Control flow integrity
In at least some embodiments, a processor in accordance with the present disclosure is operable to enforce control flow integrity. For examiner, a processor may comprise logic operable to execute a control flow integrity instruction specified to verify changes in control flow and respond to verification failure by at least one of a trap or an exception.
1 . A processor comprising:
logic operable to execute a control flow integrity instruction specified to verify changes in control flow and respond to verification failure by at least one of a trap or an exception.
2 . The processor according to claim 1 wherein the logic operable to execute a control flow integrity instruction includes:
logic operable to execute a control flow integrity instruction specified to verify changes in control flow comprising one or more conditions of at least one of instruction length or instruction alignment.
3 . The processor according to claim 1 wherein the logic operable to execute a control flow integrity instruction includes:
logic operable to execute a control flow integrity instruction specified to verify changes in control flow comprising changes resulting from direct branches, indirect branches, direct calls, indirect calls, returns, and exceptions.
4 . The processor according to claim 1 wherein the logic operable to execute a control flow integrity instruction includes:
logic operable to execute a control flow integrity instruction comprising an immediate constant bitmask that defines at least one check to be made of at least one condition, the at least one check being logically-ORed and at least one of a trap or an exception is generated if none of the at least one condition matches.
5 . The processor according to claim 4 wherein the immediate constant bitmask comprises:
one or more bitmask bits operable to identify one or more conditions selected from a group consisting of:
whether the control flow integrity instruction is reachable through sequential execution from a previous instruction;
whether the control flow integrity instruction is a target of an unconditional direct branch;
whether the control flow integrity instruction is a target of a conditional direct branch;
whether the control flow integrity instruction is a target of a non-relative direct branch;
whether the control flow integrity instruction is a target of an indirect branch;
whether the control flow integrity instruction is a target of a relative function call;
whether the control flow integrity instruction is a target of a non-relative or absolute function call;
whether the control flow integrity instruction is a target of an indirect function call; and
whether the control flow integrity instruction is a target of a function return instruction.
6 . The processor according to claim 1 wherein the logic operable to execute a control flow integrity instruction includes:
logic operable to execute a control flow integrity instruction comprising a first bitmask and a second bitmask, wherein
the first bitmask comprises an immediate constant bitmask that defines at least one check to be made of at least one condition, the at least one check being logically-ORed and at least one of a trap or an exception is generated if none of the at least one condition matches; and
the second bitmask comprises a definition of the at least one condition with an additional test that instruction branching is from a page marked non-writeable.
7 . The processor according to claim 1 wherein the logic operable to execute a control flow integrity instruction includes:
logic operable to execute a control flow integrity instruction comprising a first bitmask and a second bitmask, wherein
the first bitmask comprises an immediate constant bitmask that defines at least one check to be made of at least one condition, the at least one check being logically-ORed and at least one of a trap or an exception is generated if none of the at least one condition matches; and
the second bitmask comprises a definition of the at least one condition with an additional test that instruction branching is from a page marked execute only.
8 . The processor according to claim 1 wherein the logic operable to execute a control flow integrity instruction includes:
logic operable to execute a control flow integrity instruction comprising a first bitmask and a second bitmask, wherein
the first bitmask comprises an immediate constant bitmask that defines at least one check to be made of at least one condition, the at least one check being logically-ORed and at least one of a trap or an exception is generated if none of the at least one condition matches; and
the second bitmask comprises definition of the at least one condition with an additional test that from Instruction Pointer (fromIP) of instruction branching matches.
9 . The processor according to claim 1 wherein the logic operable to execute a control flow integrity instruction includes:
logic operable to execute a control flow integrity instruction comprising a first bitmask and a second bitmask, wherein
the first bitmask comprises an immediate constant bitmask that defines at least one check to be made of at least one condition, the at least one check being logically-ORed and at least one of a trap or an exception is generated if none of the at least one condition matches; and
the second bitmask comprises definition of the at least one condition with an additional test that instruction branching is local.
10 . The processor according to claim 1 wherein the logic operable to execute a control flow integrity instruction includes:
logic operable to execute a control flow integrity instruction comprising a first bitmask, a second bitmask, and a designation of locality, wherein
the first bitmask comprises an immediate constant bitmask that defines at least one check to be made of at least one condition, the at least one check being logically-ORed and at least one of a trap or an exception is generated if none of the at least one condition matches; and
the second bitmask comprises definition of the at least one condition with an additional test that instruction branching is local and the designation of locality defines locality.
11 . The processor according to claim 1 wherein the logic operable to execute a control flow integrity instruction includes:
logic operable to execute a control flow integrity instruction comprising a first bitmask, a second bitmask, and a designation of range, wherein
the first bitmask comprising an immediate constant bitmask that defines at least one check to be made of at least one condition, the at least one check being logically-ORed and at least one of a trap or an exception is generated if none of the at least one condition matches; and
the second bitmask comprising definition of the at least one condition with an additional test that instruction branching is local and the designation of range defines locality in terms of a range of addresses.
12 . The processor according to claim 1 wherein the logic operable to execute a control flow integrity instruction includes:
logic operable to execute a control flow integrity instruction comprising a first bitmask, a second bitmask, and a designation of interval, wherein
the first bitmask comprises an immediate constant bitmask that defines at least one check to be made of at least one condition, the at least one check being logically-ORed and at least one of a trap or an exception is generated if none of the at least one condition matches; and
the second bitmask comprises definition of the at least one condition with an additional test that instruction branching is local and the designation of interval defines locality as range within which from Instruction Pointer (fromIP) is included.
13 . The processor according to claim 1 wherein the logic operable to execute a control flow integrity instruction includes:
logic operable to execute a control flow assert indirect target from Instruction Pointer (fromIP) instruction wherein the control flow assert indirect target from Instruction Pointer (fromIP) instruction is a target of an indirect branch from IP, otherwise a trap is generated.
14 . A processor comprising:
an instruction decoder operable to decode a control flow integrity instruction; and
an execution logic coupled to the instruction decoder and operable to verify changes in control flow and respond to verification failure by at least one of a trap or an exception.
15 . The processor according to claim 14 wherein the execution logic comprises:
logic operable to verify changes in control flow comprising one or more conditions of at least one of an instruction length or an instruction alignment.
16 . The processor according to claim 14 wherein the execution logic comprises:
logic operable to verify changes in control flow comprising changes resulting from direct branches, indirect branches, direct calls, indirect calls, returns, and exceptions.
17 . The processor according to claim 14 wherein:
the instruction decoder is operable to decode the control flow integrity instruction comprising an immediate constant bitmask; and
the execution logic comprises logic operable to define at least one check to be made of at least one condition based on the immediate constant bitmask and logically-ORing the bitmask and generating at least one of a trap or an exception if none of the at least one condition matches,
wherein the immediate constant bitmask comprises bitmask bits operable to identify one or more conditions selected from a group consisting of:
whether the control flow integrity instruction is reachable through sequential execution from a previous instruction;
whether the control flow integrity instruction is a target of an unconditional direct branch;
whether the control flow integrity instruction is a target of a conditional direct branch;
whether the control flow integrity instruction is a target of a non-relative direct branch;
whether the control flow integrity instruction is a target of an indirect branch;
whether the control flow integrity instruction is a target of a relative function call;
whether the control flow integrity instruction is a target of a non-relative or absolute function call;
whether the control flow integrity instruction is a target of an indirect function call; and
whether the control flow integrity instruction is a target of a function return instruction.
18 . The processor according to claim 14 wherein:
the instruction decoder is operable to decode the control flow integrity instruction comprising a first immediate constant bitmask and a second bitmask; and
the execution logic comprises logic operable to define at least one check to be made of at least one condition based on the first immediate constant bitmask and logically-ORing the first immediate constant bitmask, and to generate at least one of a trap or an exception if none of the at least one condition matches, the execution logic further operable to define, based on the second bitmask, the at least one condition with an additional test that instruction branching is selected from one or more members of a group consisting of a page marked non-writeable, a page marked execute only, Instruction Pointer (fromIP), local, local with designation of locality defining locality, local with designation of range defining locality, and local with range of locality specified by Instruction Pointer (fromIP).
19 . The processor according to claim 14 wherein the execution logic comprises:
logic operable to execute a control flow assert indirect target from Instruction Pointer (fromIP) instruction wherein the control flow assert indirect target from Instruction Pointer (fromIP) instruction is a target of an indirect branch from an IP, otherwise a trap is generated.
20 - 33 . (canceled)
34 . A data processing apparatus comprising:
a data security logic operable to use a control flow integrity instruction specified to verify changes in control flow and respond to verification failure by at least one of a trap or an exception.
35 . The data processing apparatus according to claim 34 wherein the data security logic comprises:
logic operable to use the control flow integrity instruction in a video gaming server application.
36 . The data processing apparatus according to claim 34 wherein the data security logic comprises:
logic operable to use the control flow integrity instruction in a video gaming client application.
37 . The data processing apparatus according to claim 34 Error! Reference source not found. wherein the data security logic comprises:
logic operable to use the control flow integrity instruction in a copyrighted content anti-piracy application.
38 . The data processing apparatus according to claim 34 Error! Reference source not found. wherein the data security logic comprises:
logic operable to use the control flow integrity instruction in an information technology server application.
39 . The data processing apparatus according to claim 34 wherein the data security logic comprises:
logic operable to use the control flow integrity instruction in an information technology client application.
40 . The data processing apparatus according to claim 34 wherein:
the data security logic is operable to execute the control flow integrity instruction specified to verify changes in control flow comprising one or more conditions of at least one of an instruction length or an instruction alignment.
41 . The data processing apparatus according to claim 34 wherein:
the control flow integrity instruction is configured to verify changes in control flow comprising changes resulting from direct branches, indirect branches, direct calls, indirect calls, returns, and exceptions.
42 . The data processing apparatus according to claim 34 wherein:
the control flow integrity instruction comprises an immediate constant bitmask that defines at least one check to be made of at least one condition, the at least one check being logically-ORed and at least one of a trap or an exception is generated if none of the at least one condition matches.
43 . The data processing apparatus according to claim 42 wherein:
the immediate constant bitmask comprises one or more bitmask bits operable to identify one or more conditions selected from a group consisting of:
whether the control flow integrity instruction is reachable through sequential execution from a previous instruction;
whether the control flow integrity instruction is a target of an unconditional direct branch;
whether the control flow integrity instruction is a target of a conditional direct branch;
whether the control flow integrity instruction is a target of a non-relative direct branch;
whether the control flow integrity instruction is a target of an indirect branch;
whether the control flow integrity instruction is a target of a relative function call;
whether the control flow integrity instruction is a target of a non-relative or absolute function call;
whether the control flow integrity instruction is a target of an indirect function call; and
whether the control flow integrity instruction is a target of a function return instruction.
44 . The data processing apparatus according to claim 34 wherein:
the control flow integrity instruction comprises a first bitmask, a second bitmask, and a designation of interval;
the first bitmask comprising an immediate constant bitmask that defines at least one check to be made of at least one condition, the at least one check being logically-ORed and at least one of a trap or an exception is generated if none of the at least one condition matches; and
the second bitmask comprising definition of the at least one condition with an additional test that instruction branching is selected from a group consisting of a page marked non-writeable, a page marked execute only, Instruction Pointer (fromIP) of instruction branching matches, local, local with the designation of locality defining locality, local with the designation of range defining locality, and local with the designation of interval defining locality as range within which from Instruction Pointer (fromIP) is included.
45 . The data processing apparatus according to claim 34 wherein:
the control flow integrity instruction comprises a control flow assert indirect target from Instruction Pointer (fromIP) instruction wherein the instruction is target of an indirect branch from IP, otherwise a trap is generated.
46 - 70 . (canceled)