Fine-grained stack protection using cryptographic computing

1. A method, comprising:

storing, in a register, an encoded pointer to a variable in stack memory, wherein the encoded pointer includes an encrypted portion and a fixed plaintext portion of a memory address corresponding to the variable;

in response to a memory access request associated with the variable, decrypting the encrypted portion of the encoded pointer to obtain first upper address bits of the memory address and a memory allocation size for the variable;

decoding the encoded pointer to obtain the memory address;

verifying the memory address is valid based, at least in part on the memory allocation size; and

allowing the memory access request based on verifying that the memory address is valid.

2. The method of claim 1 , further comprising:

receiving a memory allocation request for the variable;

determining the memory allocation size for the stack memory;

obtaining the memory address for the variable based, at least in part, on a stack pointer;

storing the first upper address bits of the memory address in a memory location; and

encrypting the memory allocation size and the first upper address bits of the memory address based on an address key and an address tweak.

3. The method of claim 1 , further comprising:

storing second upper address bits with the first upper address bits in a memory location, wherein the first upper address bits and the second upper address bits are fixed for the stack memory.

4. The method of claim 3 , wherein the verifying the memory address is valid includes:

determining that the first upper address bits obtained from decrypting the encrypted portion of the encoded pointer match the stored first upper address bits in the memory location.

5. The method of claim 4 , wherein the verifying the memory address is valid further includes:

determining whether the memory address is less than a sum of the memory allocation size and a variable base address of the variable.

6. The method of claim 1 , further comprising:

decrypting the encrypted portion of the encoded pointer with a block cipher using an address key and an address tweak as inputs.

7. The method of claim 6 , wherein the encoded pointer includes power metadata that indicates in a power of two, a first number of bits in the encoded pointer that represents a fixed offset and a second number of bits in the encoded pointer that represents a mutable offset.

8. The method of claim 7 , wherein the address tweak includes the fixed offset and the power metadata.

9. A processor, comprising:

a register to store an encoded pointer to a variable in stack memory, the encoded pointer including:

an encrypted portion; and

a fixed plaintext portion of a memory address corresponding to the variable; and

circuitry to:

in response to a memory access request associated with the variable, decrypt the encrypted portion of the encoded pointer to obtain first upper address bits of the memory address and a memory allocation size for the variable;

decode the encoded pointer to obtain the memory address;

verify the memory address is valid based, at least in part on the memory allocation size; and

in response to determining that the memory address is valid, allow the memory access request.

10. The processor of claim 9 , wherein the circuitry is further to:

receive a memory allocation request for the variable;

determine the memory allocation size for the stack memory;

obtain the memory address for the variable based, at least in part, on a stack pointer;

store the first upper address bits of the memory address in a memory location; and

encrypt the memory allocation size and the first upper address bits of the memory address based on an address key and an address tweak.

11. The processor of claim 9 , wherein the circuitry is further to store second upper address bits with the first upper address bits in a memory location, wherein the first upper address bits and the second upper address bits are fixed for the stack memory.

12. The processor of claim 11 , wherein to verify the memory address is valid is to include determining that the first upper address bits obtained from decrypting the encrypted portion of the encoded pointer match the stored first upper address bits in the memory location.

13. The processor of claim 12 , wherein to verify the memory address is valid is to include determining that the memory address is less than a sum of the memory allocation size and a variable base address of the variable.

14. The processor of claim 9 , the circuitry further to:

decrypt the encrypted portion of the encoded pointer with a block cipher using an address key and an address tweak as inputs.

15. The processor of claim 14 , wherein the encoded pointer includes power metadata that indicates in a power of two, a first number of bits in the encoded pointer that represents a fixed offset and a second number of bits in the encoded pointer that represents a mutable offset.

16. The processor of claim 15 , wherein the address tweak includes the fixed offset and the power metadata.

17. The processor of claim 9 , wherein the memory address is to be decoded from the encoded pointer based, in part, on the fixed plaintext portion and the first upper address bits.

18. The processor of claim 17 , wherein the circuitry is further to:

load first data stored in the variable of the stack memory based on the memory address decoded from the encoded pointer; and

decrypt the first data based on a first data key and a data tweak derived, at least in part, from the encoded pointer.

19. The processor of claim 17 , wherein the circuitry is further to:

encrypt first data based on a first data key and a data tweak derived, at least in part, from the encoded pointer; and

use the memory address decoded from the encoded pointer to store the encrypted first data in the variable corresponding to the memory address.

20. One or more non-transitory computer-readable media with instructions stored thereon, wherein, when executed by a processor, the instructions are to perform operations comprising:

storing, in a register, an encoded pointer to a variable in stack memory, wherein the encoded pointer includes an encrypted portion and a fixed plaintext portion of a memory address corresponding to the variable;

in response to a memory access request associated with the variable, decrypting the encrypted portion of the encoded pointer to obtain first upper address bits of the memory address and a memory allocation size for the variable;

decoding the encoded pointer to obtain the memory address;

verifying the memory address is valid based, at least in part on the memory allocation size; and

allowing the memory access request based on verifying that the memory address is valid.

21. The one or more non-transitory computer-readable media of claim 20 , wherein when executed by the processor, the instructions are to perform further operations comprising:

decrypting the encrypted portion of the encoded pointer with a block cipher using an address key and an address tweak as inputs.

22. The one or more non-transitory computer-readable media of claim 21 wherein the address tweak includes a fixed offset and power metadata, and wherein the encoded pointer includes the power metadata that indicates in a power of two, a first number of bits in the encoded pointer that represents a fixed offset and a second number of bits in the encoded pointer that represents a mutable offset.

23. The one or more non-transitory computer-readable media of claim 20 , wherein the memory address is decoded from the encoded pointer based, in part, on the fixed plaintext portion and the first upper address bits.

24. The one or more non-transitory computer-readable media of claim 23 , wherein when executed by the processor, the instructions are to perform further operations comprising:

loading first data stored in the variable of the stack memory based on the memory address decoded from the encoded pointer; and

decrypting the first data based on a first data key and a data tweak derived, at least in part, from the encoded pointer.

25. The one or more non-transitory computer-readable media of claim 23 , wherein when executed by the processor, the instructions are to perform further operations comprising:

encrypting first data based on a first data key and a data tweak derived, at least in part, from the encoded pointer; and

using the memory address decoded from the encoded pointer to store the encrypted first data in the variable corresponding to the memory address.