Arm Limited

Gareth Rhys Stockwell

Jason Parker

Matthew Lucien Evans

Martin Weidmann

Djordje Kovacevic

Mark Salling Rutland

Christoffer Dall

Andrew Christopher Rose

Hakan Lars-Goran Persson

Jade Ella Carla Alglave

There is provided address translation circuitry and a method for performing address translation. The address translation circuitry is responsive to receipt of a first address and an identifier to perform an address translation from the first address to a second address by performing a translation table walk comprising one or more translation lookups in a plurality of translation tables that are indexed based on a corresponding portion of the first address. The address translation circuitry is further configured to perform a metadata table walk to determine metadata specific to the identifier and associated with the address translation. The metadata table walk comprises one or more metadata lookups in a plurality of metadata lookup tables, each of the one or more metadata lookups corresponds to one of the one or more translation lookups and is indexed based on a same portion of the first address as that translation.

Address translation circuitry and methods for performing address translation and metadata table walk using same portion of address

Memory access circuitry enforces ownership rights for memory regions. A given memory region is associated with an owner realm specified from multiple realms, each realm corresponding to a portion of at least one software process executed by processing circuitry. A realm management unit (RMU) is provided to perform realm management operations for managing the realms. The memory access circuitry controls access to a given memory region in dependence on at least one status attribute specifying whether the given memory region is an RMU-private memory region reserved for exclusive access by the RMU.

Realm management unit-private memory regions

An apparatus for processing data comprises memory access circuitry to enforce ownership rights of a plurality of memory regions within a first memory. The memory access circuitry is responsive to a first export command received from a first export command source to perform a first export operation to encrypt the given owned data to form given encrypted data and to store the given encrypted data in a second memory. The memory access circuitry is responsive to a second export command for the given memory region received from a second export command source while the first export operation is being performed to determine whether said second export command source has higher priority than the first export command source and, when the second export command source has a higher priority, to interrupt the first export operation and to perform a second export operation specified by the second export command.

Interrupting export of memory regions

Apparatus comprises a data memory to store lock data for each of a set of processing resources, the lock data representing lock status data and tag data indicating a resource type selected from a plurality of resource types; and a processing element to execute an atomic operation with respect to the lock data for a given processing resource, the atomic operation comprising at least: a detection of whether the given processing resource is of a required resource type; a detection from the lock status data whether the given processing resource is currently unlocked; and when the given processing resource is detected to be currently unlocked and of the required resource type, performance of a predetermined action with respect to one or both of the lock status data and the tag data.

Data processing

A realm management unit (RMU) manages ownership of memory regions by realms, each realm corresponding to at least a portion of a software process executed by processing circuitry. Memory access circuitry enforces ownership rights for the regions, with the owner realm having a right to exclude other realms from accessing data stored within its owned region. The memory access circuitry permits execution, from within a current realm, of program code stored in a target memory region having an owner realm other than the current realm, when the target memory region is owned by a code realm and a code realm authorisation tablestored in at least one memory region owned by the current realm indicates that execution of program code from the target memory region is permitted by the current realm.

Code realms

An apparatus has processing circuitry for performing data processing in response to software processes and memory access circuitry for enforcing ownership rights for memory regions. A given memory region is associated with an owner realm specified from a multiple realms with each realm corresponding to a portion of at least one software process. The owner realm has a right to exclude other realms from accessing data stored in the given memory region (including realms executed at a higher privilege level). The realms are managed according to a realm hierarchy in which each realm other than a root realm is a child realm initialised in response to a command triggered by its parent realm. In response to an invalidation command, a realm management unit makes the target realm and any descendant realm of the target realm inaccessible to the processing circuitry.

Invalidation of a target realm in a realm hierarchy

Memory access circuitry enforces ownership rights for memory regions. A given memory region is associated with an owner realm specified from multiple realms, each realm corresponding to a portion of at least one software process executed by processing circuitry. A realm management unit initialises the realms. The realm management unit is configured to initialise realms including a full realm which corresponds to a given software process and a sub-realm corresponding to a given address range within the given software process.

Sub-realms

Memory access circuitry enforces ownership rights for memory regions. A given memory region is associated with an owner realm specified from multiple realms, each realm corresponding to a portion of at least one software process executed by processing circuitry. In response to a first variant of an exception return instruction the processing circuitry returns from processing of an exception while staying within the same realm. In response to a second variant of the exception return instruction the processing circuitry switches processing from a current realm to a destination realm.

Exception return instruction variants for realm-based switching

A realm management unit (RMU)manages ownership of memory regions by realms, each realm corresponding to at least a portion of a software process executed by processing circuitry. Memory access circuitryenforces ownership rights for the regions, with the owner realm having a right to exclude other realms from accessing data stored within its owned region. The RMUcontrols transitions of memory regions between region states, including an invalid state, a valid state, and a scrub-commit statein which the memory region is allocated to an owner realm, inaccessible to that owner realm until a scrubbing process has been performed for the memory region to set each storage location of the region to a value uncorrelated with a previous value stored in the storage location, and prevented from being reallocated to a different owner realm.

Scrub-commit state for memory region

Memory access circuitry enforces ownership rights for memory regions. A given memory region is associated with an owner realm specified from multiple realms, each realm corresponding to a portion of at least one software process executed by processing circuitry. In response to a realm switch from a source realm to a target realm at a more privileged exception level, state masking of a subset of architectural state associated with a source realm is performed to make the state inaccessible to a target realm. In response to a flush command following the realm switch, any of the subset of architectural state data not already saved to at least one realm execution context memory region is ensured to be saved.

Realm execution context masking and saving

Memory access circuitry () enforces ownership rights for memory regions. A given memory region is associated with an owner realm specified from multiple realms, each realm corresponding to a portion of at least one software process executed by processing circuitry (). The owner realm has a right to exclude other realms from accessing data within the memory region. Realm management circuitry () accesses a realm management tree storing realm management data for at least two realms in a tree structure having a variable number of levels. The realms are identified using a realm identifier which has a variable number of variable length bit portions each providing an index into a given level of the realm management tree.

Realm identifiers for realms for memory access control

An apparatus has a translation cache () comprising a number of entries for specifying address translation data. Each entry () also specifies a translation context identifier () associated with the address translation data and a realm identifier () identifying one of a number of realms. Each realm corresponds to at least a portion of at least one software process executed by processing circuitry (). In response to a memory access a lookup of the translation cache () is triggered. When the lookup misses in the cache (), control circuitry () prevents allocation of address translation data to the cache when the current realm is excluded from accessing the target memory region by an owner realm specified for the target memory region. In the lookup, whether a given entry () matches the memory access depends on both a translation context identifier comparison and a realm identifier comparison.

Realm identifier comparison for translation cache lookup

Processing circuitry () processes software processes at one of a plurality of exception levels and in one of a plurality of realms, each realm corresponding to a portion of at least one software process and being associated with a boundary exception level indicating a most privileged exception level at which the realm can be processed by the processing circuitry (). In response to a realm exiting exception condition during processing of a given realm, where the exception condition is to be handled by an exception handler at a more privileged exception level than the boundary exception level of the given realm, the processing circuitry () performs state masking to make inaccessible, to software processes processed at a more privileged exception level than the boundary exception level, architectural state of a subset of registers selected depending on the boundary exception level of the given realm.

Masking of architectural state associated with a realm

Apparatus for processing data uses memory access circuitry to enforce ownership rights of a plurality of memory regions within a memory, a given memory region among the plurality of memory regions having a given owning process specified from among a plurality of processes. A given owning process has exclusive rights to control access to given owned data stored within the given memory region. The memory access circuitry is responsive to a first access command from a first processing element for the given memory region to perform an access sequence comprising switching a lock flag for the given memory region to a locked state, performing an access operation specified by the access command, and switching the lock flag to an unlocked state. The memory access circuitry is responsive to a second access command from a second processing element for the given memory region while the lock flag is in said locked state to block action of the second access command.

Memory region locking using lock/unlock flag state for exclusive rights to control memory access

A data processing apparatus and a method of processing data are disclosed, in which address translations between first addresses used in a first addressing system and second addresses used in a second addressing system are locally stored. Each stored address translation is stored with a corresponding identifier. In response to an invalidation command to perform an invalidation process on a selected stored address translation the selected stored address translation is invalidated, wherein the selected stored address translation is identified in the invalidation command by a specified first address and a specified identifier. The invalidation process is further configured by identifier grouping information which associates more than one identifier together as a group of identifiers, and the invalidation process is applied to all stored address translations which match the specified first address and which match any identifier in the group of identifiers to which the specified identifier belongs.

Growing community of inventors

Cambridge, United Kingdom

Gareth Rhys Stockwell