Processors, methods, systems, and instructions to protect shadow stacks

Abstract

A processor of an aspect includes a decode unit to decode an instruction. The processor also includes an execution unit coupled with the decode unit. The execution unit, in response to the instruction, is to determine that an attempted change due to the instruction, to a shadow stack pointer of a shadow stack, would cause the shadow stack pointer to exceed an allowed range. The execution unit is also to take an exception in response to determining that the attempted change to the shadow stack pointer would cause the shadow stack pointer to exceed the allowed range. Other processors, methods, systems, and instructions are disclosed.

What is claimed is: 
     
         1 . A processor comprising:
 a decode unit to decode an instruction; and   an execution unit coupled with the decode unit, the execution unit, in response to the instruction, to:
 determine that an attempted change due to the instruction, to a shadow stack pointer (SSP) of a shadow stack, would cause the SSP to exceed an allowed range; and 
 take an exception in response to determining that the attempted change to the SSP would cause the SSP to exceed the allowed range. 
   
     
     
         2 . The processor of  claim 1 , wherein the execution unit, in response to the instruction, is to compare the attempted change to the SSP with a SSP base and an SSP limit that are to specify the allowed range. 
     
     
         3 . The processor of  claim 2 , wherein the SSP base is to represent a lowest allowed logical address of the shadow stack, and the SSP limit is to represent a highest allowed logical address of the shadow stack. 
     
     
         4 . The processor of  claim 2 , wherein the SSP base and the SSP limit are to be specified by privileged system software. 
     
     
         5 . The processor of  claim 2 , wherein the SSP base and the SSP limit are to be stored in control registers of the processor. 
     
     
         6 . The processor of  claim 1 , wherein the execution unit, in response to the instruction, is to determine that an attempted push of data to the shadow stack due to the instruction would cause the SSP to exceed the allowed range and would cause data to be stored outside of the allowed range. 
     
     
         7 . The processor of  claim 1 , wherein the execution unit, in response to the instruction, is to determine that an attempted pop of data from the shadow stack due to the instruction would cause a value to be read from outside the allowed range. 
     
     
         8 . The processor of  claim 1 , wherein the decode unit is to decode the instruction which is to indicate a shadow stack selector, and wherein the execution unit, in response to the instruction, is to use the shadow stack selector to select the shadow stack. 
     
     
         9 . The processor of  claim 8 , wherein the decode unit is to decode the instruction which is to indicate a shadow stack descriptor table (SSDT) selector as the shadow stack selector, wherein the SSDT selector is to select an entry that is to correspond to the shadow stack in a shadow stack descriptor table (SSDT). 
     
     
         10 . The processor of  claim 9 , wherein the entry in the SSDT is to store a SSP base and an SSP limit that are to specify the allowed range. 
     
     
         11 . The processor of  claim 8 , wherein the execution unit, in response to the instruction, is to determine whether the shadow stack, which the shadow stack selector is to select, is valid. 
     
     
         12 . The processor of  claim 11 , wherein the decode unit is to decode the instruction which is to indicate a shadow stack descriptor table (SSDT) selector as the shadow stack selector, wherein the SSDT selector is to select an entry that is to correspond to the shadow stack in a shadow stack descriptor table (SSDT), and wherein the execution unit, in response to the instruction, is to determine whether the shadow stack is valid based at least in part on a validity indicator of the entry. 
     
     
         13 . The processor of  claim 1 , wherein the processor, in conjunction with taking the exception, is to:
 obtain a shadow stack descriptor table (SSDT) selector from a task state segment structure; and   use the shadow stack descriptor table (SSDT) selector to determine an allowed range for a second SSP of a second shadow stack that is to be used by a handler that is to handle the exception.   
     
     
         14 . The processor of  claim 1 , wherein the allowed range is an allowed linear address range. 
     
     
         15 . The processor of  claim 1 , wherein the allowed range is to be specified by privileged system software. 
     
     
         16 . A processor comprising:
 a decode unit to decode a save shadow stack pointer instruction; and   an execution unit coupled with the decode unit, the execution unit, in response to the shadow stack pointer instruction, to:
 determine that a push of a shadow stack pointer (SSP) value to a shadow stack would not cause the SSP to exceed an allowed range; and 
 push the SSP value to the shadow stack after determining that the push of the SSP value to the shadow stack would not cause the SSP to exceed the allowed range. 
   
     
     
         17 . The processor of  claim 16 , wherein the decode unit is to decode the save shadow stack pointer instruction that is to indicate a destination storage location, and wherein the execution unit, in response to the save shadow stack pointer instruction, is to store a current SSP after the push of the SSP value to the shadow stack in the destination storage location. 
     
     
         18 . The processor of  claim 16 , wherein the decode unit is to decode the save shadow stack pointer instruction which is to be a user-level instruction. 
     
     
         19 . A processor comprising:
 a decode unit to decode a restore shadow stack pointer instruction, the restore shadow stack pointer instruction to indicate a given shadow stack pointer (SSP) value; and   an execution unit coupled with the decode unit, the execution unit, in response to the restore shadow stack pointer instruction, to:
 determine that the given SSP value does not exceed an allowed range for a corresponding shadow stack; 
 determine that the given SSP value indicated by the instruction is compatible with an SSP value received from the corresponding shadow stack; and 
 change an SSP of the corresponding shadow stack to the given SSP value. 
   
     
     
         20 . The processor of  claim 19 , wherein the execution unit, in response to the instruction, is to determine that the given SSP value is within an SSP base and an SSP limit that are to specify the allowed range, wherein the SSP base is to represent a lowest allowed logical address of the shadow stack, and the SSP limit is to represent a highest allowed logical address of the shadow stack. 
     
     
         21 . The processor of  claim 19 , wherein the decode unit is to decode the restore shadow stack pointer instruction which is to be a user-level instruction and that is to indicate a shadow stack selector that is to select the corresponding shadow stack, wherein the execution unit, in response to the instruction, is further to compromise the SSP value that is to have been saved on the corresponding shadow stack before the change to the given SSP value. 
     
     
         22 . A processor comprising:
 a decode unit to decode a return instruction; and   an execution unit coupled with the decode unit, the execution unit, in response to the return instruction, to:
 receive a return address from a stack; 
 determine that a pop of a return address from a shadow stack would not cause a value to be read from outside an allowed range of the shadow stack; 
 receive the return address from the shadow stack; 
 determine that the return address from the stack and the return address from the shadow stack are compatible; and 
 store one of the return address from the stack and the return address from the shadow stack in an instruction pointer register. 
   
     
     
         23 . The processor of  claim 22 , wherein the allowed range is an allowed linear address range specified by privileged system software. 
     
     
         24 . A system to process instructions comprising:
 an interconnect;   a processor coupled with the interconnect, the processor to receive an instruction, the processor, in response to the instruction, to:
 determine that an attempted change due to the instruction, to a shadow stack pointer (SSP) of a shadow stack, would cause the SSP to exceed an allowed range; and 
 take an exception in response to determining that the attempted change to the SSP would cause the SSP to exceed the allowed range; and 
   a dynamic random access memory (DRAM) coupled with the interconnect, the DRAM storing a set of instructions of privileged system software, the set of instructions, when executed by the processor, to cause the processor to perform operations comprising:
 determine the allowed range for the SSP; and 
 store the allowed range for the SSP in an access protected portion of the DRAM. 
   
     
     
         25 . The system of  claim 24 , wherein the allowed range comprises a linear address range, and wherein the instruction is a user-level instruction.