Apparatus and method for controlling access to a set of memory mapped control registers

Abstract

A technique for controlling access to a set of memory-mapped control registers is described. An apparatus has processing circuitry for executing program code to perform data processing operations and a set of memory-mapped control registers for storing control information for controlling operation of the processing circuitry when executing the program code. In addition, a lock register is for storing a lock value. The processing circuitry is arranged to execute store instructions for performing write operations to a memory address space, the store instructions being of a plurality of types. However, on setting the lock value, the processing circuitry is arranged to prevent the write operations from being performed unless a write operation to change the control information in the memory-mapped control registers occurs as a result of executing a store instruction from a first subset of the plurality of types of store instruction. This significantly reduces the likelihood of an attacker seeking to exploit a software vulnerability to change the control information in the memory-mapped control registers.

Description

BACKGROUND

[0001] The present technology relates to an apparatus and a method for controlling access to a set of memory mapped control registers.

[0002] Data processing apparatuses can have processing circuitry for executing program code and can provide control registers to store control information for controlling the operation of the processing circuitry when executing program code. While such control registers can traditionally be set up as hardware registers that are directly accessible by the processing circuitry, it has become more and more common to set one or more of those control registers as memory mapped registers. Thus, a certain region of the memory address space is allocated for those control registers, and those memory mapped control registers can then be accessed by executing a memory access instruction for accessing memory, by arranging the memory access instruction to specify an address that corresponds to a control register of the relevant memory mapping. By using memory mapped control registers, this can reduce the internal logic within the data processing apparatus, thereby contributing to a smaller, cheaper and more energy efficient data processing apparatus. It can also mean that it is easier to program the apparatus, as the control registers can be accessed from a high level language such as C, without having to use special instructions in assembly language.

[0003] Access to various memory mapped control registers can be controlled using known memory access control mechanisms, which are used to control which regions of memory are accessible to which items of software executing on the data processing apparatus. However, if there is any bug in the software that is executing on the system, this can enable an attacker to modify the contents of certain memory mapped control registers and thereby compromise the system. For example, while a particular memory mapped control register only allows updates by software executing at a particular level of trust, in the event of a bug in the trusted software, an attacker running untrusted software can access a memory write gadget within the trusted software, and thereby update the contents of one or more memory mapped control registers that untrusted software should not have access to. This operation can severely compromise the system. For example, one or more memory mapped control registers can provide control information for enforcing memory protection boundaries between different items of software running on the system, and if an attacker is able to alter this control information, this can significantly compromise the security of the system by allowing the attacker to gain access to private data of other software executing on the system.

[0004] Accordingly, it is desirable to reduce the likelihood that an attacker is able to perform such an attack, while still allowing the contents of the control registers to be updated by trusted software. SUMMARY

[0005] In one example arrangement, there is provided an apparatus comprising: processing circuitry to execute program code to perform data processing operations; a set of memory mapped control registers to store control information for controlling operation of the processing circuitry when executing the program code; and a lock register to store a lock value; wherein: the processing circuitry is arranged to execute store instructions to perform write operations to a memory address space, the store instructions being of a plurality of types; and on setting the lock value, the processing circuitry is arranged to prevent execution of the write operations unless a write operation to change the control information in the memory mapped control registers occurs as a result of execution of a store instruction from a first subset of the plurality of types of store instruction.

[0006] In another example arrangement, there is provided a method of controlling access to a set of memory mapped control registers within an apparatus, the method comprising: executing program code on processing circuitry to perform data processing operations; storing control information within the set of memory mapped control registers for controlling operation of the processing circuitry when executing the program code; storing a lock value within a lock register; executing store instructions on the processing circuitry to perform write operations to a memory address space, the store instructions being of a plurality of types; and on setting the lock value, preventing execution of the write operations unless a write operation to change the control information in the memory mapped control registers occurs as a result of the processing circuitry executing a store instruction from a first subset of the plurality of types of store instruction.

[0007] In another example arrangement, there is provided a computer program for controlling a host data processing apparatus to provide an instruction execution environment, the computer program comprising: processing program logic to execute program code to perform data processing operations; and control program logic to maintain a set of memory mapped control data structures to store control information for controlling operation of the processing program logic when executing the program code, and to maintain a lock data structure to store a lock value; wherein: the processing program logic is arranged to execute store instructions to perform write operations to a memory address space, the store instructions being of a plurality of types; and on setting the lock value, the processing program logic is arranged to prevent execution of the write operations unless a write operation to change the control information in the memory mapped control data structures occurs as a result of execution of a store instruction from a first subset of the plurality of types of store instruction. A computer readable medium can be provided to store such a computer program, and can be in non-transient or transient form. BRIEF DESCRIPTION OF DRAWINGS

[0008] The technology will be further described, by way of example only, with reference to examples of the technology as illustrated in the accompanying drawings, in which:

[0009] Figure 1 An example of a data processing system according to one example arrangement is schematically illustrated;

[0010] Figure 2 It is schematically illustrated how a portion of the memory address space can be reserved for control registers that are memory mapped according to one example arrangement;

[0011] Figure 3A An example of different domains and modes of operation of the processing circuitry of Figure 1 is schematically illustrated;

[0012] Figure 3B It is illustrated how control information stored in memory mapped control registers can be used to enforce access boundaries between items of software running on the processing circuitry of Figure 1 according to one example arrangement;

[0013] Figure 4 is a flowchart illustrating steps performed when executing a store instruction according to one example arrangement;

[0014] Figure 5 is a flowchart illustrating steps that can be performed in order to update a lock value within a lock register of Figure 1 according to one example arrangement, in case the lock register is set to one of the memory mapped control registers;

[0015] Figure 6 It is illustrated how a batched access to memory mapped control registers can be performed according to one example arrangement;

[0016] Figure 7 It is illustrated how lock registers can be stored in different secure domains according to one example arrangement;

[0017] Figure 8A It is illustrated how a lock value can be handled during an exception according to one example arrangement;

[0018] Figure 8B is a flowchart illustrating a lock value management process performed in one example implementation when an exception occurs; and

[0019] Figure 9 An example of a simulator that can be used is illustrated. DETAILED DESCRIPTION

[0020] According to one example implementation, an apparatus is provided with processing circuitry to execute program code in order to perform data processing operations, and a set of memory-mapped control registers to store control information to control operation of the processing circuitry when executing program code. As previously described, it is desirable to allow the contents of such memory-mapped control registers to be updated using memory access instructions, but to reduce the possibility of an attacker being able to exploit a bug in software executing on the apparatus to attack by using a memory write gadget in trusted software to alter the contents of one or more of the memory-mapped control registers, which as previously described can compromise the security of the system.

[0021] In order to mitigate the risk of such an attack, the apparatus can be provided with a lock register to store a lock value. The processing circuitry is arranged to execute store instructions to perform write operations to a memory address space, where those store instructions are of a plurality of types. When the lock value is set, the processing circuitry is arranged to prevent a write operation from occurring that alters control information in the memory-mapped control registers, unless the write operation is due to the execution of a store instruction from a first subset of the plurality of types of store instructions. Thus, when the lock value is set, only store instructions within the first subset can be used to alter control information in the memory-mapped control registers. This significantly reduces the possibility of an attacker being able to use a memory write gadget that can be used to alter control information in the memory-mapped control registers, since any memory write gadget that uses a store instruction that is not in the first subset cannot be used to achieve the goal when the lock value is set.

[0022] It will be appreciated that the actual value used to indicate the set state of the lock value can vary depending on the implementation. In one particular example implementation, the lock value is set when the lock value has a value of one, and is cleared when the lock value has a value of zero, although it will be appreciated that the lock value could alternatively be set when the lock value has a value of zero, and can be considered to be cleared when the lock value has a value of one.

[0023] Whilst the use of a set of the lock value can significantly reduce the possibility of an attacker seeking to exploit a software bug in trusted code to update the memory-mapped control registers, backwards compatibility can be provided by allowing the lock value to be cleared. In particular, when the lock value is cleared, the processing circuitry can be allowed to perform write operations that alter control information in the memory-mapped control registers using a second subset of the plurality of types of store instructions in addition to the first subset, where the second subset does not overlap with the first subset.

[0024] In one example implementation, the first subset and the second subset can collectively identify all different types of store instructions that can be used. However, in example implementations, there can be one or more types of store instructions that are not in the first subset or the second subset, and thus cannot be used to update control information in the memory mapped control registers regardless of whether the lock value is set or cleared.

[0025] When the lock value is set, the processing circuitry will prevent any attempt to write to the memory mapped control registers using store instructions within the second subset of the plurality of types of store instructions. In some implementations, the processing circuitry can be additionally arranged to raise a fault exception when a store instruction from the second subset attempts to perform a write operation to the set of memory mapped control registers.

[0026] Similar techniques can also be used in connection with load instructions for reading the contents of the memory mapped control registers. Thus, for example, when the lock value is set, the processing circuitry can be further arranged to allow a read to occur as a result of executing a load instruction from the first subset of the plurality of types of load instructions, and to prevent a read from occurring as a result of executing a load instruction from the second subset of the plurality of types of load instructions, the second subset not overlapping the first subset.

[0027] As with the store instruction handling described previously, when the lock value is set, the processing circuitry can also be arranged to raise a fault exception when a load instruction from the second subset attempts to perform a read operation to the set of memory mapped control registers.

[0028] The first subset of the plurality of types of store instructions can take various forms, but in one example implementation, the first subset of the plurality of types of store instructions includes control register specific store instructions. The processing circuitry is then arranged to ignore the lock value when determining whether to allow an associated write operation to be performed to the memory mapped control registers when executing the control register specific store instructions. In some cases, it can always be allowed to execute control register specific store instructions to update the memory mapped control registers, but in some implementations, one or more other access checks can be required before allowing the write operation to proceed. For example, certain memory mapped control registers can only be accessible by software executing at a particular privilege level or in a particular security domain, and thus it can be checked whether the software including the control register specific store instruction being executed is allowed to access the particular memory mapped control register that the control register specific store instruction is directed to before allowing the write operation to proceed.

[0029] In one example implementation, upon execution of the control register dedicated store instruction, the processing circuitry is arranged to raise a fault exception when the memory address identified by the control register dedicated store instruction lies outside the range of memory addresses associated with the set of memory mapped control registers. This can be useful because it can be desirable to discourage software developers from using the control register dedicated store instruction to access other regions of the memory address space that are not associated with the memory mapped control registers, because this can increase the likelihood that an attacker will find a suitable memory write gadget that can be exploited. Instead, by ensuring that the control register dedicated store instruction is used judiciously (and in particular only when attempting to access a memory mapped control register), this can significantly reduce the chances that a write vulnerability exists that can be exploited by an attacker. In particular, the likelihood that a memory write gadget that can be exploited by an attacker will include one or more instances of the control register dedicated store instruction is less.

[0030] There can be a number of ways in which the memory address is identified by the control register dedicated store instruction. In one example implementation, the memory address is identified depending on a value stored in a register specified by the control register dedicated store instruction and an immediate value specified by the control register dedicated store instruction.

[0031] Accordingly, in such implementations, the control register dedicated store instruction does not directly identify the address of the memory mapped control register to be accessed, but rather execution of the control register dedicated store instruction causes the address of the required memory mapped control register to be calculated based on the contents of a register (typically a general purpose register) specified in the instruction and an immediate value specified in the instruction. For example, the general purpose register can store a value to be used as a base address, and the immediate value can be added to this base address to identify the address of the memory mapped control register to be accessed.

[0032] In one particular example implementation, once the address has been calculated, execution of the control register dedicated store instruction can also cause the calculated address to be written back to the identified general purpose register. This can enable multiple iterations of a loop containing the control register dedicated store instruction to be executed without the need for a separate instruction to alter the base address value used by the instruction, for example.

[0033] In further example implementations, there can be multiple variants of the register dedicated store instruction that are capable of performing store operations of different sizes. For example, there can be a variant of the register dedicated store instruction that stores a 32-bit value to a register, a variant that stores a 16-bit value to a register, and a further variant that stores an 8-bit value to a register. These variants can be useful when only a portion of a larger register needs to be updated.

[0034] In addition to the control register specific store instructions mentioned previously, control register specific load instructions can also be provided. Thus, when the processing circuitry is executing a control register specific load instruction, the lock value can be ignored in determining whether to allow the associated read operation to be performed on the memory mapped control register. As before, one or more access checks can still be required before the read is allowed to proceed. Furthermore, in a similar manner to the handling of control register specific store instructions, when a control register specific load instruction is executed, the processing circuitry can be arranged to raise a fault exception if the memory address identified by the control register specific load instruction lies outside the range of memory addresses associated with the set of memory mapped control registers. In a similar manner to the register specific store instructions, the register specific load instruction can not directly identify the address of the memory mapped control register to be accessed, but rather execution of the control register specific load instruction can cause the address of the required memory mapped control register to be calculated based on the contents of a register (typically a general purpose register) specified in the instruction and an immediate value specified in the instruction. Similarly, there can be variants of the register specific load instruction which perform load operations of different sizes.

[0035] In one example implementation, the lock register can be a hardware register which is directly accessible by the processing circuitry. However, in alternative implementations, the lock register can be provided within the set of memory mapped control registers. This can simplify the handling of access to the memory mapped control registers, as the need to use a synchronisation barrier when the lock value changes can be avoided. In particular, the region of memory addresses reserved for the memory mapped control registers can be considered similar to device memory, and thus all store instructions to be performed with respect to this address region cannot be reordered, but need to be executed in order. Thus, for example, if code executed by the processing circuitry attempts to clear the lock value to allow subsequent standard store instructions to be used to update the contents of certain memory mapped control registers, when the lock register is provided within the set of memory mapped control registers, the set of memory mapped control registers can ensure that the store instructions will be executed in the correct order without the need for a synchronisation barrier, and accordingly the lock value will be cleared before any subsequent standard memory access instructions are executed, and thus the desired behaviour will be observed in terms of the updating of the memory mapped control registers.

[0036] In the case where a lock register is provided within a set of memory mapped control registers, the processing circuitry can be arranged to change a lock value in the lock register by executing an instance of a control register specific store instruction having a specified memory address mapped to the lock register. In one example implementation, the lock value can only be altered by software executing at a particular trusted level, and so if software not at the trusted level attempts to update the lock register using the control register specific store instruction, the update will fail.

[0037] While each update to the contents of the memory mapped control registers can be achieved by executing an instance of the control register specific store instruction, in some cases it can be desirable to allow batch updates to be performed on the plurality of memory mapped control registers using standard store instructions. For example, the standard store instructions can include store multiple instructions which provide an efficient mechanism for updating data across a range of memory addresses, and so allow data in a plurality of memory mapped control registers to be updated in response to execution of a single store multiple instruction. In one example implementation, rather than providing a store multiple variant of the control register specific store instruction, the lock value can be temporarily cleared to allow the required updates to be performed on the memory mapped control registers by the standard store instructions.

[0038] In particular, the processing circuitry can be controlled by software to perform a series of accesses to the memory mapped control registers by executing the control register specific store instruction to clear the lock value, executing one or more standard access instructions to access the memory mapped control registers and then executing a store instruction to set the lock value.

[0039] While in one example implementation only the control register specific store instruction can be used to clear the lock value, it can be the case that any type of store instruction can set the lock value, and so, after the memory mapped control registers have been accessed using the standard access instructions, it can be permissible to set the lock value again using a standard store instruction.

[0040] The control information stored in the memory mapped control registers can take a variety of forms, but in one example implementation the control information includes at least control information for controlling which regions of a memory address space are accessible by trusted program code and non-trusted program code.

[0041] In one example implementation, the processing circuitry is arranged to allow trusted program code to update a lock value in a lock storage, and the processing circuitry is arranged to use the lock value to control execution of write operations to the memory mapped control registers by both the non-trusted program code and the trusted program code. Thus, it is noted that in such implementations, the trusted program code that updates the lock value is used not only to restrict access to the memory mapped control registers by software of a lower privilege level or a lower security state level, but also the lock value set by the trusted program code itself will influence how the trusted program code accesses the memory mapped control registers.

[0042] In other example implementations, the processing circuitry is arranged to allow trusted program code to update a lock value in a lock storage, and the processing circuitry is arranged to use the lock value to control execution of write operations to the memory mapped control registers by the trusted program code, while execution of write operations to the memory mapped control registers by the non-trusted program code is not controlled by the lock value state. Thus, it is again noted that the lock value is not only used to restrict access to the memory mapped control registers by software of a lower privilege level or a lower security state level. Such an arrangement is useful in cases where other access checks prevent non-trusted program code from accessing critical registers, and there is some desire to retain non-critical registers that are accessible by non-trusted code, while still locking access to critical registers that are accessible to trusted program code.

[0043] The trusted program code and the non-trusted program code can take a variety of forms. In one example implementation, the processing circuitry is arranged to execute program code in one of a plurality of states including at least a non-privileged state and a privileged state, the trusted program code is program code executed by the processing circuitry in the privileged state, and the non-trusted program code is program code executed by the processing circuitry in the non-privileged state.

[0044] Alternatively or additionally, the processing circuitry can be arranged to execute program code in one of a plurality of security domains including at least a secure domain and a less secure domain, the trusted program code is program code executed by the processing circuitry in the secure domain, and the non-trusted program code is program code executed by the processing circuitry in the less secure domain.

[0045] In implementations where the processing circuitry can execute program code in different security domains and in different privilege states, then in each security domain, the processing circuitry can be arranged to execute program code in one of a plurality of states including at least a non-privileged state and a privileged state. In such implementations, the lock register can be arranged to provide a lock value for each security domain. Thus, for example, the lock register can be stored to provide different lock values for each security domain.

[0046] As previously mentioned, in one example implementation, the lock value can be temporarily cleared to allow, for example, block access to the memory mapped control registers on a context switch. However, if an interrupt occurs during this context switch, the interrupt handler responsible for handling the interrupt can inadvertently run with the ability to access the memory mapped control registers using standard load and store instructions. Although this is difficult to exploit, it can provide an opportunity for an attacker to update the memory mapped control registers, compromising the security of the system. In one example implementation, lock value management processing is performed in association with exceptions to avoid this situation arising. In one example implementation, the lock value management processing comprises saving the lock value currently stored in the lock register on the occurrence of an exception so that the lock value can be restored on return from the exception. However, the lock value in the lock register is also set before triggering execution of the exception handling routine to handle the exception. This means that when the exception handling routine is running, the exception handling routine will only be able to access the memory mapped control registers using memory access instructions within the first subset. Then, on return from the exception handling routine, the lock value in the lock register can be restored to the saved lock value so that the code executing before the exception can then continue to execute using the lock value that existed before the exception occurred.

[0047] In some implementations, the above behaviour can always be implemented on the occurrence of an exception. However, in example implementations, an auto-lock register can be used to store an auto-lock value, and the processing circuitry can be arranged to only perform the setting of the lock value associated with the lock value management processing on the occurrence of an exception when the auto-lock value is set. Thus, when the auto-lock value is set, not only is the current lock value present in the lock register saved before the exception occurs so that the lock value can be restored on return from the exception, but the lock value in the lock register can also be set before triggering execution of the exception handling routine. However, when the auto-lock value is cleared, then although the saving and restoring of the current lock value can still be performed before the exception handling routine or on return from the exception handling routine, the lock value is not set before triggering execution of the exception handling routine. This enables the lock value management behaviour that occurs in response to an exception to be configured.

[0048] As with the lock register, the auto-lock register can be provided as a hardware register that is directly accessible by the processing circuitry, or the auto-lock register can itself be provided as one of the memory mapped control registers.

[0049] When an exception occurs, there can be a variety of ways in which the lock value currently stored in the lock register is saved during the lock value management processing. In one example implementation, when an exception occurs, the lock value currently stored in the lock register is saved as a field within a link register. Link registers can generally be used to capture return addresses, and the lock value can be set as an additional bit within the link register. In some implementations, portions of the address space are reserved and non-executable. Addresses that branch to addresses in such portions of the address space can thus be used to signal special conditions, such as a request for the hardware to perform an exception return to a background state. In one example implementation, upon entry into an exception, the return address captured in the link register can be set to a virtual return address that specifies an address within the reserved, non-executable address space, while the actual return address will be saved on the stack. In this case, the lock value currently stored in the lock register can be saved as part of the virtual return address in the link register.

[0050] Particular examples will now be described with reference to the accompanying drawings.

[0051] Figure 1 An example of a data processing system 2 is shown schematically, which includes processing circuitry for performing data processing in response to instructions fetched from a memory system 26. The memory system 26 can include a cache (e.g. one or more levels of data cache and / or instruction cache) as well as main memory. In some larger systems, the main memory can comprise a single memory type, e.g. DRAM, and in some smaller systems (e.g. microcontrollers) the main memory can comprise different memory types, such as flash memory for storing program code and constant values, and SRAM for storing stacks and other values that change during execution. The processing circuitry provides a processing pipeline comprising a plurality of pipeline stages including, for example: an fetch stage 12 for fetching instructions to be executed from the memory system 26; a decode stage 14 for decoding the fetched instructions to generate control signals for controlling the remaining pipeline stages to perform data processing; and an execution stage comprising execution units 4 for executing the decoded instructions to perform data processing operations. Registers 6 are provided for storing source data (source operands) for the processing circuitry to access when executing instructions, and for storing result data (destination operands) generated by executing those instructions.

[0052] Various different execution units can be provided, such as a vector execution unit 16 for performing vector processing operations, an arithmetic logic unit (ALU) 17 for performing arithmetic operations, and a load / store unit 18 for performing load and store operations to load data from the memory 26 to the registers 6 or store data from the registers 6 to the memory 26, etc.

[0053] In addition, control registers can be provided for storing control information for controlling the operation of the apparatus 2. In accordance with the techniques described herein, at least some of the control registers are arranged as memory-mapped control registers 30 that are accessed using load and store instructions executed by the processing circuitry. As shown, a certain region 55 of the memory address space 50 can be reserved for the memory-mapped control registers, which in the example shown is referred to as the PPB (Peripheral Figure 2 Bus) address space, and so access to a given memory-mapped control register can be performed by using a load or store instruction that identifies an address within the region 55 that stores the control information for the given memory-mapped control register. Optionally, one or more other control registers 32 can also be arranged as hardware registers that are directly accessible by the apparatus without the need to execute a load or store instruction. Figure 2

[0054] It will be appreciated that the pipeline stages shown in the example are simplified representations, and that other types of pipeline stages can also be provided, such as: a rename stage for performing register renaming; an issue stage for queuing instructions waiting for execution and issuing the instructions for execution when their required source operands are available; and a writeback stage for handling the commitment of instructions and writing back results to registers 6. The pipeline can be an in-order pipeline or an out-of-order pipeline. Figure 1 The apparatus 2 can be arranged in a variety of ways. For example, the apparatus can be operated in a single secure domain, but the processing circuitry is capable of operating in both privileged and non-privileged states. Alternatively, the apparatus can have a secure domain and a less secure domain, and have only a single processing state in each secure domain. In other examples, the apparatus 2 can be operated in only a single secure domain and privilege level.

[0055] However, for the purposes of the examples discussed herein, a system will be considered in which the processing circuitry is capable of operating in multiple secure domains (including a secure domain and a less secure domain), and in which within each secure domain the processing circuitry is capable of operating in multiple processing states (including a non-privileged state and a privileged state).

[0056]

[0057] ​​In this apparatus 2, a memory access checking circuit 20 can also be provided for checking whether access to the memory system 26 is allowed based on attribute data specified for respective regions of the memory address space. The memory access checking circuit can comprise a security attribute unit (SAU) 24 for storing security domain definition data defining a security domain associated with each respective region of the memory address space. Based on the security attribute data, the security attribute unit 24 can check whether a memory access is allowed depending on the current security domain of the operation of the processing circuit and the security domain associated with the region comprising the target address of the memory access. In other implementations, the SAU 24 can not directly store the security domain definition data, but can instead access security domain definition data stored elsewhere in order to perform the memory access check. In some systems, the security domain definition data can be stored in control registers, such as memory-mapped control registers 30.

[0058] The processing circuit can operate in a current security domain, which can generally correspond to the security domain associated with the address of the instruction currently being executed (although there can be some exceptions, such as when transitioning between processing domains). When an instruction branches from an address in a region specified by the SAU 24 to be in one domain to an address in a region associated with a different domain, this can trigger a transition in the current security domain in which the processing circuit is operating. In other implementations, such a branch can not directly trigger a transition in the current security domain, but instead trigger an additional security check, such as whether a gateway instruction is present. In these implementations, it can be the gateway instruction itself that triggers the change in the current security domain. For some other types of security domain transition, a particular branch instruction can be used to branch to execute an instruction at an address specified by the instruction, and in a different security state. Generally, while operating in a security domain, the processing circuit can access data in regions of memory associated with both the security domain and less secure domains, while when operating in a less secure domain, the processing circuit can access data in regions associated with the less secure domain, but can not be allowed to access data in regions of the address space specified by the SAU 24 as being associated with a security domain. This enables sensitive data to be protected from unauthorized access from code operating in less secure domains.

[0059] In addition, the memory access checking circuitry can comprise a memory protection unit (MPU) 22 that checks whether memory accesses to the memory system 26 satisfy access permissions, e.g. these access permissions can specify which privilege levels of the processing circuitry are allowed to access a given region of memory, or can specify whether a memory region of an address space is accessible by both read and write operations, or is a read-only region with write-inhibition. The access permissions used by the MPU 22 can be specified, for example, by a higher-privileged process such as a hypervisor or operating system, to control which regions of memory lower-privileged processes such as application programs are allowed to access, and how these regions are accessed (read-only or read / write). The permissions provided by the MPU 22 can be orthogonal to the permissions provided by the SAU 24, such that for a given memory access to be allowed it should pass checks based on the access permissions defined for both the MPU 22 and the SAU 24. Although the MPU 22 is shown in Figure 1 some examples as a single entity, in some examples separate secure and less-secure MPUs 22 can be provided, each associated with one of the secure domains, such that different memory access permissions can be specified for a given memory region depending on whether the current domain is a secure domain or a less-secure domain (e.g. a region can be readable only in a less-secure domain, but both readable and writable in a secure domain).

[0060] Accesses to the memory system 26 will generally be subject to checking by the memory access checking circuitry 20. Accesses to the memory-mapped control registers 30 can also be subject to checking by the memory access checking circuitry 20, or in some cases the memory-mapped control registers 30 can be accessed without performing memory access checks (as indicated by the dashed lines in Figure 1 some examples). In some embodiments, allowing access to the memory-mapped control registers 30 to bypass the memory access checking circuitry 20 can allow fine-grained access control checks to be performed by the memory-mapped control registers 30 themselves. For example, a non-trusted software mapping has access to a subset of the single register access bits. It can be impractical to provide this granularity of access permission checking in a general structure such as the SAU 24 or MPU 22, as such structures can be limited to a minimum region of, for example, 32 bytes.

[0061] Thus, as shown in Figure 3A the apparatus 2 can support performing data processing in one of a plurality of secure domains including at least a secure domain (S) and a less-secure domain (LS). Although Figure 3A a system with only two secure domains is shown, three or more domains associated with different security levels can be provided.

[0062] Furthermore, within a given secure domain, as Figure 3AAs shown, the apparatus can perform data processing in one of a plurality of modes, including a processor mode (H) and a thread mode (T). The processor mode is typically used for exception handling, and thus, for example, exception handling routines can be executed in processor mode. The thread mode is typically used for running different threads, e.g. different application threads. When operating in processor mode H, then by default, the processing circuitry can be assumed to have a higher privileged mode of operation, such that access to memory and control registers is controlled according to a certain level of privilege different from a lower privilege level, whereas in thread mode T, depending on other architectural state stored in control registers, the processing circuitry can have one of a plurality of different privilege levels.

[0063] Thus, as Figure 3A shown, the combination of the security domain and the mode of operation of the processing circuitry can determine how aspects of processing are performed by the processing circuitry. Figure 3A Four different combinations of these modes are shown, including:

[0064] • a secure thread mode (abbreviation for the combination of the secure domain and the thread mode)

[0065] • a less secure thread mode (combination of the less secure domain and the thread mode)

[0066] • a secure processor mode (combination of the secure domain and the processor mode) and

[0067] • a less secure processor mode (combination of the less secure domain and the processor mode).

[0068] As mentioned previously, since some of the control registers are memory mapped control registers, in the case that an attacker can exploit a bug and exploit a memory write gadget within software at a trusted level that allows access to those memory mapped control registers, the attacker has the opportunity to compromise the system. This can be particularly problematic when some of the control registers store control information that controls which software items can access which memory regions. In particular, as a result of such an attack, the attacker can be able to delete or alter some of the memory protection boundaries enforced by the MPU 22 and / or the SAU 24, by suitably modifying the control information used to control the operation of those memory access checking components, thereby compromising the security of the system. As will be discussed in more detail herein, the likelihood of an attacker being able to perform such an attack can be significantly reduced by using a lock value within the lock register 34 as shown. Also as Figure 1 Figure 1 ​As shown, the lock register 34 and the auto-lock register 36 can be provided as hardware control registers that are directly accessible by the device, but in one particular example implementation the lock register and the auto-lock register are provided as control registers within the memory mapped control registers 30, and so can be accessed using memory access instructions. As Figure 1 As shown, the processing circuitry can provide control register access check circuitry 38 which can be used to control access to at least some of the memory mapped control registers 30 depending on the value of the lock value in the lock register 34.

[0069] As Figure 3B As Figure 3A As shown, when considering the different modes of operation shown in Figure 3B It is shown how control information in certain of the memory mapped control registers 30 can be used to enforce memory access boundaries between different items of software executing within the system. For example, in the less secure thread mode, the processing circuitry can be arranged to execute a plurality of threads 60, 62, 64 if the desired MPU control information for the less secure domain as set in the memory mapped control registers can be used. This can be used, for example, to ensure that data being processed by one thread is kept private from other threads if considered appropriate. Also as Figure 3B As shown, this MPU control information for the less secure domain can also enforce access boundaries between the less secure thread mode and the less secure processor mode, so that data processed by software 66 executing in the less secure processor mode is kept private from any of the threads 60, 62, 64 in the less secure thread mode.

[0070] Similarly, equivalent MPU control information can be provided within the memory mapped control registers 30 for the secure domain, and so equivalent MPU control information can be used to enforce partitioning between different threads 70, 72, 74 executing in the secure thread mode, and equivalent MPU control information can also be used to enforce access boundaries between threads executing in the secure thread mode and software 76 executing in the secure processor mode.

[0071] Also as Figure 3B As shown, SAU control information can be stored in the memory mapped control registers to enforce access boundaries between the secure domain and the less secure domain, for example to ensure that software executing in the less secure domain cannot access data associated with the secure domain.

[0072] While these access boundaries enforced by the control information in the relevant memory-mapped control registers can provide a fine level of protection for data accessed by items of various software executing on the processor, problems can arise if there are any bugs in the software that an attacker can exploit. As an example, an attacker can arrange for non-privileged software 60 to be executed in less secure thread mode, but a software bug can cause this software 60 to trigger a memory write gadget within software 66 executed in less secure processor mode, which can for example enable the software 60 to use the memory write gadget to update the relevant memory-mapped control register 30 to change the access boundaries enforced by the MPU control information in the less secure domain. For example, this can effectively remove the boundary between less secure thread mode and less secure processor mode.

[0073] As another example, an attacker can be able to exploit a software bug to enable software 66 running in less secure processor mode to exploit a bug in software 76 executed in secure processor mode to trigger a memory write gadget in the software 76 to update the memory-mapped control register to change the access boundaries enforced by the SAU control information. In the worst case, this can effectively remove the boundary between the secure domain and the less secure domain, after which software in the less secure domain will be able to access data applicable to the secure domain.

[0074] However, as will be discussed in more detail herein, the ability of an attacker to seek to achieve any of the above attacks can be significantly reduced by the use of the lock value in the lock register 34.

[0075] Figure 4 is a flowchart showing how a store instruction is executed depending on the lock value set in the lock register 34 according to one example implementation. At step 100, a store instruction is encountered to be executed by the processing circuitry, and in particular by the load / store unit 18. At step 105, it is determined whether the store instruction specifies an address that maps to one of the control registers 30. As previously discussed, the address applicable to a store instruction can be determined in a variety of ways. For example, the store instruction can specify a source register containing a base address, and can also specify an immediate value for adjusting this base address to determine the address to be accessed by the store instruction. It can then be determined whether this address is within the address region 55 associated with the memory-mapped control registers 30, and from this it is determined which of the control registers the store instruction seeks to access.

[0076] If not, the process proceeds to step 110, where it is determined whether a control register-specific store instruction is used. Specifically, according to the techniques described herein, one or more types of control register-specific store instructions can be defined in addition to the general types of store instructions that can be used to perform write operations on memory. To minimize the ability to suppress the previously described attacks, it is desirable to use such control register-specific store instructions very sparingly, specifically only when accessing memory-mapped control registers. Therefore, if it is determined at step 110 that no control register-specific store instruction is used, this is the expected behavior because it has been determined at step 105 that the store instruction did not access one of the memory-mapped control registers, and accordingly, the process proceeds to step 115, where the desired write operation can be performed. It should be understood that whether a write operation was actually performed can be subject to any access checks that need to be passed regarding the accessed memory address, such memory checks being performed, for example, by the memory access check circuit 20 as described above.

[0077] However, if it is determined at step 110 that a control register-specific storage instruction is being used, then in Figure 4 In the example shown, this is not allowed because the accessed address is not mapped to one of the control registers, so the process proceeds to step 130, where a write operation is not performed but a fault exception is triggered.

[0078] If it is determined at step 105 that the store instruction does indeed specify the address of one of the control registers mapped to the memory map, then at step 120, the processing circuit (in...) Figure 1 In the example, the control register access check circuit 38) determines whether a lock value is set. If not set, the system operates in standard mode; in standard mode, the additional protection provided by this technology is not utilized, and accordingly, the process proceeds to step 115, where a write operation is performed if any relevant access check is passed.

[0079] However, if a lock value is set, access is only permitted when a control register-specific store instruction is used. Therefore, this is checked at step 125, and if a control register-specific store instruction is being used, the process proceeds to step 115, where a write operation is performed and any necessary access checks are performed again. As previously described, in one exemplary implementation, access to the memory-mapped control register may be exempt from the memory access check circuitry 20, and the access path may alternatively follow as... Figure 1 The path is shown by the dashed line. In this case, the access can be checked by a fine-grained checking circuit, which is part of the memory-mapped control register 30.

[0080] However, if it is determined at step 125 that no control register specific store instruction is used, then the write operation is prevented and processing proceeds to step 130 in which the write operation is not performed but a fault exception is raised.

[0081] Although the processing shown in relation to the execution of store instructions Figure 4 , similar processing can be performed to handle load instructions and again at least one control register specific variant of the load instruction can be provided and when the lock value is set, only such control register specific load instructions can be used to read from the memory mapped control registers.

[0082] By this approach, this can significantly reduce the attack surface available to an attacker seeking to exploit the attack types described above. In particular, when the lock value is set, the attacker will need to find a suitable memory write gadget that can be exploited via a software bug and in this case, the memory write gadget will need to include one or more control register specific store instructions because otherwise the presence of the set lock value will prevent any write operations performed in relation to the contents of the memory mapped control registers initiated by the attacker using the memory write gadget. Similarly, if the attacker seeks to exploit a bug to use a memory read gadget to access secret information in the memory mapped control registers 30, such as an encryption key, it will need to identify an instance of the memory read gadget that includes one or more of the control register specific load instructions.

[0083] As previously mentioned, the lock register 34 used to store the lock value can be a hardware control register that is directly accessible by the device but in one example, the lock register is implemented as one of the memory mapped control registers 30. By using one of the memory mapped control registers to provide the lock register, this avoids any need for synchronization barriers. In particular, the address space 55 reserved for the memory mapped control registers can be considered to be device memory and it is not possible to reorder store instructions for such memory. Because in this case, a store instruction will need to be used to update the contents of the lock register, this ensures that any change to the value of the lock value occurs at the correct point in time relative to read and write operations in relation to the memory mapped control registers. Thus, the expected access behaviour can be ensured without any need to perform synchronization of the time at which the lock value is changed and the time at which memory access operations in relation to the memory mapped control registers are performed.

[0084] Figure 5is a flowchart showing how a lock value within a lock register can be updated when the lock register is implemented through one of the memory mapped control registers. At step 150, it is determined whether the currently executing store instruction is specifying the address of a lock register. When this occurs, then it is determined at step 155 whether the processor is operating in the required privilege state. Specifically, it is contemplated that only software executing in a particular privilege state will be allowed to update the contents of the lock register. If the processor is not running in the required privilege state, then a fault exception is raised at step 160.

[0085] However, if the processor is operating in the required privilege state, then it is determined at step 165 whether the current lock value is set. If not, then in one exemplary implementation, any store instruction can be used to set the lock value, and accordingly, processing proceeds to step 175 where the lock value is updated in the lock register. However, if the current lock value is set, then only a control register specific store instruction (also referred to herein as a STRPPB instruction) is allowed to make the update. Thus, if it is determined at step 165 that the current lock value is set, then it is determined at step 170 whether the store instruction attempting to update the lock register is a STRPPB instruction. If not, then a fault exception is raised at step 160. However, if a STRPPB instruction is being used, then processing proceeds to step 175 where the lock value is updated in the lock register to reflect the new value specified by the store instruction. Thereafter, as indicated by step 180, the updated lock value controls future access to the memory mapped control registers by at least the privilege state.

[0086] It is possible that most of the access control registers can only be accessed from the privilege state anyway, but one or more control registers can be allowed to be accessed from the non-privileged state. In some implementations, once the lock bit has been set, access to these control registers will have to be performed using a control register specific store instruction or a control register specific load instruction, regardless of whether the software is executing in the non-privileged state or the privileged state. In other implementations, the lock bit only affects access from the privileged state, so once the lock bit is set, access to those control registers from the privileged state must be performed using a control register specific store instruction or a control register specific load instruction, however, any load instruction and store instruction can allow access to the control registers from the non-privileged state (subject to other access checks).

[0087] If only a single memory mapped control register needs to be accessed at the same time as the lock value is set, then in one exemplary implementation, the control register store (STRPPB) and load (LDRPPB) specific instructions described previously will be used.

[0088] However, it can be considered inappropriate to attempt to provide control register specific variants for every possible type of store instruction and load instruction. For example, typically the instruction encoding space is very valuable, and so it can not be possible to provide a control register specific variant for each of these instructions. Some memory access instructions allow for batch access to memory, and these instructions can be referred to herein as store multiple instructions or load multiple instructions. These instructions provide an efficient mechanism for performing batch updates to memory, and accordingly it can also be efficient to use such instructions to perform batch updates to multiple memory mapped control registers. Figure 6 is a flow diagram illustrating a mechanism that can be used to perform such batch accesses when no control register specific variants of batch store instructions or load instructions are provided.

[0089] At step 200, a STRPPB instruction is executed to clear the lock value in the lock register. Thereafter, this opens a window in which any store instruction or load instruction can be used to access the memory mapped control registers. Accordingly, at step 205, one or more standard store instructions or load instructions can be executed to perform the required access to the memory mapped control registers. For example, at this point, the store multiple instructions or load multiple instructions described previously can be used to improve the efficiency of the access.

[0090] Once the required batch access has been performed, a further store instruction can be executed at step 210 to set the lock flag. It should be noted at this point that in the implementations described herein, the store instruction at step 210 is not required to be a STRPPB instruction, and any suitable store instruction can be used to set the lock flag. This is because the setting of the lock flag is only used to enhance the security of the system, and so the setting of the lock flag need not be restricted. However, by contrast, the clearing of the lock value can allow the use of any memory access instruction to access the memory mapped control registers if any relevant memory access checks are performed. Accordingly, it is desirable to strictly control the clearing of the lock value, which is why in the implementations described herein the STRPPB instruction must be used to clear the lock value in the lock register.

[0091] As described previously, the apparatus can be capable of operating in different security domains including at least a secure domain and a less secure domain. For each security domain, a different lock value can be provided, and so the lock value can be set to the appropriate value for the security domain in which the apparatus is operating. Figure 7The lock registers are shown stored such that each secure domain can store a lock value. Thus, a lock value 250 can be provided for a secure domain, and a separate lock value 255 can be provided for a less secure domain. In one example implementation, the lock value 250 for a secure domain can be set from a privileged state in the secure domain, while the lock value 255 for a less secure domain can be set from a privileged state in the less secure domain or from a privileged state in the secure domain. In other implementations, the lock registers can be stored between a privileged state and a non-privileged state, such that both states can independently control whether a particular variant of load and store instructions is required when access to the memory mapped control registers 30 is performed from that state. In another example implementation, the lock registers can be stored between a secure domain and a privileged state, such that when access to the memory mapped control registers 30 is performed from that state, Figure 3A Each of the four states shown can independently control whether a particular variant of load and store instructions is required.

[0092] As previously mentioned, in one example implementation, access to the PPB memory address space for the control registers providing the memory map can be temporarily unlocked to perform register block accesses (e.g., on a context switch). However, if an interrupt occurs during such a context switch, the interrupt handler can end up inadvertently running with access to the PPB address space. Although it would be more difficult for an attacker to exploit an attack based on this scenario, it is desirable to suppress the ability to perform such an attack. Figure 8A and Figure 8B It is shown how this can be achieved in one example implementation by using the aforementioned auto-lock registers 36.

[0093] Figure 8A It is shown that thread Tl is running as a background thread, and then at point 300 a timer interrupt is triggered to transition to the case of an exception handler performing the previously described context switch and bulk access to the control registers of the memory map at point 305. According to the previously referenced Figure 6 The exception handler code will at this point unlock the PPB address space by clearing the lock value, then will perform the bulk access required to perform the context switch, after which the lock value will be set again in order to lock the PPB address space again, after which the exception handling will terminate at point 330 and the processing will return at point 335 to perform a different background thread T2.

[0094] However, if a higher priority interrupt occurs at point 310, causing the interrupt to be interrupted mid-way through the execution of the context switch exception handler code, which performs the bulk access, then the interrupt will be accepted at point 310 and cause a transition to different exception handler code required to handle this interrupt at point 315. At this point, it will be noted that the memory mapped control register address space has been unlocked; and accordingly, the exception handler operating between point 315 and point 320 will have access to the memory mapped control registers, which can be unintended. Upon completion of this exception handling routine code at point 320, processing will return to point 325, after which the context switch exception handler routine being processed in response to the original timer interrupt will continue to perform the bulk access, and then re-lock the PPB address space by re-setting the lock value prior to transitioning to background code T2 between point 330 and point 335.

[0095] The unexpected result of the exception handling routine executing between point 315 and point 320 having unrestricted access to the memory mapped control registers is undesirable. As Figure 8B shown, this can be achieved using the auto-lock value in the auto-lock register 36. At step 400, it is determined whether an exception has occurred; if so, the current lock value is saved at step 405. The current lock value can be saved in a variety of ways, but in one example, the current lock value is stored as a field in the exception return value stored in the link register. While the link register can be used to capture the exception return address on an exception table entry, in some implementations, a portion of the address space is reserved and non-executable. Addresses that branch to addresses in such a portion of the address space can thus be used to signal a special condition, such as a request for the hardware to perform an exception return to a background state. In one example implementation, upon entry to an exception, the exception return address captured in the link register can be set to a dummy return address that specifies an address within the reserved, non-executable address space, while the actual return address will instead be saved on the stack, and the current lock value can then include a portion of the dummy return address in the link register.

[0096] Accordingly, considering Figure 8A at point 300, the current lock value applicable to the background thread Tl can be saved at step 405. Thereafter, at step 410, it is determined whether the auto-lock flag is set in the auto-lock register 36. If not, no additional protection with respect to exceptions is implemented, and processing can proceed as previously described with reference to Figure 8A steps 415 and 420, in particular, the exception handling routine can be triggered to handle the exception at step 420, and then upon return from the exception, the lock value can be restored in the lock register to the saved lock value at step 425.

[0097] However, if the auto-lock flag is set, then as shown in Figure 8B the processing proceeds first to step 415 in which the lock value is set in the lock register. Referring to Figure 8A , this means that at point 305 the lock value is set irrespective of the value of the lock value applicable to thread Tl at point 300. The exception handler for processing SVC can then proceed normally by unlocking the PPB address space, performing the bulk access and relocking the PPB address space by resetting the lock value.

[0098] However, in setting the auto-lock flag, this removes the problem that would otherwise occur if a high priority interrupt is received at point 310. In particular, by performing the processing shown in Figure 8B it will be seen that the current lock value (in this case the clear value, since the context switch exception handling routine in response to the timer interrupt will have cleared the lock value at this time) can be saved, but in addition it will also be determined that the auto-lock flag is set. Thus, in transitioning from point 315 to the exception handling routine required to service the interrupt detected by point 310, the lock value in the lock register will be reset. This means that the lock value will be set during the execution of the exception handling routine between points 315 and 320, thereby avoiding any ability to freely access the memory mapped control registers whilst that exception handling routine is being executed. On return from the exception at point 325, then as shown in step 425 of Figure 8B the lock value in the lock register will be restored, which in the context of the example of Figure 8A will mean that the lock value is again cleared, thereby allowing the bulk access to be performed by the context switch exception handling routine before the PPB memory address space is relocked.

[0099] Figure 9Example implementations that can be used are shown. While the example implementations described previously implement the application in terms of apparatus and methods for operating specific processing hardware that support the technology involved, it is also possible to provide an instruction execution environment implemented using computer programs according to the examples described herein. Such computer programs are often referred to as emulators, to the extent that such computer programs provide a software-based implementation of a hardware architecture. Categories of emulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators. In general, an emulator implementation can run on a host processor 515 that supports the emulator program 505, optionally running a host operating system 510. In some arrangements, there can be multiple emulation layers between the hardware and the provided instruction execution environment and / or multiple different instruction execution environments provided on the same host processor. Historically, powerful processors have been required to provide an emulator implementation that executes at a reasonable speed, but such an approach can be reasonable in certain circumstances, such as when it is desirable to run code native to another processor for compatibility or re-use reasons. For example, an emulator implementation can provide an instruction execution environment that provides additional functionality not supported by the host processor hardware, or that provides an instruction execution environment normally associated with a different hardware architecture. Emulation is outlined in the paper "Some Efficient Architecture Simulation Techniques", Robert Bedichek, Winter 1990 USENIX Conference, pages 53-63.

[0100] To the extent that examples have been described previously with reference to specific hardware configurations or features, in an emulator implementation equivalent functionality can be provided by suitable software configurations or features. For example, a particular circuit can be provided as computer program logic in an emulator implementation. Similarly, memory hardware such as registers or caches can be provided as software data structures in an emulator implementation. Furthermore, a physical address space for accessing memory 26 in the hardware apparatus 2 can be emulated as an emulated address space that is mapped by the emulator 505 to a virtual address space used by the host operating system 510. To the extent that one or more of the hardware elements referred to in the examples described previously exist in an arrangement on host hardware (e.g. host processor 515), some emulator implementations can make use of the host hardware where appropriate.

[0101] The emulator program 505 can be stored on a computer-readable storage medium, which can be a non-transitory medium, and provides a virtual hardware interface (instruction execution environment) to the target code 500, which can include an application program, a guest operating system, and a hypervisor, that is identical to the hardware interface of the hardware architecture being modeled by the emulator program 505. Thus, program instructions of the target code 500 can be executed from within the instruction execution environment using the emulator program 505 so that a host computer 515 that does not actually have the hardware features of the device 2 discussed above can emulate these features. The emulator program can include processing program logic 520 for emulating the behavior of the processing pipeline 4, and control program logic 525 for maintaining a set of memory-mapped control data structures to emulate the control registers 30 that control the memory mappings, including the lock data structure in which the lock value is to be stored. The architecture registers 6 of the system 2 can also be emulated using program logic (not shown) that emulates the architecture registers of the target architecture mapping onto the memory space used by the host hardware 515 using data structures maintained by the emulator code 505. Thus, the techniques described herein for controlling access to a set of memory-mapped control registers depending on a lock value can be performed in software by the emulator program 505 in the example of a host computer 515 that does not have the hardware features of the device 2. Figure 9

[0102] By using the techniques described herein, the ability of an attacker to exploit a software bug to attempt to modify the contents of a memory-mapped control register can be significantly inhibited, thereby reducing the likelihood that an attacker can compromise a system by modifying control information within those memory-mapped control registers.

[0103] In this application, the word "configured" is used to mean that an element of the device has the capability to carry out a defined operation. In this context, a "configuration" means an arrangement or manner of interconnection of hardware or software. For example, a device can have specific hardware which provides the capability to carry out a defined operation, or a processor or other processing device can be programmed to carry out a function. "Configured" does not imply that an element of the device needs to be changed in any way in order to provide the defined operation.

[0104] While exemplary embodiments of the present application have been described in detail hereinabove, it is to be understood that the application is not limited to the precise embodiments described, and as such may be variously changed, modified and further applied by those skilled in the art without departing from the scope and spirit of the application as defined by the appended claims. For example, features of dependent claims can be combined with features of independent claims in any combination without departing from the scope of the application.​

Claims

1. An apparatus comprising: processing circuitry to execute program code to perform data processing operations; a set of memory-mapped control registers to store control information for controlling operation of the processing circuitry when executing the program code; and a lock register to store a lock value; wherein: the processing circuitry is arranged to execute store instructions to perform write operations on a memory address space, the store instructions being of a plurality of types; and on setting the lock value, the processing circuitry is arranged to prevent execution of write operations performed to change the control information in the memory-mapped control registers unless the write operation occurs as a result of execution of a store instruction from a first subset of the plurality of types of store instructions, wherein the control information stored in the memory-mapped control registers comprises at least control information for controlling which regions of the memory address space are accessible by trusted program code and non-trusted program code; and the processing circuitry is arranged to allow the trusted program code to update the lock value in the lock register and to use the lock value to control execution of write operations by at least the trusted program code to the memory-mapped control registers.

2. The apparatus of claim 1, wherein on clearing the lock value, the processing circuitry is arranged to allow write operations performed to change the control information in the memory-mapped control registers using a second subset of the plurality of types of store instructions in addition to the first subset, wherein the second subset is non-overlapping with the first subset.

3. The apparatus of claim 2, wherein on setting the lock value, the processing circuitry is arranged to raise a fault exception when a store instruction from the second subset of the plurality of types of store instructions attempts to perform a write operation on the set of memory-mapped control registers.

4. The apparatus of any of claims 1 to 3, wherein: on setting the lock value, the processing circuitry is further arranged to allow reads of the control information in the memory-mapped control registers only if the read occurs as a result of execution of a load instruction from a first subset of a plurality of types of load instructions and to prevent reads of the control information in the memory-mapped control registers if the read occurs as a result of execution of a load instruction from a second subset of the plurality of types of load instructions, the second subset being non-overlapping with the first subset.

5. The apparatus of claim 4, wherein on setting the lock value, the processing circuitry is arranged to raise a fault exception when a load instruction from the second subset of the plurality of types of load instructions attempts to perform a read operation on the set of memory-mapped control registers. ​ 6. The apparatus according to any one of claims 1 to 3, wherein the first subset of the plurality of types of store instruction comprises control register specific store instructions, wherein on execution of the control register specific store instructions the processing circuitry is arranged to ignore the lock value when determining whether to allow an associated write operation to the memory mapped control registers.

7. The apparatus according to claim 6, wherein on execution of the control register specific store instructions the processing circuitry is arranged to raise a fault exception when a memory address identified by the control register specific store instruction is outside a range of memory addresses associated with the set of memory mapped control registers.

8. The apparatus according to claim 7, wherein the memory address is identified according to a value stored in a register specified by the control register specific store instruction and an immediate value specified by the control register specific store instruction.

9. The apparatus according to claim 4, wherein: the first subset of the plurality of types of load instruction comprises control register specific load instructions, wherein on execution of the control register specific load instructions the processing circuitry is arranged to ignore the lock value when determining whether to allow an associated read operation to the memory mapped control registers; and on execution of the control register specific load instructions the processing circuitry is arranged to raise a fault exception when a memory address identified by the control register specific load instruction is outside a range of memory addresses associated with the set of memory mapped control registers.

10. The apparatus according to claim 6, wherein: the lock register is provided within the set of memory mapped control registers and the processing circuitry is arranged to change the lock value in the lock register by executing an instance of the control register specific store instruction having a particular memory address mapped to the lock register.

11. The apparatus according to claim 10, wherein the processing circuitry is controllable by software to perform a series of accesses to the memory mapped control registers by executing the control register specific store instruction to clear the lock value, executing one or more standard access instructions to access the memory mapped control registers and then executing a store instruction to set the lock value.

12. The apparatus according to claim 11, wherein the one or more standard access instructions comprise at least one store multiple instruction or a load multiple instruction.

13. The apparatus according to claim 1, wherein the processing circuitry is arranged to use the lock value to control execution of write operations to the memory mapped control registers by the untrusted program code and the trusted program code.

14. The apparatus according to claim 1, wherein the processing circuitry is arranged to ignore the lock value when determining whether to allow write operations to the memory mapped control registers by untrusted program code.

15. An apparatus according to claim 13 or claim 14, wherein: the processing circuitry is arranged to execute the program code in one of a plurality of states comprising at least a non-privileged state and a privileged state, the trusted program code being program code executed by the processing circuitry in the privileged state and the untrusted program code being program code executed by the processing circuitry in the non-privileged state.

16. An apparatus according to claim 13, wherein: the processing circuitry is arranged to execute the program code in one of a plurality of security domains comprising at least a secure domain and a less secure domain, the trusted program code being program code executed by the processing circuitry in the secure domain and the untrusted program code being program code executed by the processing circuitry in the less secure domain.

17. An apparatus according to claim 16, wherein: the processing circuitry is arranged to execute the program code in one of a plurality of states comprising at least a non-privileged state and a privileged state, the trusted program code being program code executed by the processing circuitry in the privileged state and the untrusted program code being program code executed by the processing circuitry in the non-privileged state; in each of the secure domains, the processing circuitry is arranged to execute the program code in one of a plurality of states comprising at least the non-privileged state and the privileged state; and the lock register is arranged to provide a lock value for each secure domain.

18. An apparatus according to any of claims 1 to 3, wherein: the processing circuitry is arranged to perform a lock value management process associated with an exception, the lock value management process comprising: on occurrence of an exception, saving the lock value currently stored in the lock register and setting the lock value in the lock register prior to triggering execution of an exception handling routine to handle the exception; and on return from the exception handling routine, restoring the lock value in the lock register to the saved lock value.

19. An apparatus according to claim 18, the apparatus further comprising: an auto-lock register for storing an auto-lock value; wherein the processing circuitry is arranged to perform the setting of the lock value associated with the lock value management process on occurrence of an exception only when the auto-lock value is set.

20. An apparatus according to claim 18, wherein during the lock value management process, the lock value currently stored in the lock register is saved as a field within a link register.

21. A method of controlling access to a set of memory mapped control registers within an apparatus, the method comprising: executing program code on processing circuitry to perform data processing operations; storing control information within the set of memory mapped control registers for controlling operation of the processing circuitry when executing the program code; storing a lock value within a lock register; ​ to execute a write operation on a memory address space, the store instructions having a plurality of types; and on setting the lock value, preventing execution of write operations performed to change the control information in the memory mapped control registers unless the write operation occurs as a result of the processing circuitry executing a store instruction from a first subset of the plurality of types of store instructions; wherein wherein the control information stored in the memory mapped control registers includes at least control information for controlling which regions of the memory address space are accessible by trusted program code and non-trusted program code; and the processing circuitry is arranged to allow the trusted program code to update the lock value in the lock register, and is arranged to use the lock value to control execution of write operations by at least the trusted program code on the memory mapped control registers.

22. A computer program for controlling a host data processing apparatus to provide an instruction execution environment, the computer program comprising: processing program logic for executing program code to perform data processing operations; and control program logic for maintaining a set of memory mapped control data structures to store control information for controlling operation of the processing program logic when executing the program code, and for maintaining a lock data structure to store a lock value; wherein: the processing program logic is arranged to execute store instructions to perform write operations on a memory address space, the store instructions having a plurality of types; and on setting the lock value, the processing program logic is arranged to prevent execution of write operations performed to change the control information in the memory mapped control registers unless the write operation occurs as a result of executing a store instruction from a first subset of the plurality of types of store instructions; the control information stored in the memory mapped control data structures includes at least control information for controlling which regions of the memory address space are accessible by trusted program code and non-trusted program code; and the processing program logic is arranged to allow the trusted program code to update the lock value in the lock data structure, and is arranged to use the lock value to control execution of write operations by at least the trusted program code on the memory mapped control data structures.

23. A computer readable storage medium storing the computer program of claim 22.

Images