# US 10,372,902 B2 · Control flow integrity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,902 B2 - Document ID: US10372902B2 - Status: Granted - Kind: B2 - Application number: 15/450,931 - Filed: 2017-03-06 - Published: 2018-09-06 - Granted: 2019-08-06 - Earliest claimed: 2017-03-06 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Salmin Sultana; Ravi L. Sahita - Web page: https://patentgrep.com/patent/US10372902B2 ## CPC - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 9/30054: {Unconditional branch instructions} - G06F 9/30061: {Multi-way branch instructions, e.g. CASE} - G06F 9/323: {for indirect branch instructions} - G06F 11/36: Prevention of errors by analysis, debugging or testing of software - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract One embodiment provides an accelerator circuitry. The accelerator circuitry includes accelerator processor circuitry; accelerator memory circuitry; processor trace (PT) decoder circuitry and control flow integrity (CFI) checker circuitry. The PT decoder circuitry is to at least one of receive and/or retrieve PT data from a host device. The PT decoder circuitry is further to extract a target instruction pointer (TIP) packet from the PT data and to decode the TIP packet to yield a runtime target address. The CFI checker circuitry is to determine, at runtime, whether a control flow transfer of an indirect branch instruction to the runtime target address corresponds to a control flow violation based, at least in part, on control flow (CF) information (info) stored to an accelerator CF info store. ## Claims ### Claim 1 Accelerator circuitry comprising: accelerator processor circuitry; accelerator memory circuitry comprising an accelerator control flow (CF) information store to receive CF information regarding an application prior to runtime of the application; processor trace (PT) decoder circuitry to receive PT data from a host device that is external to the accelerator circuitry, the PT decoder circuitry further to extract a target instruction pointer (TIP) packet from the PT data and to decode the TIP packet to yield a runtime target address; and control flow integrity (CFI) checker circuitry to determine, at runtime, whether a control flow transfer of an indirect branch instruction to the runtime target address corresponds to a control flow violation based at least in part on the CF information stored in the accelerator CF information store. ### Claim 2 (depends on 1) The accelerator circuitry of claim 1, further comprising PT feedback circuitry to request that PT controller circuitry of the host device reduce a PT data rate if CFI validation operations lag behind generation of the PT data. ### Claim 3 (depends on 1) The accelerator circuitry of claim 1, wherein the CFI checker circuitry is to translate the runtime target address to a corresponding static target address and to determine whether the static target address matches a valid target address included in the CF information. ### Claim 4 (depends on 1) The accelerator circuitry of claim 1, wherein the PT data is received via a direct memory access to host memory circuitry or a dedicated point-to-point interface bus. ### Claim 5 (depends on 1) The accelerator circuitry of claim 1, wherein the indirect branch instruction is selected from the group comprising an indirect call, an indirect jump and a return, and the CF information comprises a plurality of valid target addresses, each valid target address selected from the group comprising a beginning address of a function, an address of a case block for a switch case statement, a start address of a catch of a try/catch block of an exception handler, an address of a runtime function and a return address. ### Claim 6 (depends on 1) The accelerator circuitry of claim 1, wherein the determining whether the control flow transfer to the runtime target address corresponds to the control flow violation is coarse-grained. ### Claim 7 A control flow integrity system comprising: a host device comprising: host processor circuitry to execute a target application, host memory circuitry, processor trace (PT) processor circuitry to capture PT data related to an executing application, and PT controller circuitry to configure the PT processor circuitry; and accelerator circuitry that is distinct and separate from the host device, the accelerator circuitry comprising: accelerator processor circuitry; accelerator memory circuitry that includes an accelerator control flow (CF) information store to receive CF information regarding an application prior to runtime of the application; processor trace (PT) decoder circuitry to receive the PT data from the host device, the PT decoder circuitry further to extract a target instruction pointer (TIP) packet from the PT data and to decode the TIP packet to yield a runtime target address; and control flow integrity (CFI) checker circuitry to determine, at runtime, whether a control flow transfer of an indirect branch instruction to the runtime target address corresponds to a control flow violation based at least in part on CF information stored in the accelerator CF information store. ### Claim 8 (depends on 7) The control flow integrity system of claim 7, wherein the accelerator circuitry further comprises PT feedback circuitry to request that the PT controller circuitry reduce a PT data rate, if CFI validation operations lag behind generation of the PT data. ### Claim 9 (depends on 8) The control flow integrity system of claim 8, wherein the PT feedback circuitry is further to request dynamic reconfiguration of the PT processor circuitry. ### Claim 10 (depends on 7) The control flow integrity system of claim 7, wherein the CFI checker circuitry is to translate the runtime target address to a corresponding static target address and to determine whether the static target address matches a valid target address included in the CF information. ### Claim 11 (depends on 7) The control flow integrity system of claim 7, wherein the PT data is received via a direct memory access to the host memory circuitry or a dedicated point-to-point interface bus. ### Claim 12 (depends on 7) The control flow integrity system of claim 7, wherein the indirect branch instruction is selected from the group comprising an indirect call, an indirect jump and a return, and the CF information comprises a plurality of valid target addresses, each valid target address selected from the group comprising one or more of a beginning address of a function, an address of a case block for a switch case statement, a start address of a catch of a try/catch block of an exception handler, an address of a runtime function, and a return address. ### Claim 13 (depends on 7) The control flow integrity system of claim 7, wherein the determining whether the control flow transfer to the runtime target address corresponds to the control flow violation is coarse-grained. ### Claim 14 (depends on 7) The control flow integrity system of claim 7, wherein the host device further comprises CF information generator circuitry to generate the CF information based, at least in part, on the application. ### Claim 15 A control flow integrity method comprising: receiving, by processor trace (PT) decoder circuitry included within accelerator circuitry, PT data from a host device that is external to the accelerator circuitry; extracting, by the PT decoder circuitry, a target instruction pointer (TIP) packet from the PT data; decoding, by the PT decoder circuitry, the TIP packet to yield a runtime target address; and determining, by control flow integrity (CFI) checker circuitry at runtime, whether a control flow transfer of an indirect branch instruction to the runtime target address corresponds to a control flow violation based at least in part on control flow (CF) information stored prior to runtime by an accelerator CF information store included in the accelerator circuitry. ### Claim 16 (depends on 15) The method of claim 15, further comprising requesting, by PT feedback circuitry, that PT controller circuitry, included in the host device, reduce a PT data rate, if CFI validation operations lag behind generation of the PT data. ### Claim 17 (depends on 16) The method of claim 16, wherein at least a portion of operations of the PT decoder circuitry, the CFI checker circuitry and the PT feedback circuitry are performed in parallel. ### Claim 18 (depends on 15) The method of claim 15, further comprising translating, by the CFI checker circuitry, the runtime target address to a corresponding static target address; and determining, by the CFI checker circuitry, whether the static target address matches a valid target address included in the CF information. ### Claim 19 (depends on 15) The method of claim 15, wherein the PT data is received via a direct memory access to host memory circuitry or a dedicated point-to-point interface bus. ### Claim 20 (depends on 15) The method of claim 15, wherein the indirect branch instruction is selected from the group comprising an indirect call, an indirect jump and a return, and wherein the CF information comprises a plurality of valid target addresses, each valid target address selected from the group comprising a beginning address of a function, an address of a case block for a switch case statement, a start address of a catch of a try/catch block of an exception handler, an address of a runtime function, and a return address. ### Claim 21 (depends on 15) The method of claim 15, wherein the CF information is organized in a data structure in the accelerator CF information store, the data structure configured to facilitate search. ### Claim 22 (depends on 15) The method of claim 15, further comprising generating, by CF information generator circuitry, the CF information based at least in part on an application.