Microprocessor protected against stack overflow

Abstract

A microprocessor includes a central processing unit, at least one call stack, a stack pointer, an address bus, and a data bus. The microprocessor further includes a hardware monitor configured to supply protection codes, insert the protection codes in the stack or let the central processing unit insert them, and then generate an error signal in response to an attempt to modify a protection code present in the stack.

1 . A microprocessor, comprising:
 a central processing unit;   at least one call stack structure;   a stack pointer structure;   an address bus;   a data bus; and   a hardware monitor configured to:
 generate protection codes; 
 insert protection codes in the stack structure or let the central processing unit insert protection codes in the stack structure; 
 store addresses of protection codes inserted in the stack structure; and 
 generate an error signal in response to an attempt to modify a protection code present in the stack structure. 
   
     
     
         2 . A microprocessor according to  claim 1  wherein the hardware monitor is configured to generate the error signal in response to an attempt to read a protection code in the stack structure. 
     
     
         3 . A microprocessor according to  claim 1  wherein the hardware monitor is configured to generate random or pseudo-random protection codes. 
     
     
         4 . A microprocessor according to  claim 1  wherein the hardware monitor is configured to generate deterministic and reproducible protection codes. 
     
     
         5 . A microprocessor according to  claim 1  wherein the hardware monitor is configured to:
 monitor the address bus; and 
 generate the error signal if an address of a stored protection code appears on the address bus. 
 
     
     
         6 . A microprocessor according to  claim 1  wherein the hardware monitor comprises a register, the register being write-accessible to the central processing unit, and the hardware monitor is configured to generate a register protection code and apply the value of the register protection code on the data bus in response to the write of data in the register by the central processing unit. 
     
     
         7 . A microprocessor according to  claim 6  wherein the hardware monitor is configured to insert the register protection code in the stack structure at an address present in the register. 
     
     
         8 . A microprocessor according to  claim 1  wherein in response to a protection code erase request by the central processing unit or by a program executed by the central processing unit, the hardware monitor is configured to:
 read a first protection code in the stack structure at an address specified by the erase request; 
 compare the first protection code with an expected protection code value; and 
 generate the error signal if the first protection code is different from the expected value. 
 
     
     
         9 . A microprocessor according to  claim 8  wherein the hardware monitor is configured to erase the first protection code in the stack after having verified the protection code. 
     
     
         10 . A microprocessor according to  claim 8  wherein the hardware monitor comprises a register, the register being write-accessible to the central processing unit, and the hardware monitor is configured to interpret a write of the register as a request to erase the first protection code. 
     
     
         11 . A microprocessor according to  claim 10  wherein the hardware monitor is configured to interpret a write of the register as an erase request of the first protection code at an address present in the register. 
     
     
         12 . A method executed by a microprocessor, comprising:
 initializing a stack pointer;   generating a plurality of protection codes;   inserting protection codes in a stack based on an address stored in the stack pointer;   storing addresses of inserted protection codes in a memory;   monitoring, with a hardware monitor, addresses on an address bus; and   generating an error signal in response to an attempt to modify a protection code present in the stack based on detecting a monitored address on the address bus.   
     
     
         13 . The method according to  claim 12  wherein the inserting is performed with the hardware monitor or with a central processing unit. 
     
     
         14 . The method according to  claim 12 , comprising:
 executing a secure error processing function in response to the error signal.   
     
     
         15 . The method according to  claim 12 , comprising:
 erasing protection codes when corresponding return functions are executed, wherein the erasing includes removing stored addresses of the inserted protection codes from the memory.   
     
     
         16 . The method according to  claim 12  wherein generating the plurality of protection codes includes drawing random or pseudo-random numbers from an associated random or pseudo-random number generator. 
     
     
         17 . A stack overflow monitoring circuit, comprising:
 a control circuit configured to generate protection codes and further configured to direct operations of the stack overflow monitoring circuit;   a bus interface configured to couple the stack overflow monitoring circuit to a stack structure, the stack structure operable to store protection codes;   at least one internal memory;   a plurality of comparators coupled to the at least one internal memory; and   gating logic coupled to the plurality of comparators and configured to output an error signal upon detection of an address on an address bus read via the bus interface being equal to an address stored in the at least one internal memory.   
     
     
         18 . The stack overflow monitoring circuit according to  claim 17 , comprising:
 an address memory configured within the at least one internal memory; and   a value memory configured within the at least one internal memory,   wherein the address memory is operable to store addresses of protection codes stored in the stack structure and the value memory is operable to store protection code values equal to the protection codes stored in the stack,   wherein the gating logic is configured to output an error signal upon detection of a protection code value on a data bus read via the bus interface being equal to a value stored in the value memory.   
     
     
         19 . The stack overflow monitoring circuit according to  claim 17 , comprising:
 a first register coupleable to a central processing unit, the first register operable to receive a function address, wherein the function address is usable by the control circuit to generate a protection code; and   a second register coupleable to the central processing unit, the second register operable to receive an address of a protection code.   
     
     
         20 . The stack overflow monitoring circuit according to  claim 17 , comprising:
 a random or pseudo-random number generator, the random or pseudo-random number generator operable during generation of the protection codes.