Hardware Support for Safe Execution of Native Client Applications

Abstract

Over the past few years, there has been vast growth in the area of the web browser as an applications platform. One example of this trend is Google's Native Client (NaCl) platform, which is a software-fault isolation mechanism that allows the running of native x86 or ARM code on the browser. One of the security mechanisms employed by NaCl is that all branches must jump to the start of a valid instruction. In order to achieve this criteria though, all return instructions are replaced by a specific branch instruction sequence, which we call NaCl returns, that are guaranteed to return to a valid instruction. However, these NaCl returns lose the advantage of the highly accurate return-address stack (RAS) in exchange for the less accurate indirect branch predictor. In this paper, we propose a NaCl-RAS mechanism that can identify and accurately predict 76.9 on average compared to the 39.5 of a traditional BTB predictor.