Data processing apparatus and data processing method

Abstract

A data processing apparatus (300) is provided, comprising memory circuitry (110) providing a physical address space logically divided into multiple memory segments (370a, 370b, 370c, 370d) and storing a plurality of accessors (380) with associated validity indicators. Each of these accessors controls access to a region of the physical address space based on at least its associated validity indicator. A tracking circuit (310) tracks which memory segments contain these accessors, and a failure circuit (320) responds to a request to fail an accessor by referring to the tracking circuit to determine a set of equivalent accessors, and fails the accessor and the equivalent accessors by setting the associated validity indicator of the accessor and each of the equivalent accessors to indicate that the accessor and the equivalent accessors have failed.

Description

[0001] This invention was made with government support under contract number HR001118C0016 granted by the U.S. Defense Advanced Research Projects Agency (DARPA). The government owns certain rights to this invention.

[0002] This technology relates to data processing. Specifically, this technology relates to memory systems.

[0003] In data processing systems, memory accessors are used to control access to specific areas of memory. Such accessors can include both memory referencing and access restrictions, ensuring that the memory referencing can only be used in a specified manner. Accessors can be invalidated when appropriate. However, if an accessor has been copied, it is important to also invalidate the copy. Failure to do so may allow the owners of those copies to continue accessing the memory space, even if the memory space has been repurposed. However, scanning through memory to locate copies of accessors can be very time-consuming and / or resource-intensive.

[0004] From a first exemplary configuration, a data processing apparatus is provided, comprising: a memory circuit for providing a physical address space logically divided into multiple memory segments and for storing a plurality of accessors having associated validity indicators, wherein each accessor controls access to a region of the physical address space according to at least its associated validity indicator; a tracking circuit for tracking which memory segments contain accessors; and a failure circuit for responding to a request to fail an accessor by referring to the tracking circuit to determine a set of equivalent accessors, and for failing an accessor and an equivalent accessor by setting an associated validity indicator for each accessor in the accessor and the equivalent accessor to indicate that the accessor and the equivalent accessor have failed.

[0005] From a second exemplary configuration, a data processing method is provided, comprising: logically dividing the physical address space of a memory into a plurality of memory segments; storing a plurality of accessors having associated validity indicators, wherein each accessor controls access to a segment of the physical address space according to at least its associated validity indicator; tracking which memory segments contain accessors; determining a set of equivalent accessors by reference tracking circuitry to respond to a request to invalidate an accessor; and invalidating an accessor and an equivalent accessor by setting an associated validity indicator for each accessor in the accessor and the equivalent accessor to indicate that the accessor and the equivalent accessor are invalid.

[0006] From a third exemplary configuration, a computer program is provided for controlling a host data processing device to provide an instruction execution environment. The computer program includes: a plurality of data structures for storing a plurality of accessors having associated validity indicators, wherein each accessor controls access to one of the data structures according to at least its associated validity indicator; tracking program logic for tracking which data structures contain accessors; and invalidation program logic for responding to a request to invalidate an accessor by referring to the tracking program logic to determine a set of equivalent accessors, and for invalidating the accessor and equivalent accessor by setting the associated validity indicator of each accessor in the accessor and equivalent accessor to indicate that the accessor and equivalent accessor are invalidated.

[0007] The present invention will be further described by way of example only, with reference to embodiments shown in the accompanying drawings, wherein:

[0008] Figure 1 Examples of accessors based on some implementation schemes;

[0009] Figure 2A and Figure 2B Examples of ways to use a copy of the capability to access private information;

[0010] Figure 3 Examples of data processing apparatuses according to some implementation schemes;

[0011] Figure 4 This example illustrates a flowchart of a process for disabling equivalent access according to some implementation schemes;

[0012] Figure 5 This example illustrates a flowchart of the process for reconstructing Bloom filter entries according to some implementation schemes;

[0013] Figure 6 Examples of various improvements that can be made to the currently described technology according to some implementation schemes;

[0014] Figure 7 This illustrates flowcharts illustrating data processing procedures according to some implementation schemes; and

[0015] Figure 8 Examples of available simulator implementations based on some implementation schemes are provided.

[0016] Before discussing the implementation scheme with reference to the accompanying drawings, the following description of the implementation scheme and its associated advantages is provided.

[0017] According to an exemplary configuration, a data processing apparatus is provided, comprising: a memory circuit for providing a physical address space logically divided into multiple memory segments and for storing a plurality of accessors having associated validity indicators, wherein each accessor controls access to a region of the physical address space according to at least its associated validity indicator; a tracking circuit for tracking which memory segments contain accessors; and a failure circuit for responding to a request to fail an accessor by referring to the tracking circuit to determine a set of equivalent accessors, and for failing an accessor and an equivalent accessor by setting an associated validity indicator for each accessor in the accessor and the equivalent accessor to indicate that the accessor and the equivalent accessor have failed.

[0018] Memory provides a physical address space (which is used to address specific memory cells). This address space is divided into multiple memory segments. It's important to note that the address space does not need to be precisely divided into memory segments—there may be areas of the address space that fall outside multiple memory segments. Memory segments can have different sizes and can be arbitrarily selected, for example, by software. Accessors are used to access areas of the address space. Accessors can, for example, take the form of data structures that include a reference to a location in the address space and one or more restrictions on how the reference can be used, as well as a validity indicator to indicate that the accessor is valid (e.g., not corrupted). Accessors can be stored within memory, for example, within memory segments, and tracking circuitry can determine which segments of physical memory contain accessors. Therefore, when a fail-safe request indicating that an accessor (and the memory it represents) is no longer in use is received, the tracking circuitry can be queried to determine any equivalent accessors in memory. In this way, the accessor and those considered equivalent accessors are fail-safe. Thus, when one copy of an accessor fails-safe, it is possible to suppress or prevent multiple copies of that accessor from remaining valid. Therefore, this prevents malicious or erroneous segments of code (such as untrusted libraries) from accessing invalidated and then repurposed secret information stored in memory. It should be noted that although accessors supposedly control access to memory regions, these accessors do not specifically control access to each memory region. Specifically, multiple accessors may exist targeting the same region of memory or overlapping regions of memory. Furthermore, other circuitry or mechanisms may exist to maintain proper overriding of access authorized by the accessors.

[0019] There are multiple ways to determine whether an accessor is equivalent to an invalidating accessor. However, in some examples, equivalent accessors include those accessors that control access to a region in the address space. In these examples, an accessor is considered equivalent if the invalidating accessor controls access to the same region in the physical address space. Therefore, it is possible to invalidate those accessors that would otherwise authorize access to the same invalidating region in the address space. Consequently, if this region of memory is then reused, those accessors cannot be used to access anything stored in that region of the address space.

[0020] In some examples, the accessor includes a pointer. A pointer can be thought of as a reference to a location in memory where other data can be stored. Therefore, an accessor may include a pointer that is used to reference, for example, a byte within a memory segment.

[0021] In some examples, the accessor includes boundary information defining the regions of the physical address space that the pointer can access. By providing boundary information, it is possible to prevent the pointer from accessing locations that fall outside the boundaries. For example, if the boundaries define a lower address limit of 1000 and an upper address limit of 2000, and if pointer P points to address 1999, the accessor prevents the pointer from accessing an address equal to P+5, because this result (2004) would fall outside the range 1000 to 2000. The boundary information can be defined in a variety of ways. For example, the boundary information may include a lower limit and an upper limit as described previously. In other examples, the boundary information may include a lower limit and an offset, which can be used to determine the upper limit by adding an offset to the lower limit. In other examples, an upper limit may be provided, and an offset is used to define the lower limit. In other examples, two offsets relative to the pointer may be provided to describe the lower and upper limits. In yet another example, the boundary information may be used to define prohibited access locations, where all other memory locations are defined as accessible via the pointer. Other techniques will be apparent to those skilled in the art from the previous description. It should be noted that the accessor is not limited to containing only boundary information. In some examples, the accessor may also include permission information that controls how the pointer can access the address space. For example, in some examples, accessors can be used to restrict pointers to read operations.

[0022] In some examples, equivalent accessors include those accessors whose boundary information matches the accessor's information. Another way to determine whether an accessor is considered equivalent to the accessor being invalidated is by considering the boundary information. For example, if the boundary information is a match between two accessors, then those accessors can be considered equivalent. Note that this test may or may not include permission matching. For example, if additional permissions match, or if a set of permissions is a subgroup of the permissions of the accessor to be invalidated, then the two accessors can be considered equivalent. In other examples, permissions may not be considered when determining equivalence.

[0023] In some examples, equivalent accessors include those accessors whose boundary information defines a sub-region of the physical address space. In these examples, an exact match of the boundary information is not required. Rather, if the region defined by the accessor being considered is a sub-region of the address space of the accessor that is being invalidated, then the accessor is considered equivalent to the accessor that is being invalidated. It should be understood that if a region of the address space is to be invalidated, any accessor referring to a portion of the address space will also be invalidated, because the memory referred to by that accessor will become invalid due to a more widespread invalidation. For example, an accessor that accesses memory locations 2 through 98 is considered equivalent to an accessor that defines a region defining addresses 0 through 100.

[0024] There are several ways in which a tracking circuit can track which memory segment contains an accessor. However, in some examples, the tracking circuit is adapted to indicate whether each memory segment within a memory segment contains a memory within the memory. Such a tracking circuit operates by indicating whether each memory segment tracked by the tracking circuit contains an accessor. This information can be determined when the memory is created or copied. If dedicated instructions are used to reasonably create or copy accessors, these instructions can be designed in such a way that calling the instructions causes the tracking circuit to update to indicate the location of the accessor within the memory segment. It should be understood that this technique offers a trade-off relative to the size of each memory segment within a memory segment. Specifically, if the tracking circuit provides an indicator of whether each memory segment contains an accessor, the tracking circuit requires less storage space when the number of memory segments is small. However, this provides less useful information because larger memory segments become more likely to contain accessors. Similarly, this more limited information makes more precise location of the accessor less feasible.

[0025] In some examples, the tracking circuitry includes a bit field containing multiple bits; and these multiple bits are adapted to indicate which memory segment contains one of the accessors. In these examples, the bit field is used to provide multiple bits. A subgroup of the bits (bit vector) of the bit field is used to represent a specific memory segment. Therefore, by considering each bit vector, it is possible to determine whether a specific memory segment contains an accessor. In a simple example, a single bit can be provided for each memory segment, which simply indicates whether the memory segment contains an accessor—a "1" in the bit field can be used to indicate that the memory segment contains an accessor, while a "0" can be used to indicate that the memory segment does not contain an accessor. Reverse encoding is also possible. By using a bit field to store this information, the contents of each memory segment within a memory segment can be represented in a compact manner.

[0026] In some examples, the tracing circuit includes a hash table; and the hash table accepts a hash of at least a portion of the accessor as input. The term "hash table" is used here to refer to a table whose input and / or contents are generated using a hash function. For example, a lookup index can be generated against a table by hashing the input values, making a specific index of the table directly accessible instead of manually scanning every entry in the table to find a specific entry. A hash function can be viewed as a function that transforms input from a large input domain into output in a smaller output domain. This process does not need to be encrypted (one-way). In these examples, at least a portion of the accessor (e.g., boundary information) is hashed to provide input to the hash table. By using this data structure, it is possible not only to determine whether a memory segment contains any accessors, but also whether a given memory segment might contain, or which memory segments might contain, accessors with hashed inputs (e.g., with the same boundary information). This makes it possible to provide a more intelligent assessment of whether a given memory segment contains an accessor of interest. The input to the hash function can be based on those elements of the accessor that are considered to define equivalence between two accessors. For example, if two accessors are considered equivalent, and if their boundary and privilege information match, these can be provided as input to a hash, enabling the tracing circuitry to help identify memory segments containing equivalent accessors.

[0027] In some examples, the tracking circuitry includes a Bloom filter. A Bloom filter is a data structure that can be used to determine whether an accessor of a specific quality falls within a given memory segment in this case. A Bloom filter makes positive and negative identifications possible. In other words, a Bloom filter can report that a given memory segment contains an equivalent accessor when the equivalent accessor does not exist. However, negative false identifications do not occur; that is, a Bloom filter will not return an indication that an equivalent accessor does not exist in a memory segment when the equivalent accessor does exist. This is important for failures, where it is inconvenient to unnecessarily perform further analysis of the memory segment to search for accessors, but it is unsafe not to fail the equivalent accessor because its presence is not reported. A Bloom filter can be implemented using bit fields, where the number of bits corresponds to one memory segment in the memory segment. The number of bits allocated to each memory segment reduces the likelihood of positive and negative identifications, but at the cost of increased storage space.

[0028] In some examples, the failure circuit is adapted such that when the tracking circuit indicates that a given memory segment contains one of the accessors, a sweep of the given memory segment is performed and the entries for the Bloom filter corresponding to the given memory segment are reconstructed. The tracking circuit can be used to indicate (with a specific probability) that a particular memory segment contains an equivalent accessor. Although Bloom filter entries can be updated as new accessors are added to or moved to a memory segment, they cannot be updated when these accessors are moved or removed from the memory segment. This is because older versions of the entries (excluding removed accessors) may be unknown or retained. Therefore, unless the entries for a given memory segment are periodically reconstructed, the entries will eventually saturate (e.g., always indicating the presence of an accessor).

[0029] In some examples, the failure circuit is adapted to reconstruct the entries of the Bloom filter corresponding to a given memory segment by considering the associated validity indicator of each accessor in the accessors within that memory segment. In these examples, the reconstruction of the Bloom filter entries considers the validity indicator of each accessor when a sweep occurs. Specifically, Bloom filter entries are not updated with respect to accessors considered failures. This is because accessors are unavailable in the case of failure.

[0030] In some examples, the entries for the Bloom filter corresponding to a given memory segment are reconstructed by rewriting those accessors located in that memory segment; and the invalidation circuitry is adapted to operate in a sweep mode of operation when the associated validity indicator indicates validity, in which rewriting is performed by suppressing the physical writing of accessors to memory. In cases where the instructions for creating or copying capabilities are also responsible for updating the relevant entries in the trace circuitry, those same instructions can be used to recreate the Bloom filter entries during sweep. In these cases, a sweep mode of operation can be provided in which these instructions do not physically write data back to memory. Therefore, this saves memory bandwidth because no memory write is actually performed. It should be noted that even without using this technique to write data back to memory, invalidated entries will still cause their (now invalidated) validity indicators to be physically written to memory. Furthermore, Bloom filter table entries are not updated to incorporate these entries because they are now considered invalid.

[0031] In some examples, the failure circuit is adapted to sweep a given memory segment to determine the equivalent accessor when the tracking circuit indicates that the given memory segment contains one of the accessors. Having already assessed that a memory segment may contain an equivalent accessor, it is necessary to scan the memory segment to locate the equivalent accessor (if they exist). In some implementations, simultaneously, the entries of the Bloom filter corresponding to the memory segment being swept are reconstructed. Specifically, a complete set of accessors located within a given memory segment can be used to recreate the entries provided by the Bloom filter for that given memory segment. It should be noted that the size of the memory segment affects the time that will be spent performing the scan. As previously described, the number of memory segments affects the amount of storage required by the tracking circuit. However, if fewer memory segments are provided (thus utilizing a smaller tracking circuit), each memory segment is likely to be larger, resulting in a longer sweep time.

[0032] In some examples, the failure circuit is adapted to avoid sweeping a given memory segment when the tracing circuit indicates that each accessor in the memory segment is missing. When the tracing circuit indicates that a given memory segment does not contain an accessor, there is no need to sweep the given memory segment to determine if any equivalent accessor exists within the memory segment. Therefore, the tracing circuit can be used to reduce the number of memory segments to be scanned.

[0033] In some examples, the memory circuitry is further logically partitioned to include an active stack area; the tracking circuitry includes bit fields that track the active stack area; and the tracking circuitry includes hash tables or Bloom filters that track memory segments. In this data processing apparatus, an active stack area is used to store temporary data values ​​for the currently active thread. These data values ​​are characterized by the fact that they can be modified, added to, and deleted periodically. Such data values ​​may include accessors. Therefore, it should be understood that Bloom filter entries will quickly saturate the active stack area, thereby periodically indicating the presence of an equivalent accessor (even if that equivalent accessor does not exist). Therefore, in these embodiments, simpler bit fields are used to indicate the presence of an accessor within the active stack area, while at least some other areas of the memory are represented using hash table entries or Bloom filter entries because those segments of the memory are less likely to saturate due to less frequent modifications.

[0034] In some other examples, the memory circuitry is further logically partitioned to include the active stack area; and the tracing circuitry is restricted to tracing the active stack area. In these examples, the tracing circuitry may simply be restricted to fully tracing the active stack area. This can be done while recognizing that the tracing circuitry will most likely always report the active stack area as containing accessors. Therefore, the tracing circuitry can be referenced to always sweep the active stack area for the equivalent accessor.

[0035] In some examples, the tracking circuitry is adapted to further track accessors stored outside the memory segment. In these examples, simpler tracking can be used for regions of memory outside the memory segment. Specifically, a series of bits can be used to indicate whether an accessor is located within that region of memory, each bit corresponding to a different portion of the memory that falls outside the memory segment.

[0036] The specific implementation scheme will now be described with reference to the accompanying drawings.

[0037] Figure 1Example of a capability 100 (which is an example of the claimed accessor) according to some embodiments is illustrated. The capability is used to control access to a location in memory provided via pointer 130. Specifically, capability 100 includes metadata 120 that controls how pointer 130 can be used to access memory 110. In this example, metadata 120 includes a set of permissions 150. Permission 150 indicates how the pointer can be used. For example, permission 150 may indicate that pointer 130 can be used for read access to memory 110. In this case, an attempt to use pointer 130 for write access will fail, for example, by causing an exception. Metadata 120 also includes boundary information 160, 170 in the form of a base address 160 and a limit address 170. These addresses collectively define a physical region 180 of memory 110. Boundary information 160, 170 means that if pointer 130 is used to access an address outside this region 180, the request will fail, for example, by causing an exception. Capability 100 also includes a tag 140. In this example, tag 140 is not part of metadata 120. However, in other examples, label 140 may form part of metadata 120. Label 140 (which is an example of a claimed validity indicator) is used to indicate whether capability 100 is valid and / or undamaged. For example, label 140 may be set to '0' to indicate capability failure / damage, while '1' may indicate capability 100 is valid / undamaged.

[0038] It should be noted that boundary information 160 and 170 can be expressed relative to the pointer. In this case, the number of bits used to express the boundary information can be substantially less than the number of bits used to express the pointer. In this scenario, when the pointer is to be updated, it is first determined whether the updated pointer will be within the old boundary (e.g., using pointer and relative boundary calculations). If not, the capability is disabled.

[0039] Both pointer 130 and metadata 120 may be accessible to the user application. However, attempting to directly modify metadata 120 causes the tag 140 indicating that the capability has become invalid / corrupted. Some implementations may allow the use of special instructions (e.g., for narrowing boundaries or removing permissions) to legitimately modify the accessor's metadata. However, the details of such operations are beyond the scope of this disclosure. Effective capabilities can be generated through special instructions (which may require privileged operating modes). Therefore, capabilities can be used to protect access to memory. For example, when servicing a memory allocation request, the allocated area of ​​the memory can be returned and the ability to access that area of ​​memory can be provided via pointer 130. Attempts to access areas outside the memory area using the pointer will fail.

[0040] Capabilities can be viewed in other ways as regular data structures in the sense that they can be copied. For example, capability 100 is shown as several locations 190a, 190b, and 190c that have been copied into memory 110. However, this can cause problems. Specifically, when capability 190a is to be invalidated, other copies of capabilities 190b and 190c must also be located to be invalidated. Otherwise, these copies could be used to access private information, such as information related to... Figure 2A and Figure 2B As shown. One way to locate a copy is by scanning the entire memory 110. However, this is time-consuming and resource-intensive. Therefore, this technique aims to reduce the resources required to invalidate a copy of the equivalent capability to be invalidated.

[0041] Figure 2A and Figure 2B This example illustrates how a capability copy can be used to access private information. In this example, compartment A (the victim) calls compartment B, which may be an untrusted library (the attacker). Compartment A first creates capability C1 pointing to an allocated region of memory (shared 0). Then, compartment A makes a function call to compartment B, passing capability C1. Within compartment B, capability C1 is stored in the heap. Then, compartment B uses capability C1 to perform the requested operation as expected. Then, compartment B returns to compartment A. Then, compartment A releases the shared 0 of memory pointed to by capability C1. The "release" command only invalidates capability C1, and therefore the copy already held by compartment B is not invalidated. Instead, the copy already held by compartment B retains a valid capability that can be used to access the region of memory defined by shared 0 (which has now been released). Compartment A now creates a second capability C2 containing secret data. Due to the way memory allocation works, there is a reasonable chance that this memory allocation will use at least a portion of the memory previously allocated to shared 0. Specifically, capability C2 will likely refer to the memory region that overlaps with capability C1. Then, compartment A creates another capability C3 to describe region share 1. Compartment A then makes a second call to compartment B, this time passing capability C3. If compartment B now uses its copy of capability C1 stored in the heap, then compartment B will actually access the memory region referred to by capability C2, which includes secret data. Figure 2BAs shown, this is because the area of ​​memory covered by capability C1 overlaps with the area of ​​memory used to store secret data via C2. In this particular example, it is possible that compartment B can only access a portion of the secret data because capability C1 only extends into a portion of C2. However, it is possible that the reverse is also true, and capability C1 covers not only C2 but also C3. It should be noted that throughout this process, no restrictions on capabilities are violated. Specifically, copying capabilities is legitimate as long as the metadata is not modified. Furthermore, since the failure of capability C1 does not cause the copy of the capability to become invalid, the copy of capability C1 stored in the heap of compartment B will not become invalid, and therefore it can continue to be used even if the area referred to by the memory has been repurposed in practice. This technique attempts to solve this problem.

[0042] Figure 3 An example of a data processing apparatus 300 according to some embodiments is illustrated. The data processing apparatus 300 includes memory circuitry 110 defining a physical address space. At least a portion of this physical address space is logically divided into a plurality of segments 370a, 370b, 370c, and 370d. In this example, capability C0 380 is stored within one of the segments 370a. A tracking circuit 310 is provided that tracks whether the capability is stored within each of the segments 370a, 370b, 370c, and 370d. In this example, the tracking circuit 310 includes a Bloom filter. The Bloom filter 310 provides a bit field consisting of a plurality of bit vectors 330, 340, 350, and 360. Each of the bit vectors 330, 340, 350, and 360 corresponds to one of the segments 370a, 370b, 370c, and 370d. It should be noted that logical partitions may or may not be set in a consistent manner, and the size of each segment may be arbitrarily chosen by the software, for example, at startup or during runtime.

[0043] The content of each bit vector in bit vectors 330, 340, 350, and 360 is computed by hashing the boundaries of each capability located within the corresponding memory segment. For example, if we assume that the only capability in the first segment 370a is capability C0380, then the corresponding bit vector 330 is generated by hashing the boundaries of capability C0380. Whenever a capability is added or moved to the first segment 370a, a hash of the boundaries of that capability is built, and a logical OR is performed on the existing bit vector 330 corresponding to that segment 370a. Note that, with respect to the Bloom filter, since capability 380 is removed from the corresponding memory segment 370a, bit vectors 330, 340, 350, and 360 are not modified. Therefore, within multiple additions (logical ORs), the bit vector 330 corresponding to memory segment 370a will saturate. In other words, the corresponding bit vector 330 will all become 1. This can be addressed by periodically rebuilding the Bloom filter. The contents of the tracking circuit are privileged and therefore can only be accessed in a restricted manner—for example, only through hardware access, or in some implementations through a privileged mode accessible by the operating system.

[0044] When a failure of capability 380 is to be performed, the failure circuit 320 queries the tracking circuit 310 to search for an equivalent capability in memory 300. Before the revocation is complete, threads capable of accessing the address space currently targeted by the revocation circuit are stopped. Interrupts associated with software potentially capable of accessing said address space are also disabled. Therefore, the equivalent capability cannot be transferred to the already considered portion of memory, which could result in capability loss. In these examples, a hash of the capability 380 to be failed is constructed. The hash is then compared with each of the bit vectors 330, 340, 350, and 360, which are themselves generated by performing a logical OR on the hash of the capability stored in the corresponding memory segment. This comparison can be achieved by performing a logical AND operation between the hash of the boundary of the capability 380 to be failed and the bit vector to be tested. If the result equals the hash of the boundary of the capability 380 to be failed, then a kill has been achieved on that entry in the tracking circuit 310.

[0045] For example, consider the following case: if the boundary of C1 falls within the boundary of C0, then capability C1 is equivalent to capability C0. This can be achieved by considering the upper and lower bounds of each capability separately. For the upper bound, the least significant "1" and all low bits of the upper bound of each capability are set to "1". For example, if the upper bound of C0 is 00001000, it is hashed to 00001111, and if the upper bound of C1 is 00000100, it is hashed to 00000111. A logical AND between these produces 00000111, which is equal to the hashed upper bound of C1. In other words, the upper bound of C1 is less than or equal to the upper bound of C0.

[0046] For the lower bound, the same operation can be performed by checking the result of a AND operation on C0 but not C1. This shows whether C0 is less than or equal to C1, which in turn suggests whether C1 is greater than or equal to C0.

[0047] Since both conditions are met, the upper and lower bounds of C1 lie within the upper and lower bounds of C0, and therefore C1 limits the sub-region of C0. When a hash entry in a memory segment contains multiple capabilities, a logical OR is used to combine the upper and lower bounds of each capability individually to provide a combined lower and upper bound. Other hashing algorithms will be known to those skilled in the art.

[0048] It should be noted that the nature of a Bloom filter is that even when a kill occurs, the existence of the entry is not guaranteed. Therefore, it is necessary to search the corresponding memory segment to determine whether the equivalent capability actually exists. This can be achieved by sweeping through the relevant memory segment. For example, if a kill occurs on entry 350 of tracking circuit 310, a sweep occurs on the corresponding memory segment 370c of memory circuit 110. Since it is not expected that a kill will occur in every entry 330, 340, 350, 360 of tracking circuit 310, it is expected that certain segments 370a, 370b, 370c, 370d of memory will not need to be swept, and therefore it is not necessary to search the entire memory 110 for the corresponding capability.

[0049] Note that a Bloom filter is used in this example. However, in other examples, smaller bit fields can be used to indicate whether each memory segment 370a, 370b, 370c, 370d contains an accessor / capability. Specifically, a "1" for a particular entry can indicate that the corresponding memory segment 370a, 370b, 370c, 370d contains a capability, while a "0" can indicate that the memory segment 370a, 370b, 370c, 370d does not contain a capability. The advantage of this data structure is that it is smaller than a Bloom filter. However, this data structure cannot distinguish between different capabilities because boundary information is not considered. Therefore, this data structure cannot provide an indication of whether a capability with a specific boundary is located within the memory segment, and further analysis of the memory segment is more likely to be required. Another option is to track the boundaries of capabilities within each memory segment. For example, some implementations track the minimum base address and maximum limit (e.g., top) address of each capability within the memory segment. Space in the tracing circuitry can be saved by removing bits from these addresses (such as the least significant bit) or by tracking the hashes of the maximum and minimum addresses. By tracking this additional information, it's less likely that memory segments will be examined more closely. Another way to track this information is to use the tracing circuitry itself to record boundary information for each capability within the memory segment—the precise address, relevant bits, or hash. This would reduce the probability of false positives and false negatives. However, examining each entry in the tracing circuitry would take longer, and the tracing circuitry would require additional storage space.

[0050] Although the tracing circuit 310 is shown as a different element in this example, in other examples, the tracing circuit may take the form of a series of instructions executed on a central processing unit (CPU). In these embodiments, the operations associated with tracing may be initiated by, for example, an operating system or a hypervisor. Regardless of whether the tracing circuit is a different unit, the data used by the tracing circuit (tracing data) may be stored within a memory hierarchy (e.g., in main memory) or in dedicated storage circuitry.

[0051] Figure 4A flowchart 400 illustrates a process for invalidating an equivalent access according to some embodiments. The process begins at step 405, where a invalidation request for a specific accessor is received. At step 410, the boundaries defining the access to be invalidated are hashed. Then, at step 415, it is determined whether there are any additional entries to consider in the tracking circuit 310. If not, the scan of the tracking circuit 310 is complete, and the process restarts by returning to step 405 to wait for the next accessor to be invalidated. Otherwise, at step 420, the next entry in the tracking circuit 310 is considered, and at step 425, it is determined whether there is a hit against the hashed boundaries calculated in step 410. If not, the process returns to step 415 to consider any additional entries in the tracking circuit 310. Otherwise, the process proceeds to step 430, where the memory segment corresponding to the hit entry is swept. Specifically, step 435 determines whether there are any additional entries to consider in the segment to be swept. Such entries can consist of bytes or a memory block of the same size as the accessor (e.g., capability). For example, if the capability is 128 bits long, the entries under consideration can be multiples of 128 bits, so that the capability is not spread across multiple entries. If no more entries are available to consider, the process returns to step 415. Otherwise, the process proceeds to step 440, where the next entry for the memory segment is obtained. Step 445 considers whether the entry under consideration is an accessor representing a sub-region of the boundary of the accessor to be invalidated. If not, in this example, the entry under consideration is not an equivalent accessor, and therefore the process returns to step 435. Otherwise, the process proceeds to step 450, where it is determined whether there is equivalence between the permissions of the accessor to be invalidated and the current entry of the memory segment. This may occur if the permissions match or if one set of permissions is a subgroup of permissions in another set of permissions. If not, in this example, the accessor is not considered equivalent, and therefore the process returns to step 435. Otherwise, the accessor is considered equivalent, and the accessor in the current entry is invalidated in step 455 before the process returns to step 435.

[0052] Checking permissions makes it possible to revoke write access to regions that are not yet covered by read or execute capabilities (for example) that have not been invalidated.

[0053] Therefore, for each entry in the hit test trace circuit, in the event of a hit, the memory segment corresponding to the hit entry is swept. Each hit entry within the memory segment is tested to determine if they are equivalent accessors. In this example, accessors are considered equivalent if (a) the accessor refers to a sub-region defined by the boundary of the accessor to be invalidated and (b) the permissions are the same. In other examples, additional tests may be provided to test equivalence. For example, the two regions may need to be identical. In some examples, permissions do not need to match, or it will only be necessary that the permissions of one accessor are a subgroup of the permissions of the other accessor. Additional tests may also be added. Specifically, this example does not explicitly require setting the validity label of the accessor to be tested. However, it is not necessary to invalidate an already invalidated accessor, and therefore additional tests can be performed regarding whether a particular entry contains a currently valid accessor. If the accessor to be tested is invalidated, non-equivalence is assumed.

[0054] As previously explained, Bloom filters can be used to provide a probabilistic determination of whether a particular memory segment contains an equivalent accessor to be invalidated. Specifically, the Bloom filter is populated with a hash of accessor parameters that define equivalence (e.g., boundaries and / or permissions). However, because the Bloom filter is populated by performing a logical OR between the hash of the entry to be added to the Bloom filter and the current value of the Bloom filter, it is very difficult to update the entries of the Bloom filter to represent the removed capabilities. Therefore, after numerous additions and removals, Bloom filter entries may still always hit even if no capabilities remain in the corresponding memory segment. One way to address this is to periodically rebuild the entries of the memory segment, taking into account the currently valid entries in the corresponding memory segment and ignoring those that have failed.

[0055] Figure 5 Example flowchart 500 illustrates the process of reconstructing a Bloom filter entry for a memory segment when a life occurs on a corresponding Bloom filter entry. Steps 505 to 555 can be used as Figure 4 The substitution shown in steps 430 to 455. Relative to Figure 5 The process illustrated utilizes a 'sweep mode' of operation, which allows existing write mechanisms to be repurposed for reconstructing Bloom filter table entries. Specifically, this process assumes that when capability is written to memory, the write instruction also updates the tracking circuitry.

[0056] When a hit occurs on a specific entry of the Bloom filter, the process begins at step 505. At step 505, the corresponding entry of the Bloom filter that caused the hit is erased. At step 510, a sweep of the corresponding memory segment begins. This also initiates the 'sweep mode' of the failed circuit's operation. At step 515, it is determined whether there are any more entries for the segment under consideration. If not, the process returns to consider whether other memory segments might be hit. For example, this could lead to a return to... Figure 4 Step 415 is shown. If more entries exist, at step 520, the next entry in the memory segment is considered. At step 525, it is determined whether the entry in the memory segment is a capability. If not, the process returns to step 515. At step 540, it is determined whether this capability defines a sub-region bounded by the boundary defined by the capability to be invalidated. If not, the process proceeds to step 555, discussed below. If yes, at step 545, it is determined whether there is equivalence between permissions, as previously described (e.g., matching or subgrouping in some embodiments). If no, the process proceeds to step 555. Otherwise, the process proceeds to step 550, where the capability is invalidated because it is considered an equivalent capability. The process then proceeds to step 535, where a validity label is set for the capability to indicate its invalidation. At step 555, data rewriting is performed. Again, the existing write mechanism is used to implement the data rewriting process because the ongoing sweep mode does not actually require physically rewriting the data back to memory. This makes it possible to use the existing write mechanism to update the Bloom filter table entries. However, in this case, since the capability data is already in memory, there is no actual need to write the data to memory. Therefore, although the write mechanism is invoked, no data is physically written to memory, and the existing contents of the memory location remain unchanged. This makes it possible to reuse the existing mechanism while reducing the impact on memory bandwidth, as no data needs to be provided for the write process. After the rewrite is performed, the process returns to step 515.

[0057] As a result of the sweep mode, the amount of data physically written is reduced. Specifically, in the case of an invalid entry, only the tag needs to be written. In other cases, no data is actually written, and the write mechanism is only used to update the filter.

[0058] Figure 6Examples of various improvements that can be made to the currently described technique are illustrated. Specifically, the address space provided by memory 110 can be divided into insecure memory 605 and secure memory 610. Different trace tables (e.g., Bloom filter tables) can be provided for a first segment 615a of memory located in insecure memory 605 and a second segment 615b of memory located in secure segment 610. This can be used to help isolate insecure memory 605 and secure memory 610.

[0059] It should be understood that, such as Figure 6 As shown, not all memory segments need to be covered by the table of tracking circuit 310. For example, consider non-secure memory 605, where portion 615a is covered by a Bloom filter table, while other segments 625, 630, 635, and 640 are simply marked to indicate whether that segment contains an accessor / capability. Unlike Bloom filters, marking may be appropriate in cases where a segment of memory is extremely unlikely to contain a capability (and therefore, detailed reporting is unnecessary); or where capabilities are frequently added and removed, making it highly likely that the relevant Bloom filter entries will saturate. This latter situation is particularly likely in the case of an application stack, a data structure used to temporarily store data values ​​during the computation of a specific threat.

[0060] The above description illustrates how multiple tables can be provided for multiple security domains. However, other methods exist where memory space can be managed to avoid tracing circuitry tracking the entire address space. In some implementations, tracing circuitry may provide a table (e.g., a Bloom filter table) for each different thread or privilege level. The table to be searched can then be switched as the thread changes. Thus, the amount of memory to be searched can be reduced to only the region of memory associated with the current thread, allowing for finer-grained tracing. Where capabilities are shared between threads, it is necessary not only to check the current Bloom filter table (for the current thread) but also to check the table associated with the thread that can share the capability. In some implementations, a table may be provided for each Memory Protection Unit (MPU).

[0061] In the preceding description, it was assumed that each entry in the tracing circuit was considered to determine which entries were "hit". For each "hit", the corresponding memory segment was then searched to find the equivalent accessor / capability. In other embodiments, the minimum and maximum addresses allocated to the address space of a thread are traced. When a failure occurs, only those entries corresponding to memory segments falling within the minimum and maximum limits are considered. In this way, memory segments that have not yet been allocated are "skipped". In some embodiments, the memory allocation itself is traced. Other embodiments may trace the minimum and maximum addresses of the capability memory area, such that only those areas of memory containing the capability are considered. Still other embodiments may consider only those entries located in the effective MPU area.

[0062] During runtime, the amount of memory to be tracked can change, and this can be compensated for. One way to do this is to use the aforementioned "marking" system for areas outside the main tracking region of the memory. Another possibility is to expand the table (if sufficient memory is available) to store more entries. If additional memory is unavailable, it is possible to compensate by increasing the "fragment size" (e.g., the size of each memory region covered by entries in the tracking circuitry).

[0063] For updating the tracking circuit, a buffer can be provided to store frequently accessed entries within the tracking circuit. This is particularly beneficial if the data structure used by the tracking circuit would otherwise have a long latency (e.g., if the data structure is stored in main memory). Another possibility is to include memory update instructions. These instructions fetch the value from memory, perform operations (such as a logical OR operation between the value in memory and another value), and write the result back to memory. In this way, updates to the data in the tracking circuit can be performed without retrieving data from memory, performing operations on the data, and writing back in a series of time-consuming memory transactions.

[0064] Figure 7A flowchart 700 illustrating a data processing procedure according to some embodiments is shown. At step 710, an address space is provided to a memory segment. The address space does not necessarily need to be precisely divided into memory segments, and segments of the address space may exist outside the memory segments. At step 720, one or more accessors for accessing specific areas of the address space are stored. At step 730, tracing is performed on the memory segment to determine whether a particular memory segment contains an accessor. This can be achieved by adding tracing capabilities to instructions that perform capability operations. For example, instructions for creating or copying capabilities can be extended to update the tracing circuitry 310. At step 740, a fail request is received for one of the accessors. At step 750, an equivalent accessor is determined with reference to the tracing circuitry used to perform the tracing in step 730. If an equivalent has been determined, at step 760, those equivalent accessors are then fail.

[0065] By using trace circuitry in this way, in many cases it is not necessary to search the entire memory address space for the equivalent accessor. Instead, it is possible to use trace circuitry to limit the memory segments that need to be searched, thereby reducing the resource efficiency of the process of invalidating the equivalent accessor. By invalidating the equivalent accessor in this way, it is possible to limit unauthorized access to memory regions in a resource-efficient manner.

[0066] Figure 8Examples of emulator implementations that can be used are illustrated. While the previously described embodiments implement the invention in terms of means and methods for operating specific processing hardware supporting the technologies involved, it is also possible to provide an instruction execution environment according to the embodiments described herein, which is implemented using a computer program. Such computer programs are generally referred to as emulators, in part because they provide a software-based implementation of a hardware architecture. Types of emulator computer programs include simulators, virtual machines, models, and binary converters, including dynamic binary converters. Typically, an emulator implementation can run on a host processor 830 that supports an emulator program 810, which optionally runs a host operating system 820. In some arrangements, multiple emulation layers may exist between the hardware and the provided instruction execution environment and / or multiple different instruction execution environments provided on the same host processor. Historically, powerful processors were required to provide emulator implementations that execute at a reasonable speed, but this approach may be reasonable in certain situations, such as when it is desirable to run code native to another processor for compatibility or reuse reasons. For example, an emulator implementation may provide additional functionality to the instruction execution environment that is not supported by the host processor hardware, or provide an instruction execution environment that is typically associated with a different hardware architecture. An overview of the simulation is given in the following literature: “Some Efficient Architecture Simulation Techniques”, Robert Bedichek, Winter 1990 USENIX Conference, pp. 53-63.

[0067] With respect to embodiments previously described with reference to specific hardware constructions or features, in simulated embodiments, equivalent functionality may be provided by suitable software constructions or features. For example, specific circuitry may be implemented as computer program logic in simulated embodiments. Similarly, memory hardware such as registers or cache memory may be implemented as software data structures in simulated embodiments. One or more of the hardware elements referenced in the previously described embodiments are present in an arrangement on host hardware (e.g., host processor 830), and where appropriate, some simulated embodiments may utilize the host hardware.

[0068] The simulator program 810 may be stored on a computer-readable storage medium (which may be a non-transitory medium) and provides a program interface (instruction execution environment) to the target code 800 (which may include application programs, operating systems, and management programs), the same as the interface of the hardware architecture modeled by the simulator program 810. Therefore, the simulator program 810 can be used to execute program instructions of the target code 800 from within the instruction execution environment, enabling a host computer 830, which does not actually possess the hardware features of the device 300 discussed above, to emulate these features.

[0069] In this example, simulator program 810 utilizes memory data structure 812 to simulate memory accessible by object code 800. Memory data structure 812 includes one or more accessor data structures 814, which can be created and / or used by object code 800, and which are used to access memory elements 816 within memory data structure 812. Similarly, memory elements 816 can be created and / or used by object code 800. Simulator program 810 also includes tracer logic 818, which simulates memory accessibility with respect to memory data structure 812. Figure 3 The tracking circuit 310 discussed here functions to track the use of the accessor data structure 814 in the memory data structure 812. Additionally, the simulation 810 utilizes the invalidation procedure logic 819 to invalidate the equivalent accessor data structure 814 in the memory data structure 812.

[0070] In this application, the phrase "configured as..." is used to mean that the elements of the device have a configuration capable of performing the defined operations. In this context, "configuration" means the arrangement or manner of interconnection of hardware or software. For example, the device may have dedicated hardware that provides the defined operations, or a processor or other processing device may be programmed to perform the function. "Configured as" does not mean that the elements of the device need to be changed in any way to provide the defined operations.

[0071] While exemplary embodiments of the invention have been described in detail herein with reference to the accompanying drawings, it should be understood that the invention is not limited to those precise embodiments, and various changes, additions, and modifications can be made therein by those skilled in the art without departing from the scope and spirit of the invention as defined by the appended claims. For example, features of the dependent claims may be combined with features of the independent claims in various ways without departing from the scope of the invention.

Claims

1. A data processing apparatus, the data processing apparatus comprising: A memory circuit for providing a physical address space logically divided into multiple memory segments, and for storing multiple accessors with associated validity indicators, wherein each accessor controls access to a segment of the physical address space based on at least its associated validity indicator. A tracking circuit, the tracking circuit being used to track which memory segments contain the accessor; and A failure circuit is configured to respond to a request to fail an accessor by referring to the tracking circuit to determine a set of equivalent accessors, and to fail the accessor and the equivalent accessor by setting the associated validity indicator of each of the accessors and the equivalent accessors to indicate that the accessor and the equivalent accessor are failed.

2. The data processing apparatus according to claim 1, wherein The equivalent accessor includes those accessors that control access to the region of the physical address space.

3. The data processing apparatus of claim 1, wherein the accessor includes a pointer.

4. The data processing apparatus according to claim 3, wherein The accessor includes boundary information of the region that defines the physical address space that the pointer can access.

5. The data processing apparatus according to claim 4, wherein The equivalent accessor includes those accessors whose boundary information matches the boundary information of the accessor.

6. The data processing apparatus according to claim 4, wherein The equivalent accessor includes those accessors whose boundary information in the accessor defines a sub-region of the region of the physical address space.

7. The data processing apparatus according to claim 1, wherein The tracking circuit is adapted to indicate whether each memory segment in the memory segment contains one of the accessors.

8. The data processing apparatus according to claim 1, wherein The tracking circuit includes a bit field containing multiple bits; and The plurality of bits are adapted to indicate which memory segment contains one of the accessors.

9. The data processing apparatus according to claim 1, wherein The tracking circuit includes a hash table; and The hash table accepts at least a portion of the hash of the accessor as input.

10. The data processing apparatus according to claim 1, wherein The tracking circuit includes a Bloom filter.

11. The data processing apparatus according to claim 10, wherein The failure circuit is adapted to perform a sweep of the given memory segment and reconstruct the entry of the Bloom filter corresponding to the given memory segment when the tracking circuit indicates that a given memory segment contains one of the accessors.

12. The data processing apparatus according to claim 11, wherein The failure circuit is adapted to reconstruct the entry of the Bloom filter corresponding to the given memory segment by considering the associated validity indicator of each of the accessors in the given memory segment.

13. The data processing apparatus according to any one of claims 11 to 12, wherein The entries corresponding to the given memory segment in the Bloom filter are reconstructed by rewriting those accessors located in the given memory segment; and The failure circuit is adapted to operate in a sweep mode when the associated validity indicator indicates validity, in which the rewrite is performed by suppressing the physical writing of the accessor to the memory.

14. The data processing apparatus according to claim 1, wherein The failure circuit is adapted to sweep the given memory segment to determine the equivalent accessor when the tracking circuit indicates that the given memory segment contains one of the accessors.

15. The data processing apparatus according to claim 1, wherein The failure circuit is adapted to avoid sweeping the given memory segment to determine the equivalent accessor when the tracking circuit indicates that each of the accessors is missing in a given memory segment.

16. The data processing apparatus according to claim 1, wherein The memory circuitry is further logically partitioned to include an active stack area; The tracking circuit includes a bit field for tracking the active stack area; and The tracking circuitry includes a hash table or Bloom filter that tracks the memory segment.

17. The data processing apparatus according to claim 1, wherein The memory circuitry is further logically partitioned to include an active stack area; and The tracking circuit is restricted to tracking the active stack area.

18. The data processing apparatus according to claim 1, wherein The tracking circuit is adapted to further track those accessors stored outside the memory segment.

19. A data processing method, the data processing method comprising: The physical address space of the memory is logically divided into multiple memory segments; The storage includes a plurality of accessors with associated validity indicators, wherein each of the accessors controls access to a region of the physical address space based on at least its associated validity indicator; Track which memory segments contain the accessor; A set of equivalent accessors is determined by a reference tracking circuit to respond to requests to disable accessors; and The accessor and the equivalent accessor are disabled by setting the associated validity indicator of each of the accessors to indicate that the accessor and the equivalent accessor are disabled.

20. A computer program product for controlling a host data processing device to provide an instruction execution environment, comprising: Multiple data structures are used to store multiple accessors having associated validity indicators, wherein each accessor controls access to one of the data structures according to at least its associated validity indicator; Tracing program logic, which is used to trace which data structures in the data structure contain the accessor; and The failure procedure logic is configured to respond to a request to fail an accessor by referring to the trace procedure logic to determine a set of equivalent accessors, and to fail the accessor and the equivalent accessor by setting the associated validity indicator of each of the accessors and the equivalent accessors to indicate that the accessor and the equivalent accessor are failed.

Images