SecureShield Programming

SecureShield API

A secure-callable API is a set of functions executing in secure mode that can be called from code executing in normal mode. The processor contains a special function call instruction, SJLI, that the compiler uses to implement a secure-mode API. This instruction transfers execution from normal mode to secure mode. Any other call or jump into secure mode from normal mode results in a processor exception.

The GNU tools support a secure-callable API with a two-executable approach:

• One linked executable contains the secure-mode code;

• The second linked executable contains the normal-mode code.

The normal-mode code is compiled normally—no special code is generated for calls to the secure-mode API. However, such calls are resolved by the linker in the normal executable with special function entry points that transfer control to the normal executable using the SJLI instruction. In the secure-mode executable, functions that are designate as belonging to the secure API need an index into the SJLI table. Also the runtime initialization for the secure-mode needs to be carried on by the user.

Identifying the Secure-Callable APIs

To indicate to the compiler that a secure-mode function is callable from normal mode, you can use __attribute__((secure_call (IndexNumber))) with secure-callable function. Where IndexNumber is the entry of that particular function into the SJLI table.

Programming Cautions

Using function pointer of a secure call function is not supported. However, one can make a stub which can be called indirectly, the stub itself calls the secure call normally.

Example

Let us consider the following example:

#include <stdio.h>

extern int foo (int) __attribute__((secure_call(2)));

int bar (void)
{
  printf ("%d\n", foo (100));
  return 0;
}

int bar2 (void)
{
  return foo(100);
}

Where function foo() is an external secure function located at index 2 in the SJLI table.

The result is:

.cpu EM
.section     .rodata.str1.4,"aMS",@progbits,1
.align 4
      .LC0:
         .string     "%d\n"
         .section    .text
         .align 4
         .global     bar
         .type       bar, @function
      bar:
         push_s blink
         mov_s r0,100        ;3
         sjli  2     ; @foo
         mov_s r1,r0 ;4
         mov_s r0,@.LC0      ;14
         bl @printf;1
         pop_s blink
         j_s.d [blink]
         mov_s r0,0  ;3
         .size       bar, .-bar
         .align 4
         .global     bar2
         .type       bar2, @function
      bar2:
         push_s blink
         mov_s r0,100        ;3
         sjli  2     ; @foo
         pop_s blink
         j_s [blink]
          .size      bar2, .-bar2

Where, we can easily spot the call to foo() function via SJLI instruction.