Instruction and logic for a binary translation mechanism for control-flow security

Patent metadata

Field	Value
Publication number	US-9330028-B2
Application number	US-201414228018-A
Country	US
Kind code	B2
Filing date	Mar 27, 2014
Priority date	Mar 27, 2014
Publication date	May 3, 2016
Grant date	May 3, 2016

Abstract

A processor includes a front end, an execution pipeline, and a binary translator. The front end includes logic to receive an instruction and to dispatch the instruction to a binary translator. The binary translator includes logic to determine whether the instruction includes a control-flow instruction, identify a source address of the instruction, identify a target address of the instruction, determine whether the target address is a known destination based upon the source address, and determine whether to route the instruction to the execution pipeline based upon the determination whether the target address is a known destination based upon the source address. The target address includes an address to which execution would indirectly branch upon execution of the instruction.

First claim

What is claimed is:

1. A processor, comprising:
a front end including a first logic to receive an instruction and to dispatch the instruction to a binary translator;
an execution pipeline; and
a binary translator including a second logic to:
determine whether the instruction includes a control-flow instruction;
identify a source address of the instruction;
identify a target address of the instruction, the target address including an address to which execution would indirectly branch upon execution of the instruction;
determine whether the target address is a known destination based upon the source address; and
determine whether to route the instruction to the execution pipeline based upon the determination whether the target address is a known destination based upon the source address.

2. The processor of claim 1 , wherein the binary translator further includes a third logic to:
access a control structure with references of a set of known destinations for the source address; and
determine whether the target address is identified with the set of known destinations.

3. The processor of claim 1 , wherein the binary translator further includes a third logic to:
access a control structure with no known destinations for the source address; and
determine to not route the instruction to the execution pipeline based on a determination that there are no known destinations for the source address.

4. The processor of claim 1 , wherein the binary translator further includes a third logic to:
access a control structure with references of a set of known destinations for each of a set of given source addresses;
access a default set of known destinations based on a determination that there is no entry in the control structure for the source addresses; and
determine whether to route the instruction to the execution pipeline based upon whether the target address is included in the default set of known destinations.

5. The processor of claim 1 , wherein the binary translator further includes a third logic to route another instruction to the execution pipeline based upon a determination that the other instruction does not include a control-flow instruction.

6. The processor of claim 1 , wherein the binary translation further includes a third logic to:
access a control structure with references of a set of known destinations for each of a set of given source addresses;
determine that the target address is not within the set of known destinations for the source address;
generate an exception based upon the determination that the target address is not within the set of known destinations for the source address.

7. The processor of claim 1 , wherein the binary translation further includes a third logic to:
access a control structure with entries for a plurality of given source addresses, wherein each entry defines:
whether any known destinations are available for a given source address;
a size of a list of known destinations; and
an offset to a memory segment for the list of known destinations;

access the memory segment based upon the offset; and
determine whether the target address is within the list of known destinations.

8. A system, comprising:
a front end including a first logic to receive an instruction and to dispatch the instruction to a binary translator;
an execution pipeline; and
a binary translator including a second logic to:
determine whether the instruction includes a control-flow instruction;
identify a source address of the instruction;
identify a target address of the instruction, the target address including an address to which execution would indirectly branch upon execution of the instruction;
determine whether the target address is a known destination based upon the source address; and
determine whether to route the instruction to the execution pipeline based upon the determination whether the target address is a known destination based upon the source address.

9. The system of claim 8 , wherein the binary translator further includes a third logic to:
access a control structure with references of a set of known destinations for the source address; and
determine whether the target address is identified with the set of known destinations.

10. The system of claim 8 , wherein the binary translator further includes a third logic to:
access a control structure with no known destinations for the source address; and
determine to not route the instruction to the execution pipeline based on a determination that there are no known destinations for the source address.

11. The system of claim 8 , wherein the binary translator further includes a third logic to:
access a control structure with references of a set of known destinations for each of a set of given source addresses;
access a default set of known destinations based on a determination that there is no entry in the control structure for the source addresses; and
determine whether to route the instruction to the execution pipeline based upon whether the target address is included in the default set of known destinations.

12. The system of claim 8 , wherein the binary translator further includes a third logic to route another instruction to the execution pipeline based upon a determination that the other instruction does not include a control-flow instruction.

13. The system of claim 8 , wherein the binary translation further includes a third logic to:
access a control structure with references of a set of known destinations for each of a set of given source addresses;
determine that the target address is not within the set of known destinations for the source address;
generate an exception based upon the determination that the target address is not within the set of known destinations for the source address.

14. The system of claim 8 , wherein the binary translation further includes a third logic to:
access a control structure with entries for a plurality of given source addresses, wherein each entry defines:
whether any known destinations are available for a given source address;
a size of a list of known destinations; and
an offset to a memory segment for the list of known destinations;

access the memory segment based upon the offset; and
determine whether the target address is within the list of known destinations.

15. A method for security, comprising, in a processor:
receiving an instruction;
determining whether the instruction includes a control-flow instruction;
identifying a source address of the instruction;
identifying a target address of the instruction, the target address including an address to which execution would indirectly branch upon execution of the instruction;
determining whether the target address is a known destination based upon the source address; and
determining whether to route the instruction to an execution pipeline based upon the determination whether the target address is a known destination based upon the source address.

16. The method of claim 15 , further comprising:
accessing a control structure with references of a set of known destinations for the source address; and
determining whether the target address is identified with the set of known destinations.

17. The method of claim 15 , further comprising:
accessing a control structure with no known destinations for the source address; and
determining to not route the instruction to the execution pipeline based on a determination that there are no known destinations for the source address.

18. The method of claim 15 , further comp

Assignees

• Maniatis Petros
• Gupta Shantanu
• Kumar Naveen
• Intel Corp

Inventors

• Maniatis Petros
• Gupta Shantanu
• Kumar Naveen

Classifications

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F9/35

  Indirect addressing · CPC title

• G06F9/3877

  using a secondary processor, e.g. coprocessor (peripheral processor G06F13/12) · CPC title

• G06F12/145

  the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism · CPC title