SPARC architecture, operating method of this architecture, and associated computer program output

Abstract

TITLE: SPARC-type architecture, method of operating this architecture, and associated computer program product. The present invention relates to a SPARC-type architecture (10) comprising a processor (12) and a memory (14) comprising a cyclic structure (29). The cyclic structure (29) comprises a plurality of windows. The processor (12) defines a normal mode and a privileged mode for executing applications and is configured to, in the event of data overwriting in the oldest window, raise an overflow exception and execute an exception routine in its privileged mode.The architecture (10) is characterized in that the memory (14) further includes a reserved area (30) accessible for reading / writing data only by the processor (12) in its privileged mode, and in that the exception routine is configured to copy the data from the oldest window into the reserved area (30) when an over-use exception has been raised. Figure for the abstract: Figure 1.

Description

Title of the invention: SPARC-type architecture, method of operating this architecture and associated computer program product

[0001] The present invention relates to a SPARC type architecture.

[0002] The SPARC type architecture (for English acronym "Scale Processor Ar "chitecture", which translates into French as "Adaptable Processor Architecture") has been known for many years.

[0003] More particularly, this type of architecture allows a processor to read and write data in a random access memory using a cyclic data storage structure.

[0004] When the cyclic data storage structure is filled, new data is written into this structure by overwriting the oldest data.

[0005] Applications running on the SPARC-type architecture, however, have vulnerabilities.

[0006] For example, these applications remain susceptible to RoP attacks (from the English acronym "Return Oriented Programming") based on the exploitation of stack overflow faults (known in English as "buffer overflow" or "stock overflow").

[0007] This type of fault overwrites or diverts the return address present in the stack.

[0008] In the state of the art, several solutions for detecting attacks of stack overflow type are applicable to SPARC-type architectures.

[0009] Thus, for example, it is possible to use so-called "canary" values ​​which are placed in the stack and present control data to monitor overflows.

[0010] According to some solutions, these values ​​are positioned randomly in the stack.

[0011] However, the use of "canary" values ​​remains circumventable and costly in performance. Their reliability can therefore be questioned.

[0012] The aim of the present invention is to propose a SPARC-type architecture for executing applications in such a way as to prevent the exploitation of their vulnerabilities by an attacker. In particular, this architecture makes it possible to reliably avoid application vulnerabilities leading to RoP (“Return Oriented Programming”) attacks and in particular to stack overflow type faults. This is done in a particularly reliable manner and without modification. consequent of the classic SPARC architecture.

[0013] To this end, the invention relates to a SPARC type architecture comprising a processor and a memory comprising a cyclic structure.

[0014] The cyclic structure comprises a plurality of windows configured to store data cyclically from an oldest window to a most recent window, each window comprising a plurality of registers, each register being configured to store data usable by the processor.

[0015] The processor defines a normal mode and a privileged mode for executing applications, and is configured to, in the event of overwriting of data in the oldest window, raise an overuse exception and execute an exception routine in its privileged mode.

[0016] The architecture is characterized in that the memory further comprises a reserved area accessible for reading / writing data only by the processor in its privileged mode, and in that the exception routine is configured to copy the data from the oldest window into the reserved area when an overuse exception has been raised.

[0017] According to other advantageous aspects of the invention, the architecture comprises one or more of the following characteristics taken in isolation or in all possible combinations:

[0018] - the processor is configured to, in the event of use of an empty window, raise a underutilization exception and execute the exception routine in its privileged mode;

[0019] - the exception routine is further configured to copy data from the area reserved in the empty window, when an underutilization exception was thrown;

[0020] - the processor is configured to raise an overuse exception and / or a underuse exception when comparing a counter with a WIM type register;

[0021] - the counter is modified each time an exception is raised;

[0022] - the architecture is configured to implement a plurality of processes, the memory including an area reserved for each process;

[0023] - the processor is configured to, in the event of a process change between a previous process and a following process, raise a process switch exception and execute the exception routine in its privileged mode;

[0024] - the exception routine is further configured to copy data from all windows in the reserved area corresponding to the previous process and to restore from the reserved area corresponding to the next process the data for all windows;

[0025] - the architecture further comprises a memory management unit configured to control access to the or each restricted area.

[0026] The invention also relates to a method of operating a SPARC type architecture as defined above, comprising a step of saving the data of the oldest window in the reserved area.

[0027] According to other advantageous aspects of the invention, the method further comprises a step of restoring the data from the reserved area.

[0028] The invention finally relates to a computer program product comprising software instructions which, when executed by a computer, implement the method as defined above.

[0029] The invention will appear more clearly on reading the description which follows, given solely by way of non-limiting example and made with reference to the drawings in which: - [Fig.l] [Fig.l] is a schematic view of a SPARC type architecture according to the invention, the architecture comprising in particular a memory; - [Fig.2] [Fig.2] is a schematic view of part of the memory of the [Fig.l] ; and - [Fig.3][Fig.4][Fig.5] Figures 3 to 5 are different flowcharts illustrating a method of operation of the SPARC-type architecture of [Fig.l],

[0030] In fact, [Fig.l] illustrates a SPARC-type architecture 10. In all that follows, SPARC-type architecture means an architecture conforming to the SPARC designation known per se, regardless of its previous or future version.

[0031] In particular, such an architecture includes the essential characteristics of any SPARC architecture regardless of its version or different variations of these versions. The principles described below remain applicable to these essential characteristics so that a person skilled in the art would easily adapt these principles to a concrete version or variation of this architecture (old or future).

[0032] With reference to [Fig.l], the architecture 10 comprises a processor 12 (also known by the English acronym CPU), a memory 14 and a memory management unit 16.

[0033] In particular, the memory management unit 16 makes it possible to control access by the processor 12 to the memory 14 according to rules defined by this unit 16. Such a unit is known by the English acronym MMU (“Memory Management Unit”).

[0034] The processor 12 may have any known processor comprising, for example, one or more cores.

[0035] Generally speaking, the SPARC 10 type architecture can comprise any other component known per se and usable in combination with the components 12 to 16 explained above.

[0036] The memory 14 is advantageously divided into two parts.

[0037] A first part 21 of the memory 14 has a RAM which is used to interact directly with the processor 12.

[0038] A second part 22 of the memory 14 is advantageously a non-volatile memory which makes it possible to store data in a durable manner. This second part 22 of the memory 14 may have a hard memory or a memory distributed between a plurality of servers and / or media known per se.

[0039] In accordance with the generic principles of the SPARC type architecture, the first part 21 of the memory 14 comprises a cyclic structure 29 which is illustrated in more detail in [Fig.2].

[0040] In particular, with reference to this [Fig.2], the cyclic structure 29 contained in this part 21 of memory has a plurality of windows W.

[0041] Each window W comprises a plurality of registers. In addition, adjacent windows share the same registers which then constitute output registers (Wouts) and input registers (Wins) for these windows. The output registers of the first window (window W0 in the figure) coincide with the input registers of the last window (window W7 in the figure) so as to form a cyclic structure.

[0042] In the example of [Fig.2], eight windows W0 to W7 are represented. Each of these windows W0 to W7 comprises three families of registers: a family of input registers, a family of output registers and a family of local registers. Each family comprises for example 8 registers. The input registers and the output registers form end registers which are shared with the adjacent windows.

[0043] For example, with reference to [Fig.2], the output registers of window W0 coincide with the input registers of window W7.

[0044] In the same example, each register has, for example, a 32-bit or 64-bit memory.

[0045] Of course, many other examples of the cyclic structure 29 are also possible.

[0046] In a manner known per se, a CWP pointer (also called a CWP counter) is used to designate the current window currently used by the processor 12. This pointer is decremented when moving to the next window and is incremented when restoring data from the second part 22 of the memory 14 as will be explained in more detail later.

[0047] In [Fig.2], the CWP pointer indicates the W0 window.

[0048] The processor 12 defines at least two modes of operation. In one mode Normally, the processor 12 executes applications which then call upon functions which write or read data into or from the corresponding windows of the cyclic structure 29.

[0049] When a function calls another function, the CWP pointer is decremented, the next window is then used by the processor 12.

[0050] When the return to the calling function is made, the CWP pointer is incremented and the processor 12 returns to the window corresponding to this calling function.

[0051] When the cyclic structure 29 is completely filled or a function refers to an empty window (i.e. a window which does not correspond to the calling function), the processor 12 goes into privileged mode in which it executes an exception routine. In the first case it is an overuse exception and in the second case it is an underuse exception of the cyclic structure 29.

[0052] The exception routine then executes in the privileged mode of the processor 12 which defines more rights than the normal mode in which other applications execute.

[0053] The second part 22 of the memory 14 comprises in particular a reserved area 30 which is only accessible when the processor 12 is in privileged execution mode. Alternatively, the reserved area 30 is contained in the first part 21.

[0054] In other words, the reserved area 30 is accessible in read / write mode only when the processor 12 raises an exception and then switches to privileged mode and executes the exception routine.

[0055] The memory control unit 16 is configured to provide such exclusive access in the reserved area 30.

[0056] Generally, the second part 22 of the memory 14 has a reserved area for each process implemented by the architecture 10. In the example of [Fig.l], only one reserved area 30 is illustrated.

[0057] Process switching is performed by the exception routine when a process switching exception is thrown by an application.

[0058] According to the invention, when an exception is raised by the processor 12, the exception routine then obtains access to the reserved area 30 to write or read data depending on the exception raised.

[0059] In particular, this exception routine is configured to copy the data from the oldest window of the cyclic structure 29 into the reserved area 30 when an overuse exception has been raised.

[0060] Further, the exception routine is configured to copy data from the reserved area 30 into the empty window of the cyclic structure 29, when an underuse exception has been thrown.

[0061] Finally, the exception routine is configured to change processes by writing data contained in the cyclic structure 29 into the reserved area associated with this process to be changed and by copying into the cyclic structure 29 the data contained in the reserved area associated with the process to be implemented, following a process change type exception.

[0062] The operating method of the SPARC 10 type architecture will now be explained with reference to figures 3 to 5 showing different phases of this method.

[0063] In particular, [Fig.3] corresponds to a phase implemented during a function call.

[0064] During an initial step 110 of this first phase, a function then calls another function.

[0065] During the following step 120, the current window is then changed.

[0066] In the example of [Fig.2], this corresponds to the change of a window according to the clockwise.

[0067] During a following step 130, the processor 12 detects whether or not the data in the oldest window of the circular structure 29 has been overwritten. When such an overwriting has not been detected, the processor 12 decrements the counter CWP and then moves on to the following step 140 during which the called function is executed.

[0068] When an overwriting of the data of the oldest window is detected, the processor 12 proceeds to the execution of step 150.

[0069] To detect the overwriting of data in the oldest window, the processor 12 compares for example the CWP counter with a particular register, called WIM (in English “window invalid mask”).

[0070] When this counter coincides with the number of the oldest window, a data overwrite is detected.

[0071] During step 150, the processor raises an overuse exception of the circular structure 29 of the “window overflow” type and then executes the exception routine in privileged mode.

[0072] In a subsequent step 160, the exception routine verifies that the reserved area 30 includes sufficient space to write the data contained in the oldest window, i.e., the data contained in the window which will have to be overwritten.

[0073] When this is the case, the exception routine saves in step 170 the data contained in this oldest window and then, in step 180, modifies the CWP pointer. In particular, in the example of [Fig.2], this modification includes the decrement of the CWP pointer.

[0074] During a following step 190, the processor 12 finishes the execution of the exception routine and then goes to step 140 during which the called function is executed.

[0075] [Fig.4] illustrates a second phase of the method during which a return to the calling function is made.

[0076] In particular, during a step 210 of this second phase, the called function returns to the calling function.

[0077] This then leads to a change of the current window during step 220. In the example of [Fig.2], this change is carried out in the counterclockwise direction.

[0078] During a following step 230, the processor 12 checks the window to which the change was made.

[0079] When it is the window corresponding to the calling function, the processor 12 increments the counter CWP and then returns to the execution of this calling function during a following step 240.

[0080] When it is an empty window, that is to say a window containing data which is not linked to the calling function, the processor 12 raises an exception of under-use of the circular structure 29 of the “window underflow” type.

[0081] To detect this exception, and as in the previous case, the processor 12 compares the WIM register with the CWP counter.

[0082] During a following step 260, the processor 12 verifies that the data is available in the reserved area 30. When this is the case, the processor 12 restores this data from the reserved area 30 in the current window during step 270 and proceeds to the execution of step 280.

[0083] In particular, during step 280 the CWP counter is modified. In the example of [Fig.2] this modification corresponds to the incrementation of this counter.

[0084] Finally, during step 290 the processor 12 finishes the execution of the exception routine and moves on to the execution of the calling function during step 240.

[0085] [Fig.5] illustrates a third phase of the operating method of the SPARC 10 type architecture.

[0086] In particular, this third phase corresponds to a process change occurring in architecture 10.

[0087] More particularly, during an initial step 310 of this third phase, a call to a process change is made. In such a case, a “syscall” type routine triggers a “software trap” type instruction which then causes the execution of the exception routine.

[0088] During a following step 320, the processor 12 then executes the exception routine in its privileged mode.

[0089] In the next step 330, this exception routine checks that the area reserved for this process to be changed contains enough space to save the data of all the windows associated with this process.

[0090] When this is the case, the exception routine saves all data from all windows in this reserved area.

[0091] In a subsequent step 350, the exception routine selects the reserved area which is associated with the process to which the switch is to be made.

[0092] During a following step 360, the exception routine then restores all the data from this reserved area in the windows of the circular structure 29.

[0093] In a subsequent step 370, this routine updates the CWP counter.

[0094] For example, this counter can be initialized to zero, which indicates that the window W0 should be used at the beginning.

[0095] In a subsequent step 380, the processor 12 finishes executing the exception routine and then moves on to executing the new process in step 390.

[0096] It is therefore understood that the present invention has a certain number of advantages.

[0097] The invention makes it possible to prevent the exploitation of a vulnerability in applications allowing writing on the stack to modify the return address of the function (i.e. RoP type attacks) since the reserved areas used to store the data are only accessible in privileged mode, and only by the exception routine.

[0098] Thus, applications have no possibility of accessing these areas and then modifying this data. In particular, applications running and manipulating data that may come from outside are no longer vulnerable to attacks implementing ROP-type attacks. Moreover, this is done using the usual tools of a SPARC-type architecture.

[0099] This makes it possible to remain completely transparent from an application point of view because each application runs in the same way with or without the solution proposed by the invention.

[0100] Finally, the solution proposed by the invention has no impact in terms of performance and does not require any additional hardware support to those already offered by the SPARC architecture. It also does not require any specific support by the compilation chain.

Claims

Claims

1. A SPARC-type architecture (10) comprising a processor (12) and a memory (14) comprising a cyclic structure (29); the cyclic structure (29) comprising a plurality of windows configured to store data cyclically from an oldest window to a most recent window, each window comprising a plurality of registers, each register being configured to store data usable by the processor (12); the processor (12) defining a normal mode and a privileged mode of application execution, and being configured to, in the event of overwriting of the data in the oldest window, raise an overuse exception and execute an exception routine in its privileged mode;the architecture (10) being characterized in that the memory (14) further comprises a reserved area (30) accessible for reading / writing data only by the processor (12) in its privileged mode, and in that the exception routine is configured to copy the data from the oldest window into the reserved area (30) when an overuse exception has been raised.;

2. Architecture (10) according to claim 1, wherein: - the processor (12) is configured to, in case of use of an empty window, raise an underuse exception and execute the exception routine in its privileged mode; - the exception routine is further configured to copy data from the reserved area (30) into the empty window, when an underuse exception has been raised.

3. Architecture (10) according to claim 1 or 2, wherein the processor (12) is configured to raise an overuse exception and / or an underuse exception by comparing a counter (CWP) with a WIM type register.

4. Architecture (10) according to claim 3, in which the counter (CWP) is modified each time an exception is raised.

5. Architecture (10) according to any one of the preceding claims, configured to implement a plurality of processes, the memory comprising a reserved area (30) for each process.

6. Architecture according to claim 5, in which: - the processor (12) is configured to, in the event of a change of

7.

8.

9.

10. process between a previous process and a following process, raise a process switch exception and execute the exception routine in its privileged mode; - the exception routine is further configured to copy the data of all the windows into the reserved area (30) corresponding to the previous process and to restore from the reserved area (30) corresponding to the next process the data for all the windows. Architecture (10) according to any one of the preceding claims, further comprising a memory management unit (16) configured to control access to the or each reserved area. Method of operating a SPARC type architecture (10) according to any one of the preceding claims, comprising a step (170) of saving the data of the oldest window in the reserved area (30). The method of claim 8, further comprising a step (270) of restoring data from the reserved area (30). A computer program product comprising software instructions which, when executed by a computer, implement the method according to claim 8.

Images