US 10,768,937 B2 · Using return address predictor to speed up control stack return address verification

Abstract

Overhead associated with verifying function return addresses to protect against security exploits is reduced by taking advantage of branch prediction mechanisms for predicting return addresses. More specifically, returning from a function includes popping a return address from a data stack. Well-known security exploits overwrite the return address on the data stack to hijack control flow. In some processors, a separate data structure referred to as a control stack is used to verify the data stack. When a return instruction is executed, the processor issues an exception if the return addresses on the control stack and the data stack are not identical. This overhead can be avoided by taking advantage of the return address stack, which is a data structure used by the branch predictor to predict return addresses. In most situations, if this prediction is correct, the above check does not need to occur, thus reducing the associated overhead.

Claims20

Dependent claims

A method for executing a return instruction on a processor, the method comprising:

predicting a first target return address for a first return instruction based on a first return address stack entry;
responsive to detecting that a first indicator associated with the first return address stack entry indicates that the first predicted target return address is not guaranteed to match a corresponding entry of a control stack, checking the corresponding entry of the control stack against a corresponding entry of a data stack to verify the return address for the first return instruction;
predicting a second target return address for a second return instruction based on a second return address stack entry;
and
responsive to detecting that a second indicator associated with the second return address stack entry indicates that the second predicted target return address is guaranteed to match a corresponding address of the control stack, foregoing checking the corresponding address of the control stack against a corresponding address of the data stack for the second return instruction.

2 more elements

A computing pipeline for executing a return instruction, the computing pipeline comprising:

a return address stack;
a misprediction detector;
a decode unit;
and
a branch predictor,
wherein the branch predictor is configured to:
predict a first target return address for a first return instruction based on a first return address stack entry, and
predict a second target return address for a second return instruction based on a second return address stack entry,
wherein, responsive to the decode unit detecting that a first indicator associated with the first return address stack entry indicates that the first predicted target return address is not guaranteed to match a corresponding address of a control stack, the decode unit is configured to generate first micro-operations for the first return instruction, the first micro-operations configured to check the corresponding address of the control stack against a corresponding address of a data stack to verify the return address for the first return instruction, and
wherein, responsive to the decode unit detecting that a second indicator associated with the second return address stack entry indicates that the second predicted target return address is guaranteed to match a corresponding address of the control stack, the decode unit is configured to forego generating second micro-operations for the second return instruction that are configured to check the corresponding address of the control stack against a corresponding address of the data stack for the second return instruction.

7 more elements

A computing device comprising:

a memory configured to store instructions;
and
a computing pipeline for executing a return instruction from the memory, the computing pipeline comprising:
a return address stack;
a misprediction detector;
a decode unit;
and
a branch predictor,
wherein the branch predictor is configured to:
predict a first target return address for a first return instruction based on a first return address stack entry, and
predict a second target return address for a second return instruction based on a second return address stack entry,
wherein, responsive to the decode unit detecting that a first indicator associated with the first return address stack entry indicates that the first predicted target return address is not guaranteed to match a corresponding address of a control stack, the decode unit is configured to generate first micro-operations for the first return instruction, the first micro-operations configured to check the corresponding address of the control stack against a corresponding address of a data stack to verify the return address for the first return instruction, and
wherein, responsive to the decode unit detecting that a second indicator associated with the second return address stack entry indicates that the second predicted target return address is not guaranteed to match a corresponding address of the control stack, the decode unit is configured to forego generating second micro-operations for the second return instruction that are configured to check the corresponding address of the control stack against a corresponding address of the data stack for the second return instruction.

10 more elements

Dependencies are inferred from the claim text.

Using return address predictor to speed up control stack return address verification

Life of this patent

Using return address predictor to speed up control stack return address verification

Life of this patent

Abstract

Claims20