Architectural support for software-based protection

• US 8,136,091 B2
• Filed: 01/31/2007
• Issued: 03/13/2012
• Est. Priority Date: 01/31/2007
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Erlingsson, Ulfar, Abadi, Martin, Budiu, Mihai-Dan
• Primary Examiner(s): TECKLU, ISAAC TUKU
• Application Number:
  US11/700,451
• Publication Number:
  US 20080184016A1
• Time in Patent Office: 1,868 Days
• Field of Search: None
• US Class Current: 717/121
• CPC Class Codes: G06F 12/1441 for a range
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 9/30054 Unconditional branch instructions
• CPC Class Codes: G06F 9/30061 Multi-way branch instructions, e.g. CASE
• CPC Class Codes: G06F 9/323 for indirect branch instructions

Abstract

Instruction set architecture (ISA) extension support is described for control-flow integrity (CFI) and for XFI memory protection. ISA replaces CFI guard code with single instructions. ISA support is provided for XFI in the form of bounds-check instructions. Compared to software guards, hardware support for CFI and XFI increases the efficiency and simplicity of enforcement. In addition, the semantics for CFI instructions allows more precise static control-flow graph encodings than were possible with a prior software CFI implementation.

Claims

1. A method of enforcing control-flow integrity (CFI) of a software program operating in conjunction with a microprocessor and associated with a control flow graph (CFG), comprising:

identifying indirect branches in the software program, and destinations of the indirect branches;

constraining the destinations to a set of targets within the CFG;

annotating each target of each indirect branch with a label; and

for each indirect branch, using a microarchitecture that comprises a CFI integer register that stores information about a checked jump instruction to determine if the destination contains the label, to determine that the indirect branch is valid if the label is present, and to otherwise trigger an exception;

extending an instruction set architecture (ISA) with at least one instruction to embed a label within the software program code at the destination of a branch,

wherein the at least one instruction in the ISA is used to embed an immediate label value in the program code,

comparing the immediate label value with the contents of the CFI integer register, and resetting the CFI register if the immediate label value equals the contents of the CFI integer register.

2. The method of claim of claim 1, wherein the at least one instruction comprises the checked jump instruction.

3. The method of claim 2, wherein the checked jump instruction is a CFI guard.

4. The method of claim 1, further comprising triggering an exception if the label is not present and the adding a CFI integer register stores non-zero contents.

5. The method of claim 1, further comprising determining the CFG.