Function call authentication for program flow control
This document discloses aspects of function call authorization for program flow control. In some aspects, a processor encounters a first instruction to initiate or call a function. The processor compares an immediate value of a second instruction at an entry point of the function to a function call authorization value stored in a register. In response to the immediate value of the second instruction matching the function call authorization value stored in the register the process transfers control flow to the function. Alternatively, if the values do not match, an exception or fault may be raised to halt execution of the function or other code. By so doing, these and other aspects of function call authorization may prevent fault injection attacks, execution of unauthorized instructions, or access to sensitive data.
1 . A method comprising:
encountering a first instruction to call a function, the first instruction comprising a branch instruction or a jump instruction configured to call the function;
comparing an immediate value of a second instruction at an entry point of the function to a function call authorization value stored in a register, the second instruction comprising a landing pad instruction of the function, access to the register storing the function call authorization value limited to:
a first function call authorization instruction to set the function call authorization value;
a second function call authorization instruction to read the function call authorization value stored in the register; and
a third function call authorization instruction to clear the function call authorization value from the register; and
transferring control flow to the function in response to the immediate value of the second instruction matching the function call authorization value stored in the register.
2 . The method as recited in claim 1 , wherein function call authorization value comprises a function call authorization token stored in the register.
3 . The method as recited in claim 2 , wherein:
the register in which the function call authorization token comprises a register that is not part of the RISC a reduced instruction set computer (RISC) register file.
4 . The method as recited in claim 1 , wherein the function comprises a function that accesses sensitive information or operates on sensitive information.
5 . The method as recited in claim 1 , further comprising:
before encountering the first instruction to call the function, accessing the register to set the function call authorization value stored in the register.
6 . The method as recited in claim 1 , further comprising:
executing a first portion of code of the function;
comparing an immediate value of a third instruction at an intermediate point of the function to the function call authorization value stored in a register; and
executing a second portion of the code of the function in response to the immediate value of the third instruction matching the function call authorization value stored in the register; or
ceasing execution of the function in response to the immediate value of the third instruction not matching the function call authorization value stored in the register.
7 . The method as recited in claim 1 , further comprising:
obtaining a return address from the function from a call stack; and
returning from the function to the return address obtained from the call stack.
8 . The method as recited in claim 1 , further comprising:
prior to returning from the function, clearing the function call authorization value stored in the register.
9 . The method as recited in claim 1 , further comprising:
prior to executing code that includes the first instruction and the second instruction:
determining the immediate value for the second instruction, the immediate value associated with the function to enable function call authorization; and
adding, to code of the function, code of the second instruction that includes the immediate value.
10 . An integrated circuit comprising:
a register configured to store a function call authorization value, access to the register limited to a first function call authorization instruction to set the function call authorization value, a second function call authorization instruction to read the function call authorization value stored in the register, and a third function call authorization instruction to clear the function call authorization value from the register; and
a processor configured to execute instructions to implement a function call authorization code module, the function call authorization code module configured to:
encounter a first instruction to call a function, the first instruction comprising a branch instruction or a jump instruction configured to call the function;
compare an immediate value of a second instruction at an entry point of the function to the function call authorization value stored in the register, the second instruction comprising a landing pad instruction of the function; and
transfer control flow to the function in response to the immediate value of the second instruction matching the function call authorization value stored in the register.
11 . The integrated circuit as recited in claim 10 , wherein function call authorization value comprises a function call authorization token stored in the register.
12 . The integrated circuit as recited in claim 11 , wherein:
the register in which the function call authorization token comprises a register that is not part of a reduced instruction set computer (RISC) register file.
13 . The integrated circuit as recited in claim 10 , wherein the function comprises a function that accesses sensitive information or operates on sensitive information.
14 . The integrated circuit as recited in claim 10 , wherein the function call authorization code module is further configured to:
before encountering the first instruction to call the function, access the register to set the function call authorization value.
15 . An integrated circuit comprising:
a register configured to store a function call authorization token;
a hardware-based call stack; and
a processor configured to execute instructions to implement a function call authorization module, the function call authorization module configured to:
access the register to set the function call authorization token, access to the register limited to a first function call authorization instruction to set the function call authorization token, a second function call authorization instruction to read the function call authorization token stored in the register, and a third function call authorization instruction to clear the function call authorization token from the register;
encounter an instruction to call a function, the instruction comprising a branch instruction or a jump instruction configured to call the function;
compare an immediate value of a landing pad instruction at an entry point of the function to the function call authorization token stored in the register;
transfer control flow to the function in response to the immediate value of the landing pad instruction matching the function call authorization token stored in the register;
obtain a return address from the function from the hardware-based call stack; and
return from the function to the return address obtained from the hardware-based call stack.
16 . The integrated circuit as recited in claim 15 , wherein the landing pad instruction comprises an only entry point of the function and the processor is further configured to raise a fault responsive to an attempt to enter the function at any other point.
17 . The integrated circuit as recited in claim 15 , wherein the function call authorization module is further configured to:
prior to returning from the function, clearing the function call authorization token stored in the register.
18 . The integrated circuit as recited in claim 15 , further comprising a memory storing code of the function and multiple other functions and wherein the function and multiple other functions are each configured to use different respective function call authorization tokens.
19 . The integrated circuit as recited in claim 15 , the register configured to store a function call authorization token comprises a limited-access register that is not part of a reduced instruction set computer (RISC) register file.
20 . The integrated circuit as recited in claim 16 , wherein the function comprises a function that accesses sensitive information or operates on sensitive information.