Apparatus and method for handling events causing anomalies

Abstract

An apparatus and method for handling an event that causes an exception are provided. A first processing unit for executing a program code is provided, and a second processing unit is also provided. The first processing unit has a control interface, which is mapped to the memory address space of the second processing unit and is configured to provide the second processing unit with direct mapped access to the state information of the first processing unit. The first processing unit enters a pause mode in which the first processing unit stops executing the program code and issues a trigger event in response to at least one event that causes an exception. The second processing unit executes an exception handling routine in response to the trigger event, during which the second processing unit is arranged to access the state information of the first processing unit via the control interface so as to modify the state information as required by the exception handling routine.

Description

Technical Field

[0001] The present technology relates to an apparatus and method for handling an event causing an exception. Background Art

[0002] When executing software on a processing unit, an event that causes an exception may occur. At that time, the execution of an interrupt service routine may be called in order to handle the event that caused the exception. Often, the interrupt service routine may be executed at a higher level of software execution privilege and is part of a more trusted code than the code that was executed when the event that caused the exception occurred. In some example embodiments, the level of software execution privilege may be referred to as an exception level, so that when an event that causes an exception occurs during the execution of a particular piece of software, a transition to a higher exception level may occur so that the interrupt service routine can then be executed at the higher exception level.

[0003] In such systems, it is desirable to increase the level of security within the system in order to mitigate the risk of less trusted code gaining access to data associated with more trusted code. Summary of the invention

[0004] In an example configuration, a system is provided, the system comprising: a first processing unit, the first processing unit being used to execute program code; and a second processing unit; the first processing unit having a control interface, the control interface being mapped to the memory address space of the second processing unit and being configured to provide the second processing unit with direct mapped access to state information of the first processing unit; the first processing unit entering a pause mode in which the first processing unit stops executing the program code and issues a trigger event in response to at least one event causing an exception; the second processing unit executing an exception handling routine in response to the trigger event, during which the second processing unit is arranged to access the state information of the first processing unit via the control interface so as to modify the state information as required by the exception handling routine; and the second processing unit being arranged to cause the first processing unit to exit the pause mode and resume execution of the program code upon completion of the exception handling routine.

[0005] In another example configuration, a first processing unit is provided, the first processing unit comprising: an execution circuit, the execution circuit being used to execute program code; and a control interface, the control interface being mapped to the memory address space of a second processing unit and being configured to provide the second processing unit with direct mapped access to state information of the first processing unit; the first processing unit enters a pause mode in which the execution circuit stops executing the program code in response to at least one event causing an exception, and issues a trigger event; the control interface is arranged to be accessible to the second processing unit while the second processing unit is executing an exception handling routine in response to the trigger event, so that the second processing unit can access and modify the state information of the first processing unit as required by the exception handling routine; the first processing unit is arranged to exit the pause mode and resume execution of the program code when the second processing unit has completed the exception handling routine.

[0006] In yet another example configuration, a second processing unit is provided, the second processing unit comprising: an execution circuit for executing an exception handling routine in response to a trigger event issued by the first processing unit, the trigger event indicating that the first processing unit has entered a pause mode in which execution of program code by the first processing unit has been paused; and a communication interface, the second processing circuit being arranged to access a control interface of the first processing unit via the communication interface while executing the exception handling routine, the control interface being mapped to a memory address space of the second processing unit and being configured to provide the second processing unit with direct mapped access to state information of the first processing unit; the second processing unit being arranged to access the state information of the first processing unit via the control interface so as to modify the state information as required by the exception handling routine; and the second processing unit being arranged to cause the first processing unit to exit the pause mode and resume execution of the program code upon completion of the exception handling routine.

[0007] In yet another example configuration, a method for handling an event causing an exception in a system is provided, the system having a second processing unit and a first processing unit for executing program code, the method comprising: providing a control interface to the first processing unit, the control interface being mapped to a memory address space of the second processing unit and being configured to provide the second processing unit with direct mapped access to state information of the first processing unit; in response to at least one event causing an exception within the first processing unit, causing the first processing unit to enter a pause mode in which the first processing unit stops executing the program code, and issuing a trigger event; causing the second processing unit to execute an exception handling routine in response to the trigger event, during which the second processing unit accesses the state information of the first processing unit via the control interface so as to modify the state information as required by the exception handling routine; and causing the first processing unit to exit the pause mode and resume execution of the program code when the exception handling routine is completed by the second processing unit.

[0008] In another example configuration, a system is provided, the system comprising: a first processing means for executing program code; and a second processing means; the first processing device having a control interface means, the control interface means being mapped to the memory address space of the second processing means so as to provide the second processing means with direct mapped access to the state information of the first processing means; the first processing means being used to respond to at least one event causing an exception by entering a pause mode in which the first processing means stops executing the program code and by issuing a trigger event; the second processing means being used to execute an exception handling routine in response to the trigger event, during which the second processing means is arranged to access the state information of the first processing means via the control interface means so as to modify the state information as required by the exception handling routine; and the second processing means being used to cause the first processing means to exit the pause mode and resume execution of the program code when the exception handling routine is completed. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The present technology will be further described, by way of illustration only, with reference to examples of the present technology as shown in the accompanying drawings, in which:

[0010] Figure 1 is a block diagram illustrating components provided within a system according to one example implementation;

[0011] Figure 2 is a more detailed illustration of the Figure 1 A memory map providing a map of storage elements within a control interface;

[0012] Figure 3 is a flow chart illustrating exception handling according to one example implementation;

[0013] Figure 4A The figure shows the exception handling without using this technique. Figure 4B Figure 1 shows the exception handling when using this technique;

[0014] Figure 5A and Figure 5B illustrates an example implementation of a processing unit that may utilize the techniques described herein;

[0015] Figure 6 illustrates how the techniques described herein can be implemented according to one example arrangement to allow nesting of exception handling;

[0016] Figure 7 illustrates an alternative example configuration for using an interrupt distributor to distribute interrupts to one of many different control cores; and

[0017] Figure 8 An example arrangement is shown in which at least one level of cache may be shared between an application core and a control core. DETAILED DESCRIPTION

[0018] In one example configuration, a system may provide a second processing unit and a first processing unit for executing program code. The second processing unit may also execute program code, but the technology described herein is interested in how to use the second processing unit in the event that an event causing an exception occurs during execution of program code by the first processing unit.

[0019] The first processing unit is provided with a control interface that is mapped to the memory address space of the second processing unit, and the first processing unit is configured to provide the second processing unit with direct mapped access to state information of the first processing unit. Thus, via the control interface, the second processing unit is provided with direct mapped access to at least some state of the first processing unit.

[0020] The first processing unit is arranged so that it enters the pause mode and issues a triggering event in response to at least one event causing an exception, and the first processing unit stops executing the program code in the pause mode. The second processing unit is then arranged so that it executes the exception handling routine in response to such a triggering event, during which the second processing unit can access the state information of the first processing unit via a control interface, so as to modify the state information as required by the exception handling routine. Therefore, compared to the normal method that the first processing unit itself will execute the required exception handling routine, after first being converted to a higher level of software execution privilege if required, according to the technology described herein, the first processing unit does not execute the exception handling routine, and is instead executed by a separate processing unit. This therefore enables physical separation to be realized between the first processing unit that executes its program code and the separate processing units that are used to represent the first processing unit to execute the exception handling routine. This can significantly improve the security in the system.

[0021] Upon completion of the exception handling routine, the second processing unit may then be arranged to cause the first processing unit to exit the halt mode and resume execution of program code. As the second processing unit is able to access the required state information via the control interface of the first processing unit, it is able to efficiently manipulate the state of the first processing unit as required whilst executing the exception handling routine on behalf of the first processing unit, so that when the first processing unit exits the halt mode in due course, it is able to correctly resume execution of program code with the state having been updated as appropriate to handle the event that gave rise to the exception.

[0022] Therefore, by providing the first processing unit with a control interface that is mapped into the memory address space of the second processing unit, and allowing the second processing unit to directly map access to the relevant status information of the first processing unit, the execution of the exception handling routine required to handle the exception caused by the event that caused the exception can be offloaded from the first processing unit to a physically separate processing unit, thereby significantly mitigating the possibility that certain types of attacks can seek to gain access to trusted data from untrusted code.

[0023] The state information given to the second processing unit via the control interface of the first processing unit for direct mapping access can take various forms. In one example embodiment, such state information includes the contents of a register set of the first processing unit, which is used to store data processed by the first processing unit when executing program code. Thus, during execution of the execution processing routine on the second processing unit, the second processing unit can use the control interface of the first processing unit to read the contents of those registers in an efficient manner and update the contents of those registers as required.

[0024] There are multiple ways that the control interface can be arranged to provide the second processing unit with direct mapped access to the register set of the first processing unit mentioned above. In an example arrangement, the control interface provides a storage element group, which is mapped to the memory address space of the second processing unit to provide direct mapped access to the register set by the second processing unit. Therefore, each storage element in the register set can be addressed by the second processing unit and is directly mapped to the corresponding register in the register set of the first processing unit. As a result, whenever the second processing unit makes a read or write access to one of those storage elements, this is used to trigger the corresponding read or write access to the relevant register in the register set of the first processing unit.

[0025] In addition to or instead of accessing the register set of the first processing unit, the second processing unit may be given direct mapped access to at least a portion of the memory address space of the first processing unit, whereby at least a portion of the state information of the first processing unit provided to the second processing unit via the control interface may be part of the memory address space of the first processing unit.

[0026] In one example arrangement, such a portion of the memory address space of the first processing unit may be arranged to form a secondary address space of the second processing unit separate from the primary address space of the second processing unit. There are many mechanisms that can be provided to allow the second processing unit to access the secondary address space. For example, separate load / store instructions can be used for this purpose, or a flag bit can be added to the non-address portion of an address register used by the second processing unit when generating a memory address to influence whether it generates a memory access in the primary address space or the secondary address space.

[0027] However, providing a secondary address space as identified above is likely to require certain architectural changes to the system. In an alternative embodiment, such architectural changes can be avoided by mapping the relevant portion of the memory address space of the first processing unit into the primary address space of the second processing unit. For example, the control interface can provide a block of storage elements mapped to the memory address space of the second processing unit, each storage element in the block of storage elements being directly mapped to a corresponding memory location within at least a portion of the memory address space of the first processing unit. Therefore, in such a case, the relevant memory address space of the first processing unit can be accessed by the second processing unit in much the same manner as the register set of the first processing unit mentioned earlier can be accessed.

[0028] In order to allow configurability as to how a block of storage elements within a control interface is associated with individual memory locations of a portion of a memory address space of the first processing unit, the control interface may include a configurable mapping storage to identify a direct mapping between storage elements in the block of storage elements and corresponding memory locations within at least a portion of the memory address space of the first processing unit.

[0029] In one example implementation, any exception-causing event that occurs while the first processing unit is executing program code may be handled in the manner discussed above, i.e., the first processing unit is caused to enter a halt mode and issue a triggering event. However, in other implementations, this may be constrained to occur only for certain exception-causing events, although other exception-causing events may be handled in a conventional manner (i.e., within the first processing unit itself), possibly in association with transitioning the exception level of the first processing unit prior to executing the exception handling routine.

[0030] In one embodiment, the control interface may further include a configurable abnormal event identification storage to identify: when encountering abnormal events during execution of program code by the first processing unit, which abnormal events will cause the first processing unit to enter the pause mode and issue a trigger event. Therefore, the first processing unit can be controlled by the contents of the configurable abnormal event identification storage so that when an abnormal event is detected, it can determine whether it is appropriate to enter the pause mode and issue a trigger event.

[0031] Such an approach provides great flexibility in using the above techniques. As a specific example use case, the exception event identification storage can be configured to identify that the first processing unit will enter a pause mode and issue a trigger event whenever an exception-causing event occurs, and if the exception-causing event is to be processed by the first processing unit, the exception-causing event will require the first processing unit to transition to a specified exception level. Therefore, in the case where processing the exception-causing event within the first processing unit will not cause it to transition to the specified exception level, it can be determined that the required exception handling routine is to be allowed to be executed by the first processing unit itself, but in the case where it is necessary for the first processing unit to transition to the specified exception level (or alternatively to the specified exception level or a higher exception level), rather than taking this step, the first processing unit can be arranged to enter a pause mode and issue a trigger event, so that the required exception handling routine is executed by a physically separated second processing unit.

[0032] In an example embodiment, the first processing unit is arranged to remain at its current exception level when entering the pause mode, and the second processing unit is arranged to perform an exception handling routine at the selected exception level. Therefore, by using the above-mentioned technology, the event causing the exception is handled without changing the current exception level of the first processing unit. Alternatively, the first processing unit only enters the pause mode, thereby remaining at its current exception level, and when the first processing unit is instructed to exit the pause mode at an appropriate time, the first processing unit can then restart the execution of the program code at the current exception level. This avoids the need for the first processing unit to take steps that may be required in other cases if the first processing unit is converted to a different exception level in order to handle the exception handling routine. Such steps may, for example, involve saving the current execution state and return address, entering the required mode / exception level, possibly clearing certain data from a temporary storage such as a local cache, etc. Therefore, in addition to the security benefits that can be achieved by adopting the technology described herein, certain efficiency benefits can also be achieved in some embodiments.

[0033] The exception level selected for the second processing unit to execute the exception handling routine can take various forms. For example, it is possible that in some cases, the exception level selected for the second processing unit can be the same as the current exception level of the first processing unit. However, in a specific embodiment, the exception level selected is an exception level that is higher than the current exception level of the first processing unit.

[0034] In one embodiment, the trigger event may incorporate certain information to help the second processing unit identify why the first processing unit entered the pause mode. However, as an alternative to supplementing the trigger event itself, in one embodiment the control interface may include a syndrome memory that is mapped into the memory address space of the second processing unit and written by the first processing unit to provide information used by the second processing unit to help identify why the first processing unit entered the pause mode. Thus, when the second processing unit processes the trigger event, it is then able to perform a read access to the syndrome memory to obtain information that helps identify why the first processing unit entered the pause mode, thereby improving the efficiency of the process required to handle the event that caused the exception.

[0035] There need not be a one-to-one mapping between the first processing unit and the second processing unit. For example, the second processing unit can perform the above functionality on behalf of various different processing units that are executing program code. For example, in an example arrangement, the system can further include a third processing unit, the third processing unit having another control interface, the other control interface being mapped to the memory address space of the second processing unit and being configured to provide the second processing unit with direct mapping access to the state information of the third processing unit. The third processing unit can enter a pause mode and issue a triggering event in response to at least one event causing an exception, in which the third processing unit stops executing. The triggering event can include information that enables the second processing unit to determine whether the triggering event is issued by the first processing unit or the third processing unit, thereby determining which of the first processing unit and the third processing unit is to be accessed when executing an exception handling routine. Therefore, in this case, the second processing unit can perform the exception handling routine on behalf of both the first processing unit and the third processing unit, and can access the state information of any one of the required processing units as required via the relevant control interface mapped into its memory address space.

[0036] In an example implementation, it is possible to nest the handling of exceptions at multiple levels within the system. Therefore, although the second processing unit can handle exceptions on behalf of the first processing unit, the second processing unit itself can be arranged so that the event causing the exception that occurs when it is executing the code can be handled by the additional processing unit. Therefore, in an example arrangement, the system can further include an additional processing unit, wherein the second processing unit has a second control interface, which is mapped to the memory address space of the additional processing unit and is configured to provide the additional processing unit with direct mapping access to the state information of the second processing unit. The second processing unit can then enter a pause mode and issue another triggering event in response to at least one event causing an exception that occurs during the execution of the program code on the second processing unit, in which the second processing unit stops executing the program code running on the second processing unit. The additional processing unit then executes another exception handling routine in response to another triggering event, during which the additional processing unit is arranged to access the state information of the second processing unit via the second control interface, so as to modify the state information as required by another exception handling routine. The additional processing unit is then arranged to, upon completion of the further exception handling routine, cause the second processing unit to exit the halt mode and resume execution of program code running on the second processing unit.

[0037] By such method, it should be appreciated that any arbitrary level of nesting can be realized as required. Utilize such embodiment, each respective processing unit can be configured to make it only operate under the subset of available abnormal level in the system. In fact, in a kind of extreme case, all respective processing units can be arranged to be executed only at a single abnormal level, wherein any event causing abnormality will be handled by the current processing unit, rather than by the current processing unit processing that enters pause mode and issues a triggering event (wherein, this triggering event is then handled by another processing unit operating under this higher abnormal level), will not cause the transition to a higher abnormal level.

[0038] The various processing units within the system can take various forms. In one example arrangement, the first processing unit is an application processing unit and the program code is application code, and the second processing unit is a control processing unit. Thus, in one example arrangement, the first processing unit can be arranged so that it executes only application code, and can be configured so that it can only operate at the lowest software execution privilege level (e.g., at the lowest exception level). Any exception-causing event that would require execution of code at a higher exception level is not handled by the first processing unit, but is instead offloaded to another processing unit via the techniques described herein.

[0039] In one example arrangement, the first processing unit and the second processing unit may be provided by separate processor cores. In one such arrangement, the first processing unit and the second processing unit may have separate cache structures for at least a subset of cache levels within the system. This can further improve security benefits (e.g., with respect to recently disclosed speculation-based cache timing side channel attacks, where a number of techniques can be used to try to create scenarios where cache timing analysis may be abused to leak information from erroneous speculative execution of instructions) by ensuring that separate cache structures are used, at least at higher levels of cache (e.g., first level cache and second level cache), such attacks can be mitigated.

[0040] It is not required that the first processing unit and the second processing unit are separate processor cores. For example, in another embodiment, the first processing unit and the second processing unit can be provided by separate threads on a multi-threaded processor core. Each thread has its own architectural state, so the technology described herein can be applied with respect to such separate threads within a multi-threaded processor core.

[0041] As mentioned earlier, the techniques described herein can provide a great degree of flexibility in how to configure the system. For example, at least one of the first processing unit and the second processing unit can be constrained to operate only at a single exception level. In fact, as mentioned earlier, it is possible that each respective processing unit is constrained to operate only at a single exception level through appropriate nesting techniques.

[0042] The trigger event issued by the first processing unit can take various forms. For example, it may explicitly target a particular processing unit that will handle the trigger event, so in such cases the second processing unit is the target processing unit to which the trigger event is issued. However, in an alternative approach, the trigger event may be issued to some dispatch mechanism that determines which processing unit will handle the trigger event, in which case the second processing unit is a processing unit among several processing units that is capable of responding to the trigger event.

[0043] Specific examples will now be described with reference to the figures.

[0044] Figure 1 is a block diagram of a system according to an example embodiment. A first processing unit 10 is provided having a processing pipeline 25 for executing program code. During execution of instructions by the processing pipeline, the processing pipeline will access registers in a register file 30 in a standard manner to obtain source operands for the instructions and to store result operands produced by the execution of those instructions into the register file. Data can be loaded from memory into registers via load operations, and similarly data can be stored back to memory via the execution of store instructions. The memory system may include one or more levels of cache, such as Figure 1 Cache 35 is shown in FIG.

[0045] As will be well understood by those skilled in the art, during the execution of program code within a processing unit, situations may arise that cause an exception to be caught, such situations being referred to herein as events that cause an exception. Such events that cause an exception can take a wide variety of different forms, such as input / output (I / O) device requests, requests to call operating system services from user programs (often referred to as system calls), integer arithmetic overflows or underflows, page faults, etc.

[0046] It is also known that a processing unit can execute at many different levels of software execution privilege (referred to herein as different exception levels). When the event causing the exception causes the exception to be caught, this will generally require the execution of an interrupt service routine (also referred to herein as an exception handling routine) in order to cope with the exception. Often, although not in all cases, the processing unit may be required to transition to a different, higher privilege exception level before executing an interrupt service routine in order to handle the exception.

[0047] In order to ensure the security of data within the system, it is desirable to ensure that software executed at a specific exception level cannot access certain data associated with software executed at a higher exception level. There are known mechanisms that try to isolate the data used by the trusted code within the system so that it cannot be accessed by the less trusted code running at a lower exception level. However, the techniques used by attackers to try to obtain access to trusted data when executing untrusted code are becoming increasingly complex. As a specific example, a cache timing side channel attack based on speculation (often referred to as Spectre) has been developed, in which many techniques can be used so that it is then possible to abuse cache timing analysis to try to leak information from the erroneous speculation execution of instructions. Against this background, it is desirable to improve the security within the system when handling exceptions to ensure that trusted data manipulated at a higher exception level will not be unknowingly provided to the code executed at a lower less trusted exception level.

[0048] As will be discussed in more detail herein, the first processing unit 10 is arranged such that, for at least some types of events that may occur that give rise to an exception, the first processing unit does not handle the exception itself (e.g. by switching to a higher exception level and executing an appropriate interrupt service routine on the processing pipeline 25), but instead provides a mechanism to enable the servicing of the exception to be performed by a physically separate processing unit (in the example of FIG. 1 ). Figure 1 The second processing unit 20 is referred to as the second processing unit 20).

[0049] In particular, the first processing unit 10 has a memory mapped control interface 40 which is mapped to the memory address space of the second processing unit 20. In particular, a plurality of storage elements 45 are provided within the memory mapped control interface 40 which is mapped to a portion of the memory address space of the second processing unit, thereby allowing load and store instructions to be executed on the processing pipeline 50 to read from and write to those storage elements 45 by specifying corresponding addresses within the memory address range of the second processing unit.

[0050] Furthermore, those storage elements 45 are configured to provide direct mapping access to certain state information of the first processing unit. In particular, as will be described later with reference to Figure 2As discussed in more detail, certain of those storage elements may provide direct mapped access to registers within register bank 30, thereby enabling the second processing unit to read and update the contents of those registers while executing an interrupt service routine to handle an exception raised by first processing unit 10. Similarly, a portion of the memory address space of the first processing unit may be provided to the second processing unit via storage element 45, such that load or store operations performed by second processing unit 20 with respect to those storage elements will cause data to be read from or written to memory locations within the memory address space of first processing unit 10. Thus, via storage element 45, the second processing unit may be able to perform read and write operations on register bank 30, such as by Figure 1 , and similarly may be capable of performing read and write operations on at least a subset of the memory address space of the first processing unit, as indicated by a bidirectional line 85 interfaced with the cache 35 of the first processing unit 10.

[0051] The second processing unit may be arranged in a similar manner to the first processing unit and may therefore enable the processing pipeline 50 to be arranged to execute instructions, during which the processing pipeline may access the associated register set 55 and may also load data from memory into those registers via its local cache 60, or store data from registers back to memory via the local cache 60.

[0052] According to the technology described herein, for at least some types of abnormal events, the processing pipeline 25 is arranged to enter a pause mode of operation and issue a trigger event, in which it stops executing program code. In particular, the processing pipeline 25 can assert a pause mode signal through a path 65, so that a trigger event 70 is output from the first processing unit 10. The trigger event can be directed to a specific processing unit, or can be issued to an interrupt distribution entity, which applies any suitable criteria to determine which processing unit the trigger event is to be directed to. In the present case, it is assumed that the trigger event is ultimately propagated to the second processing unit 20.

[0053] Upon receiving the triggering event, the second processing unit interrupts the processing being executed within its processing pipeline 50 and determines, based on the information provided in the triggering event, an appropriate interrupt service routine to be executed to handle the exception raised by the first processing unit 10 .

[0054] When executing an interrupt service routine, the processing pipeline 50 may perform load and / or store operations via path 75, which is directed to a memory-addressable storage element 45 within the memory-mapped control interface 40. As discussed earlier, a read or write access to the storage element triggers a corresponding access to a direct-mapped state retention structure (e.g., a register in register file 30) within the first processing unit via path 80, or a corresponding access to a memory location within the memory address space of the first processing unit via path 85.

[0055] As a result, during processing of the interrupt service routine, the second processing unit 20 is able to access required state within the first processing unit and is able to modify that state as required by the interrupt service routine.

[0056] While this process is being executed under the control of the second processing unit, the first processing unit remains in a halt mode so that it does not execute any instructions within the processing pipeline 25. When the exception handling routine is completed by the second processing unit, a signal can be sent via path 90 to indicate that the exception handling process is complete, i.e., return from the exception. At this point, the first processing unit is free to resume executing program code, and accordingly, a halt mode exit signal is sent to the processing pipeline 25 via path 95 to resume program execution.

[0057] It should be noted that, by such a mechanism, the processing pipeline 25 need not transition from its current exception level, i.e., the exception level in which it was operating before the event causing the exception occurred. Instead, it can simply suspend execution while remaining at the current exception level, and when appropriate can resume execution of program code again while remaining at the current exception level.

[0058] By using the memory-mapped control interface 40, the processing of the exception handling routine can be offloaded to the physically separated processing unit 20 by providing a mechanism for the physically separated processing unit to access and modify the state information of the first physical unit as required so that it can effectively execute the exception handling routine. This provides significantly enhanced security within the system. For example, if the type of event causing the exception would normally require the first processing unit to enter a higher exception level before executing the exception handling routine, it is no longer required to perform the transition within the first processing unit. Alternatively, the exception handling routine can be executed by a separate processing unit, which itself can (or may not) transition to a higher exception level in order to execute the exception handling routine, and the physical separation between the software operating at different exception levels significantly enhances security in this case.

[0059] If desired, the second processing unit can also be given memory mapped access to other storage within the first processing unit, such as additional memory mapped control registers 110. For example, an embedded trace macrocell (ETM) 100 can be provided within the first processing unit to generate a trace stream indicative of processing activity of the processing pipeline 25, wherein the operation of the ETM is controlled by certain control information 120 stored within the control registers 110. Similarly, a performance management unit (PMU) 105 can be provided to generate certain performance metrics indicative of the operational performance of the first processing unit, and the performance management unit can also be configured based on the control information 115 within the control registers 110. If desired, the second processing unit 20 can be given memory mapped access to the control registers 110 to allow the second processing unit to program operations to be performed by the ETM 100 and the PMU 105.

[0060] In one embodiment, a memory mapped control interface 40 can be provided by enhancing the functionality provided within the debug interface of the first processing unit 110. In particular, the debug interface can provide a mechanism that enables execution of the processing pipeline to be suspended as and when required when debug operations are performed on the first processing unit. Such a mechanism can be supplemented to allow higher performance access from external devices (e.g., a second processing unit) rather than simply providing a standard external debug interface, and by providing direct mapped access to certain state information of the first processing unit, thereby providing an efficient mechanism for interrupt service routines executing on a separate processing unit 20 to access and update that state information during the handling of an exception.

[0061] Figure 2 is a diagram illustrating in greater detail storage elements 45 that may be provided within memory mapped control interface 40 in one example implementation.

[0062] As shown, a group of storage elements 150 may be provided to give the second processing unit direct mapped access to the registers 30 of the first processing unit. For example, each respective storage element within the group may be directly mapped to a register in the register group 30. When the processing pipeline 50 in the second processing unit 20 then performs a load or store operation specifying a memory address mapped to a particular storage element within the group 150, this can be used to directly access the registers within the register group. For example, when performing a load operation, the contents from the associated register 30 can be retrieved into a storage element within the group 150 to be provided back to the processing pipeline 50, and similarly when performing a store operation, data can be written to the addressed storage element within the group 150 to directly cause an update to be made to the corresponding register of the register group 30.

[0063] like Figure 2As further shown in , if desired, a storage element block 155 can be provided to provide direct mapped access to a portion of the memory address space of the first processing unit. For example, the storage element block 155 can be associated with a specific address range within the memory address space of the second processing unit to allow load and store operations to be performed by the second processing unit for those storage element blocks. Further, each storage element can be directly mapped to an associated memory location within the memory address space of the first processing unit, so that any access performed for such storage element is then directly performed for the associated memory location.

[0064] The manner in which storage elements in block 155 are mapped to specific memory locations within the memory address space of the first processing unit may be configurable, so that, for example, one or more mapping registers 160 may be provided to identify a mapping between storage elements in block 155 and corresponding memory locations in the memory address space of the first processing unit 10. The mapping register(s) may be written to in a variety of ways, such as by trusted code executing on the second processing unit 20, by suitable trusted code executing on the first processing unit 10, or by trusted code executing on another processing unit for establishing a relationship between the first processing unit and the second processing unit. By such an approach, state information maintained within the memory of the first processing unit 10 may be accessed and updated during execution of an interrupt service routine on the processing pipeline 50 of the second processing unit 20 in an efficient manner resulting from direct mapping access provided by the memory mapped control interface 40.

[0065] Although the storage element block 155 configured via the mapping register 160 provides a mechanism that can be used to give the second processing unit 20 a direct mapping access to a portion of the memory address space of the first processing unit, it should be appreciated that other mechanisms can also be used as needed. For example, the memory address space of the first processing unit 10 can be regarded as a secondary address space of the second processing unit separated from the primary address space of the second processing unit. Then the second processing unit can be provided with a mechanism that enables it to address its secondary address space so as to access the state information in the address space of the first processing unit 10 while executing the interrupt service routine on behalf of the first processing unit. There are many mechanisms that can be used for this purpose. For example, a set of separate load and store instructions can be provided by the instruction set architecture, which is used to access the secondary address space instead of the primary address space. Alternatively, a tag bit can be added to the non-address portion of the address register used by the second processing unit when generating a memory address to affect whether it is generated in the primary address space or the secondary address space. However, it should be appreciated that although such a mechanism can potentially enable the entire address space of the first processing unit to be copied as the secondary address space of the second processing unit, it may require certain architectural changes to be implemented. Therefore, in some embodiments, reference Figure 2 The above mechanism may be preferred. Although the amount of address space within the first processing unit that can be accessed by the second processing unit at any point in time (i.e., without changing the mapping in the mapping register 165) is dictated by the size of the storage element block 155, it does provide a mechanism that can be implemented without requiring any architectural changes to the system.

[0066] like Figure 2 As shown in addition, one or more abnormal event identification registers 165 can be provided, which can be programmed to identify which types of abnormal events will cause the first processing unit to enter the pause mode and issue a triggering event, rather than itself trying to deal with the exception (e.g., by triggering a change in the abnormal level and executing an interrupt service routine in the processing pipeline 25). This provides great configurability regarding when to use the pause mode. For example, at one end of the scale, any abnormal event can cause the processing pipeline to enter the pause mode, so that all exceptions are handled remotely by the second processing unit. However, as needed, it is possible to allow one or more different forms of abnormal events to be handled by the first processing unit without triggering the pause mode and unloading the exception handling to the second processing unit.

[0067] In one example arrangement, the exception event identification register 165 may be programmed to identify that whenever an exception-causing event occurs within the first processing unit (which, if handled by the first processing unit, would require the first processing unit to transition to a specified exception level), the occurrence of the exception-causing event will cause entry into a halt mode, and a trigger event 70 is issued to cause a physically separate processing unit, such as the second processing unit 20, to handle the exception. As a specific example, the first processing unit may be allowed to handle exception-causing events that can be handled while remaining in exception level 0, but for any exception-causing events that would require transitioning to exception level 1 or higher, this may cause the processing pipeline 25 to enter a halt mode, and offload the handling of the exception to the physically separate processing unit. As another example, the first processing unit may be allowed to handle exceptions that can be handled at exception level 0 or exception level 1, but for any other exception-causing events that would require transitioning to exception level 2 or higher, a halt mode will be entered.

[0068] The exception event identification register 165 can be programmed in various ways, such as by trusted code executed on the second processing unit 20, by trusted code executed on the first processing unit 10, or by trusted code executed on another processing unit for setting a relationship between the first processing unit and the second processing unit.

[0069] In one embodiment, the triggering event 70 itself may provide some information that will enable the second processing unit to determine why the first processing unit entered the suspend mode. However, in alternative embodiments, one or more syndrome registers 170 may be provided within the storage element 45 for this purpose. In particular, the first processing unit can then write to those syndrome registers before entering the suspend mode, so that when the second processing unit responds to the triggering event and thus executes an interrupt service routine, it can then access the syndrome registers in order to obtain this information.

[0070] Figure 3 is a diagram illustrating the process of processing an event causing an abnormality detected in the first processing unit 10. Figure 1 Flowchart of the operation of the system. At step 200, it is determined whether the first processing unit has detected that an exception needs to be caught. When this is detected, then at step 205, it is determined whether the event causing the exception requires the first processing unit to enter a pause mode. As discussed earlier, this may depend on the configuration of the exception event identification register 165. If the event causing the exception does not require the first processing unit to enter a pause mode, the process proceeds to step 210, where the first processing unit handles the exception in a standard manner. As discussed earlier, this may involve the first processing unit changing to a higher exception level.

[0071] If it is determined that the event causing the exception requires the first processing unit to enter a halt mode, then at step 215 the first processing unit remains at its current exception level, enters a halt mode, and asserts the triggering event.

[0072] The triggering event may be directed to a specific processing unit that will handle the exception, or alternatively may be routed via an interrupt redistributor mechanism that determines which processing unit the triggering event is to be directed to. Regardless of which mechanism is used, the triggering event is ultimately received by a suitable second processing unit, and at step 220, the second processing unit that responds to the triggering event captures the interrupt to suspend the processing currently being performed by the second processing unit, and then executes a suitable exception handling routine to handle the exception. The determination of the exception handling routine can be made in a standard manner, such as by reference to the type of exception that has been caused. Further, information such as an interrupt number issued as part of the triggering event will enable the second processing unit to determine the first processing unit that has issued the triggering event, and therefore determine which memory-mapped control interface 40 it will communicate with when executing the exception handling routine.

[0073] As indicated at step 220, in the course of executing the exception handling routine, the second processing unit 20 will access and update the state information of the first processing unit 10 via the storage element 45 of the memory mapped control interface 40 of the first processing unit 10. This may involve, for example, accessing and updating the contents of one or more registers within the register file 30, and accessing and updating one or more memory locations within the memory address space of the first processing unit.

[0074] The second processing unit will thereafter signal a return from the exception to the first processing unit via path 90 at step 225, causing the first processing unit to exit the halt mode and resume executing program code.

[0075] Figure 4A and Figure 4B The diagram illustrates the enhanced protection afforded to data when the above method is employed. In particular, Figure 4A The illustration shows an approach that would be taken without the present technique, i.e., where the first processing unit handles its own exceptions, e.g., by transitioning to a higher exception level and then executing the required exception handling routine at the higher exception level. Initially, it is assumed that application code is executing at the first processing unit (at the application exception level) at the application exception level. Figure 4A 0), and then at point 250, a trap is captured to an exception handling routine. In this example, it is assumed that when point 250 is reached, the processing unit transitions to a higher exception level, such as an exception level associated with operating system software, and then executes the exception handling routine under operating system control.

[0076] Both the application code executing prior to the trap point 250 and the operating system code used to implement the exception handling routine access the local cache 230 within CPU 0. During execution of the exception handling routine, different types of data may then be read from the cache 230 by the operating system software and written to the cache 230 by the operating system software. This may include the operating system's own data 255, 265, which can be considered data private to the operating system and not shared with the application code, but may also include user data 260, such as updated status information for the application exception level, which is the type of data that is provided to the application code once the exception handling routine has completed and the processing pipeline has returned to the application exception level to resume execution of the application code.

[0077] At step 270, it is assumed that the exception handling routine is complete, so the processor returns from the exception, resulting in a transition back to the application exception level (e.g., exception level (EL) 0), after which CPU0 resumes processing of the application code and accesses the cache 230. Although various mechanisms can be employed to try to protect the operating system's own data 255, 265 from being accessed by application code after returning from an exception handling routine, such as by purging the data from the cache or protecting it through the use of some other mechanism, there have been growing concerns recently about the security of such data and the prospect of side-channel attacks for accessing the data.

[0078] Figure 4B 275 , CPU 0 enters a halt mode and stops executing instructions. The issuance of the triggering event causes an interrupt to be sent to the second processing unit (at the 275th processor). Figure 4B 1) capture. At point 280, CPU 1 then begins executing the required exception handling routine, and again this may involve executing code at an operating system exception level (e.g., EL1). However, while the required exception routine is being run by CPU 1, the operating system's private data ("own data") 282, 286 can be read from the local cache 240 of CPU 1 and written to the local cache 240 of CPU 1. Conversely, user data 284 to be shared with application code is written to the local cache 230 of CPU 0 via the control interface 235 of CPU 0 using the mechanism discussed earlier, i.e., direct mapped access to the memory address space of CPU 0 provided via storage elements within the memory-mapped control interface 235.

[0079] When the exception handling routine completes in due course and the process returns from the exception at step 290, this will then cause CPU 0 to resume executing application code. However, due to the physical separation between CPU 0 and CPU 1, there is significantly enhanced security as no operating system sensitive data has been written to cache 230 of CPU 0.

[0080] In addition, security is often enhanced because when using Figure 4B When the mechanism is implemented, CPU 0 never transitions from an application exception level (e.g., exception level 0) and therefore has no access privileges associated with a higher exception level (as opposed to the case where CPU 0 would itself transition to a higher exception level in order to handle the exception).

[0081] When using reference Figure 4B Some performance benefits may also be achieved when the described techniques are used. For example, since data not associated with exception level 0 is not stored in cache 230 of CPU 0 during the handling of the exception, no steps are required to maintain the safety of exception level 1 data when the exception handling routine is completed. For example, when the exception handling routine is completed at point 290, no data needs to be cleared from cache 230 of CPU 0.

[0082] It should be noted that the techniques described herein can be extended to allow the second processing unit to assume more of a control role in the operation of the first processing unit. For example, the second processing unit 20 can be considered to take the form of a control core that is capable of pausing the first processing unit (which, for example, might be considered an application core) and can switch contexts at any time, such as to time-share an application core between multiple user processes. Thus, in addition to the control core providing system services to the application core, such an approach enables the application core to equally effectively provide computing services to the control core by handling exceptions for one or more types of events that cause exceptions. A single control core can manage multiple application cores in such a scenario.

[0083] A processing unit capable of employing the above techniques can take various forms. Figure 5A As shown in , each processing unit may be a separate processor core. Thus, a plurality of first processing units 300, 310 can be provided, each having an associated control interface 305, 315, which is memory mapped to a second processing unit (in Figure 5A In the memory address space of the control core 320).

[0084] When the event causing the exception occurs in any of the cores 300, 310 and is of a type that causes the core to enter a halt mode and issue a triggering event, the triggering event can be routed to the control core 320. Based on the exception number, the control core can determine which core issued the triggering event and can then execute the appropriate exception handling routine to handle the exception, taking into account the type of exception that has occurred. Using the techniques described earlier, the control core can access and update the required state of the core 300, 310 that issued the triggering event via the relevant control interface 305, 315.

[0085] However, the processing unit need not be Figure 5A Alternatively, the separate processing units may be separate threads within a multi-threaded core, such as Figure 5B . Thus, the multithreaded core 330 may include multiple threads 335, 345, each of which may have an associated control interface 340, 350. Although the different threads may share some of the processing resources of the multithreaded core 330, the threads effectively form separate processing elements and may have their own registers, address spaces, operate in their own specific exception levels, etc. Thus, the separate threads can operate in the same manner as the first processing unit discussed earlier, and can issue trigger events to the second processing unit to cause the second processing unit to handle exceptions on their behalf. Thus, the control core 360 ​​can operate in the same manner as the earlier referenced Figure 5A The exception is handled in the exact same manner as discussed in the example of , where the exception number information is used to identify the specific thread within the multithreaded core that has issued the triggering event.

[0086] Although in Figure 5B The control core 360 ​​is shown as a separate processor core in FIG. 3 , but it should be noted that the control core 360 ​​itself may be one of the threads within the multi-threaded core 330 in other embodiments.

[0087] Figure 6How the technology described in this article can be used to support nested processing of exceptions is illustrated. Therefore, in this example, the first processing unit takes the form of an application core 370 with a related control interface 375, and the control interface 375 is mapped to the memory address space of the second processing unit (exemplified as control core 1 380 in this example). However, it is also possible that during the processing performed by control core 1 380, an event causing an exception will be detected in control core 1, thereby requiring the exception to be captured and a suitable exception handling routine to be executed. Although in such cases, an exception handling routine can be implemented in control core 1 380 itself, such as by transitioning to a higher exception level and executing a suitable exception handling routine, in an alternative example, control core 1 380 can also have a control interface 385 that is memory-mapped to the memory address space of control core 2 390. In this way, control core 1 is able to enter a pause mode for certain events that cause exceptions, and issue a trigger event to enable control core 2 390 to execute an appropriate exception handling routine, and during this process, control core 2 390 can access and update the required state within control core 1 380 via control interface 385.

[0088] It should be appreciated that it is possible to arbitrarily extend Figure 6 The scheme illustrated in the figure can provide more nesting levels as needed. Such a mechanism provides significant flexibility. For example, it will be appreciated that in one example each respective core can be arranged to operate only at a single exception level, with all events causing exceptions being routed to the respective core for processing. In some cases, this may mean that the concept of exception levels can be completely abolished.

[0089] As discussed earlier Figure 5B Same, although in Figure 6 It is assumed in FIG. 3 that elements 370 , 380 , 390 are separate processor cores, but in alternative embodiments those elements could be provided by separate threads within a multi-threaded core.

[0090] Figure 7 An embodiment of providing an interrupt distributor 420 within a system is illustrated. In this example, there are multiple control cores 410, 415, each of which can be provided with memory mapped access to one or more application cores 400, 440. The application cores have associated control interfaces 405, 445 arranged as discussed earlier to provide direct mapped access to certain state information within those application cores by the control core executing interrupt service routines on behalf of the application cores.

[0091] In such an embodiment, when the application core 400 issues a trigger event, this can take the form of an interrupt request that is passed to the interrupt distributor 420. Thus, when the application core 400 asserts a trigger event, it can issue an interrupt request to the interrupt distributor 420 via path 425. The interrupt distributor will then employ a mechanism to determine which control core to route the interrupt request to, and will send the interrupt request to either control core 1 410 via path 430 or to control core 2 415 via path 435. It should be appreciated that in Figure 7 Only two control cores have been shown for simplicity in FIG. 4 , but in other embodiments, more control cores may be provided and thus more options may be available to the interrupt distributor 420 regarding the destination control core to which the interrupt request is propagated.

[0092] Assuming the interrupt request is accepted by the control core to which it is directed, processing then proceeds substantially as discussed earlier, with the control core executing an appropriate exception handling routine, during which load and / or store operations can be performed on storage elements within the memory mapped control interface 405 in order to access and update state information within the application core 400. Once the exception handling routine has completed, the application core 400 is notified of a return from the exception, and then exits the suspended mode in order to resume execution of the application code.

[0093] Although in Figure 7 References to application cores and control cores have been made in the previous section, but Figure 6 It should be appreciated that the core issuing the interrupt request need not be the application core, and that it may itself execute software at a higher exception level than the application code.

[0094] It should also be appreciated from the earlier discussion that Figure 7 The various cores illustrated in FIG. 1 are not necessarily physically separate processor cores, but instead may be separate threads executing on a multi-threaded core.

[0095] Although in one embodiment, the cache structures accessed by the application core and the control core may be separate, in some cases one or more cache levels may be shared, such as in Figure 84. In this example, application core 470 has a local level 1 cache 475, while control core 480 also has an associated level 1 cache 485. However, if desired, application core 470 and control core 480 may share a level 2 cache 490. While in some embodiments, in order to provide enhanced robustness against cache timing side channel attacks (such as the Spectre-based attacks mentioned earlier), sharing the level 2 cache structure may be considered inappropriate, and in such cases the application core and control core may have different level 2 cache structures as well as different level 1 cache structures, in other embodiments, Figure 8 The approach illustrated in may be perfectly acceptable. In particular, with such an approach it will still be possible to obtain many of the benefits of allowing exceptions to be handled by separate cores using the halt mode discussed above, such as the physical separation of the exception levels and the possibility for certain cores to be arranged to support only a subset of the possible exception levels, in some cases being able to operate at only a single exception level. By allowing at least some cache structures to be shared, this increases the area of ​​applicability of the presently described technique, for example making it easier to apply it with respect to individual threads within a multithreaded core.

[0096] When using the techniques described herein, many benefits can be achieved while improving overall security through physical separation of exception levels. First, it is noted that the application software running on the application core does not need to be changed. Further, the control core does not have to run at a higher exception level, and can even run at exception level 0, as long as it is given memory mapped access to the application core in the manner discussed earlier. As discussed earlier in addition, the exception of the control core itself can be captured and processed by another core, thereby allowing arbitrary nesting of exception handling.

[0097] Further, assuming that an application core can rely on delegating its exceptions to a control core, the application core may implement only a subset of the exception levels, such as only EL0 (thus implementing a pure data plane core), which can lead to significant simplification of the design.

[0098] In one particular embodiment, all application cores and control cores can be arranged so that they only need to implement a single exception level, which can potentially allow exception levels to be discarded entirely.

[0099] As mentioned earlier, in one example embodiment, the memory mapped control interface 40 provided within the first processing unit 10 can be formed by enhancing the capabilities of an existing debug interface to allow fast memory mapped access by the control core and to provide direct mapped access to the relevant register states and / or memory address space. It should be noted that the improved memory mapped interface will also support existing debug use cases with improved efficiency, allowing an external debugger to access the core's registers and its memory view faster, which can provide additional benefits in addition to the benefits associated with exception handling.

[0100] As mentioned earlier, while physically separate processor cores can be used in one embodiment, in an alternative embodiment, the individual processing units can take the form of individual threads within a multithreaded core. Thus, an event that causes an exception occurring within a first thread can cause the thread to enter a pause mode, and the exception to be offloaded to another thread for processing, while the other thread can memory map access to the state of the first thread. The above nested approach can be employed in one such example embodiment, where each thread corresponds to a specific exception level, so that exceptions that need to be handled at a specific exception level can be directed to a specific thread that can operate at that exception level.

[0101] As mentioned earlier, in some embodiments the storage elements within the memory mapped control interface 40 can be configured to allow a great degree of configurability with respect to the type of event causing the exception that will cause the first processing unit to enter a halt mode and issue a triggering event to cause the exception handling routine to be executed by a different processing unit. In some cases, the first processing unit may be arranged so that it always responds to an exception in that manner, regardless of the event causing the exception. In that case, reference is made to the earlier discussed Figure 3 , it will be seen that step 205 is effectively removed, so there will never be a path to step 210 where the first processing unit handles the exception. Instead, the process will proceed directly to step 215, where the processing unit will remain at its current exception level, enter a halt mode and assert the triggering event. This can result in a significant simplification of the complexity of the first processing unit.

[0102] In this application, the phrase "configured to..." is used to mean that elements of a device have a configuration that enables the performance of a defined operation. In this context, "configuration" means the arrangement or manner of interconnection of hardware or software. For example, a device may have dedicated hardware that provides the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured to" does not imply that the device elements need to be changed in any way in order to provide the defined operation.

[0103] Although illustrative examples of the present invention have been described in detail herein with reference to the accompanying drawings, it will be appreciated that the present invention is not limited to those precise embodiments and that various changes, additions and modifications will be possible therein by those skilled in the art without departing from the scope and spirit of the present invention as defined in the appended claims. For example, various combinations of the features of the independent claims may be made with the features of the dependent claims without departing from the scope of the present invention.

Claims

1. A system for data processing, the system comprising: a first processing unit, the first processing unit being configured to execute program code; and a second processing unit; The first processing unit has a control interface mapped to a memory address space of the second processing unit and configured to provide the second processing unit with direct mapped access to state information of the first processing unit; The first processing unit enters a pause mode and issues a trigger event in response to at least one event causing an exception, wherein the first processing unit stops executing the program code in the pause mode; the second processing unit executing an exception handling routine in response to the triggering event, during which the second processing unit is arranged to access the state information of the first processing unit via the control interface so as to modify the state information as required by the exception handling routine; the second processing unit being arranged to cause the first processing unit to exit the halt mode and resume execution of the program code upon completion of the exception handling routine; Wherein, the first processing unit is arranged to remain at its current exception level when entering the halt mode, and the second processing unit is arranged to execute the exception handling routine at the selected exception level.

2. The system according to claim 1, wherein: The state information of the first processing unit includes content of a register group of the first processing unit, and the register group of the first processing unit is used to store data processed by the first processing unit when executing the program code.

3. The system according to claim 2, wherein: The control interface provides a group of storage elements that are mapped into the memory address space of the second processing unit to provide direct mapped access to the group of registers by the second processing unit.

4. A system according to any one of the preceding claims, wherein: The state information of the first processing unit includes data stored in at least a portion of a memory address space of the first processing unit.

5. The system according to claim 4, wherein: The at least a portion of the memory address space of the first processing unit forms a secondary address space of the second processing unit.

6. The system according to claim 4, wherein: The control interface provides a block of storage elements mapped to the memory address space of the second processing unit, each storage element in the block being directly mapped to a corresponding memory location within the at least a portion of the memory address space of the first processing unit.

7. The system according to claim 6, wherein: The control interface includes a mapping store configurable to identify a direct mapping between the storage elements in the block of storage elements and the corresponding memory locations within the at least a portion of the memory address space of the first processing unit.

8. The system according to any one of claims 1 to 3, wherein: The control interface includes a configurable exception event identification storage, which is used to identify: when encountering exception-causing events during execution of the program code by the first processing unit, which exception-causing events will cause the first processing unit to enter the pause mode and issue the trigger event.

9. The system according to any one of claims 1 to 3, wherein: The abnormal event identification storage is configured to identify that the first processing unit will enter the pause mode and issue the trigger event whenever the following abnormal event occurs: the abnormal event if processed by the first processing unit will require the first processing unit to transition to a specified abnormal level.

10. The system according to any one of claims 1 to 3, wherein: The selected exception level is an exception level higher than a current exception level of the first processing unit.

11. The system according to any one of claims 1 to 3, wherein: The control interface includes a syndrome store that is mapped into the memory address space of the second processing unit and is written to by the first processing unit to provide information used by the second processing unit to help identify why the first processing unit entered the suspend mode.

12. The system according to any one of claims 1 to 3, further comprising: a third processing unit having a further control interface mapped to the memory address space of the second processing unit and configured to provide the second processing unit with directly mapped access to state information of the third processing unit; The third processing unit enters the pause mode and issues the trigger event in response to at least one event causing an exception, wherein the third processing unit stops executing in the pause mode; The trigger event includes the following information: the information enables the second processing unit to determine whether the trigger event is issued by the first processing unit or the third processing unit, thereby determining which of the first processing unit and the third processing unit to access when executing the exception handling routine.

13. The system according to any one of claims 1 to 3, further comprising: Additional processing units; The second processing unit has a second control interface mapped to a memory address space of the additional processing unit and configured to provide the additional processing unit with direct mapped access to state information of the second processing unit; the second processing unit enters the halt mode in response to at least one exception-causing event and issues a further triggering event, wherein the second processing unit stops executing program code running on the second processing unit; the additional processing unit executing a further exception handling routine in response to the further triggering event, during which the additional processing unit is arranged to access the state information of the second processing unit via the second control interface in order to modify the state information as required by the further exception handling routine; The additional processing unit is arranged to, upon completion of the further exception handling routine, cause the second processing unit to exit the halt mode and resume execution of the program code running on the second processing unit.

14. The system according to any one of claims 1 to 3, wherein: The first processing unit is an application processing unit and the program code is an application program code, and the second processing unit is a control processing unit.

15. The system according to any one of claims 1 to 3, wherein: The first processing unit and the second processing unit are provided by separate processor cores.

16. The system according to any one of claims 1 to 3, wherein: The first processing unit and the second processing unit have respective cache structures for a subset of cache levels within the system.

17. The system according to any one of claims 1 to 3, wherein: The first processing unit and the second processing unit are provided by respective threads on a multi-threaded processor core.

18. The system according to any one of claims 1 to 3, wherein: At least one of the first processing unit and the second processing unit is constrained to operate only at a single exception level.

19. The system according to any one of claims 1 to 3, wherein: The second processing unit is one of: a target processing unit, the trigger event being sent to the target processing unit; A processing unit among the plurality of processing units that is capable of responding to the triggering event.

20. A first processing device, comprising: An execution circuit, wherein the execution circuit is used to execute the program code; as well as a control interface mapped to a memory address space of a second processing device and configured to provide the second processing device with directly mapped access to state information of the first processing device; The first processing device enters a halt mode and issues a trigger event in response to at least one event causing an exception, wherein the execution circuit stops executing the program code in the halt mode; the control interface being arranged to be accessible by the second processing device while the second processing device is executing an exception handling routine in response to the triggering event, so as to enable the second processing device to access and modify the state information of the first processing device as required by the exception handling routine; The first processing means is arranged to: exit the pause mode and resume execution of the program code when the second processing means has completed the exception handling routine; Therein, the first processing means is arranged to remain at its current exception level when entering the pause mode.

21. A second processing device, the second processing device comprising: execution circuitry for executing an exception handling routine in response to a trigger event issued by a first processing device, the trigger event indicating that the first processing device has entered a halt mode in which execution of program code by the first processing device has been halted; as well as a communications interface, the second processing device being arranged to access via the communications interface a control interface of the first processing device while executing the exception handling routine, the control interface being mapped to a memory address space of the second processing device and configured to provide the second processing device with directly mapped access to state information of the first processing device; the second processing device being arranged to access the state information of the first processing device via the control interface in order to modify the state information as required by the exception handling routine; and the second processing means being arranged to cause the first processing means to exit the halt mode and resume execution of the program code upon completion of the exception handling routine; Wherein, when the first processing means remains at its current exception level when entering the suspend mode, the second processing means is arranged to execute the exception handling routine at the selected exception level.

22. A method for processing an event causing an exception in a system having a second processing unit and a first processing unit for executing program code, the method comprising: providing a control interface to the first processing unit, the control interface being mapped to a memory address space of the second processing unit and being configured to provide the second processing unit with direct mapped access to state information of the first processing unit; In response to at least one event causing an exception in the first processing unit, causing the first processing unit to enter a pause mode and issue a trigger event, wherein the first processing unit stops executing the program code in the pause mode; causing the second processing unit to execute an exception handling routine in response to the triggering event, during which the second processing unit accesses state information of the first processing unit via the control interface so as to modify the state information as required by the exception handling routine; as well as When the exception handling routine is completed by the second processing unit, causing the first processing unit to exit the pause mode and resume execution of the program code; Wherein, the first processing unit is arranged to remain at its current exception level when entering the halt mode, and the second processing unit is arranged to execute the exception handling routine at the selected exception level.

Images