Exception Handling

Abstract

Apparatuses, methods, computer programs and computer readable storage media are provided. Data processing occurs at a current privilege level of multiple privilege levels and when an exception coercion flag for the current privilege level is set, any instruction is responded to by taking a specified type of exception to an exception handling privilege level. The exception coercion flag for the current privilege level cannot be set when operating at the current privilege level other than by an exception return to the current exception level, and the exception coercion flag for a less privileged level can be set when operating in a more privileged level of the multiple privilege levels. When switching from operating at the current privilege level to a target privilege level, the exception coercion flag for the target privilege level is cleared.

Description

The present techniques relate to data processing. In particular they relate to exception handling in data processing. A data processing apparatus may be configured to operate at a privilege level selected from multiple privilege levels and may be configured such that, when operating in a lower privilege level of the multiple privilege levels and a certain type of event occurs, it takes an exception a more privileged level of the multiple privilege levels in order to respond appropriately to the event. At least some examples provide an apparatus comprising: processing circuitry; and register circuitry configured to hold state values indicative of a current processing state of the processing circuitry, wherein the processing circuitry is configured to perform data processing operations in response to a sequence of instructions in dependence on the state values held in the register circuitry, wherein the processing circuitry is configured to operate at a current privilege level of multiple privilege levels, wherein the state values comprise an exception coercion flag which is privilege level specific, wherein the processing circuitry, when operating at the current privilege level and the exception coercion flag for the current privilege level is set, is configured to respond to any instruction in the sequence of instructions by taking a specified type of exception to an exception handling privilege level, and wherein the exception coercion flag for the current privilege level cannot be set by the processing circuitry when operating at the current privilege level other than by an exception return to the current exception level, and the exception coercion flag for a less privileged level can be set by the processing circuitry when operating in a more privileged level of the multiple privilege levels, and wherein, when the processing circuitry switches from operating at the current privilege level to a target privilege level, the exception coercion flag for the target privilege level is cleared. At least some examples provide a method comprising: performing data processing operations; holding state values indicative of a current processing state of the data processing operations, wherein the data processing operations are performed in response to a sequence of instructions in dependence on the state values held; wherein the data processing operations are performed at a current privilege level of multiple privilege levels, wherein the state values comprise an exception coercion flag which is privilege level specific, wherein, when operating at the current privilege level and the exception coercion flag for the current privilege level is set, any instruction in the sequence of instructions is responded to by taking a specified type of exception to an exception handling privilege level, and wherein the exception coercion flag for the current privilege level cannot be set by the data processing operations when operating at the current privilege level other than by an exception return to the current exception level, and the exception coercion flag for a less privileged level can be set by the data processing operations when operating in a more privileged level of the multiple privilege levels, and wherein, when the data processing operations switch from operating at the current privilege level to a target privilege level, the exception coercion flag for the target privilege level is cleared . At least some examples provide a computer program which, when executed on a computer, causes the computer to provide: processing program logic; and register program logic configured to hold state values indicative of a current processing state of the processing program logic, wherein the processing program logic is configured to perform data processing operations in response to a sequence of instructions in dependence on the state values held in the register program logic, wherein the processing program logic is configured to operate at a current privilege level of multiple privilege levels, wherein the state values comprise an exception coercion flag which is privilege level specific, wherein the processing program logic, when operating at the current privilege level and the exception coercion flag for the current privilege level is set, is configured to respond to any instruction in the sequence of instructions by taking a specified type of exception to an exception handling privilege level, and wherein the exception coercion flag for the current privilege level cannot be set by the processing program logic when operating at the current privilege level other than by an exception return to the current exception level, and the exception coercion flag for a less privileged level can be set by the processing program logic when operating in a more privileged level of the multiple privilege levels, and wherein, when the processing program logic switches from operating at the current privilege level to a target privilege level, the exception coercion flag for the target privilege level is cleared . At least some examples provide a computer-readable storage medium to store the computer program. The present techniques will be described further, by way of example only, with reference to embodiments thereof as illustrated in the accompanying drawings, to be read in conjunction with the following description, in which: Figure 1 schematically illustrates an apparatus in accordance with some examples; Figure 2 illustrates a sequence of steps which are taken in accordance with the method of some examples; Figure 3 illustrates a sequence of steps which are taken in accordance with the method of some examples; Figure 4 illustrates a sequence of steps which are taken in accordance with the method of some examples; Figure 5 illustrates a sequence of steps which are taken in accordance with the method of some examples; Figure 6 schematically illustrates an set of registers in accordance with some examples; and Figure 7 schematically illustrates a simulator implementation in accordance with some examples. In one example herein there is an apparatus comprising: processing circuitry; and register circuitry configured to hold state values indicative of a current processing state of the processing circuitry, wherein the processing circuitry is configured to perform data processing operations in response to a sequence of instructions in dependence on the state values held in the register circuitry, wherein the processing circuitry is configured to operate at a current privilege level of multiple privilege levels, wherein the state values comprise an exception coercion flag which is privilege level specific, wherein the processing circuitry, when operating at the current privilege level and the exception coercion flag for the current privilege level is set, is configured to respond to any instruction in the sequence of instructions by taking a specified type of exception to an exception handling privilege level, and wherein the exception coercion flag for the current privilege level cannot be set by the processing circuitry when operating at the current privilege level other than by an exception return to the current exception level, and the exception coercion flag for a less privileged level can be set by the processing circuitry when operating in a more privileged level of the multiple privilege levels, and wherein, when the processing circuitry switches from operating at the current privilege level to a target privilege, the exception coercion flag for the target privilege level is cleared . The present techniques enable the “injection” of an exception into a given privilege level. In a particular use case, a more privileged level is able to “inject” an exception into a less privileged level. Moreover, the use of the exception coercion flag, in response to which the processing circuitry takes the specified type of exception, provides a mechanism for this exception injection with a reduced processing burden. Whilst, generally speaking, software at a more privileged level could intervene to configure the state values for a less privileged level to achieve a similar exception-taking behaviour, the determination of these state values by the software at the more privileged level is a non-trivial task. For example, the state values when an exception is taken may include values held in “syndrome registers” relating to the cause of the exception which would require emulating. Instead, the use of the exception coercion flag according to the present techniques to trigger the exception-taking means that the state values are handled by the apparatus in the same manner as for any exception that might be taken that privilege level. For example, the state values held in “syndrome registers” relating to the cause of the exception are automatically populated by the hardware and the software at a more privileged level does not need to calculate them. Furthermore, the configuration that the processing circuitry will respond to the exception coercion flag by taking the specified type of exception to the exception handling privilege level whatever instruction in the sequence of instructions is currently to be executed provides a mechanism for the (typically) more privileged level to force the immediate taking of the exception by the (typically) less privileged level. The integrity of the multiple privilege levels is protected by the feature that a privilege level cannot set the exception coercion flag for a more privileged level, and can only set the privilege level specific exception coercion flag for itself via an exception return. Moreover, the automatic clearing of the exception coercion flag for the target privilege level when switching from the current privilege level to the (typically more privileged) target privilege level on taking an exception ensures that only a single exception is forced in response to the setting of the exception coercion flag. The multiple privilege levels will be understood to be an ordered set of privilege levels of increasing privilege (or of decreasing privilege which considered in reverse order) and the use of the terms “less privileged level” and “more privileged level” of the multiple privilege levels herein should be understood to mean that the total number of the multiple privilege levels is not significant for the present techniques, nor where in the ordered set of privilege levels the “less privileged level” and the “more privileged level” lie, but only that these two levels do not have the same privilege level. Similarly the exception handling privilege level need only be the same as or more privileged than the current privilege level. Moreover the more privileged level that sets the exception coercion flag and the exception handling privilege level need not be the same privilege level. There may be a variety of reasons for a more privileged level to set the exception coercion flag for a less privileged level. However, in some examples, the processing circuitry, when operating at the more privileged level of the multiple privilege levels, is responsive to a received exception from the less privileged level and when a cause of the received exception cannot be diagnosed, to set the exception coercion flag of the less privileged level and to execute an exception return to the less privileged level. When the cause of a received exception cannot be diagnosed, this has the potential to result in a fatal condition for the data processing being carried out, wherein the more privileged level, being unable to diagnose the cause of the received exception and therefore to carry out a suitable exception handling routine to remedy the situation, brings the data processing to an abrupt halt. This may be referred to as a “panic” response, when software running at the more privileged level typically causes various system data to be dumped to whatever persistent data storage the apparatus has available and halts, such that the cause of the problem can be studied by a system user. One example in which this situation could occur would be when software running at the more privileged level is out-of-date with respect to the software running at the current privilege level. There then exists the possibility for the software running at the current privilege level to have new features which the software running at the more privileged level is unaware of (i.e. has not been configured to act in a supervisory role for). Hence, when the software running at the current privilege level interacts with such a new feature and encounters a problem in that interaction which causes an exception to be taken to the more privileged level, the cause of the received exception cannot be diagnosed, since the software running at the more privileged level does not know about the new feature. The present techniques provide the software running at the more privileged level with a mechanism for dealing with this situation, in that the handling of the received exception which is not understood is promptly returned to the current privilege level wherein the exception handling is immediately bounced to the exception handling privilege level by the taking of the specified type of exception. In some examples the cause of the received exception is an access by the processing circuitry operating at the less privileged level to a feature of the apparatus, wherein the feature of the apparatus is not enabled. Hence, despite the presence of the feature of the apparatus, the fact that the feature is not enabled means that the access to it fails and as a result an exception is taken. In some examples, use by the processing circuitry operating at the less privileged level of the feature requires enablement by the processing circuitry operating at the more privileged level. Hence, in the situation in which software running at the more privileged level is not aware of the feature, it will not be able to enable the feature. Moreover, being unaware of the feature, this would be liable to cause the kind of panic described above, if the mechanism provided by the present techniques were not present. The variety of types of exception may be the specified type of exception which is forced to be taken when the exception coercion flag is set, but in some examples the specified type of exception is taken by the processing circuitry when an undefined instruction is encountered in the sequence of instructions. Accordingly in such examples a fixed type of exception is taken when the exception coercion flag is set. The apparatus may however provide configurability with regard to the type of exception which is taken when the exception coercion flag is set. Accordingly, in some examples the specified type of exception is specified by a type value stored in a control register comprised in the register circuitry. The specification of the type of exception may be under the control of the more privileged level (which sets the exception coercion flag) and hence in some examples the control register is accessible to the processing circuitry when operating in the more privileged level of the multiple privilege levels. Alternatively or in addition, the type of exception may be under the control of the exception handling privilege level (to which the exception is taken when the exception coercion flag is set) and hence in some examples the control register is accessible to the processing circuitry when operating in the exception handling privilege level of the multiple privilege levels. Thus when the exception coercion flag is set a non-specific exception may be taken to the exception handling privilege level and the type of exception to be taken may then be determined at the exception handling privilege level with reference to the type value stored in the control register. Different types of exception may be allocated different priorities with respect to one another, such that when two (or more) exceptions are concurrently pending one will take precedence over the other(s). Accordingly the relative priority of taking the exception coercion flag triggered exception can be set appropriately for the particular implementation of the present techniques. Hence in some examples the processing circuitry is configured to treat the taking the specified type of exception when the exception coercion flag for the current privilege level is set as lower priority than taking an exception of at least one other type. Various other types of exception may thus be set to have higher priority than the exception coercion flag triggered exception. In some examples the exception of at least one other type is a debugging exception taken on execution of an instruction to facilitate study of the apparatus before and after that execution. Accordingly with such a configuration, the implementation of the present techniques will not interfere with the ability of the system user to employ such debugging exception to study the step-by-step behaviour and state of the apparatus. In some examples the exception of at least one other type is a page fault exception. As mentioned above, amongst the relative priorities of the privilege levels involved the only constraint is that the exception handling privilege level is of the same or of higher privilege than the current privilege level. In some examples the more privileged level of the multiple privilege levels which sets the exception coercion flag for the less privileged level is of higher privilege than the exception handling privilege level to which the specified type of exception is taken. The present techniques are not limited to any particular number levels being provided as the multiple privilege levels. In some examples the multiple privilege levels comprise at least a first privilege level, a second privilege level, and a third privilege level, wherein the first privilege level is of lesser privilege than the second privilege level and the second privilege level is of lesser privilege than the third privilege level, and wherein the more privileged level of the multiple privilege levels which sets the exception coercion flag is one of the second privilege level and the third privilege level, and wherein the less privileged level for which the exception coercion flag can be set is one of the first privilege level and the second privilege level. These privilege levels may be utilised in a variety of ways, but in some examples the first privilege level is a user application level, the second privilege level is an operating system level, and the third privilege level is a firmware level. Thus to take just one of example of the use of the present techniques in such an arrangement, the current privilege level may be the user application level, the more privileged level which sets the exception coercion flag may be the firmware level, and the exception handling privilege level may be the operating system level. In this context, one example sequence of events is that a problem arising at the user application level causes an exception to be taken to the firmware level, and the firmware level responds by bouncing the exception handling back via the user application level to the operating system level. In some examples the multiple privilege levels comprise at least a first privilege level, a second privilege level, a third privilege level, and a fourth privilege level, wherein the first privilege level is of lesser privilege than the second privilege level, the second privilege level is of lesser privilege than the third privilege level, and the second privilege level is of lesser privilege than the fourth privilege level, and wherein the more privileged level of the multiple privilege levels which sets the exception coercion flag is one of the second privilege level, the third privilege level, and the fourth privilege level, and wherein the less privileged level for which the exception coercion flag can be set is one of the first privilege level, the second privilege level, and the third privilege level. Accordingly such examples add a further privilege level to the three privilege level example described above. Again, these privilege levels may be utilised in a variety of ways, but in some examples the first privilege level is a user application level, the second privilege level is an operating system level, the third privilege level is a hypervisor level, and the fourth privilege level is a firmware level. In this context, one example sequence of events is that a problem arising at the user application level causes an exception to be taken to the firmware level, and the firmware level responds by bouncing the exception handling back via the user application level to either the operating system level or the hypervisor level. In one example herein there is a method comprising: performing data processing operations; holding state values indicative of a current processing state of the data processing operations, wherein the data processing operations are performed in response to a sequence of instructions in dependence on the state values held; wherein the data processing operations are performed at a current privilege level of multiple privilege levels, wherein the state values comprise an exception coercion flag which is privilege level specific, wherein, when operating at the current privilege level and the exception coercion flag for the current privilege level is set, any instruction in the sequence of instructions is responded to by taking a specified type of exception to an exception handling privilege level, and wherein the exception coercion flag for the current privilege level cannot be set by the data processing operations when operating at the current privilege level other than by an exception return to the current exception level, and the exception coercion flag for a less privileged level can be set by the data processing operations when operating in a more privileged level of the multiple privilege levels, and wherein, when the data processing operations switch from operating at the current privilege level to a target privilege level, the exception coercion flag for the target privilege level is cleared. In one example herein there is a computer program which, when executed on a computer, causes the computer to provide: processing program logic; and register program logic configured to hold state values indicative of a current processing state of the processing program logic, wherein the processing program logic is configured to perform data processing operations in response to a sequence of instructions in dependence on the state values held in the register program logic, wherein the processing program logic is configured to operate at a current privilege level of multiple privilege levels, wherein the state values comprise an exception coercion flag which is privilege level specific, wherein the processing program logic, when operating at the current privilege level and the exception coercion flag for the current privilege level is set, is configured to respond to any instruction in the sequence of instructions by taking a specified type of exception to an exception handling privilege level, and wherein the exception coercion flag for the current privilege level cannot be set by the processing program logic when operating at the current privilege level other than by an exception return to the current exception level, and the exception coercion flag for a less privileged level can be set by the processing program logic when operating in a more privileged level of the multiple privilege levels, and wherein, when the processing program logic switches from operating at the current privilege level to a target privilege level, the exception coercion flag for the target privilege level is cleared . In one example herein there is a computer-readable storage medium to store the computer program. Some particular embodiments are now described with reference to the figures. Figure 1 schematically illustrates a data processing apparatus 2 in accordance with some examples. The apparatus 2 has a processing pipeline 4 that includes a number of pipeline stages. In this example, the pipeline stages include: a fetch stage 6 for fetching instructions from an instruction cache 8; a decode stage 10 for decoding the fetched program instructions to generate micro-operations (decoded instructions) to be processed by remaining stages of the pipeline; an issue stage 12 for checking whether operands required for the micro-operations are available in a register file 14 and issuing micro-operations for execution once the required operands for a given micro-operation are available; an execute stage 16 for executing data processing operations corresponding to the micro-operations, by processing operands read from the register file 14 to generate result values; and a writeback stage 18 for writing the results of the processing back to the register file 14. It will be appreciated that this is merely one example of possible pipeline architecture, and other systems may have additional stages or a different configuration of stages. For example, in an out-of-order processor an additional register renaming stage could be included for mapping architectural registers specified by program instructions or micro-operations to physical register specifiers identifying physical registers in the register file 14. In some examples, there may be a one-to-one relationship between program instructions decoded by the decode stage 10 and the corresponding micro-operations processed by the execute stage. It is also possible for there to be a one-to-many or many-to-one relationship between program instructions and micro-operations, so that, for example, a single program instruction may be split into two or more micro-operations, or two or more program instructions may be fused to be processed as a single micro-operation. The execute stage 16 includes a number of processing units, for executing different classes of processing operation. In the example shown, the execution units include an arithmetic / logic unit (ALU) 20 for performing arithmetic or logical operations; a floating-point unit 22 for performing operations on floating-point values; a branch unit 24 for evaluating the outcome of branch operations and adjusting the program counter which represents the current point of execution accordingly; and a load / store unit 28 for performing load / store operations to access data in a memory system 8, 30, 32, 34. In this example, the memory system includes a level one data cache (L1D$) 30, a level one instruction cache (L1I$) 8, a shared level two cache (L2$) 32, and main system memory 34. It will be appreciated that this is just one example of a possible memory hierarchy and other arrangements of caches can be provided. The specific types of processing unit 20 to 28 shown in the execute stage 16 are just one example, and other implementations may have a different set of processing units or could include multiple instances of the same type of processing unit so that multiple micro-operations of the same type can be handled in parallel. It will be appreciated that Figure 1 is merely a simplified representation of some components of a possible processor pipeline architecture, and the processor may include many other elements not illustrated for conciseness, such as branch prediction mechanisms or address translation or other memory management mechanisms. Processing circuitry operating according to the present techniques (for example that of the apparatus 2 shown in Figure 1) is configured to configured to operate at a privilege level of multiple privilege levels. That is, software which is currently being executed by the processing circuitry (i.e. the current sequence of instructions passing along the processing pipeline 4 in the example of Figure 1) operates at that privilege level. The operation of the processing circuity is carried out in dependence on state values held in the register circuitry (i.e. the registers 14 in the example of Figure 1). Generally the processing circuitry operates at a lower privilege level executing user-provided software (application software), although certain events can cause the operation at the lower privilege level to be paused and the processing circuitry switches to operating at another (higher) privilege level, such as when an exception is taken. The usual further progression in such circumstances is for software at the target privilege level of the exception to executed an appropriate exception handling routine, after which an exception return brings the processing circuitry back to operating at a lower privilege level executing user-provided software (from the point at which the exception was taken). Equally the processing circuitry may perform certain tasks operating at a higher privilege level executing more privileged software, in particular to carry out certain system administration or configuration tasks, which application software is not permitted to carry out itself. Processes at the higher privilege level may for example be a kernel running an operating system, a hypervisor running multiple virtual machines, or firmware closely linked to operation of the hardware components of the apparatus. Figure 2 shows a sequence of steps which are taken when operating such processing circuitry in accordance with one example. The sequence begins at step 50, where the processor (processing circuitry) is operating in a first privilege mode. Next at step 51 the exception coercion flag for a second privilege mode is set. Typically the first privilege mode is more privileged than the second privilege mode (and thus the first privilege mode is able to set the exception coercion flag for the second privilege mode), however in a case where the processor is performing an exception routine in the first privilege mode, the second privilege mode can be at the same privilege level as the first privilege mode (indeed they may be the same mode), and the exception coercion flag for the first privilege mode can be set by the exception return from the exception routine. At step 52 the processor then returns to operating at the first privilege level. On the resumption of instruction execution (step 53) at the second privilege level the taking of an exception is forced, in that regardless of the next instruction to be executed the exception is taken because exception coercion flag is set. In taking the exception, at step 54 the exception coercion flag is cleared and at step 55, the processor having transitioned to operating at an exception handling privilege level, an exception handler (exception handling routine) is executed. Once the exception handler has completed, at step 56 the process returns to the first privilege level. Finally at step 57 instruction execution resumes at the 57 privilege level. Note that the privilege level at which the exception coercion flag for the first privilege level was set at step 51 may differ from the privilege level at which the exception handler is executed. Figure 3 shows a sequence of steps which are taken when operating such processing circuitry in accordance with one example. The sequence begins at step 100, where the processor (processing circuitry) is operating in a higher privilege mode (i.e. at a higher privilege level). Next at step 101 the exception coercion flag for a lower privilege mode (i.e. a lower privilege level) is set. At step 102 the processor then returns to operating at the lower privilege level. On the resumption of instruction execution (step 103) at the lower privilege level the taking of an exception is forced, in that regardless of the next instruction to be executed at the lower privilege level the exception is taken because exception coercion flag is set. In taking the exception, at step 104 the exception coercion flag is cleared and at step 105 the processor having transitioned to operating at a higher privilege level an exception handler (exception handling routine) is executed. Once the exception handler has completed, at step 106 the process returns to the lower privilege level. Finally at step 107 instruction execution resumes at the lower privilege level. Note that the higher privilege level at which the exception coercion flag for the lower privilege level was set at step 101 may differ from the higher privilege level at which the exception handler is executed. Figure 4 shows a sequence of steps which are taken in accordance with one example. The sequence begins at step 200, where the processor (processing circuitry) is operating at a lower privilege level (e.g. executing application software). In the process of executing instructions at the lower privilege level, an attempt is made to access a feature of the apparatus which requires enablement by higher privilege level and this has not happened (i.e. the features not enabled). Accordingly at step 202, this attempted access causes a fault which is trapped to a higher privilege level to diagnose. Then at 204 it is found that the higher privilege level does not recognise the problem (cannot diagnose the problem). Recall that at step 201 an attempt was made to access the feature which had not been enabled by the higher privilege level. Note that such a feature, by default, is not enabled. Not recognising the problem, at step 205 the exception coercion flag for the lower privilege level is set and at step 206, the processor returns to operating at the lower privilege level. Now, when that operating at the lower privilege level resumes, an exception is immediately forced because the exception coercion flag for the lower privilege level is set. Once more, in taking an exception from the lower privilege level, at step 208 the exception coercion flag for the lower privilege level is cleared. The exception taken transitions the processing circuitry to operate at a higher privilege level (note that this may not be the same privilege level as the one at which the exception coercion flag for the lower privilege level was set) and at step 209 an exception handler is executed. On its completion, at step 210 an exception return brings the processor back to operating at the lower privilege level. The actions of the exception handler may for example present the lower privilege level with a view consistent with the feature (to which access was sought at step 201) simply not being present in the apparatus. Finally at step 211 instruction execution resumes at the lower privilege level. Figure 5 shows a sequence of steps which are taken in accordance with one example. Here the processing circuitry (processor) is configured to operate in a privilege level of four privilege levels, these also being referred to as exception levels (EL) and enumerated as EL0, ELI, EL2, and EL3. EL0 is the lowest privilege level and EL3 is the highest privilege level. Moreover in this example, user code (application software) runs at EL0, one or more guest operating system run at ELI, a hypervisor (with control over the one or more guest operating system) runs at ELI, and firmware runs at EL3. Referring to the figure, the sequence begins at step 301, where the processing circuitry is operating at EL0, running application software. Then at step 302 the application software attempts to access a feature that requires enabling by EL3 and this has not occurred. Accordingly at step 303 this attempted access causes a fault which is trapped to EL3 to diagnose the issue. In the apparatus of this example two of the state holding registers are PSTATE and SPSRELx (where x = [0-3]). PSTATE is the processor state and SPSR ELx is the Saved Program Status Register used to hold saved process state for the current mode when an exception to ELx is taken. The exception coercion flag is set / unset within a field of PSTATE referred to as PSTATE.UINJ and when this bit of state is saved on taking an exception the field in which it is saved is SPSR^ELx.UINJ. In trapping the fault at step 303 and taking an exception to EL3, the exception coercion flag is cleared both in PSTATE.UINJ and in SPSR EL3.UINJ. Then at step 305, the firmware operating at EL3 does not recognise the problem (that an access has been attempted to a feature that requires EL3 to enabling it). This may for example be because the firmware is out-of-date with respect to the application software and the guest operating system under which the application software is running. Since it cannot diagnose the problem, the firmware injects an exception back into EL0, which begins at step 306 by the firmware setting SPSREL3.UINJ (the exception coercion flag within the saved state saved when the transition from ELO to ELO occurred). Execution of ERET (exception return) at step 307 returns the processor to ELO. In configuring the processor for operation at ELO again, at step 308 PSTATE.UINJ is set to SPSREL3.UINJ, i.e. to 1. Instruction execution then resumes at ELO at step 309, but because PSTATE.UINJ is now set, an exception is immediately taken (regardless of the instruction where instruction execution resumed). Moreover, here the processor is configured such that the exception taken when PSTATE.UINJ is set an UNDEF exception (i.e. the kind of exception which would be taken if an undefined instruction were to be encounter in the sequence of instructions being executed). The UNDEF exception is taken to ELI, so firstly at step 311 PSTATE.UINJ is cleared and SPSR EL1.UINJ is set to 0. An exception handling routine (exception handler) then runs at ELI (step 312) and on completion execution of ERET (exception return) at step 313 returns the processor to ELO. Finally at step 314 instruction execution (of the application software) resumes at ELO. Figure 6 schematically illustrates a set of registers 400 in accordance with some examples. A first set of the registers 401 are general purpose registers, which have no architectural control function and are available to the programmer for use. A second set of the registers 402 are status registers, which hold processor status and control information, and program status. One such status register (not explicitly shown) is the current program status register (CPSR) which holds various values controlling the processor operation (such as the current processor mode, condition code flags, execution state bits, and so on). The saved program status register 403 (SPSRELx) is used to hold saved process state for the current mode when an exception to ELx is taken. This enables the processor to continue its operations precisely where it left off, once the exception return occurs. A further status register is the processor state register 404 (PSTATE). Both the saved program status register and the processor state register comprise a bit for the exception coercion flag (i.e. SPSRELx.UINJ and PSTATE.UINJ respectively). One further register 406 is also shown, which is an exception type definition register, which can optionally be provided and can be used to the type of exception which is to be taken when forced by the setting of the exception coercion flag, thus allowing this choice of exception type to be programmable. This register may be accessed only from one of the more privileged levels of the multiple privilege levels, e.g. from EL3 or ELI in the example of Figure 5. Figure 7 illustrates a simulator implementation that may be used. Whilst the earlier described embodiments implement the present invention in terms of apparatus and methods for operating specific processing hardware supporting the techniques concerned, it is also possible to provide an instruction execution environment in accordance with the embodiments described herein which is implemented through the use of a computer program. Such computer programs are often referred to as simulators, insofar as they provide a software based implementation of a hardware architecture. Varieties of simulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators. Typically, a simulator implementation may run on a host processor 515, optionally running a host operating system 510, supporting the simulator program 505. In some arrangements, there may be multiple layers of simulation between the hardware and the provided instruction execution environment, and / or multiple distinct instruction execution environments provided on the same host processor. Historically, powerful processors have been required to provide simulator implementations which execute at a reasonable speed, but such an approach may be justified in certain circumstances, such as when there is a desire to run code native to another processor for compatibility or re-use reasons. For example, the simulator implementation may provide an instruction execution environment with additional functionality which is not supported by the host processor hardware, or provide an instruction execution environment typically associated with a different hardware architecture. An overview of simulation is given in “Some Efficient Architecture Simulation Techniques”, Robert Bedichek, Winter 1990 USENIX Conference, Pages 53 - 63. To the extent that embodiments have previously been described with reference to particular hardware constructs or features, in a simulated embodiment, equivalent functionality may be provided by suitable software constructs or features. For example, particular circuitry may be implemented in a simulated embodiment as computer program logic. Similarly, memory hardware, such as a register or cache, may be implemented in a simulated embodiment as a software data structure. In arrangements where one or more of the hardware elements referenced in the previously described embodiments are present on the host hardware (for example, host processor 515), some simulated embodiments may make use of the host hardware, where suitable. The simulator program 505 may be stored on a computer-readable storage medium (which may be a non-transitory medium), and provides a program interface (instruction execution environment) to the target code 500 (which may include applications, operating systems and a hypervisor) which is the same as the interface of the hardware architecture being modelled by the simulator program 505. Thus, the program instructions of the target code 500 may be executed from within the instruction execution environment using the simulator program 505, so that a host computer 515 which does not actually have the hardware features of the apparatus 2 discussed above can emulate these features. For example, within the simulator program 505 there is provided processing logic 501 and register logic 502 to emulate the behaviours and interactions between the processing circuitry and register circuitry described above. In brief overall summary, apparatuses, methods, computer programs and computer readable storage media are provided. Data processing occurs at a current privilege level of multiple privilege levels and when an exception coercion flag for the current privilege level is set, any instruction is responded to by taking a specified type of exception to an exception handling privilege level. The exception coercion flag for the current privilege level cannot be set when operating at the current privilege level other than by an exception return to the current exception level, and the exception coercion flag for a less privileged level can be set when operating in a more privileged level of the multiple privilege levels. When switching from operating at the current privilege level to a target privilege level, the exception coercion flag for the target privilege level is cleared. In the present application, the words “configured to...” are used to mean that an element of an apparatus has a configuration able to carry out the defined operation. In this context, a “configuration” means an arrangement or manner of interconnection of hardware or software. For example, the apparatus may have dedicated hardware which provides the defined operation, or a processor or other processing device may be programmed to perform the function. “Configured to” does not imply that the apparatus 5 element needs to be changed in any way in order to provide the defined operation. Although illustrative embodiments have been described in detail herein with reference to the accompanying drawings, it is to be understood that the invention is not limited to those precise embodiments, and that various changes, additions and 10 modifications can be effected therein by one skilled in the art without departing from the scope of the invention as defined by the appended claims. For example, various combinations of the features of the dependent claims could be made with the features of the independent claims without departing from the scope of the present invention. 15

Claims

1. An apparatus comprising:processing circuitry; andregister circuitry configured to hold state values indicative of a current processing state of the processing circuitry, wherein the processing circuitry is configured to perform data processing operations in response to a sequence of instructions in dependence on the state values held in the register circuitry,wherein the processing circuitry is configured to operate at a current privilege level of multiple privilege levels,wherein the state values comprise an exception coercion flag which is privilege level specific,wherein the processing circuitry, when operating at the current privilege level and the exception coercion flag for the current privilege level is set, is configured to respond to any instruction in the sequence of instructions by taking a specified type of exception to an exception handling privilege level, andwherein the exception coercion flag for the current privilege level cannot be set by the processing circuitry when operating at the current privilege level other than by an exception return to the current exception level, and the exception coercion flag for a less privileged level can be set by the processing circuitry when operating in a more privileged level of the multiple privilege levels,and wherein, when the processing circuitry switches from operating at the current privilege level to a target privilege level, the exception coercion flag for the target privilege level is cleared.

2. The apparatus as claimed in claim 1, wherein the processing circuitry, when operating in the more privileged level of the multiple privilege levels, is responsive to a received exception from the less privileged level and when a cause of the received exception cannot be diagnosed, to set the exception coercion flag and to execute an exception return to the less privileged level.

3. The apparatus as claimed in claim 2, wherein the cause of the received exception is an access by the processing circuitry operating at the less privileged level to a feature of the apparatus, wherein the feature of the apparatus is not enabled.

4. The apparatus as claimed in claim 3, wherein use by the processing circuitry operating at the less privileged level of the feature requires enablement by the processing circuitry operating at the more privileged level.

5. The apparatus as claimed in any preceding claim, wherein the specified type of exception is taken by the processing circuitry when an undefined instruction is encountered in the sequence of instructions.

6. The apparatus as claimed in any preceding claim, wherein the specified type of exception is specified by a type value stored in a control register comprised in the register circuitry.

7. The apparatus as claimed in claim 6, wherein the control register is accessible to the processing circuitry when operating in the more privileged level of the multiple privilege levels.

8. The apparatus as claimed in claim 6 or claim 7, wherein the control register is accessible to the processing circuitry when operating in the exception handling privilege level of the multiple privilege levels.

9. The apparatus as claimed in any preceding claim, wherein the processing circuitry is configured to treat the taking the specified type of exception when the exception coercion flag for the current privilege level is set as lower priority than taking an exception of at least one other type.

10. The apparatus as claimed in claim 9, wherein the exception of at least one other type is a debugging exception taken on execution of an instruction to facilitate study of the apparatus before and after that execution.

11. The apparatus as claimed in claim 9, wherein the exception of at least one other type is a page fault exception.

12. The apparatus as claimed in any preceding claim, wherein the more privileged level of the multiple privilege levels which sets the exception coercion flag for the less privileged level is of higher privilege than the exception handling privilege level to which the specified type of exception is taken.

13. The apparatus as claimed in any preceding claim, wherein the multiple privilege levels comprise at least a first privilege level, a second privilege level, and a third privilege level,wherein the first privilege level is of lesser privilege than the second privilege level and the second privilege level is of lesser privilege than the third privilege level,and wherein the more privileged level of the multiple privilege levels which sets the exception coercion flag is one of the second privilege level and the third privilege level, and wherein the less privileged level for which the exception coercion flag can be set is one of the first privilege level and the second privilege level.

14. The apparatus as claimed in claim 13, wherein the first privilege level is a user application level, the second privilege level is an operating system level, and the third privilege level is a firmware level.

15. The apparatus as claimed in any of claims 1-13, wherein the multiple privilege levels comprise at least a first privilege level, a second privilege level, a third privilege level, and a fourth privilege level,wherein the first privilege level is of lesser privilege than the second privilege level, the second privilege level is of lesser privilege than the third privilege level, and the second privilege level is of lesser privilege than the fourth privilege level,and wherein the more privileged level of the multiple privilege levels which sets the exception coercion flag is one of the second privilege level, the third privilege level, and the fourth privilege level,and wherein the less privileged level for which the exception coercion flag can be set is one of the first privilege level, the second privilege level, and the third privilege level.

16. The apparatus as claimed in claim 15, wherein the first privilege level is a user application level, the second privilege level is an operating system level, the third privilege level is a hypervisor level, and the fourth privilege level is a firmware level.

17. A method comprising:performing data processing operations;holding state values indicative of a current processing state of the data processing operations, wherein the data processing operations are performed in response to a sequence of instructions in dependence on the state values held;wherein the data processing operations are performed at a current privilege level of multiple privilege levels,wherein the state values comprise an exception coercion flag which is privilege level specific,wherein, when operating at the current privilege level and the exception coercion flag for the current privilege level is set, any instruction in the sequence of instructions is responded to by taking a specified type of exception to an exception handling privilege level, andwherein the exception coercion flag for the current privilege level cannot be set by the data processing operations when operating at the current privilege level other than by an exception return to the current exception level, and the exception coercion flag for a less privileged level can be set by the data processing operations when operating in a more privileged level of the multiple privilege levels,and wherein, when the data processing operations switch from operating at the current privilege level to a target privilege level, the exception coercion flag for the target privilege level is cleared.

18. A computer program which, when executed on a computer, causes the computer to provide:processing program logic; andregister program logic configured to hold state values indicative of a current processing state of the processing program logic, wherein the processing program logic is configured to perform data processing operations in response to a sequence of instructions in dependence on the state values held in the register program logic,wherein the processing program logic is configured to operate at a current privilege level of multiple privilege levels,wherein the state values comprise an exception coercion flag which is privilege level specific,wherein the processing program logic, when operating at the current privilege level and the exception coercion flag for the current privilege level is set, is configured to respond to any instruction in the sequence of instructions by taking a specified type of exception to an exception handling privilege level, andwherein the exception coercion flag for the current privilege level cannot be set by the processing program logic when operating at the current privilege level other than by an exception return to the current exception level, and the exception coercion flag for a less privileged level can be set by the processing program logic when operating in a more privileged level of the multiple privilege levels,and wherein, when the processing program logic switches from operating at the current privilege level to a target privilege level, the exception coercion flag for the target privilege level is cleared.

19. A computer-readable storage medium to store the computer program of claim 18.

Images