US 12,541,582 B2 · Function call authentication for program flow control

Abstract

This document discloses aspects of function call authorization for program flow control. In some aspects, a processor encounters a first instruction to initiate or call a function. The processor compares an immediate value of a second instruction at an entry point of the function to a function call authorization value stored in a register. In response to the immediate value of the second instruction matching the function call authorization value stored in the register the process transfers control flow to the function. Alternatively, if the values do not match, an exception or fault may be raised to halt execution of the function or other code. By so doing, these and other aspects of function call authorization may prevent fault injection attacks, execution of unauthorized instructions, or access to sensitive data.

Claims20

Dependent claims

A method comprising:

encountering a first instruction to call a function, the first instruction comprising a branch instruction or a jump instruction configured to call the function;
comparing an immediate value of a second instruction at an entry point of the function to a function call authorization value stored in a register, the second instruction comprising a landing pad instruction of the function, access to the register storing the function call authorization value limited to:
a first function call authorization instruction to set the function call authorization value;
a second function call authorization instruction to read the function call authorization value stored in the register;
and
a third function call authorization instruction to clear the function call authorization value from the register;
and
transferring control flow to the function in response to the immediate value of the second instruction matching the function call authorization value stored in the register.

5 more elements

An integrated circuit comprising:

a register configured to store a function call authorization token;
a hardware-based call stack;
and
a processor configured to execute instructions to implement a function call authorization module, the function call authorization module configured to:
access the register to set the function call authorization token, access to the register limited to a first function call authorization instruction to set the function call authorization token, a second function call authorization instruction to read the function call authorization token stored in the register, and a third function call authorization instruction to clear the function call authorization token from the register;
encounter an instruction to call a function, the instruction comprising a branch instruction or a jump instruction configured to call the function;
compare an immediate value of a landing pad instruction at an entry point of the function to the function call authorization token stored in the register;
transfer control flow to the function in response to the immediate value of the landing pad instruction matching the function call authorization token stored in the register;
obtain a return address from the function from the hardware-based call stack;
and
return from the function to the return address obtained from the hardware-based call stack.

8 more elements

Dependencies are inferred from the claim text.

Function call authentication for program flow control

Life of this patent

Function call authentication for program flow control

Life of this patent

Abstract

Claims20