# US 12,001,842 B2 · Hardware apparatuses and methods to switch shadow stack pointers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,842 B2 - Document ID: US12001842B2 - Status: Granted - Kind: B2 - Application number: 18/324,788 - Filed: 2023-05-26 - Published: 2024-03-07 - Granted: 2024-06-04 - Earliest claimed: 2015-12-20 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Vedvyas Shanbhogue; Jason W. Brandt; Ravi L. Sahita; Barry E. Huntley; Baiju V. Patel; Deepak K. Gupta - Web page: https://patentgrep.com/patent/US12001842B2 ## CPC - G06F 9/3004: {to perform operations on memory} - G06F 9/30134: {Register stacks; shift registers} - G06F 9/461: {Saving or restoring of program or task context} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and apparatuses relating to switching of a shadow stack pointer are described. In one embodiment, a hardware processor includes a hardware decode unit to decode an instruction, and a hardware execution unit to execute the instruction to: pop a token for a thread from a shadow stack, wherein the token includes a shadow stack pointer for the thread with at least one least significant bit (LSB) of the shadow stack pointer overwritten with a bit value of an operating mode of the hardware processor for the thread, remove the bit value in the at least one LSB from the token to generate the shadow stack pointer, and set a current shadow stack pointer to the shadow stack pointer from the token when the operating mode from the token matches a current operating mode of the hardware processor. ## Claims ### Claim 1 A processor comprising: a shadow stack pointer (SSP) register to store a current SSP for a current shadow stack; a decode unit to decode an instruction to switch from the current shadow stack to a new shadow stack, the instruction having a memory operand to provide a memory address of a token stored on the new shadow stack; and an execution unit coupled with the decode unit, the execution unit to perform operations corresponding to the instruction, including to: load the token from the new shadow stack; check that a portion of the token matches a portion of the memory address and that a least significant bit of the token has a value of one; cause a fault, if the check fails; and update the SSP register with an SSP having a least significant bit replaced with a value of zero, if the check succeeds. ### Claim 2 (depends on 1) The processor of claim 1, wherein the execution unit is not to update the SSP register with the SSP, if the check fails. ### Claim 3 (depends on 1) The processor of claim 1, wherein the execution unit is to load the token as one of a plurality of operations to be performed atomically. ### Claim 4 (depends on 3) The processor of claim 3, wherein, if the check succeeds, the execution unit is further to modify the token as one of the plurality of operations to be performed atomically. ### Claim 5 (depends on 1) The processor of claim 1, wherein the execution unit is to update the SSP register with the SSP having two least significant bits replaced with a value of zero. ### Claim 6 (depends on 1) The processor of claim 1, further comprising circuitry to check that a seventh least significant bit of the token is zero. ### Claim 7 (depends on 1) The processor of claim 1, wherein the operations include to determine whether the memory address is in shadow stack type memory. ### Claim 8 (depends on 1) The processor of claim 1, wherein the decode unit is to decode a second instruction, and wherein the processor is to perform operations corresponding to the second instruction, including to: set the least significant bit of the token; and store the token to the new shadow stack. ### Claim 9 (depends on 1) The processor of claim 1, wherein the portion of the token is a most significant portion. ### Claim 10 (depends on 1) The processor of claim 1, wherein the portion of the token corresponds to a most significant end of the token. ### Claim 11 (depends on 1) The processor of claim 1, wherein the portion of token includes a plurality of most significant bits of the token. ### Claim 12 (depends on 11) The processor of claim 11, wherein the plurality of most significant bits of the token includes at least bits [63:32] of the token. ### Claim 13 (depends on 1) The processor of claim 1, wherein the execution unit is to update the SSP register with the SSP having a most significant portion matching a most significant portion of the memory address. ### Claim 14 A method comprising: storing a current SSP for a current shadow stack in a shadow stack pointer (SSP) register; decoding an instruction to switch from the current shadow stack to a new shadow stack, the instruction having a memory operand providing a memory address of a token stored on the new shadow stack; and performing operations corresponding to the instruction, including: loading the token from the new shadow stack; performing one or more checks, including: checking that a portion of the token matches a portion of the memory address and that a least significant bit of the token has a value of one; causing a fault, if the check fails; and updating the SSP register with an SSP having a least significant bit replaced with a value of zero, if the check succeeds. ### Claim 15 (depends on 14) The method of claim 14, further comprising not updating the SSP register with the SSP, if the check fails. ### Claim 16 (depends on 14) The method of claim 14, wherein loading the token is one of a plurality of operations to be performed atomically, and further comprising, if the check succeeds, modifying the token as one of the plurality of operations to be performed atomically. ### Claim 17 (depends on 14) The method of claim 14, wherein updating the SSP register comprises updating the SSP register with the SSP having two least significant bits replaced with a value of zero. ### Claim 18 (depends on 14) The method of claim 14, further comprising checking that a seventh least significant bit of the token is zero, and wherein the operations include determining whether the memory address is in shadow stack type memory. ### Claim 19 (depends on 14) The method of claim 14, wherein the portion of the token is a most significant portion, and wherein updating the SSP register with the SSP comprises updating the SSP register with the SSP having a most significant portion matching a most significant portion of the memory address. ### Claim 20 An apparatus comprising: a memory controller; and a processor coupled with the memory controller, the processor comprising: a shadow stack pointer (SSP) register to store a current SSP for a current shadow stack; a decode unit to decode an instruction to switch from the current shadow stack to a new shadow stack, the instruction having a memory operand to provide a memory address of a token stored on the new shadow stack; and an execution unit coupled with the decode unit, the execution unit to perform operations corresponding to the instruction, including to: load the token from the new shadow stack; check that a portion of the token matches a portion of the memory address and that a least significant bit of the token has a value of one; cause a fault, if the check fails; and update the SSP register with an SSP having a least significant bit replaced with a value of zero, if the check succeeds. ### Claim 21 (depends on 20) The apparatus of claim 20, further comprising a coprocessor coupled with the processor, wherein the execution unit is not to update the SSP register with the SSP, if the check fails, and wherein the execution unit is to load the token as one of a plurality of operations to be performed atomically. ### Claim 22 (depends on 21) The apparatus of claim 21, wherein, if the check succeeds, the execution unit is further to modify the token as one of the plurality of operations to be performed atomically. ### Claim 23 (depends on 20) The apparatus of claim 20, further comprising a coprocessor coupled with the processor, and wherein the execution unit is to update the SSP register with the SSP having two least significant bits replaced with a value of zero. ### Claim 24 (depends on 20) The apparatus of claim 20, further comprising a coprocessor coupled with the processor, wherein the portion of the token is a most significant portion, and wherein the execution unit is to update the SSP register with the SSP having a most significant portion matching a most significant portion of the memory address. ### Claim 25 A system comprising: a system memory; and a processor coupled with the system memory, the processor comprising: a shadow stack pointer (SSP) register to store a current SSP for a current shadow stack; a decode unit to decode an instruction to switch from the current shadow stack to a new shadow stack, the instruction having a memory operand to provide a memory address of a token stored on the new shadow stack; and an execution unit coupled with the decode unit, the execution unit to perform operations corresponding to the instruction, including to: load the token from the new shadow stack; check that a portion of the token matches a portion of the memory address and that a least significant bit of the token has a value of one; cause a fault, if the check fails; and update the SSP register with an SSP having a least significant bit replaced with a value of zero, if the check succeeds. ### Claim 26 (depends on 25) The system of claim 25, further comprising a mass storage device coupled with the processor, wherein the execution unit is not to update the SSP register with the SSP, if the checks fail, and wherein the execution unit is to load the token as one of a plurality of operations to be performed atomically. ### Claim 27 (depends on 26) The system of claim 26, wherein, if the check succeeds, the execution unit is further to modify the token as one of the plurality of operations to be performed atomically. ### Claim 28 (depends on 25) The system of claim 25, further comprising a communication device coupled with the processor, and wherein the execution unit is to update the SSP register with the SSP having two least significant bits replaced with a value of zero. ### Claim 29 (depends on 28) The system of claim 28, further comprising an input/output device coupled with the processor, wherein the portion of the token is a most significant portion, and wherein the execution unit is to update the SSP register with the SSP having a most significant portion matching a most significant portion of the memory address. ### Claim 30 A processor comprising: one or more caches; one or more control registers; a shadow stack pointer (SSP) register to store a first SSP for an active shadow stack; a decode unit to decode an instruction to switch from the active shadow stack to a new shadow stack, the instruction having a memory operand to provide a memory address of a token stored on the new shadow stack; and an execution unit coupled with the decode unit, the one or more caches, and the one or more control registers, the execution unit to execute the instruction to: load the token; perform a plurality of checks on the token, including to: determine whether an operating mode indicated by a bit value of a least significant bit of the token matches a current operating mode of the processor; and determine whether an SSP regenerated from the token matches the memory address; cause a fault if at least one of the checks fails; and update the SSP register with a value that matches the SSP regenerated from the token if the checks succeed. ### Claim 31 A non-transitory machine-readable storage medium storing code that if executed causes a machine to perform operations, including to: store a current SSP for a current shadow stack in a shadow stack pointer (SSP) register; decode an instruction to switch from the current shadow stack to a new shadow stack, the instruction having a memory operand to provide a memory address of a token stored on the new shadow stack; and perform operations corresponding to the instruction, including to: load the token from the new shadow stack; check that a portion of the token matches a portion of the memory address and that a least significant bit of the token has a value of one; cause a fault, if the check fails; and update the SSP register with an SSP having a least significant bit replaced with a value of zero, if the check succeeds. ### Claim 32 (depends on 31) The non-transitory machine-readable storage medium of claim 31, further comprising code that if executed causes the machine to: load the token as one of a plurality of operations to be performed atomically; and if the check succeeds, modify the token as one of the plurality of operations to be performed atomically. ### Claim 33 (depends on 31) The non-transitory machine-readable storage medium of claim 31, wherein the code if executed causes the machine to update the SSP register with the SSP having two least significant bits replaced with a value of zero, and wherein the portion of the token is a most significant portion, and wherein the code if executed causes the machine to update the SSP register with the SSP having a most significant portion matching a most significant portion of the memory address.