Dynamic subroutine stack protection
A protection unit of a subroutine stack accessible by a CPU controlled by one main software program, for storing and removing stack frame(s), the stack protection unit being coupleable to the stack and the CPU, comprising: a processor coupled to a first and a second address register; wherein, when a first stack frame is stored onto the stack and the execution of the main software program is suspended by the CPU due to the execution of a subroutine; the processing unit is adapted to set one access rule based on the first and second address registers, preventing: the ongoing subroutine, from accessing a hardware-protected region of the stack, comprising at least one stack frame associated with a return address from which the main software program resumes execution after termination of the execution of the subroutine. A processor, a method and a computer program are also claimed.
1. A stack protection unit for preventing unauthorized access to at least part of a memory stack, the memory stack having memory addresses extending between a top address and a bottom address, the memory stack being accessible by a processor for storing and removing at least one stack frame, the processor controllable by one main software program, the stack protection unit comprising:
a first and a second address register, each adapted to store an address of the stack;
a third and a fourth address register, each adapted to store an address of the stack; and
the processor, wherein the processor is coupled to the first and second address registers,
wherein, when the execution of the main software program is suspended by the processor due to the execution of a first subroutine of the main software program,
the processor is configured to:
set at least one access rule based on at least the first and second address registers, preventing the ongoing subroutine from accessing at least a first hardware-protected region of the memory stack, the first hardware-protected region comprising at least one stack frame associated with a return address from which the main software program resumes execution after termination of the execution of the first subroutine;
store onto the memory stack, a second stack frame comprising content of the second address register;
store in the first address register, a bottom address associated with the second stack frame;
store in the second address register, a top address associated with a third stack frame stored onto the memory stack by the main software program, the third stack frame comprising a return address from which the main software program resumes execution after termination of the execution of the first subroutine;
set a first access rule preventing the first subroutine from accessing the first hardware-protected region of the memory stack, the first hardware-protected region extending between the address of the memory stack stored in the first address register and the address of the memory stack stored in the second address register; and
wherein, when the execution of the first subroutine is suspended due to execution of at least one nested subroutine, the processor is further configured to store in the first address register a bottom address of the memory stack and to, until the nested subroutines have terminated execution, recursively:
store onto the memory stack, a fourth stack frame comprising content of the second address register;
store in the fourth address register, content of the second address register;
store in the third address register, a bottom address associated with the fourth stack frame;
store in the second address register, a top address associated with a fifth stack frame stored onto the memory stack by the first subroutine or a nested subroutine, the fifth stack frame comprising a return address from which the first subroutine or a nested subroutine resumes execution after termination of the execution of an ongoing subroutine; and
set a second access rule preventing the ongoing subroutine from accessing the first hardware-protected region of the memory stack, the first hardware-protected region extending between the address of the memory stack stored in the second address register and the address of the memory stack stored in the third address register, and a second hardware-protected region of the memory stack, the second hardware-protected region extending between the address of the memory stack stored in the first address register and the address of the memory stack stored in the fourth address register.
2. The stack protection unit of claim 1 , wherein, when executing the main software program:
the processor is configured to store in:
the first address register, the bottom address of the memory stack;
the second address register, the bottom address of the memory stack or a null address.
3. The stack protection unit of claim 1 , wherein the first hardware-protected region of the memory stack extends between the address of the memory stack stored in the second address register and a predetermined higher address relative to the address of the memory stack stored in the second address register.
4. The stack protection unit of claim 1 , wherein, when the execution of the first subroutine is terminated:
the processor is further adapted to store in the second address register content of the second stack frame.
5. The stack protection unit of claim 1 , wherein, when the execution of the ongoing subroutine is terminated:
the processor is further adapted to:
store in the second address register, content of a latest stored stack frame selected between the third stack frame and the fourth stack frame;
store in the third address register, a bottom address associated with a latest stored stack frame selected between the second stack frame and the fourth stack frame;
store in the fourth address register, one address selected between:
a top address associated with a latest stored stack frame selected between the third stack frame and the fifth stack frame; and
the bottom address of the memory stack.
6. A method of preventing unauthorized access to at least part of a memory stack, the memory stack having memory addresses extending between a top address and a bottom address, the memory stack being accessible by a processor for storing and removing at least one stack frame, the method comprising:
providing a first, a second, a third and a fourth address register, each adapted to store a respective address of the memory stack, wherein the processor is coupled to the first and second registers;
when the execution of the main software program is suspended by the CPU due to the execution of a first subroutine of the main software program,
causing the processing unit processor to:
set at least one access rule based on at least the first and second address registers, preventing
the first subroutine from accessing at least a first hardware-protected region of the memory stack, the first hardware-protected region comprising at least one stack frame associated with a return address from which the main software program resumes execution after termination of the execution of the first subroutine;
store onto the memory stack, a second stack frame comprising content of the second address register;
store in the first address register, a bottom address associated with the second stack frame;
store in the second address register, a top address associated with a third stack frame stored onto the memory stack by the main software program, the third stack frame comprising a return address from which the main software program resumes execution after termination of the execution of the first subroutine; and,
set at least one access rule preventing the first subroutine from accessing the first hardware-protected region of the memory stack, the first hardware-protected region extending between an address of the memory stack stored in the first address register and an address of the memory stack stored in the second address register; and
when execution of the first subroutine is suspended due to execution of at least one nested subroutine, causing the processor to further store in the first address register the bottom address of the memory stack and to, until the nested subroutines have terminated execution, recursively:
store onto the memory stack, a fourth stack frame comprising content of the second address register;
store in the fourth address register, content of the second address register;
store in the third address register, a bottom address associated with the fourth stack frame;
store in the second address register, a top address associated with a fifth stack frame stored onto the memory stack by the first subroutine or a nested subroutine, the fifth stack frame comprising a return address from which the first subroutine or a nested subroutine resumes execution after termination of the execution of an ongoing subroutine; and
set at least one access rule preventing the ongoing subroutine from accessing the first hardware-protected region of the memory stack, the first hardware-protected region extending between an address of the memory stack stored in the second address register and an address of the memory stack stored in the third address register, and a second hardware-protected region of the memory stack, the second hardware-protected region extending between an address of the memory stack stored in the first address register and an address of the memory stack stored in the fourth address register.
7. The method of claim 6 , further comprising during the execution of the main software program:
storing the bottom address of the stack in the first address register; and
storing the bottom address of the stack or a null address in the second address register.
8. The method of claim 6 wherein the first hardware-protected region of the memory stack extends between an address of the memory stack stored in the second address register and a predetermined higher address relative to the address of the memory stack stored in the second address register.
9. The method of claim 6 , further comprising, when the execution of the first subroutine is terminated, storing content of the second stack frame
in the second address register.
10. The method of claim 6 , further comprising, when the execution of the ongoing subroutine is terminated:
storing in the second address register, a bottom address associated with a latest stored stack frame selected between the third stack frame and the fourth stack frame;
storing in the third address register, content of the latest stored stack frame selected between the second stack frame and the fourth stack frame;
storing in the fourth address register, one address selected between:
a top address associated with the latest stored stack frame selected between the third stack frame and the fifth stack frame; and
the bottom address of the memory stack.