Arm Limited

Arm IP Limited

The Chancellor, Masters and Scholars of the University of Cambridge

Qualcomm Technologies International, Ltd.

Thomas Christopher Grocutt

François Christopher Jacques Botman

Simon John Craske

Richard Roy Grisenthwaite

Bradley John Smith

Milosch Meriac

John Michael Horley

Geraint David Luff

Jonathan Austin

Michael John Williams

Yasuo Ishii

Frederic Claude Marie Piry

Timothy Gareth Jones

Sam Ainsworth

Andrew Brookfield Swaine

Stuart David Biles

Peter Richard Greenhalgh

Ian Michael Caulfield

Albin Pierrick Tonnerre

Alastair David Reid

Alasdair Grant

Matthias Lothar Boettcher

Daryl Wayne Bradley

Thomas Sean Houlihane

Michael John Gibbs

Carlo Dario Fanara

Dean Armstrong

Alexander Donald Charles Chadwick

Dominic Phillip Mulligan

Jack William Derek Andrew

Neil Burgess

Nathan Yong Seng Chong

Daryl John Stewart

Jean Sébastien Leroy

Marianne Crowder

Dall George Mathew Amos

Nathan Young Seng Chong

An apparatus and method are described for handling sealed capabilities. The apparatus has processing circuitry to perform processing operations during which access requests to memory are generated, wherein the processing circuitry is arranged to generate memory addresses for the access requests using capabilities that identify constraining information. Checking circuitry then determines whether a given access request whose memory address is generated using a given capability is permitted based on the constraining information identified by that given capability, and based on a level of trust associated with the given access request. Each capability has a capability level of trust associated therewith, and the level of trust associated with the given access request is dependent on both a current mode level of trust associated with a current mode of operation of the processing circuitry, and the capability level of trust of the given capability. At least one of the capabilities is settable as a sealed capability, and the apparatus further comprises sealed capability handling circuitry to prevent the processing circuitry performing at least one processing operation using a given sealed capability when the current mode level of trust is a lower level of trust than the capability level of trust of the given sealed capability.

Technique for handling sealed capabilities

A processing circuitry having a secure domain and a less secure domain. A control storage location stores a domain transition disable configuration parameter specifying whether domain transitions between the secure domain and the less secure domain are enabled or disabled in at least one mode of the process-ing circuitry. In the at least one mode of the processing circuitry, when the domain transition disable configuration parameter specifies that said domain transitions are disabled in said at least one mode, a disabled domain transition fault is signalled in response to an attempt to transition between domains in either direction. This can help support lazy configuration of resources for the secure domain or less secure domain for a thread expected only to need the other domain.

Domain transition disable configuration parameter

An apparatus and method for constraining access to memory using capabilities. Processing circuitry performs operations during which access requests to memory are generated, with memory addresses for the access requests being generated using capabilities that identify constraining information. Capability checking circuitry performs a capability check operation to determine whether a given access request whose memory address is generated using a given capability is permitted based on the constraining information. Memory access checking circuitry then further constrains access to the memory by the given access request in dependence on a level of trust. The given capability has a capability level of trust associated therewith, and the level of trust associated with the given access request is dependent on both the current mode level of trust associated with the current mode of operation of the processing circuitry, and the capability level of trust of the given capability.

Technique for constraining access to memory using capabilities

Apparatuses, methods and techniques for controlling memory access in a data processing system are disclosed. The operating data processing system comprises multiple subsystems, each comprising at least one processing element and at least one peripheral device. Memory transaction control circuitry receives memory transaction information of a memory transaction comprising a stream identifier indicative of the issuing peripheral device. A main control register indicates an address of a stream table having multiple entries each comprising an owning subsystem identifier. At least one subsystem control register corresponding to each subsystem of the multiple subsystems stores memory access checking configuration information. On receipt of the memory transaction information an entry of the stream table is selected in dependence on the stream identifier. At least one subsystem control register. corresponding to the subsystem identified by the owning subsystem identifier of the entry is selected.

Controlling memory access in a data processing systems with multiple subsystems

Processing circuitry has a handler mode and a thread mode. In response to an exception condition, a switch to handler mode is made. In response to an intermodal calling branch instruction specifying a branch target address when the processing circuitry is in the handler mode, an instruction decoder controls the processing circuitry to save a function return address to a function return address storage location; switch a current mode of the processing circuitry to the thread mode; and branch to an instruction identified by the branch target address. This can be useful for deprivileging of exceptions.

Intermodal calling branch instruction

Apparatus comprises a processor to execute program instructions stored at respective memory addresses, processing of the program instructions being constrained by a prevailing capability defining at least access permissions to a set of one or more memory addresses; the processor comprising: control flow change handling circuitry to perform a control flow change operation, the control flow change operation defining a control flow change target address indicating the address of a program instruction for execution after the control flow change operation; and capability generating circuitry to determine, in dependence on the control flow change target address, an address at which capability access permissions data is stored; the capability generating circuitry being configured to retrieve the capability access permissions data and to generate a capability for use as a next prevailing capability in dependence upon at least the capability access permissions data.

Apparatus and method for capability-based processing

A technique for controlling access to memory mapped control registers. The apparatus has processing circuitry for executing program code to perform data processing operations, and a set of memory mapped control registers for storing control information used to control operation of the processing circuitry. Further, a lockdown register used to store a lockdown value. The processing circuitry is arranged to execute store instructions to perform write operations to a memory address space. The processing circuitry is arranged to prevent a write operation being performed to change the control information in the memory mapped control registers. This significantly reduces the prospect of an attacker seeking to exploit a software vulnerability to change the control information in the memory mapped control registers.

Apparatus and method for controlling access to a set of memory mapped control registers

A control table () defines information for controlling a processing component () to perform an operation. The table () comprises entries each corresponding to a variable size region defined by a first limit address and one of a second limit address and size. A binary search procedure is provided for looking up the table, comprising a number of search window narrowing steps, each narrowing a current search window of candidate entries to a narrower search window comprising fewer entries, based on a comparison of a query address against the first limit address of a selected candidate entry of the current search window. The comparison is independent of the second limit address or size of the selected candidate entry. After the search window is narrowed to a single entry, the query address is compared with the second limit address or size of that single entry.

Binary search procedure for control table stored in memory system

There is provided a data processing apparatus comprising a plurality of registers, each of the registers having data bits to store data and metadata bits to store metadata. Each of the registers is adapted to operate in a metadata mode in which the metadata bits and the data bits are valid, and a data mode in which the data bits are valid and the metadata bits are invalid. Mode bit storage circuitry indicates whether each of the registers is in the data mode or the metadata mode. Execution circuitry is responsive to a memory operation that is a store operation on one or more given registers.

Saving and restoring registers

An apparatus comprises: processing circuitry to perform data processing in one of a plurality of security domains including at least a secure domain and a less secure domain, and memory access checking circuitry to check whether a memory access is allowed depending on security attribute data indicating which domain is associated with a target address. In response to a given change of program flow from processing in the less secure domain to a target instruction having an address associated with the secure domain: a fault is triggered when the target instruction is an instruction other than a gateway instruction indicating a valid entry point to the secure domain. When the target instruction is said gateway instruction, a stack pointer verifying action is triggered to verify whether it is safe to use a selected stack pointer stored in a selected stack pointer register.

Verifying stack pointer

Data processing apparatuses, methods and computer programs are disclosed. A range definition register is arranged to store a range specifier and filtering operations are performed with respect to a specified transaction by reference to the range definition register. The range definition register stores the range specifier in a format comprising a significand and an exponent, wherein a range of data identifiers is at least partially defined by the range specifier. When the specified transaction is with respect to a data identifier within the range of data identifiers, the filtering operations performed are dependent on attribute data associated with the range of data identifiers.

Filtering based on a range specifier

An apparatus comprises an instruction decoder to decode instructions, processing circuitry to perform data processing in response to the instructions decoded by the instruction decoder, and memory attribute checking circuitry to check whether a memory access request issued by the processing circuitry satisfies access permissions specified in a plurality of memory attribute entries. Each memory attribute entry specifies access permissions for a corresponding address region of variable size within an address space. In response to a range checking instruction specifying address identifying parameters for identifying a first address and a second address, the instruction decoder controls the processing circuitry to set, in at least one software-accessible storage location, a status value indicative of whether the first address and the second address correspond to the same memory attribute entry.

Range checking instruction for setting a status value indicative of whether a first address and second address identified by the instruction correspond to the same memory attribute entry

An apparatus and method are provided for performing vector processing operations. In particular the apparatus has processing circuitry to perform the vector processing operations and an instruction decoder to decode vector instructions to control the processing circuitry to perform the vector processing operations specified by the vector instructions. The instruction decoder is responsive to a vector generating instruction identifying a scalar start value and wrapping control information, to control the processing circuitry to generate a vector comprising a plurality of elements. In particular, the processing circuitry is arranged to generate the vector such that the first element in the plurality is dependent on the scalar start value, and the values of the plurality of elements follow a regularly progressing sequence that is constrained to wrap as required to ensure that each value is within bounds determined from the wrapping control information. The vector generating instruction can be useful in a variety of situations, a particular use case being to implement a circular addressing mode within memory, where the vector generating instruction can be coupled with an associated vector memory access instruction. Such an approach can remove the need to provide additional logic within the memory access path to support such circular addressing.

Vector generating instruction for generating a vector comprising a sequence of elements that wraps as required

A data processing system includes processing circuitry for executing context-data-dependent program instructions which are decoded by decoder circuitry. Such context-data-dependent program instructions perform processing which is dependent upon currently existing context data. As an example, the context-data-dependent program instructions may be floating point instructions and the context data may be rounding mode information. The decoder circuitry supports a context save instruction which saves context data when it is marked as having been used and saves default context data when the current context data is marked as not having been used. The decoder circuitry further supports a context restore instruction which restores context data when the current context data is marked as having been used and permits the current context data to continue for future use when it is marked as currently unused.

Marking current context data to control a context-data-dependent processing operation to save current or default context data to a data location

In response to decoding a zero-overhead loop control instruction of an instruction set architecture, processing circuitry sets at least one loop control parameter for controlling execution of one or more iterations of a program loop body of a zero-overhead loop. Based on the at least one loop control parameter, loop control circuitry controls execution of the one or more iterations of the program loop body of the zero-overhead loop, the program loop body excluding the zero-overhead loop control instruction. Branch prediction disabling circuitry detects whether the processing circuitry is executing the program loop body of the zero-overhead loop associated with the zero-overhead loop control instruction, and dependent on detecting that the processing circuitry is executing the program loop body of the zero-overhead loop, disables branch prediction circuitry. This reduces power consumption during a zero-overhead loop when the branch prediction circuitry is unlikely to provide a benefit.

Growing community of inventors

Impington, United Kingdom

Thomas Christopher Grocutt