Securing registers across security zones
In an example, a system includes a processor, where the processor includes a plurality of processor registers, and where the processor is configured to execute a first instruction in a first execution context. The processor is also configured to receive a PRESERVE instruction that indicates at least one processor register among the plurality of processor registers. The processor is configured to, responsive to the PRESERVE instruction, preserve parameters in the at least one processor register and clear other processor registers in the plurality of processor registers in the first execution context. The processor is also configured to execute a second instruction in a second execution context.
1. A system, comprising:
a processor, wherein the processor includes a plurality of processor registers that includes a first processor register and a second processor register, and wherein the processor is configured to:
execute a first instruction in a first execution context, wherein the first instruction is associated with a transition to a second execution context;
receive a PRESERVE instruction that indicates the first processor register among the plurality of processor registers;
responsive to the PRESERVE instruction and the transition from the first execution context to the second execution context, preserve a value in the first processor register by clearing the second processor register without clearing the first processor register; and
execute a second instruction in the second execution context.
2. The system of claim 1 , wherein the processor includes a stack pointer register for each execution context.
3. The system of claim 1 , wherein the PRESERVE instruction includes one or more mask bits configured to specify at least one processor register to preserve from among the plurality of processor registers.
4. The system of claim 1 , wherein executing the second instruction includes executing the second instruction with the preserved value from the first processor register.
5. The system of claim 1 , wherein:
the first instruction is a protected call instruction; and
the PRESERVE instruction is part of the protected call instruction.
6. The system of claim 1 , wherein:
the PRESERVE instruction is a first PRESERVE instruction; and
the processor is further configured to:
receive a second PRESERVE instruction in the second execution context that specifies one or more of the first processor register or the second processor register;
responsive to the second PRESERVE instruction and a transition from the second execution context to the first execution context, preserve a value in the one or more of the first processor register or the second processor register specified by the second PRESERVE instruction without clearing the one or more of the first processor register or the second processor register; and
execute a third instruction in the first execution context.
7. The system of claim 1 , wherein the PRESERVE instruction is a 48-bit instruction.
8. The system of claim 1 , wherein:
the first instruction is a protected call instruction; and
the processor is configured to execute the PRESERVE instruction in parallel with the protected call instruction.
9. The system of claim 1 , wherein the plurality of processor registers has a set of address registers, a set of fixed-point registers, and a set of floating-point registers.
10. A method, comprising:
storing values in a plurality of processor registers that includes a first processor register and a second processor register;
executing a first instruction in a first execution context, wherein the first instruction is associated with a transition to a second execution context;
receiving a PRESERVE instruction that specifies the first processor register among the plurality of processor registers;
responsive to the PRESERVE instruction and the transition from the first execution context to the second execution context, preserving a value in the first processor register by clearing the second processor register without clearing the first processor register; and
executing a second instruction in the second execution context.
11. The method of claim 10 , wherein the PRESERVE instruction includes one or more mask bits configured to specify at least one processor register to preserve from among the plurality of processor registers.
12. The method of claim 10 , wherein executing the second instruction includes executing the second instruction with the preserved value from the first processor register.
13. The method of claim 10 , wherein:
the PRESERVE instruction is a first PRESERVE instruction; and
the method further comprises:
receiving a second PRESERVE instruction in the second execution context that specifies one or more of the first processor register or the second processor register;
responsive to the second PRESERVE instruction and a transition from the second execution context to the first execution context, preserving a value in the one or more of the first processor register or the second processor register specified by the second PRESERVE instruction without clearing the one or more of the first processor register or the second processor register; and
executing a third instruction in the first execution context.
14. The method of claim 10 , wherein:
the first instruction is a protected call instruction; and
the method further comprises executing the PRESERVE instruction in parallel with the protected call instruction.
15. The method of claim 10 , wherein the plurality of processor registers includes address registers and data registers.
16. The method of claim 10 , wherein the plurality of processor registers has a set of address registers, a set of fixed-point registers, and a set of floating-point registers.
17. A method, comprising:
receiving a protected call instruction in a first execution context, wherein the protected call instruction is associated with a transition to a second execution context;
preserving a value in a first processor register responsive to a PRESERVE instruction and the transition from the first execution context to the second execution context by clearing a second processor register without clearing the first processor register;
executing one or more functions in the second execution context;
receiving a protected return instruction in the second execution context; and
executing an instruction in the first execution context responsive to the protected return instruction.
18. The method of claim 17 , wherein the PRESERVE instruction includes one or more mask bits configured to specify at least one processor register to preserve from among a plurality of processor registers.
19. The method of claim 17 , wherein executing the one or more functions includes executing a function using the value in the first processor register.
20. The method of claim 17 wherein each of the first processor register and the second processor register is from a group consisting of an address register, a fixed-point register, and a floating-point register.