit is to decode a second instruction, and the processor further to execute the second instruction to store the SSP state information to the first shadow stack.

16. A method comprising:
storing a current SSP to identify a current shadow stack in a shadow stack pointer (SSP) register;
decoding a shadow stack protection instruction, the shadow stack protection instruction indicating a first SSP, the first SSP identifying a first shadow stack; and
performing operations corresponding to the shadow stack protection instruction, including:
performing a plurality of security checks, including determining whether a value derived from the first SSP, based on a transformation of the first SSP, is equal to a value accessed from the first shadow stack;
determining that the plurality of security checks succeed; and
restoring SSP state information to the SSP register.

17. The method of claim 16 , further comprising accessing a plurality of shadow stacks for different privilege levels, wherein the first shadow stack is one of the plurality of shadow stacks for the different privilege levels.

18. The method of claim 17 , wherein the SSP state information comprises bits of the first SSP.

19. The method of claim 18 , further comprising performing a store to the first shadow stack after said determining that the plurality of security checks succeed.

20. The method of claim 19 , further comprising:
decoding a call instruction; and
executing the call instruction, including storing a return address for the call instruction on a current shadow stack.

21. An apparatus comprising:
a shadow stack pointer (SSP) register to store an SSP, including a first SSP to point to a first shadow stack, the SSP register to indicate a current SSP for a current shadow stack;
a fetch unit to fetch an instruction, the instruction to indicate a second SSP, the second SSP to point to a second shadow stack;
a decode unit to decode the instruction; and
circuitry coupled with the decode unit, the circuitry to perform operations corresponding to the instruction, including to:
perform a plurality of security checks, including to determine whether the second SSP is compatible with a value stored on the second shadow stack;
wherein, if at least one of the plurality of security checks fail, the circuitry is further to:
not make the second SSP the current SSP; and
cause an exception; and

wherein, if the plurality of security checks succeed the circuitry is further to switch from the first shadow stack to the second shadow stack, wherein to switch from the first shadow stack to the second shadow stack the circuitry is to:
change the value; and
update the SSP register t

Assignees

• Intel Corp

Inventors

• Shanbhogue Vedvyas
• Brandt Jason W
• Sahita Ravi L
• Huntley Barry E
• Patel Baiju V

Classifications

• G06F9/323

  for indirect branch instructions · CPC title

• G06F2212/657

  Virtual address space management · CPC title

• G06F12/1036

  for multiple virtual address spaces, e.g. segmentation (G06F12/1045 takes precedence) · CPC title

• G06F12/1491

  in a hierarchical protection system, e.g. privilege levels, memory rings · CPC title

• G06F12/1063

  the data cache being concurrently virtually addressed · CPC title