Security configurations in page table entries for execution domains
Systems, apparatuses, and methods related to a computer system having a page table entry containing security settings for calls from predefined domains are described. The page table entry can be used to map a virtual memory address to a physical memory address. In response to a call to execute a routine identified using the virtual memory address, a security setting corresponding to the execution domain from which the call initiates can be extracted from the page table entry to determine whether a security measure is to be used. For example, a shadow stack structure can be used to protect the private stack content of the routine from being access by a caller and/or to protect the private stack content of the caller from being access by the callee.
1. A device, comprising:
a memory configured to store first instructions of a first routine and second instructions of a second routine; and
a processor coupled with memory and configured to:
add first data to a first call stack during execution of the first instructions; and
in response to the first routine calling the second routine:
add second data to the first call stack;
allow execution of the second instructions to access the second data; and
prevent the execution of the second instructions from accessing the first data.
2. The device of claim 1 , wherein the processor is further configured to:
stack third data upon the second data during the execution of the second instructions; and
prevent the execution of the first instructions from accessing the third data.
3. The device of claim 2 , wherein the processor is further configured to:
replicate at least a portion of the first call stack to generate a second call stack after the second data is added to the first call stack;
execute the second instructions using the second call stack; and
prevent the execution of the first instructions from accessing the second call stack.
4. The device of claim 3 , wherein the processor is further configured to:
prevent the execution of the second instructions from accessing the first call stack.
5. The device of claim 3 , wherein the processor is further configured to:
erase the second call stack, in response to the execution of the second instructions returning to the execution of the first instructions.
6. The device of claim 3 , wherein the processor is further configured to:
determine a physical memory address of an instruction of the second routine in response to the first routine calling the second routine;
determine a security setting during determination of the physical memory address;
determine to generate the second call stack based on the security setting.
7. The device of claim 6 , wherein the security setting is extracted from a page table entry used to determine the physical memory address.
8. The device of claim 7 , wherein the page table entry is configured to specify a plurality of security settings for a plurality of domains of routes respectively; and the security setting is extracted based on a domain of the first routine.
9. The device of claim 8 , wherein the plurality of domains include a domain of routines of a hypervisor, a domain of routines of an operating system, or a domain of routines of applications, or any combination thereof.
10. The device of claim 9 , further comprising:
a first set of registers configured to control operations of the first call stack; and
a second set of registers configured to control operations of the second call stack.
11. A method, comprising:
storing, in a memory of a device, first instructions of a first routine and second instructions of a second routine;
adding, by a processor of the device, first data to a first call stack during execution of the first instructions; and
in response to the first routine calling the second routine:
adding, by the processor, second data to the first call stack;
allowing, by the processor, execution of the second instructions to access the second data; and
preventing the execution of the second instructions from accessing the first data.
12. The method of claim 11 , further comprising:
stacking, by the processor, third data upon the second data during the execution of the second instructions; and
preventing, by the processor, the execution of the first instructions from accessing the third data.
13. The method of claim 12 , further comprising:
replicating, by the processor, at least a portion of the first call stack to generate a second call stack after the second data is added to the first call stack;
executing, by the processor, the second instructions using the second call stack; and
preventing, by the processor, the execution of the first instructions from accessing the second call stack.
14. The method of claim 13 , further comprising:
preventing, by the processor, the execution of the second instructions from accessing the first call stack.
15. The method of claim 13 , further comprising:
erasing the second call stack, in response to the execution of the second instructions returning to the execution of the first instructions.
16. The method of claim 13 , further comprising:
determining a physical memory address of an instruction of the second routine in response to the first routine calling the second routine;
determining a security setting during determination of the physical memory address;
determining to generate the second call stack based on the security setting.
17. The method of claim 16 , wherein the security setting is extracted from a page table entry used to determine the physical memory address; the page table entry is configured to specify a plurality of security settings for a plurality of domains of routes respectively; and the security setting is extracted based on a domain of the first routine.
18. An apparatus, comprising:
a first call stack;
a first set of registers configured to control operations of the first call stack;
a second call stack;
a second set of registers configured to control operations of the second call stack;
at least one execution unit configured to execute instructions; and
a memory management unit;
wherein the apparatus is configured to:
allocate the first call stack for execution of first instructions of a first routine;
add first data to the first call stack during the execution of the first instructions of the first routine;
add second data to the first call stack in response to the first routine calling a second routine;
replicate at least a portion of the first call stack to the second call stack;
allocate the second call stack for execution of second instructions of the second routine; and
prevent the execution of the first instructions of the first routine from accessing the second call stack.
19. The apparatus of claim 18 , wherein the memory management unit is configured to determine a physical memory address of an instruction of the second routine in response to the first routine calling the second routine; and
wherein the apparatus is configured to:
determine a security setting during determination of the physical memory address; and
determine to generate the second call stack based on the security setting.
20. The apparatus of claim 19 , wherein the security setting is extracted from a page table entry used to determine the physical memory address; the page table entry is configured to specify a plurality of security settings for a plurality of domains of routes respectively; and the security setting is extracted based on a domain of the first routine.