Circuitry and methods for implementing forward-edge control-flow integrity (FECFI) using one or more capability-based instructions

A method comprising:

• checking, by a capability management circuit of a processor, a capability for a memory access request for a memory, the capability comprising an address field and a bounds field that is to indicate a lower bound and an upper bound of an address space to which the capability authorizes access;
• decoding, by a decoder circuit of the processor, a single instruction into a decoded single instruction, the single instruction comprising:
• a first capability to indicate a first call table comprising a respective entry for each of a plurality of functions of a first type,
• a field to indicate a first offset of a first entry for a first function requested for execution, and
• an opcode to indicate the capability management circuit is to perform a first check that the first offset is within a lower bound and an upper bound of the first capability and a second check that the first offset is a permitted offset for the entries in the first call table, and in response to the first check and the second check both passing, cause an execution circuit to execute the first function;
• and
• executing, by the execution circuit, the decoded single instruction according to the opcode.

A non-transitory machine-readable medium that stores code that when executed by a machine causes the machine to perform a method comprising:

• checking, by a capability management circuit of a processor, a capability for a memory access request for a memory, the capability comprising an address field and a bounds field that is to indicate a lower bound and an upper bound of an address space to which the capability authorizes access;
• decoding, by a decoder circuit of the processor, a single instruction into a decoded single instruction, the single instruction comprising:
• a first capability to indicate a first call table comprising a respective entry for each of a plurality of functions of a first type,
• a field to indicate a first offset of a first entry for a first function requested for execution, and
• an opcode to indicate the capability management circuit is to perform a first check that the first offset is within a lower bound and an upper bound of the first capability and a second check that the first offset is a permitted offset for the entries in the first call table, and in response to the first check and the second check both passing, cause an execution circuit to execute the first function;
• and
• executing, by the execution circuit, the decoded single instruction according to the opcode.