Techniques for controlling manipulation of pointers

Abstract

An apparatus is disclosed, the apparatus comprising: a decoder circuit to decode an instruction, where the decoder circuit generates a control signal in response to a sequence of instructions; and processing circuitry to perform an operation defined by the instruction sequence in response to the control signal. The decoder circuit generates one or more control signals in response to a pointer control prefix instruction in the sequence of instructions to cause the processing circuit to incorporate a pointer control operation in association with a data processing operation defined by a given data processing instruction subsequent to the pointer control prefix instruction in the sequence, the controller is configured to control whether a data processing operation produces a result operand that is deemed valid if a given input operand of a given data processing instruction is a pointer operand that identifies a pointer for determining an address to access the memory.

Description

Background Technology

[0001] This technology relates to the field of data processing.

[0002] Within a data processing system, the instructions to be executed and the data values ​​to be processed during the execution of such instructions are typically stored in the memory system. To access the memory system, addresses can be generated to identify the location in memory containing the instructions or data values ​​of interest. The system can use pointers to generate such addresses. For example, a pointer can directly identify the address to be accessed, or it can be used in conjunction with other information, such as a base address or offset, to identify the address to be accessed. Data processing instructions that define associated data processing operations can be used to manipulate data values, and pointers can be processed in the same way as general data during such data processing operations. Therefore, when it is desired to change the value of a pointer, a data processing instruction can be executed, specifying the pointer as an input operand, and the associated data processing operation can be performed in exactly the same way that would be performed if the input operand were a general data value. In this way, it is possible to change the value of a specified pointer, for example, by performing an addition operation to adjust the value of the pointer by a specific amount.

[0003] Given that pointers are used to access memory, it is generally desirable to impose some restrictions on how pointers are updated. However, as mentioned above, when executing data processing instructions, the device typically does not distinguish between general data and pointers and will perform the same operation regardless of whether the specified input data is general data or data defining a pointer. This could potentially lead to pointers being manipulated in ways that are not permitted.

[0004] It may be impractical to attempt to provide pointer-specific variants of various data processing instructions that can be usefully associated with pointer values, because, for example, the instruction coding space available for defining all the various instructions that need to be executed by the system is limited. Therefore, it is desirable to provide a mechanism for controlling the manipulation of pointers when performing data processing operations, without having to provide dedicated pointer-specific data processing instructions. Summary of the Invention

[0005] According to a first example arrangement, an apparatus is provided, comprising: a decoder circuit for decoding instructions, wherein the decoder circuit generates control signals in response to a sequence of instructions; and a processing circuit for performing an operation defined by the sequence of instructions in response to the control signals; wherein: the decoder circuit generates one or more control signals in response to a pointer control prefix instruction in the sequence of instructions to cause the processing circuit to incorporate a pointer control operation associated with a data processing operation defined by a given data processing instruction following the pointer control prefix instruction in the sequence, to control whether the data processing operation produces a result operand, wherein the result operand is considered valid if a given input operand of a given data processing instruction is a pointer operand identifying a pointer for determining an address for accessing memory.

[0006] According to another example arrangement, a method for manipulating a pointer controlled by a device is provided, the method comprising: decoding an instruction sequence using a decoding circuit to generate control signals; performing an operation defined by the instruction sequence using a processing circuit in response to the control signals; and causing the decoding circuit to generate one or more control signals in response to a pointer control prefix instruction in the instruction sequence, such that the processing circuit incorporates a pointer control operation associated with a data processing operation defined by a given data processing instruction following the pointer control prefix instruction in the sequence, to control whether the data processing operation produces a result operand, wherein the result operand is considered valid if a given input operand of a given data processing instruction is a pointer operand identifying a pointer used to determine an address for accessing memory.

[0007] According to another example arrangement, a computer program including instructions, when executed by a host data processing device, controls the host data processing device to provide an instruction execution environment for executing target program code. The computer program includes: instruction decoding program logic for decoding instructions, wherein the instruction decoding program logic generates control signals in response to a sequence of instructions; and data processing program logic in response to the control signals to perform an operation defined by the sequence of instructions. Specifically, the instruction decoding program logic generates one or more control signals in response to pointer control prefix instructions in the instruction sequence to cause the data processing program logic to incorporate pointer control operations associated with a data processing operation defined by a given data processing instruction following the pointer control prefix instructions in the sequence, to control whether the data processing operation produces a result operand, wherein the result operand is considered valid if the given input operand of the given data processing instruction is a pointer operand identifying a pointer used to determine an address for accessing memory. Such a computer program can be set in any known transient computer-readable medium (such as wired or wireless transmission of code over a network) or non-transitory computer-readable medium such as semiconductor, magnetic disk, or optical disk.

[0008] In yet another example arrangement, a computer-readable medium is provided for storing computer-readable code for manufacturing an apparatus according to the first example arrangement described above. This computer-readable storage medium may be a transient computer-readable medium or a non-transitory computer-readable medium. Attached Figure Description

[0009] Further aspects, features, and advantages of this technology will become apparent from the following description, which is taken in conjunction with the accompanying drawings, in which:

[0010] Figure 1 An example of a data processing device is shown schematically;

[0011] Figure 2A This is a flowchart illustrating the steps taken when decoding pointer control prefix instructions, based on a specific example implementation;

[0012] Figure 2B This is a flowchart illustrating the steps taken when decoding a data processing instruction, which is of a type whose execution may be affected by pointer-controlled prefix instructions, according to a specific example implementation.

[0013] Figure 3 This schematically illustrates a form of pointer control operation that can be performed in a specific example implementation;

[0014] Figure 4 This is a flowchart illustrating the steps taken in a specific implementation when decoding pointer control prefix instructions;

[0015] Figure 5 This is a flowchart illustrating the steps that can be taken when a pointer control prefix instruction is applied to multiple associated subsequent instructions, based on a specific example.

[0016] Figure 6 This is a flowchart illustrating, based on an example, the steps taken in maintaining status indication information in exception entries and when returning from an exception;

[0017] Figure 7 This is a flowchart illustrating how the setting of an overwrite value, based on a specific example implementation, can affect the steps taken when decoding pointer control prefix instructions;

[0018] Figure 8 An example of a tag-protected memory access operation is shown, which includes checking whether the address tag matches the protection tag.

[0019] Figure 9 This is a flowchart illustrating a method for performing tag-protected memory access operations;

[0020] Figure 10 An example of addition with a carry is shown;

[0021] Figure 11 An example is given, based on a specific implementation of an example, how pointer control operations associated with an incorporation and data processing operation can affect the results produced by the data processing operation;

[0022] Figure 12 The label represents a flowchart of the implementation of pointer control operations based on an example.

[0023] Figure 13 The label retains the flowchart of the specific implementation of the pointer control operation according to the alternative example;

[0024] Figure 14 This example illustrates an invalid address pointer that can be generated when a pointer control operation is implemented.

[0025] Figure 15 This is a flowchart illustrating a method for executing an arithmetic instruction according to a specific example implementation, for which a pointer check has been indicated by a previously pointer-controlled prefix instruction;

[0026] Figure 16 This is a flowchart illustrating a method for executing memory access instructions; and

[0027] Figure 17 The specific implementation of the simulator is illustrated. Detailed Implementation

[0028] According to one example embodiment, an apparatus is provided having decoder circuitry for decoding instructions. Specifically, the decoder circuitry generates control signals in response to a sequence of instructions. The apparatus also has processing circuitry that, in response to these control signals, performs an operation defined by the sequence of instructions.

[0029] One or more of those instructions may be data processing instructions that perform associated data processing operations on the data values ​​of the input operands specified as those data processing instructions. Sometimes, the execution of such data processing instructions may be used to change the value of a pointer specified as an input operand, and typically the processing circuitry will execute the same associated data processing operation required by that data processing instruction, regardless of whether the data processing operation is used to modify the pointer or a general data value. As mentioned earlier, this could potentially lead to the pointer being manipulated in an unauthorized manner.

[0030] To mitigate this problem, according to the technique described herein, the instruction sequence may include pointer control prefix instructions. Subsequently, the decoding circuitry may be arranged to generate one or more control signals in response to such pointer control prefix instructions in the instruction sequence. These control signals cause the processing circuitry to incorporate pointer control operations associated with a data processing operation defined by a given data processing instruction following the pointer control prefix instructions in the sequence. Therefore, the presence of pointer control prefix instructions can be used to modify the sequence of steps taken when a given data processing instruction is subsequently executed by incorporating pointer control operations during the execution of that given data processing instruction. Pointer control operations can take various forms, but generally, they are arranged to control whether the data processing operation performed when a given data processing instruction is executed produces a result operand, which is considered valid if the given input operand of the given data processing instruction is a pointer operand identifying a pointer used to determine the address of memory access.

[0031] Therefore, by incorporating pointer control operations, it is possible to control whether the resulting operand will be considered a valid pointer if it is subsequently used as a pointer to determine an address in memory. This scenario can occur when the input operand of a data processing instruction is a pointer operand and the execution of the data processing instruction is used to generate a modified pointer to be used subsequently when accessing memory.

[0032] As mentioned earlier, when executing such data processing instructions, the processing circuit may not be able to distinguish between input operands that identify pointers and input operands that identify general data. However, when using pointer control prefix instructions, this can be used to affect the result operands produced by performing data processing operations, in order to control whether the result operands will be considered valid when subsequently used as pointers.

[0033] By using the techniques described herein, the behavior of one or more data processing instructions can be selectively modified to account for cases where one or more data processing instructions are used to manipulate pointers, without providing a dedicated set of equivalent pointer-specific data processing instructions. Furthermore, in some implementations, this allows for backward-compatible implementation with existing systems, since no new pointer-specific data processing instructions need to be decoded. For example, it is possible that pointer control prefix instructions can be encoded as "No-Operation" (NoP) instructions in existing systems that do not support their use. Consequently, such existing systems would simply treat the pointer control prefix instruction as a "No-Operation" instruction and therefore would not take any action in response to its encounter.

[0034] Pointer operands can take various forms, but in one example implementation, they include a pointer portion for identifying the pointer and a metadata portion for providing metadata associated with the pointer. The metadata represented in the metadata portion can take various forms, such as an address tag associated with a target address derived from the pointer, which can then be used in tag-protected memory access operations to perform a comparison of the address tag with a protection tag stored in the memory system in association with a block of memory locations including one or more memory locations identified by the target address. In another example, the metadata can take the form of garbage collection data associated with memory regions accessible by the pointer in the associated pointer portion of the pointer operand, which is referenced when a garbage collection process is performed to attempt to free up memory regions that are no longer in use.

[0035] Pointer control operations can take many forms, but in one example implementation, they are used to detect when a portion of the resulting operand corresponding to at least one of the pointer and metadata portions takes a value that would be considered invalid if the given input operand were a pointer operand. In this implementation, the pointer control operation may therefore attempt to check whether a particular portion of the resulting operand would be considered valid if the resulting operand were to be used as a pointer (e.g., this might be the case when the given input operand is a pointer operand and a data processing operation is being used to generate a modified pointer operand for subsequent use when accessing memory).

[0036] In one example implementation, when the given input operand is a pointer operand, the resulting operand, generated by executing a data processing operation defined by a given data processing instruction, is considered valid when the value of the portion of the resulting operand corresponding to the metadata portion matches the value of the metadata portion of the given input operand. In this example, the pointer control operation can be used to detect when a mismatch exists between the value of the portion of the resulting operand corresponding to the metadata portion and the value of the metadata portion of the given input operand. For example, such a mismatch might occur where the data processing operation is only intended to adjust the pointer value in the pointer portion, but an overflow condition occurs that causes one or more bits to propagate into the metadata portion, thereby altering the metadata portion. This scenario can occur unintentionally or intentionally in an attempt to update a value in the metadata portion when it should not be modified. Given previous examples where metadata may provide address tags, such a deliberate attack could be used to attempt to compromise the security benefits provided by tag-protected memory access mechanisms by potentially allowing software blocks to access memory regions they should not be allowed to access. However, by using the techniques described herein, where the pointer control operation is thus incorporated in association with the data processing operation, such situations can be detected and appropriate action taken.

[0037] In the examples above, pointer control operations are used to detect when the metadata portion is modified in a way that is not permitted. However, in alternative implementations, pointer control operations can be used to detect when the pointer portion has been modified in a way that should be considered invalid. For example, when the data processing operation is a combination of multiplication and addition, it may be appropriate for the result of the multiplication operation not to overflow when manipulating pointer operands using such data processing operations, and pointer control operations can be used to detect when such an overflow does occur and then take appropriate action.

[0038] Several actions can be taken. However, in one example implementation, when the execution of a pointer control operation indicates that the result operand will be considered invalid if the given input operand is a pointer operand, the processing circuitry can be arranged to set at least a given portion of the result operand to an error indication value.

[0039] One might assume that an appropriate response to detecting that the result operand has been updated in a way that should be considered invalid would raise an exception. However, there can be significant performance costs associated with raising a processor exception, and this may not be reasonable in all cases. For example, the result operand may never be used as an address pointer; in this case, if the result operand were used as a pointer, detecting that the result operand is invalid might not be a problem. The method described above, which sets at least a given portion of the result operand to the error indication value, does not incur such high performance costs. For example, this method could then make it possible to detect an error at a later stage without immediately incurring the performance costs associated with raising an exception.

[0040] In the example of the pointer control operation above, the execution of the pointer control operation involves performing checks to determine when the result operand has been updated in a way that should be considered invalid if the result operand will be used as a pointer. However, pointer control operations can take many other forms. For example, in one example implementation, no specific checks may be performed, and instead, the execution of the pointer control operation may cause a portion of the result operand to be set to a value that matches the value of the corresponding portion of the given input operand. Thus, when the result operand is generated where the given input operand represents a pointer, this can be effectively implemented simply by copying the relevant portion of the given input operand within the result operand, without explicitly checking whether the relevant portion of the result operand will otherwise differ from the corresponding portion of the given input operand, provided that the execution of the data processing operation should not change the value of a specific portion of the given input operand.

[0041] This approach provides a particularly simple and efficient mechanism for offering appropriate control when updating pointer values. It should also be noted that this approach offers further potential benefits. For example, if a given input operand already represents an invalid pointer, marking the pointer as invalid can be propagated to the pointer generated as the result operand, thus ensuring that invalid states are accumulated.

[0042] As previously described, pointer operands may include a pointer portion for identifying the pointer and a metadata portion for providing metadata associated with the pointer. In this specific implementation, the execution of pointer control operations of the form described above can be arranged such that the processing circuitry sets the value of the portion of the resulting operand corresponding to the metadata portion to match the value of the metadata portion of the given input operand. Therefore, it can be ensured that when data processing operations are performed on the input pointer operand to generate a modified pointer operand, the value of the metadata portion is not updated.

[0043] A given data processing instruction can take many forms. In one example implementation, the given data processing instruction is an arithmetic instruction, and when the given input operand is a pointer operand, the execution of the data processing operation defined by the arithmetic instruction is arranged to manipulate the value of the pointer identified by the pointer operand to produce a modified pointer operand as the result operand. Arithmetic instructions can take many forms, but in one example implementation, the arithmetic processing operation defined by the arithmetic instruction can be an arithmetic operation involving addition, and therefore, as an example, the arithmetic instruction could be an addition instruction, a multiplication / addition instruction, etc. However, it should be noted that pointer control prefix instructions can be used in association with a variety of instructions, and in some cases, can be used in association with instructions that are not arithmetic instructions. For example, pointer control prefix instructions can be used in association with instructions that define logical operations (such as OR or AND operations), for example, in cases where such instructions are envisioned to be used to modify pointer operands.

[0044] There are several ways in which, when executing a data processing operation defined by a given data processing instruction, a control signal generated by the decoding circuit during the decoding of the pointer control prefix instruction can be used to trigger the execution of the pointer control operation. However, in one example embodiment, the apparatus also includes a state storage device for storing state indication information, and the decoding circuit generates one or more control signals in response to the pointer control prefix instruction to set the state indication information to a first state, which indicates that the pointer control operation will be incorporated in association with the data processing operation defined by the given data processing instruction. Therefore, the presence of the state indication information in the first state can be used to trigger the incorporation of the pointer control operation in association with the relevant data processing operation.

[0045] In one example implementation, the processing circuitry can be arranged to, in response to a status indication information having a first state, incorporate pointer control operations associated with data processing operations defined by a given data processing instruction, and change the status indication information to a second state. In one example implementation, the second state may indicate that pointer control operations are not required, and thus return the system to a default state, in which data processing operations defined by subsequent data processing instructions are executed in a standard manner without incorporating any pointer control operations. However, in an alternative implementation, as will be discussed in more detail later, a single instance of a pointer control prefix instruction can be used to associate pointer control operations with multiple subsequent data processing instructions. In this case, the second state may differ from the first state, but may still identify the need for one or more additional applications of the pointer control operations. For example, the first state may identify the number of subsequent data processing instructions for which pointer control operations need to be applied, and the second state may indicate a reduced number to account for the fact that applications that have already performed pointer control operations.

[0046] In one example implementation, the given data processing instruction is an instruction of a given type and is expected to be the next instruction to be executed after a pointer control prefix instruction. In this example implementation, the processing circuitry can be arranged to take one of several actions in response to a next instruction to be executed after a pointer control prefix instruction, rather than the given data processing instruction. For example, the processing circuitry can be arranged to retain status indication information in a first state until the given data processing instruction is executed. Alternatively, the processing circuitry can be arranged to clear the status indication information to a second state (e.g., if the given data processing instruction is not encountered as the next instruction to be executed after a pointer control prefix instruction, it is considered appropriate not to merge the pointer control operation with the execution of the given data processing instruction). As another alternative, assuming that the expected behavior has not yet been observed (i.e., the next instruction is not the expected given data processing instruction), it may be considered appropriate to generate an exception. As yet another alternative, an indication of unexpected behavior can be stored in a memory element for later reference, which provides a less intrusive approach than raising an exception and may be considered sufficient in some implementations. The storage element can take many forms, but in one example implementation it can take the form of a status register, which allows a value to be set in the status register to indicate when a pointer control prefix instruction is followed by no expected given data processing instruction.

[0047] As previously described, one instance of a pointer control prefix instruction may affect multiple subsequent data processing instructions. Specifically, in one example implementation, the decoding circuitry may generate one or more control signals in response to a pointer control prefix instruction in the instruction sequence, causing the processing circuitry to perform pointer control operations for associated data processing operations defined by multiple given data processing instructions following the pointer control prefix instruction in the sequence. In this implementation, the aforementioned first state may be arranged to indicate the number of given data processing instructions for which the processing circuitry will perform pointer control operations for the associated data processing operations, and the processing circuitry may be arranged to update the state indication information each time a pointer control operation is performed to identify the remaining number of given data processing instructions for which pointer control operations will be performed.

[0048] In an implementation that uses the previously mentioned status indication information to track whether pointer control operations need to be incorporated during the execution of one or more subsequent data processing operations, in an example implementation, the processing circuitry can be arranged such that the status indication information is retained when an exception occurs and restored upon returning from the exception. This ensures that the status indication information is retained when an exception occurs, so that it can be referenced again when returning from the exception. The status indication information can be retained in various ways. For example, it can be retained as an entry in a saved processor status register, which is populated over the exception entry and subsequently used to restore the processor state upon returning from the exception.

[0049] While in some embodiments the given data processing instructions associated with the pointer control prefix instructions may be predetermined, or in practice may be other relevant information, such as the form of the pointer control operation to be performed and the action to be taken based on the result of the pointer control operation, in other embodiments, one or more of these aspects may be configurable. For example, in one example embodiment, the apparatus may also include a configuration storage device to provide at least one of the following:

[0050] Instruction indication information, which enables the processing circuitry to identify a given data processing instruction to perform pointer control operations;

[0051] Control instruction information, which enables the processing circuitry to identify the form of the pointer control operation to be performed;

[0052] Action indication information, which identifies the action to be taken if the execution of a control operation results in the determined result operand being considered invalid. This action indication information may, for example, indicate how the result operand should be modified so that, if a pointer check operation indicates that the result operand should be considered invalid if it is to be used as a pointer, the previously mentioned error indication value is incorporated.

[0053] The configuration storage device can take various forms depending on the specific implementation. For example, the configuration storage device can be a system control register, and the aforementioned information can be set in the system control register by any suitable means (e.g., by executing one or more earlier instructions). Alternatively, the configuration storage device can take the form of the aforementioned state storage device for storing state indication information, and this information can be identified by pointer control prefix instructions and stored in the state storage device when the pointer control prefix instructions are decoded. When the pointer control prefix instructions are associated with multiple subsequent data processing instructions, more fine-grained information can be stored in the state storage device, such as capturing the pointer control operations to be performed on an instruction-by-instruction basis, or actions to be performed if the execution of a pointer control operation results in the determination that the operand will be considered invalid.

[0054] Regardless of the form of the configuration storage device used, in one example implementation, the form of the check operation performed may depend on the type of data processing instructions associated with the pointer control prefix instructions.

[0055] In one example implementation, the given data processing instruction is a predetermined instruction following a pointer control prefix instruction in a sequence, such as the next instruction after a pointer control prefix instruction in a sequence, the next instruction of a specific type, etc. Therefore, in this implementation, no configuration storage device is required to identify the given data processing instruction to be associated with the pointer control prefix instruction.

[0056] In one example implementation, the application of pointer control operations can be configurable if desired. For instance, the apparatus may include a configuration storage device that, when storing a predetermined value, causes the decoder circuitry to refrain from performing any operation due to a pointer control prefix instruction, rather than generating one or more control signals to associate the processing circuitry with a data processing operation defined by a given data processing instruction. This provides additional flexibility in the use of pointer control prefix instructions.

[0057] As previously described, an example use case for pointer control prefix instructions is in a system employing a tag-protected memory access mechanism. Therefore, the apparatus can be arranged such that processing circuitry issues a memory access request in response to a memory access instruction identifying a pointer operand, the memory access request including a request to access data stored at a memory location identified by a memory address determined based on the pointer portion of the pointer operand. The apparatus may also include access control circuitry that, in response to the memory access request, compares a tag value determined based on the tag portion of the pointer operand with an allocation tag associated with the memory location identified by the memory address, and performs a tag error response in response to a comparison indicating a given result. In such a system, the processing circuitry's execution of pointer control operations can be configured to control the value of a portion of the result operand, which, if the result operand is used as the pointer operand of a memory access instruction, will be used as the tag portion. Therefore, where the result operand generated by the data processing operation can be used as a pointer to subsequent memory access instructions, the previously described technique can maintain the security benefits of the tag-protected memory access mechanism by ensuring that the value of the tag portion can be controlled to ensure that it is not modified in an unauthorized manner when the result operand is generated due to the execution of the data processing operation.

[0058] In one example implementation, multiple different variations of the pointer control prefix instructions described above can be defined if needed, each causing different behavior. For example, different forms of pointer control prefix instructions can be defined for use with different associated data processing instructions, and / or for applying different forms of pointer control operations, and / or for taking different actions based on the result of the pointer control operations.

[0059] In some example implementations, different behaviors can be defined for scenarios where multiple instances of pointer control prefix instructions (which can be instances of the same type of pointer control prefix instructions or instances of different types of pointer control prefix instructions) are encountered before appropriate data processing instructions. In one example implementation, the action of a later pointer control prefix instruction can replace the action of an earlier pointer control prefix instruction, such that when an appropriate data processing instruction is encountered, the pointer check operation defined by the later pointer control prefix instruction is incorporated. Alternatively, the opposite approach can be taken, effectively ignoring the later pointer control prefix instruction to preserve the defined action of the earlier pointer control prefix instruction. As another alternative, the actions defined by multiple pointer control prefix instructions can be additive (e.g., in cases where more than one instruction can be affected by pointer control prefix instructions). As yet another example, exceptions may occur in such scenarios, or error state conditions may be generated and stored in a status register for future reference.

[0060] A specific example implementation will now be described with reference to the accompanying drawings.

[0061] Figure 1 An example of a data processing device 2 is illustrated schematically. It should be understood that this is only a high-level representation of a subset of the components of the device, and the device may include many other components not illustrated. Device 2 includes processing circuitry 4 for performing data processing in response to instructions decoded by instruction decoder 6. Instruction decoder 6 decodes instructions fetched from instruction cache 8 to generate control signals 10 for controlling processing circuitry 4 to perform the corresponding processing operation represented by the instructions. Processing circuitry 4 may include one or more execution units for performing operations on values ​​stored in register 14 to generate a result value to be written back to the register. For example, execution units may include an arithmetic / logic unit (ALU) for performing arithmetic or logical operations, a floating-point unit for performing operations using floating-point operands, and / or a vector processing unit for performing vector operations on operands comprising multiple independent data elements. The processing circuitry also includes a memory access unit (or load / store unit) 15 for controlling data transfer between register 14 and the memory system. In this example, the memory system includes instruction cache 8, a Level 1 data cache 16, a Level 2 cache 17 shared between data and instructions, and main memory 18. It should be understood that other cache hierarchy structures are also possible—this is merely one example. A memory management unit (MMU) 20 is provided to provide address translation functionality to support memory accesses triggered by load / store unit 15. The MMU has a translation lookup buffer (TLB) 22 for caching a subset of entries from page tables stored in memory systems 16, 17, and 18. Each page table entry can provide an address translation mapping for the corresponding address page and can also specify access control parameters, such as specifying whether the page is a read-only region or has read-and-write access permission, or specifying which privilege levels can access the page.

[0062] The device may also provide multiple processing status registers 30, the contents of which can be referenced by the processing circuit 4 when performing data processing operations, for example, to track certain status information used by the processing circuit when performing data processing operations. In one example, a status storage device that can be used to store status indication information may be provided by one or more processing status registers in the processing status registers 30, the status indication information being used to determine whether a pointer control operation should be incorporated in association with one or more data processing operations defined by data processing instructions.

[0063] For example Figure 1As shown, the device may provide one or more system control registers 32 and one or more status registers 34. The one or more system control registers are used to provide system control information for controlling the operation of the device. Status information generated by the device during operation may be stored in the one or more status registers for future reference.

[0064] As previously discussed, according to the techniques described herein, the instruction set architecture can be arranged to include one or more pointer control prefix instructions, which, when encountered, can be used to modify the processing performed by the processing circuit 4 upon encountering one or more subsequent data processing instructions. Figure 2A This is a flowchart illustrating an example of the steps taken when decoding a pointer control prefix instruction, according to a specific implementation of an example. When the pointer control prefix instruction is decoded at step 100, then at step 105, the instruction decoder circuit 6 is arranged to generate one or more control signals to include pointer control operations during the execution of one or more subsequent associated data processing instructions. The generated control signals can take various forms, but in one example, they can be used to set one or more status indicator bits in the processing status register 30, which are referenced by the processing circuit 4 as appropriate during data processing operations required by subsequent data processing instructions in the instruction sequence being executed by the execution device.

[0065] Figure 2B The steps that can be taken when decoding such a data processing instruction are illustrated, depending on the values ​​of one or more status indicator bits set in response to decoding a previous pointer control prefix instruction. At step 110, it is determined whether the decoded data processing instruction is of a type that might be affected by the pointer control prefix instruction. If the decoded data processing instruction is not of that type, the process proceeds to step 115, where the processing circuit 4 executes the data processing instruction in a normal manner, i.e., by performing the required data processing operations without performing the associated pointer control operations.

[0066] However, if it is determined at step 110 that the decoded data processing instruction is of a type that can be affected by pointer control prefix instructions, then at step 120 it is determined whether the relevant status indicator bit has been set, i.e., the status indicator bit that will be set when decoding the pointer control prefix instruction. The evaluation at step 120 can be performed in various ways, but in one example implementation, the processing circuit 4 can be arranged to access the processing status register 30 to determine whether the status indicator bit is set when the data processing operation defined by the data processing instruction that was determined to be decoded at step 110 is to be executed.

[0067] If the relevant status indicator bit is not set, the process proceeds to step 115, whereby the processing circuitry executes the data processing instructions in a normal manner. However, if the relevant status indicator bit is set, the process proceeds to step 125, whereby the processing circuitry is arranged to incorporate a pointer control operation in association with the data processing operation performed when the data processing instructions are executed. As indicated in step 130, the pointer control operation causes a predetermined action to be taken when the data processing instructions are executed. This action can take various forms, but in one example implementation it may involve copying certain bits of the input operand to corresponding bits of the output operand. Alternatively, if it is determined that the result operand should be considered invalid when the data processing instructions are being used to manipulate the pointer operand, it may involve setting a given portion of the result operand to an error indication value, and thus the result operand can be used as a pointer when appropriate to determine the address to be accessed in memory.

[0068] The incorporation of pointer control operations allows general data processing instructions to be used to manipulate pointers, while permitting steps to ensure that pointer operands are not updated in unexpected or prohibited ways. As an example, pointer operands may include a metadata section containing certain metadata information. Typically, it is expected that data processing operations will be performed on pointer operands to change the pointer's value, with the intention of not altering the contents of the metadata section. This metadata section can be copied by using a method that copies certain bits of the input operand into the corresponding bits of the output operand, thus preventing the metadata section from being modified. This could otherwise occur in certain situations when data processing operations are performed on pointer operands; for example, if a value is added to the pointer section, the contents of the pointer section may overflow, and thus bits may be propagated into the metadata section, thereby changing the value in the metadata section.

[0069] When evaluating a result operand to determine whether it should be considered invalid if it represents a pointer operand, and if so, as an alternative method of setting a given portion of the result operand to an error indication value, the presence of the error indication value can be used by downstream processes to determine the appropriate action to take. For example, if the result operand is used as an input operand for a memory access operation and an error indication value is set, a pointer error condition can be detected at that time, and appropriate actions can be taken, such as raising an exception or logging the value in a status register.

[0070] Figure 3The execution of a pointer control operation according to an example implementation is illustrated schematically, wherein the evaluation of the result operand is performed to determine whether a given portion of the result operand should be modified to identify an error indication value. The input pointer operand 150 may include a metadata portion 155 and a pointer portion 160. The pointer portion is used to identify the pointer, and the metadata portion 155 may include various information depending on the implementation. In one example implementation, the metadata portion contains an address tag used in a tag-protected memory access mechanism to perform a comparison with a protection tag associated with the accessed memory block to evaluate whether memory access should be allowed to proceed, as will be referred to later. Figure 8 and Figure 9 This will be discussed in more detail. However, alternatively, other forms of metadata can be provided in the metadata section. For example, metadata can take the form of garbage collection data associated with memory regions accessible by pointers in the associated pointer section using pointer operands, which is referenced when a garbage collection process is performed to attempt to free up memory regions that are no longer in use.

[0071] exist Figure 3 In the example, input pointer operand 150 is used as input to perform data processing operation 165. Depending on the data processing operation, one or more additional operands may also be provided as input. The data processing operation can take many forms and can be, for example, arithmetic or logical operations. As a result of performing the data processing operation, a result operand 170 representing the modified pointer is produced. Therefore, this also includes a pointer section 180 defining the modified pointer and a metadata section 175 including metadata.

[0072] As mentioned earlier, when the processing circuit is performing data processing operations, it can be arranged to process pointer operands in the same way as general data value operands. Figure 3 In the illustrated example, when a data processing operation is used to modify the input pointer to generate the result pointer, the intention is to operate on the pointer portion, thus keeping the metadata portion unchanged. However, in some cases, the application of a data processing operation may cause the metadata portion to be modified, for example, if a pointer portion overflows due to the execution of the data processing operation. By incorporating the previously mentioned pointer control operation when performing the data processing operation, this situation can be detected and appropriate action taken. Figure 3 In the example, the pointer control operation causes a comparison operation 185 to be performed on the metadata portion 155 of the input pointer operand 150 and the metadata portion 175 of the result operand 170. If the comparison operation detects a mismatch between the two values, the processing circuitry can be arranged to take a defined action, such as updating a given portion of the result operand to indicate the previously mentioned error indication value.

[0073] Although Figure 3 In the example, pointer control operations are arranged to find mismatches in the metadata section, but the checks performed by pointer control operations can take many forms depending on the specific implementation. For example, pointer control operations can be used to detect when a pointer section has been modified in a way that should be considered invalid. For instance, when the data processing operation is a combination of multiplication and addition, it may be appropriate to use such data processing operations to manipulate pointer operands to check that the result of the multiplication operation does not overflow, and pointer control operations can be used to detect when such an overflow does occur and then take appropriate action.

[0074] Figure 4 This is a flowchart illustrating the steps taken in one example implementation when decoding a pointer control prefix instruction. At step 200, when it is determined that the pointer control prefix instruction has been decoded, the process proceeds to step 205, where the status indicator bit is set to a first state. In one example implementation, this status indicator bit may be provided within a processing status register in processing status register 30.

[0075] At step 210, it is then determined whether the next instruction decoded for execution is an expected data processing instruction, i.e., whether it is a data processing instruction whose execution is intended to be influenced by a pointer control prefix instruction. For example, there may be a predetermined data processing instruction used with a pointer control prefix instruction, or at least a data processing instruction of a predetermined type. In other specific implementations, instead of pre-determining the data processing instruction, the indication of the expected data processing instruction can be configured by storing this information in a suitable configuration register (e.g., a system control register in system control register 32), or it can actually be captured as information within processing status register 30.

[0076] If it is determined at step 210 that the next instruction to be decoded is the expected data processing instruction, the process proceeds to step 215, where processing circuit 4 incorporates the previously discussed pointer control operation when executing the data processing instruction. Additionally, in this example implementation, the status indicator bit is subsequently cleared, such that the decoding of the pointer control prefix instruction only affects the processing performed in response to a subsequent data processing instruction.

[0077] If it is determined at step 210 that the next instruction decoded for execution is not the expected data processing instruction, the process proceeds to step 220, where a defined action can be taken. For example, status indication information can be retained in a first state until the given data processing instruction is executed. Alternatively, status indication information can be cleared to a second state indicating that pointer control operation is not required (e.g., if the expected data processing instruction is not encountered as the next instruction to be executed after a pointer control prefix instruction, it is considered appropriate not to merge the execution of the pointer control operation with the execution of the expected data processing instruction instance). As another alternative, it may be appropriate to generate an exception, assuming that the expected behavior has not yet been observed (i.e., the next instruction is not the expected data processing instruction). As yet another alternative, an indication of unexpected behavior can be stored in a storage element for later reference, which provides a less intrusive approach than raising an exception and may be considered sufficient in some implementations. In one example implementation, the storage element may take the form of a status register in status register 34, such that a value can be set in this status register to indicate when a situation occurs where a pointer control prefix instruction is not immediately followed by an expected data processing instruction.

[0078] In some example implementations, a single instance of a pointer control prefix instruction can be associated with multiple subsequent data processing instructions, and Figure 5 This is a flowchart illustrating the steps that can be taken when decoding such instructions in an example implementation. When it is determined at step 250 that pointer control prefix instructions applicable to multiple associated subsequent instructions have been decoded, then at step 255, status indication information is set to identify the number of instructions for which pointer control operations are to be performed when those instructions are executed. This can be captured, for example, in a multi-bit field within a processing status register in processing status register 30. Additional information can also be stored, if needed, for use in controlling the pointer control operations performed when each associated subsequent instruction is executed. Examples of the additional information that can be captured are instruction indication information that enables the processing circuitry to identify the data processing instruction for which pointer control operations are to be performed, and / or control indication information in the form of enabling the processing circuitry to identify the pointer control operation to be performed. As another example of information that can be captured, such information may include action indication information for identifying the action to be taken if the execution of a pointer control operation results in the determination that the result operand will be considered invalid. Such action indication information may, for example, indicate how the result operand should be modified so that the previously mentioned error indication value is incorporated if the pointer check operation indicates that the result operand should be considered invalid if it is to be used as a pointer.

[0079] This additional information can be captured in various locations. For example, it can be captured within one or more system control registers 32, and this information can be set within the system control register by any suitable means (e.g., by executing one or more earlier instructions). Alternatively, this information can be identified by a pointer control prefix instruction and stored in one or more processing status registers in processing status register 30 when the prefix instruction is decoded. In some cases, different information can be provided for different associated data processing instructions, thus capturing more fine-grained control information, such as capturing pointer control operations to be performed for each subsequent instruction, actions to be performed if the execution of a pointer control operation results in the determined operand being considered invalid, etc.

[0080] In other example implementations, it may not be necessary to capture all or part of this additional information, as it may be pre-defined rather than configurable.

[0081] At step 260, when each associated instruction is encountered and executed, the pointer control operation is merged with the corresponding data processing operation, and the status indication information is adjusted to indicate the remaining number of instructions that require pointer control operations, until all associated instructions have been processed.

[0082] In an implementation where status indication information is stored within the system (e.g., in one or more processing status registers in processing status register 30) for reference by processing circuitry 4 when performing data processing operations to determine whether to merge pointer control operations with those data processing operations, it may be useful to ensure that this status indication information is retained across exceptions. Therefore, in one example implementation, such as... Figure 6 As shown in the flowchart, when an exception entry event occurs at step 300, causing the current software routine to pause while executing the exception handling routine, this information is retained at step 305, for example, by storing status indication information indicating the need for pointer control operations in a saved processor status register. Then, if appropriate, when it is determined at step 310 that a return from the exception has occurred, the status indication information can be restored at step 315 by retrieving it from the saved processor status register.

[0083] In one example implementation, the application of pointer control operations can be configurable if needed. For example, such as Figure 7As shown in the flowchart, in one example implementation, when the pointer control prefix instruction is to be decoded at step 350, it is determined at step 355 whether an overwrite value has been set in a predetermined configuration storage element (such as a system control register in system control register 32). If not, the process proceeds to step 360, where the pointer control prefix instruction is decoded in the manner previously discussed, resulting in the generation of one or more control signals that cause pointer control operations to be included when one or more associated data processing instructions are subsequently executed. However, if an overwrite value has been set, at step 365, the pointer control prefix instruction is considered "No Operation" (NoP), and therefore no operation is performed in response to the instruction. Where appropriate, the associated data processing instructions will then be executed normally without incorporating any pointer control operation.

[0084] Although Figure 7 The example uses an overwrite value to determine when a pointer control prefix instruction should be treated as no operation. However, it should be understood that in alternative implementations, the pointer control prefix instruction may be treated as no operation by default, and it may be necessary to specifically set a value in the configuration storage device to enable the pointer control prefix instruction to be decoded to generate a control signal that incorporates the pointer control operation when one or more subsequent data processing instructions are executed.

[0085] In one example implementation, pointer control prefix instructions can be encoded in the instruction set architecture using the encoding currently considered "No-Operation" (NoP) instructions to allow backward compatibility with existing systems that do not support the use of pointer control prefix instructions. Therefore, in legacy systems, pointer control prefix instructions will simply be treated as no-operations, and their presence in the software will not affect the correct operation of the legacy system. Furthermore, in systems already designed to execute software including pointer control prefix instructions, pointer control prefix instructions can be decoded in the manner discussed herein to modify the behavior of one or more subsequent data processing instructions, particularly by incorporating pointer control operations when performing the desired data processing operations.

[0086] As discussed earlier, in one example implementation, it is desirable to retain the value of the metadata portion of a pointer operand while it undergoes data processing operations, so as to manipulate the pointer value of the pointer operand to produce an updated pointer operand, or at least to identify when the execution of the data processing operation causes a change in the value of the metadata portion. There are various scenarios where this capability could be useful; a concrete example is in systems employing tag-protected memory access mechanisms to attempt to improve the security of data access. The application of the above techniques within such systems will now be described in more detail.

[0087] Software to be executed by a data processing device is typically written in a high-level programming language and then compiled into code according to the instruction set architecture supported by the device on which the software will be executed. For example, the software may initially be written in a higher-level language such as Java, C, or C++, and then compiled into a natively supported instruction set architecture such as x86 or Arm. ® .

[0088] Some higher-level programming languages ​​(such as Java) are considered memory-safe languages ​​because they include runtime error detection checks to inspect for certain errors related to memory access. In contrast, memory-unsafe languages ​​(such as C and C++) do not include such runtime error checks. The continued prevalence of memory-unsafe languages ​​means that code compiled according to a given instruction set architecture may contain a large number of memory-related errors that could be easily exploited by attackers or other malicious parties. Such errors may include:

[0089] • Boundary violation, where the array index provided by the code exceeds the array's legal boundaries;

[0090] • Use-after-free error, which means accessing a memory location only after the memory location has been deallocated or freed;

[0091] • Use-after-return, where memory access to the address associated with variables used within the function (such as values ​​on the stack) is performed after the function returns;

[0092] • Use-out-of-scope errors, where a variable is accessed outside the scope in which it is declared; and

[0093] • Use-before-initialisation error, where the memory address associated with a variable is accessed before the variable is initialized.

[0094] These are just some examples of memory-related errors that can lead to unpredictable behavior and potentially provide avenues for exploitation by attackers. Therefore, it may be desirable to provide architectural support within the instruction set architecture supported by a given processing device to aid in runtime detection of certain categories of memory errors.

[0095] One method for preventing certain types of memory usage errors discussed above could be providing protection tags stored in the memory system associated with blocks of one or more memory locations. When a tag-protected memory access operation is requested based on a target address identifying a specific addressable location in the memory system, the memory access circuitry can compare an address tag associated with the target address with a protection tag stored in the memory system associated with a block of one or more memory locations including the addressable location identified by the target address. The memory access circuitry can generate an indication of whether a match has been detected between the protection tag and the address tag. This indication can be used to control whether the memory access is allowed to proceed successfully or whether subsequent operations can proceed successfully, or it can be reported only if the memory access is allowed to continue normally.

[0096] This can be useful because, for example, a compiler that compiles code based on a memory-unsafe language (such as C or C++) can set protection tags for memory blocks that the code is expected to access to specific values ​​when initializing memory regions, and can associate the corresponding address tag values ​​with the target addresses pointing to those blocks. If a memory usage error occurs, and, for example, the use of an address pointer is out of range or beyond the valid range of initialization, the protection tag associated with the address location may not match the address tag associated with the target address, and subsequently, in this case, an indication of whether a match was detected can be used to trigger an error handling response or error reporting mechanism. The specific response taken may depend on the specific needs of the software being executed, or on the specific microarchitecture implementation of the architecture. Therefore, even if the high-level language does not have a means for performing runtime error checking to prevent memory access errors, the ISA used to compile the code can include architectural features for performing such checks.

[0097] It should be noted that although the term "protection label" is used above, the term "assignment label" can be used instead.

[0098] Figure 8 This schematically illustrates a tag-protected memory access mechanism implemented according to an example. The physical address space used to refer to memory locations within the memory system can be logically divided into multiple blocks 400, each block comprising a certain number of addressable locations. For simplicity, in Figure 8In the example, each block 400 includes four memory locations, but other block sizes may also be used. Each block 400 is associated with a corresponding protection tag 402. Protection tags associated with a certain number of blocks 400 may be grouped together and stored in different architecture-accessible memory locations 404 within the physical address space, or stored in additional architecture-inaccessible storage locations (not mapped to the same physical address space) provided in main memory 18. In some cases, using separate non-architecture-accessible storage devices may be preferred to avoid exhausting the space in data caches 16, 17 used for caching protection tag values, which could impact the performance of regular code and potentially complicate consistency management. Additional tag caches 19 (such as...) may be provided in the microarchitecture. Figure 1 (As shown), it is used to cache tag values ​​from non-architecturally accessible storage devices for faster access than if tags had to be accessed from main memory 18. Which tag storage locations 404 correspond to a specific mapping for each block 400 can be controlled by the load / store unit 15 and can be hardwired or programmable. Although in Figure 8 In this context, each tag 402 is associated with a physical address block. It's also possible to provide protection tags 402 associated with virtual memory locations in the virtual memory address space, but this might require some additional address translation on each memory access. Therefore, associating protection tags 402 with physical memory locations improves performance. Typically, how exactly a protection tag 402 is associated with its corresponding block 400 in the physical address space is a choice made by the specific microarchitecture implementation. Generally, what's needed is accessibility and the ability to compare protection tags 402 associated with a given memory block.

[0099] Therefore, when tagged memory access is required, address tag 406 (associated with a target address 408 identifying the address location 410 to be accessed) is compared with protection tag 402, which is associated with the block of memory location 400 that includes address location 410. For example, in Figure 8 In the diagram, target address 408 points to a memory location B1. Figure 8 It is marked as 410 in the address space. Therefore, the protection label B associated with the block containing location B1 is compared with the address label 406 associated with the target address 408. Figure 8As shown at the top, address tag 406 can be determined as a function of selected bits of the target address itself. Specifically, the address tag can be determined based on the bits within the portion of the target address not used to indicate the specific memory location to be addressed 410. For example, in some architectures, the top portion of the bits of the target address may always have a fixed value, such as a sign extension (all 0s or all 1s), and thus the address can be labeled with address tag 406 by overwriting these unused bits with arbitrary tag values. For example, a specific address tag value may be chosen by the programmer or compiler. The address tag and protection tag 402 can be a relatively small number of bits (e.g., 4 bits), so they do not need to occupy too much space in memory and at the target address. Providing a 4-bit tag space (i.e., 16 possible tag values) is generally sufficient to detect many common types of memory access errors.

[0100] Therefore, when performing a tag-protected memory access, the load / store unit 15 compares the address tag 406 with the protection tag 402 associated with the block 400 including the address location 410 and determines whether they match. The load / store unit 15 generates a match indication indicating whether the address tag 406 and the protection tag 402 match. For example, this match indication could be a fault signal 60 generated in the event of a mismatch between the address tag 406 and the protection tag 402 (such as...). Figure 1 (as shown), or an indication placed in the status register indicating whether a match exists, or an entry added to the error report indicating the address where the error was detected and / or the instruction address of the instruction that triggered the error.

[0101] Figure 9 A flowchart illustrating the process of handling tag-protected memory access is shown. The instruction that triggers the memory access can specify an address tag and a target address. For example... Figure 8As shown, in some cases, the address tag can actually be derived from a subset of bits of the target address itself, although in other examples it may be specified in a separate register. At step 500, an instruction to trigger a tag-protected memory access is encountered. In response, at step 520, memory access circuitry 15 triggers a memory access to the address location 410 identified by the target address. Furthermore, at step 540, memory access circuitry 15 obtains a protection tag 402 stored in the memory system in association with a block including the memory location 400, which includes the address location 410 identified by the target address. At step 560, memory access circuitry 15 compares address tag 406 with the protection tag 402 obtained at step 540. At step 580, memory access circuitry 15 generates an indication of whether a match was detected between the protection tag and the address tag (e.g., any of the types of match / mismatch reporting indications described above). The precise indication used to report any mismatch may vary depending on the specific implementation.

[0102] In systems that implement memory tagging, the tag pointer can be manipulated as an integer, which can lead to modification of the tag value. Even if the operation targets only the non-tagged portion of the pointer, the tag can still be unintentionally affected by overflows from the operation. Such unintentional modification of the tag may have a mildly beneficial effect, for example, in highlighting errors in operations performed on address pointers; however, it also reduces the security benefits of such a system by potentially allowing attackers to manipulate the tag value. In many systems, this security reduction outweighs the potentially mild benefits.

[0103] An example that might involve manipulating address pointers is pointer arithmetic, where the pointer is designated as an input operand for an arithmetic operation (e.g., addition, subtraction, multiplication, division, etc.). It's important to note that although the term "pointer arithmetic" is used here, the processing circuitry is typically unaware of the meaning of the operands used for a given operation—that is, "pointer arithmetic" is simply arithmetic to the processing circuitry, and the address pointer designated as an input operand is simply an input operand to the processing circuitry.

[0104] Most arithmetic operations performed by processing circuitry involve addition (e.g., even subtraction, multiplication, or division operations can be represented using one or more addition operations). Processing circuitry may include an arithmetic logic unit (ALU) for performing arithmetic operations, and the ALU may include ADD circuitry for performing addition operations. An example of addition is... Figure 10 As shown in the image.

[0105] Figure 10This example demonstrates the addition of two three-digit binary addends, 620: 0b100 + 0b111 (note that the prefix "0b." indicates that the following values ​​are binary values ​​– 0b100 is represented as "4" in decimal, and 0b111 is represented as "7" in decimal). For example... Figure 10 As shown, even if both addends are three-bit values, addition will produce a carry value of 640, which has a non-zero value (in this case, "1") in the higher significant bit position (i.e., the carry value is a 4-bit value 0b1000) – this is because when the bits in the third least significant bit position 660 are added together (0b1 + 0b1), the result is a two-bit value (0b10), and therefore the "1" carries over to the next most significant bit position. This means that the resulting value 680 is a 4-bit value (0b1011, which is "11" in decimal). Therefore, the carry value generated during addition can overflow to higher significant bit positions.

[0106] Figure 11 This illustrates how the generation of a carry value can lead to a modification of the label in the address pointer. Specifically, Figure 11 This represents an addition operation that adds the value "Y" to the address pointer "X" to produce the output "Z". For example, Y could be an offset value added to the base address represented by the address pointer X - however, it will be understood that this is merely one example of why arithmetic operations can be performed on address pointers.

[0107] like Figure 11 As shown, address pointer X and another addend Y both have a value of "1" in position 700 of the most significant bit corresponding to address portion 720 of pointer X. This means that when addends X and Y are added, a carry value is generated, which overflows into portion 740 of the result value Z, which would be tag portion 406 if Z were used as an address pointer. (Note that this is not the only way such a carry value can be generated—that is, it is not necessary for bit 700 in both addends to be "1").

[0108] Therefore, even if the addend Y does not contain a non-zero value in portion 740 of the tag portion 406 corresponding to the address pointer X, the carry value generated during addition can still cause the corresponding portion 740 in the output value Z to differ from the tag portion 406 in the input address pointer Y. As mentioned above, this can lead to reduced security.

[0109] It's important to note that while arithmetic operations are one example of pointer manipulation, other operations can also be applied to address pointers and can modify the label portion. For example, a logical "OR" operation can be performed on a value that might later be used as an address pointer, and this operation can also modify the label. For instance, two operands can have labeled portions, which are read as follows:

[0110] 0b1010

[0111] 0b0001

[0112] If a logical OR is performed on these two operands, the label portion of the output value will be read:

[0113] 0b1011

[0114] Therefore, in this case, the label portion of the output value is different from the label portions of the two input operands.

[0115] To prevent security risks arising from allowing modification of the label portion of operands, according to the previously described technique, pointer control prefix instructions can be used to associate pointer control operations with subsequent data processing instructions, such that when the data processing instruction is executed, the data processing operation defined by that instruction is supplemented to include the pointer control operation. The pointer control operation can take various forms, but can be arranged to attempt to ensure that the output operand Z' does not have a portion 740 that is updated in an unexpected manner. Consider... Figure 11 For example, this can be achieved by copying the tag portion 406 of the address pointer X within the corresponding portion 740 of the result operand, for example by overwriting the corresponding bit 740 in the intermediate result operand Z to produce a modified result operand Z', where portion 740 then represents the tag value that matches the tag value in the input operand X, but the address portion 760 represents the modified address pointer produced as the result of the addition operation.

[0116] In an alternative embodiment, the pointer control operation may perform a check when the result operand Z is generated to determine whether portion 740 has a value different from the tag portion 406 in the input operand X. If so, in an example embodiment, a given portion of the output operand may be set to an error indication value to produce a modified output operand Z'. For example, the processor circuitry may detect an overflow into the region 740 corresponding to the tag portion, and in response to this detection, may generate a modified result value Z' that includes a certain error indication value. The error indication value may be selected as a value that makes the value Z' invalid when subsequently used as an address pointer.

[0117] Figure 12This is a flowchart illustrating a specific implementation of a pointer control operation with label retention, based on an example implementation. At step 800, an arithmetic instruction is executed, for which the pointer control operation has been indicated by a previous pointer control prefix instruction. At step 805, an arithmetic operation is performed to generate a result operand, and subsequently, a pointer check is performed on the result operand. As a result of the check, it is then determined at step 810 whether the portion of the result operand corresponding to the label portion has the same value as the label portion of the input pointer operand. If so, the process can proceed directly to step 815, where the result operand is output. However, if a mismatch is detected at step 810, a modified result operand is generated at step 820, where the portion of the modified result operand corresponding to the label portion is set to match the value of the label portion of the input pointer operand.

[0118] Figure 13 This is a flowchart illustrating a label retention implementation of a pointer control operation according to an alternative example. According to this alternative implementation, no checks are required. Instead, when an arithmetic instruction is executed at step 830, for which the pointer control operation has already been indicated by a previous pointer control prefix instruction, a result operand is generated at step 835 by performing the desired data processing operation. Subsequently, at step 840, the value of the portion of the result operand corresponding to the label portion is set to match the value of the label portion in the input pointer operand. This can lead to a more efficient implementation in some cases because it avoids the need to perform any checks.

[0119] As mentioned earlier, as an alternative to preserving label values, in a different specific implementation, it is possible to... Figure 12 The method described herein performs a check on the result operand, but in the event of a mismatch, it may be decided to modify the result operand to include an error indication value that will mark the result operand as invalid if it is ever attempted to be used as an input pointer for a memory access operation.

[0120] Figure 14 An example of an invalid pointer was given - previously in Figure 11 The resulting value Z' of the modification discussed in the figure can, for example, be set to be invalid in one of the ways shown in the figure. Figure 14 An example of an address pointer comprising 64 bits is shown. In the effective address pointer 850, these bits can be interpreted as follows:

[0121] - The bottom (least significant) 56 bits (bits 55:0) can be interpreted as address bits—these bits are the bits that identify a location in memory (either directly or when combined with some other value such as a base address).

[0122] - Bits 59 and 56 represent a 4-bit address label; and

[0123] - The first 4 bits (bits 63:60) can be spare bits and / or bits used to provide some other information.

[0124] The processing circuitry can modify the value in any of a variety of different ways to make it represent an invalid address pointer. For example, some specific implementations of this technique may utilize some top bits and set these bits to a specific value to indicate that the pointer is invalid—for example, Figure 14 An example of an invalid pointer 855 is shown, where bits 61:60 have been set to the value 0b01. (It should be understood that the value 0b01 for these bits is used as an example - the exact value used as an error indication value can vary depending on the specific implementation.)

[0125] In some example implementations, the label bit can be set to a specific value to indicate that the pointer is invalid. For example, certain label values ​​can be reserved to indicate errors, and therefore the label value can be set to one of those values. Figure 14 An example of an invalid pointer 860 is shown, where the label portion has been set to the value 0b1110. (Again, this is just one example of a value that can be used as an error indication value).

[0126] In some example implementations, if not all address bits need to define the addressable memory, the address portion can be set to a non-canonical value (e.g., an address guaranteed to cause a fault upon access). As a specific example, Figure 14 The example shows an invalid pointer 865, where all address bits have been set to zero. Again, this is merely one example of a value that can be used as an error indication value—while it is quite common to reserve this address value to provide some alternative information (e.g., indicating an error as in this example), other implementations may use different address values ​​as error indication values.

[0127] It should be noted that Figure 14 The specific values ​​used for error generation are merely examples, and the specific values ​​used may depend on the specific architecture of the system. Furthermore, it should be noted that some implementations may use a certain combination of these techniques to force pointers to invalid values.

[0128] Figure 15This is a flowchart illustrating an example of a method that can be performed by processing circuitry in response to an arithmetic instruction executed at step 870, for which a pointer check has already been indicated by a previous pointer-controlled prefix instruction. The arithmetic instruction identifies the input operand, and the processing circuitry responds to the instruction by performing an operation on the input operand at step 872 to generate an output value. Although in this example the instruction is an arithmetic instruction, and therefore an arithmetic operation is performed at step 872, it should be understood that the techniques described herein can be used in conjunction with any instruction having the potential to modify the label portion of an address pointer.

[0129] The processing circuit also detects at step 874 whether the operation performed on the input operand involves attempting to set the value of at least one bit in the identified portion of the output value to a value other than the value in the corresponding bit position in the input operand, where the identified portion is a part of the output value, and if that portion of the output value is used as an address pointer for a memory access instruction, that portion will be used as the tag portion. If it is determined that no such attempt was made (N), the output operand is returned unmodified at step 876 (e.g., it can be recorded in a register). On the other hand, if it is determined that such an attempt was made (Y), the processing circuit sets at least a given portion of the output value to an error indication value at step 878 before returning the modified output value at step 880.

[0130] Figure 16 This is a flowchart illustrating an example of a method executed by the access control circuitry in response to decoding a memory access instruction at step 900. When the memory access instruction is decoded, the access control circuitry is configured to determine at step 905 whether the address pointer identified by the memory access instruction is valid. If the pointer is invalid, a pointer error response is executed at step 910. For example, the error response may include raising an exception or logging a value to a status register. In some cases, after executing an error response at step 910 (e.g., if the response is logging a value to a status register), the method continues to step 915. Alternatively, an error response may be executed instead of steps 915, 920, 925, and 930—for example, raising an exception may stop processing.

[0131] Figure 16 The method also includes determining the memory address at step 915 based on the address pointer identified by the memory access instruction. It should be noted that while this example only performs step 915 when it is determined at step 905 that the address pointer is valid (Y), in alternative implementations, step 915 may be performed before checking whether the address pointer is valid at step 905.

[0132] The method further includes step 920, which compares a tag value (address tag) determined based on the tag portion of the address pointer with an allocation tag (protection tag) associated with the memory location identified by the determined memory address, and determines whether the comparison indicates a given result. When (Y) the comparison indicates a given response, a tag error response is performed at step 925 (e.g., this may be the same as or different from the error response indicated above). On the other hand, when (N) it is determined that the comparison does not indicate a given result, the requested data access is performed at step 930 (subject to satisfying any other access requirements).

[0133] The concepts described herein may be embodied in computer-readable code used to manufacture devices embodying the described concepts. For example, the computer-readable code may be used in one or more stages of the semiconductor design and manufacturing process, including the electronic design automation (EDA) stage, to manufacture integrated circuits including devices embodying these concepts. The aforementioned computer-readable code may additionally or alternatively enable the definition, modeling, simulation, verification, and / or testing of devices embodying the concepts described herein.

[0134] For example, computer-readable code for manufacturing a device embodying the concepts described herein may be embodied in code that defines the hardware description language (HDL) representation of these concepts. For instance, the code may define a register-transfer level (RTL) abstraction of one or more logic circuits for defining a device embodying these concepts. The code may define an HDL representation of one or more logic circuits embodying the device using Verilog, SystemVerilog, Chisel, or VHDL (Very High Speed ​​Integrated Circuit Hardware Description Language) and intermediate representations such as FIRRTL. Computer-readable code may provide definitions of the concepts or other behavioral representations of the concepts embodying the concepts using system-level modeling languages ​​such as SystemC and SystemVerilog, which can be interpreted by a computer to enable simulation, functional and / or formal verification and testing of the concepts.

[0135] Additionally or alternatively, computer-readable code may define a low-level description of an integrated circuit component embodying the concepts described herein, such as one or more netlists or integrated circuit layout definitions, including representations such as GDSII. One or more netlists or other computer-readable representations of the integrated circuit component may be generated by applying one or more logic synthesis processes to the RTL representation to generate a definition for manufacturing a device embodying the invention. Alternatively or additionally, one or more logic synthesis processes may generate a bitstream from the computer-readable code to be loaded into a field-programmable gate array (FPGA) to configure the FPGA to embody the described concepts. The FPGA may be deployed for the purpose of verifying and testing the concepts prior to manufacturing integrated circuits, or the FPGA may be deployed directly in a product.

[0136] Computer-readable code may include a mixture of code representations for manufacturing apparatus, such as one or more of RTL representations, netlist representations, or other computer-readable definitions used in the semiconductor design and manufacturing process for manufacturing apparatus embodying the present invention. Alternatively or additionally, the concept may be defined in a combination of computer-readable definitions used in the semiconductor design and manufacturing process for manufacturing apparatus and computer-readable code defining instructions that will be executed by the defined apparatus once manufactured.

[0137] Such computer-readable code can be contained in any known transient computer-readable medium (such as wired or wireless transmission of code over a network) or non-transitory computer-readable medium such as semiconductors, magnetic disks, or optical disks. Integrated circuits made using computer-readable code may include components such as one or more of the following: a central processing unit, a graphics processing unit, a neural processing unit, a digital signal processor, or other components that embody the concept individually or collectively.

[0138] Figure 17 Specific implementations of emulators that can be used are illustrated. While the previously described embodiments implement the invention in terms of means and methods for operating specific processing hardware supporting the technologies involved, it is also possible to provide an instruction execution environment according to the embodiments described herein, which is implemented using a computer program. Such computer programs are commonly referred to as emulators, in part because they provide a software-based implementation of a hardware architecture. Types of emulator computer programs include simulators, virtual machines, models, and binary converters, including dynamic binary converters.

[0139] Typically, the simulator implementation runs on a host processor 970, which optionally runs a host operating system 960 supporting the simulator program 950. In some arrangements, multiple simulation layers may exist between the hardware and the provided instruction execution environment and / or multiple different instruction execution environments provided on the same host processor. Historically, powerful processors were required to provide simulator implementations that execute at a reasonable speed, but this approach may be reasonable in certain situations, such as when it is desirable to run code native to another processor for compatibility or reuse reasons. For example, the simulator implementation may provide additional functionality to the instruction execution environment that is not supported by the host processor hardware, or provide an instruction execution environment that is typically associated with a different hardware architecture. An overview of simulation is given in the following literature: “Some Efficient Architecture Simulation Techniques”, Robert Bedichek, Winter 1990 USENIX Conference, pp. 53-63.

[0140] With respect to embodiments previously described with reference to specific hardware constructions or features, equivalent functionality may be provided in simulated embodiments by suitable software constructions or features. For example, specific circuitry may be implemented as computer program logic in simulated embodiments. Similarly, memory hardware such as registers or cache memory may be implemented as software data structures in simulated embodiments. Where one or more of the hardware elements referenced in the previously described embodiments are present in an arrangement on host hardware (e.g., host processor 970), some simulated embodiments may utilize the host hardware where appropriate.

[0141] For example, simulator code 950 may include instruction decoding program logic 952 to decode instructions in the target code—thus, the instruction decoding program logic can emulate the previously described instruction decoder 6. Simulator code 950 may also include register emulation program logic 954 to emulate the aforementioned register 14. The simulator program also includes data processing program logic 956 for processing instructions in the target code 940 (thus ending the simulation processing circuit 4) and access control program logic 958 for emulating access control circuitry such as MMU 20.

[0142] The simulator program 950 can be stored on a computer-readable storage medium (which may be a non-transitory medium) and provides a program interface (instruction execution environment) to the target code 940 (which may include application programs, operating systems, and management programs). This program interface is identical to the interface of the hardware architecture modeled by the simulator program 950. Therefore, the program instructions of the target code 940 (including the aforementioned pointer control prefix instructions, data processing instructions, and memory access instructions) can be executed from within the instruction execution environment using the simulator program 950, enabling the host computer 970, which does not actually possess the hardware features of the aforementioned device 2, to emulate these features.

[0143] Accordingly, simulator code 950 is an example of a computer program including instructions that, when executed by a host data processing device, control the host data processing device to provide an instruction execution environment for executing the target program code. The computer program includes:

[0144] Instruction decoding program logic, which decodes instructions, wherein the instruction decoding program logic generates control signals in response to a sequence of instructions; and

[0145] Data processing program logic that executes operations defined by a sequence of instructions in response to control signals;

[0146] in:

[0147] The instruction decoding program logic generates one or more control signals in response to pointer control prefix instructions in the instruction sequence, so that the data processing program logic incorporates pointer control operations in association with the data processing operation defined by the given data processing instruction following the pointer control prefix instruction in the sequence, to control whether the data processing operation produces a result operand. The result operand is considered valid if the given input operand of the given data processing instruction is a pointer operand that identifies a pointer used to determine the address of the memory access.

[0148] In this application, the phrase "configured as..." is used to mean that the elements of the device are configured to perform the defined operations. In this context, "configuration" means the arrangement or manner of interconnection of hardware or software. For example, the device may have dedicated hardware that provides the defined operations, or a processor or other processing device may be programmed to perform the function. "Configured as" does not mean that the elements of the device need to be changed in any way to provide the defined operations.

[0149] In this application, a list of features beginning with the phrase “at least one of” means that any one or more of those features may be provided individually or in combination. For example, “at least one of [A], [B], and [C]” covers any of the following options: A only (without B or C), B only (without A or C), C only (without A or B), a combination of A and B (without C), a combination of A and C (without B), a combination of B and C (without A), or a combination of A, B, and C.

[0150] While exemplary embodiments of the invention have been described in detail herein with reference to the accompanying drawings, it should be understood that the invention is not limited to those precise embodiments, and various changes and modifications can be made therein by those skilled in the art without departing from the scope of the invention as defined by the appended claims.

Claims

1. An apparatus, the apparatus comprising: A decoder circuit for decoding instructions, wherein the decoder circuit generates control signals in response to a sequence of instructions; as well as A processing circuit that executes an operation defined by the instruction sequence in response to the control signal; in: The decoding circuit generates one or more control signals in response to a pointer control prefix instruction in the instruction sequence, such that the processing circuit incorporates a pointer control operation in association with a data processing operation defined by a given data processing instruction following the pointer control prefix instruction in the sequence, to control whether the data processing operation produces a result operand, wherein the result operand is considered valid if the given input operand of the given data processing instruction is a pointer operand that identifies a pointer for determining an address to access memory.

2. The apparatus of claim 1, wherein the pointer operand includes a pointer portion for identifying the pointer and a metadata portion for providing metadata associated with the pointer, and the pointer control operation is configured to detect when a portion of the result operand corresponding to at least one of the pointer portion and the metadata portion takes a value that would be considered invalid if the given input operand is the pointer operand.

3. The apparatus of claim 2, wherein when the given input operand is the pointer operand, the result operand generated by executing the data processing operation defined by the given data processing instruction is considered valid when the value of the portion of the result operand corresponding to the metadata portion matches the value of the metadata portion of the given input operand, and the pointer control operation is used to detect when there is a mismatch between the value of the portion of the result operand corresponding to the metadata portion and the value of the metadata portion of the given input operand.

4. The apparatus of claim 2 or claim 3, wherein when the execution of the pointer control operation indicates that the result operand would be considered invalid if the given input operand is a pointer operand, the processing circuitry is arranged to set at least a given portion of the result operand to an error indication value.

5. The apparatus of claim 1, wherein the execution of the pointer control operation causes a portion of the result operand to be set to a value that matches the value of the corresponding portion of the given input operand.

6. The apparatus of claim 5, wherein the pointer operand includes a pointer portion for identifying the pointer and a metadata portion for providing metadata associated with the pointer, and the execution of the pointer control operation causes the processing circuit to set the value of the portion of the result operand corresponding to the metadata portion to match the value of the metadata portion of the given input operand.

7. The apparatus according to any of the preceding claims, wherein: The given data processing instruction is an arithmetic instruction, and when the given input operand is the pointer operand, the execution of the data processing operation defined by the arithmetic instruction is arranged to manipulate the value of the pointer identified by the pointer operand in order to produce a modified pointer operand as the result operand.

8. The apparatus of claim 7, wherein the data processing operation defined by the arithmetic instructions is an arithmetic operation involving addition.

9. The apparatus according to any of the preceding claims, further comprising: A state storage device, wherein the state storage device is used to store state indication information; and The decoding circuit generates one or more control signals in response to the pointer control prefix instruction, such that the state indication information is set to a first state, the first state indicating that the pointer control operation will be incorporated in association with the data processing operation defined by the given data processing instruction.

10. The apparatus of claim 9, wherein the processing circuitry is arranged to, in response to the status indication information having the first state, incorporate the pointer control operation in association with the data processing operation defined by the given data processing instruction, and change the status indication information to the second state.

11. The apparatus according to claim 10, wherein: The given data processing instruction is an instruction of a given type and is expected to be the next instruction to be executed after the pointer control prefix instruction, and the processing circuitry is arranged to take one of the following actions in response to the next instruction to be executed after the pointer control prefix instruction, rather than the given data processing instruction: - Retain the status indication information in the first state until the given data processing instruction is executed; - Clear the status indication information to the second status; - Generate an exception; - Store indications of unexpected behavior in the storage element.

12. The apparatus according to any one of claims 9 to 11, wherein: The decoding circuit generates one or more control signals in response to the pointer control prefix instruction in the instruction sequence, so that the processing circuit performs the pointer control operation for associated data processing operations defined by a plurality of given data processing instructions following the pointer control prefix instruction in the sequence; The first state indicates the number of given data processing instructions for which the processing circuit will execute the pointer control operation for the associated data processing operation, and the processing circuit is arranged to update the state indication information each time the pointer control operation is executed to identify the remaining number of given data processing instructions for which the pointer control operation will be executed.

13. The apparatus according to any one of claims 9 to 12, wherein the processing circuitry is arranged such that the status indication information is retained when an anomaly occurs and is restored when returning from the anomaly.

14. The apparatus according to any preceding claim, further comprising a configuration storage means for providing at least one of the following: Instruction indication information, the instruction indication information being used to enable the processing circuitry to identify the given data processing instruction for which the pointer control operation is to be performed; Control instruction information, the control instruction information being used to enable the processing circuit to identify the form of the pointer control operation to be performed; Action indication information, which identifies the action to be taken if the execution of the control operation results in the determination that the result operand will be considered invalid.

15. The apparatus according to any of the preceding claims, wherein the given data processing instruction is a predetermined instruction following the pointer control prefix instruction in the sequence.

16. The apparatus according to any preceding claim, further comprising a configuration storage means, which, when storing a predetermined value, causes the decoder circuitry to refrain from performing an operation due to the pointer control prefix instruction in response to the pointer control prefix instruction, rather than generating one or more control signals to incorporate the processing circuitry into the pointer control operation in association with the data processing operation defined by the given data processing instruction.

17. The apparatus according to any of the preceding claims, wherein: The processing circuit issues a memory access request in response to a memory access instruction identifying a pointer operand, the memory access request including a request to access data stored at a memory location identified by a memory address determined based on the pointer portion of the pointer operand; and The apparatus further includes access control circuitry that, in response to the memory access request, compares a tag value determined based on the tag portion of the pointer operand with an allocation tag associated with the memory location identified by the memory address, and performs a tag error response in response to the comparison indicating a given result. The processing circuit is configured to control the value of a portion of the result operand when executing the pointer control operation, and if the result operand is used as the pointer operand of the memory access instruction, then that portion of the result operand will be used as the tag portion.

18. A method for controlling the manipulation of a pointer by a device, the method comprising: The instruction sequence is decoded using a decoding circuit to generate control signals; In response to the control signal, the processing circuitry executes the operation defined by the instruction sequence; as well as The decoding circuit generates one or more control signals in response to a pointer control prefix instruction in the instruction sequence, so that the processing circuit incorporates a pointer control operation in association with a data processing operation defined by a given data processing instruction following the pointer control prefix instruction in the sequence, to control whether the data processing operation produces a result operand, wherein the result operand is considered valid if the given input operand of the given data processing instruction is a pointer operand that identifies a pointer used to determine an address for accessing memory.

19. A computer program comprising instructions that, when executed by a host data processing device, control the host data processing device to provide an instruction execution environment for executing target program code, the computer program comprising: Instruction decoding program logic, the instruction decoding program logic is used to decode instructions, wherein the instruction decoding program logic generates control signals in response to instruction sequence; as well as Data processing program logic, which executes operations defined by the instruction sequence in response to the control signal; in: The instruction decoding program logic generates one or more control signals in response to pointer control prefix instructions in the instruction sequence, so that the data processing program logic incorporates pointer control operations in association with the data processing operation defined by a given data processing instruction following the pointer control prefix instruction in the sequence, to control whether the data processing operation produces a result operand, wherein the result operand is considered valid if the given input operand of the given data processing instruction is a pointer operand identifying a pointer used to determine an address for accessing memory.

20. A computer-readable medium for storing computer-readable code for manufacturing an apparatus according to any one of claims 1 to 17.

Images