Isolation address region assignment update instruction

Abstract

In response to the instruction decode circuit decoding the instruction specifying the target physical address and an updated isolated address region assignment for the target physical address, at least one memory system request is issued to request an update to isolated address region assignment information defining access control information for controlling access to the target physical address, to set the isolated address region assignment information to indicate one of a plurality of isolated address region assignments selected based on the updated isolated address region assignment specified by the instruction. The plurality of isolated address region assignments includes at least one more secure isolated address region assignment for which associated data is to be isolated from being able to be observed by program code associated with at least one less secure isolated address region assignment.

Description

[0001] This technology relates to the field of data processing.

[0002] Some processor architectures support address region isolation, which allows data and addresses associated with access to one region of memory to be isolated from program code that may be observed by code associated with another address region.

[0003] At least some examples of this technology provide an apparatus comprising: an instruction decoding circuit for decoding instructions according to an instruction set architecture; and a processing circuit for performing a processing operation in response to the decoded instructions decoded by the instruction decoding circuit; wherein: in response to the instruction decoding circuit decoding an isolated address region assignment update instruction for a specified target physical address and an updated isolated address region assignment for the target physical address, the processing circuit is configured to trigger the issuance of at least one memory system request to request an update of isolated address region assignment information, the isolated address region assignment information defining controls for the... Access control information for accessing the target physical address; the update includes setting the isolated address region assignment information for the target physical address to indicate one of a plurality of isolated address region assignments selected based on the updated isolated address region assignment specified by the isolated address region assignment update instruction; and the plurality of isolated address region assignments includes at least one more secure isolated address region assignment, for which data associated with the at least one more secure isolated address region assignment will be isolated to prevent it from being observed by program code associated with at least one less secure isolated address region assignment.

[0004] At least some examples of this technology provide computer-readable code for manufacturing the apparatus as described above. This computer-readable code can be stored on a storage medium. The storage medium can be a non-transitory storage medium.

[0005] At least some examples of this technology provide a method comprising: decoding an instruction according to an instruction set architecture; and performing a processing operation in response to the decoded instruction; wherein: in response to the instruction decoding circuitry decoding a specified target physical address and an isolation address region assignment update instruction for an updated isolation address region assignment for the target physical address, at least one memory system request is issued to request an update of isolation address region assignment information, the isolation address region assignment information defining access control information for controlling access to the target physical address; the update includes setting the isolation address region assignment information for the target physical address to indicate one of a plurality of isolation address region assignments selected based on the updated isolation address region assignment specified by the isolation address region assignment update instruction; and the plurality of isolation address region assignments includes at least one more secure isolation address region assignment, for which data associated with the at least one more secure isolation address region assignment is isolated to prevent it from being observed by program code associated with at least one less secure isolation address region assignment.

[0006] At least some examples provide a computer program for controlling a host data processing device to provide an instruction execution environment for executing target program code. The computer program includes: instruction decoding program logic for controlling the host data processing device to decode instructions of the target program code according to an emulated instruction set architecture; and processing program logic for controlling the host data processing device to perform processing operations in response to the decoded instructions; wherein: in response to decoding of an isolated address region assignment update instruction for a specified target emulated physical address and an updated isolated address region assignment for the target emulated physical address, the processing program logic is configured to request isolated address region assignment information. The update includes setting the isolated address region assignment information for the target simulated physical address to indicate one of a plurality of isolated address region assignments selected based on the updated isolated address region assignment specified by the isolated address region assignment update instruction; and the plurality of isolated address region assignments includes at least one more secure isolated address region assignment, for which data associated with the at least one more secure isolated address region assignment will be isolated to prevent it from being observed by program code associated with at least one less secure isolated address region assignment.

[0007] Computer programs can be stored on storage media. The storage media can be non-transitory.

[0008] Further aspects, features, and advantages of this technology will become apparent from the following description, which is taken in conjunction with the accompanying drawings, in which:

[0009] Figure 1 An example of a device including instruction decoding circuitry and processing circuitry is shown;

[0010] Figure 2 An example of assigning isolated address regions is shown;

[0011] Figure 3 An example of a data processing system is given;

[0012] Figure 4 This example illustrates the use of client-side isolated address region assignment information based on a sample request.

[0013] Figure 5 An example is shown in which an isolated address region assignment instruction is associated with one of multiple physical address spaces;

[0014] Figure 6 Examples of physical alias points are shown;

[0015] Figure 7 An example of the use of completion end-side isolation address region assignment information is illustrated, in which the completion end-side isolation address region assignment information is used by a device communicating with a host device according to a device interface protocol such as Compute Quick Link (CXL);

[0016] Figure 8 The steps for processing isolated address region assignment update instructions are illustrated.

[0017] Figure 9 This is the first example of an isolated address region assignment update instruction;

[0018] Figure 10 The steps to be performed in response to an isolated address region assignment update instruction are illustrated, including mapping from a first request defined according to the host memory system protocol to a second request according to the device interface protocol;

[0019] Figure 11 This illustrates the handling of a first request when the target physical address does not correspond to any memory system location accessed by the end-side access control circuitry.

[0020] Figure 12 This illustrates the handling of a first request when the completed end-side access control circuitry supports uncontrolled access to a target physical address assigned by an updated isolated address region specified by an isolated address region assignment update instruction.

[0021] Figure 13This is a second example of an isolated address region assignment update instruction;

[0022] Figure 14 Another example of the steps for processing an isolated address region assignment update instruction is illustrated; and

[0023] Figure 15 A simulation example is shown.

[0024] An apparatus includes: an instruction decoding circuit for decoding instructions according to an instruction set architecture (ISA); and a processing circuit for performing a processing operation in response to the decoded instructions decoded by the instruction decoding circuit. To support trusted computing or other use cases involving the processing of sensitive data or program code, it may be helpful to provide support for isolating data associated with one address region of memory from being observed by program code associated with another address region. Therefore, a given address region may be associated with isolated address region assignment information, which defines access control information for controlling access to that region. The isolated address region assignment may be selected from one of a plurality of supported isolated address region assignments, including at least one more secure isolated address region assignment, for which data associated with the at least one more secure isolated address region assignment will be isolated from being observable by program code associated with at least one less secure isolated address region assignment.

[0025] Typically, an ISA may not have any dedicated instructions to set the isolation address region assignment information for a given address. Instead, the isolation address region assignment information is usually stored in a memory-based table structure accessed by load / store instructions executed by processing circuitry, and updated by executing a generic store instruction that specifies the address of the memory system location where the isolation address region assignment information is actually stored (rather than the address of the memory system location whose access is controlled by the isolation address region assignment information) as its target physical address.

[0026] However, as the memory topologies used in modern processing systems become increasingly complex, it can become increasingly difficult for software to track the specific memory system location where isolated address region assignment information is stored. This makes it more cumbersome to execute corresponding storage instructions that specify the address corresponding to the storage location of the isolated address region assignment information when it is necessary to change the address region assignment.

[0027] In the examples discussed below, the instruction decoding circuitry and processing circuitry support an ISA that includes, within its instruction set, an isolated address region assignment update instruction specifying a target physical address and an updated isolated address region assignment for that target physical address. In response to the isolated address region assignment update instruction being decoded by the instruction decoding circuitry, the processing circuitry triggers the issuance of at least one memory system request to request an update to isolated address region assignment information that defines access control information for controlling access to the target physical address. This update includes setting the isolated address region assignment information for the target physical address to indicate an isolated address region assignment from a supported set of isolated address region assignments. A specific isolated address region assignment to be set for the target physical address is selected based on the updated isolated address region assignment specified by the isolated address region assignment update instruction.

[0028] Therefore, using this approach, the isolated address region assignment update instruction specifies the address of the memory system location to be controlled by the updated isolated address region assignment, rather than specifying the storage location of the isolated address region assignment information itself. This simplifies software development because the software does not necessarily need to track the specific physical address storing the isolated address region assignment for a given physical address. This approach allows monolithic software to be more scalable to execute on different memory topologies involved in different processing system implementations, because the software is less likely to perform implementation-specific load / store operation sets to manage the specific isolated region assignment information structure for a specific part of the memory topology.

[0029] Instruction decoding and processing circuitry may support one or more variants of isolated address region assignment update instructions. Some examples may support only one variant of the variants mentioned below. Other examples may support more than one variant. Variants of instructions can be distinguished by their instruction opcodes and / or by other parameters (such as operands or control parameters specified by the instruction) and / or by control information stored in control registers or other storage locations that may affect how a given instruction encoding is interpreted. A single implemented instruction type may, for example, be used as more than one variant of the variants described below by having a single instruction opcode that, for a given encoding, causes two or more variants of the variants described below in relation to the behavior described below. In some cases, a given instruction type with a given opcode may be considered to always have one or more behaviors depending on one or more variants discussed below. In other examples, a given instruction type with a given opcode may be variably selected to behave as one variant or another, for example, by providing parameters specified by the instruction or in a control register that controls which behavior is triggered by the instruction. Therefore, it should be understood that variants of instructions can be distinguished in multiple ways, and any particular implementation may support multiple combinations of one or more variants of these variants.

[0030] Some implementations may perform specific completion-side access control checks for a given region of the system address space. These specific completion-side access control checks perform access control at a system point local to the "completion end" (the component acting on the requested memory access) of the memory access to the given address. For example, the completion end may be a memory controller associated with a specific memory storage unit, or it may be a device coupled to a host system including the CPU via a device port. Such completion-side access control checks can be contrasted with "request-side" access control checks, which are performed at the requesting end that issues the memory access, such as by a central processing unit (CPU), graphics processing unit (GPU), or input / output memory management unit (IOMMU) that manages memory access on behalf of devices such as input / output devices and hardware accelerators. Completion-side access control checks allow for more specialized access control schemes for specific address regions (e.g., regions used by input / output devices) compared to what can be practically achieved by implementing all access control checks on the requesting end. However, in specific implementations supporting such completion-side access control checks, the address mapping used to identify the location of a specific item in the memory address region assignment information can be particularly complex, depending on the specific memory topology in use. Furthermore, some variants of the completion side may require commands to be generated in a specific protocol, which can be difficult to drive from the requesting side using generic memory instructions.

[0031] Therefore, in some examples, the ISA may support completion-side update variants of the isolated address region assignment update instruction. In response to a completion-side update variant, the processing circuitry may trigger the issuance of at least one memory system request to request the application of the update to completion-side isolated address region assignment information used by completion-side access control circuitry to control access to the target physical address by completion-side memory system components associated with the completion-side access control circuitry. Providing ISA support for completion-side variants of the isolated address region assignment update instruction can be particularly useful, as this can significantly simplify the software management of address region isolation implemented using completion-side access control checks.

[0032] For example, the completion edge memory system components may include devices that share access to the device's memory system and communicate with the device via a device interface according to a device interface protocol. Such protocols enable devices to implement some form of completion edge isolated address region assignment information, which is set using a specific message type according to the device interface protocol. However, if the table of isolated address region assignment information is to be set using regular storage instructions, which are not distinguished in the ISA from regular storage instructions used for standard data write operations, it may be more difficult to provide the circuitry logic for the device interface to issue specific message types for updating the completion edge isolated address region assignment information according to the device interface protocol. By providing ISA support instructions at the architecture level for requesting updates to the completion edge isolated address region assignment information, the microarchitecture design for device interface-specific circuitry can be greatly simplified (e.g., this reduces the need for the device interface to track specific addresses associated with the completion edge isolated address region assignment information, which would otherwise consume power and introduce latency when looking up the address structure at the device interface).

[0033] For example, the device interface protocol may include Compute Fast Link (CXL), a protocol for supporting coherent devices with caches that will undergo coherence protocols used by the host system to which the device is connected via the device interface. The CXL protocol supports a feature known as CXL-TSP (CXL TEE Security Protocol, where TEE stands for Trusted Execution Environment), which supports the use of devices with Trusted Execution Environments (TEEs) and other use cases requiring data isolation from one application to prevent it from being observed by another application. The CXL-TSP protocol enables the assignment of a TEE exclusive state (or simply TE state) to a given physical address. This state can be used to isolate data associated with an address having a more secure TE state from being observed by processes that generate memory access requests associated with a less secure TE state.

[0034] Therefore, in some examples, the completion end-side isolated address region assignment information includes information indicating the TEE exclusive status associated with the target physical address according to CXL-TSP. Thus, supporting the completion end-side update variant of the isolated address region assignment update instruction in the ISA can be particularly useful for simplifying the development of software executing on a host processing system that includes an interface with CXL-TSP-compatible devices, while enabling more efficient design of the host system's device interface circuitry when supporting CXL-TSP.

[0035] It should be understood that other device interface protocols with characteristics similar to the TEE exclusive state of CXL-TSP can also be provided, and therefore the end-side update variant of the isolated address region assignment update instruction can also be applied to other device interface protocols.

[0036] Additionally, in some cases, the memory system component itself, as part of the host memory system rather than an external device coupled via a device interface, may have a completion-side access control check unit that implements local access control based on a corresponding set of completion-side isolated address region assignment information. Therefore, the completion-side update variant of the isolated address region assignment update instruction is not limited to use with a device, but can also be used to set isolated address region assignment information associated with completion-side access control circuitry within the host processing system.

[0037] In some examples, in response to a completion-side update variant of the isolated address region assignment update instruction, at least one memory system request issued by the processing circuitry may include a first request as defined by the host memory system protocol. The first request may represent a request such that, if the first request is routed to the device interface based on a target physical address, the device interface generates a second request to be transmitted to the device according to the device interface protocol. The second request may include a request to update the completion-side isolated address region assignment information associated with the target physical address. Therefore, the completion-side update variant of the isolated address region assignment update instruction can drive the hardware to remap the first request according to the host memory system protocol to the second request according to the device interface protocol. For system designers, implementing updates to isolated address region assignment information using regular memory instructions (which are not architecturally distinguishable from memory instructions used for regular data write operations) would be far less efficient because, without a dedicated completion-side update variant of the instruction, the only information available to detect updates to the completion-side isolated address region assignment information would be the physical address. Therefore, this would require implementing a structure at the device interface for tracking addresses allocated for storing completion-side isolated address region assignment information. Finding such a structure would result in significant latency and power costs for each memory operation, which is undesirable. This can be avoided by providing a dedicated isolated address region assignment update instruction that can drive the generation of a second request based on a first request. For example, the first request could be a request according to the device's internal memory system bus protocol, while the second request could be a TEUpdate command of CXL-TSP as defined in the CXL specification (version 3.0 or later).

[0038] In some examples, a first request generated in response to an Isolated Address Region Assignment Update (IARI) instruction may instruct at least one cache entry in a cache that specifies data associated with a target physical address to be invalidated. At least one cache may include one or more host caches of a host device and / or one or more device caches of a device. In some cases, invalidating stale entries from host caches and / or device caches may be important for maintaining security after updating the IARI assignment information. Therefore, in addition to triggering the update from the IARI assignment Update (IARI) instruction, a completion-side update variant of the IARI assignment Update (IARI) instruction may also trigger the invalidation of stale cache entries corresponding to the target physical address. This reduces the need for software to use ISA instructions executed separately from the instruction that triggers the update of the IARI assignment information to individually trigger such cache invalidation; thus, this combined update / invalidation instruction simplifies software development and improves processing performance by reducing the total number of instructions that need to be executed.

[0039] In some examples, in response to a completion-side update variant of an isolated address region assignment update instruction, when the target physical address does not correspond to any memory system location controlled by completion-side access control circuitry, the processing circuitry may allow the instruction to continue execution without applying the update to the completion-side isolated address region assignment information corresponding to the target physical address. It can be anticipated that for variants of instructions used to update completion-side isolated address region assignment information, if an instruction specifying an address not subject to completion-side access control is executed, an error should be flagged (e.g., a fault to interrupt program execution) because the update cannot be performed. However, in practice, when executing a completion-side update variant of an isolated address region assignment update instruction specifying a target physical address mapped to a location not subject to completion-side access control, it may be more efficient to allow the processing circuitry's program execution to continue without interruption. If completion-side access control circuitry is not configured in a given system to provide access control functionality associated with the target physical address, this operation may architecturally manifest as a no-operation (NOP) instruction. This allows for the development of scalable software that is independent of whether or not end-side access control circuitry is actually provided to control access to a given physical address, enabling the same software to be designed and executed across multiple physical platforms.

[0040] In some examples, the isolated address region assignment update instruction specifies one of multiple request-side isolated address region assignments defined according to the instruction set architecture as the updated isolated address region assignment. The request-side isolated address region assignment can specify a given set of options for encoding the isolated address region assignment. Not all of these options are necessarily supported in the completion-side isolated address region assignment information. In some cases, only a subset of the supported request-side isolated address region assignments may have corresponding settings for the completion-side isolated address region assignment. To support the development of platform-independent program code, it may be helpful to identify the updated isolated address region assignment using a given request-side isolated address region assignment, even if the instruction is intended to cause an update to the corresponding item in the completion-side isolated address region assignment information. This allows the same software to be extended to different forms of completion ends that may implement different combinations of options for the completion-side isolated address region assignment information. There may be a specific mapping between the requesting end-side isolated address region assignment information and the completed end-side isolated address region assignment information. This specific mapping can be used by the device interface to convert between the first request and the second request.

[0041] Therefore, in some examples, in response to a completed-side update variant of an isolated address region assignment update instruction, when the target physical address corresponds to a memory system location accessed under the control of the completed-side access control circuitry, the completed-side access control circuitry does not support any completed-side isolated address region assignment corresponding to one of the multiple requested-side isolated address region assignments specified as updated by the completed-side update variant of the isolated address region assignment update instruction: the processing circuitry is configured to allow the instruction to continue execution without applying the update to the completed-side isolated address region assignment information corresponding to the target physical address. This means that if the requesting end executing the isolated address region assignment update instruction is requesting an update to a setting not supported by the completed end, the update can be simply ignored without signaling a fault or error that would cause processing to be interrupted. Similarly, this helps to make the software scalable to multiple different system implementations, ensuring that the same software remains compatible with the device even if the device does not necessarily support all the options supported by the requesting-side check.

[0042] In some examples, the ISA supports request-side update variants of isolated address region assignment update instructions. This can be supported as a complement to or alternative to completion-side update variants. In some examples, the completion-side update variant and the request-side update variant can be the same type of instruction (either permanently represented as two variants, or having parameters for the instruction, or parameters stored in a control register that select whether the instruction is represented as a completion-side update variant, a request-side update variant, or both variants for a given instance of executing the instruction).

[0043] In response to a request-side update variant of an isolated address region assignment update instruction, the processing circuitry triggers at least one memory system request to apply an update to the request-side isolated address region assignment information, which will be used by the request-side access control circuitry to control the processing circuitry's access to the target physical address. Therefore, this allows the memory-based control structure used by the request-side access control circuitry to be updated more efficiently than using general-purpose memory instructions. The intent expressed by the isolated address region assignment update instruction allows the memory system to distinguish updates to the request-side access control information from regular memory write operations, which can contribute to more efficient processing (such as additional cleanup and / or erasure as needed in response to the same instruction, and / or selection of caching strategies based on instruction type).

[0044] Some examples support request-side and completion-side update variants of isolated address region assignment update instructions. In response to these variants, processing circuitry is configured to trigger the issuance of at least one memory system request to request that a corresponding update be applied to both: completion-side isolated address region assignment information used by completion-side access control circuitry to control access to a target physical address by a completion-side memory system component associated with the completion-side access control circuitry; and request-side isolated address region assignment information to be used by request-side access control circuitry to control processing circuitry's access to the target physical address. This can be useful because when changing isolated address region assignments, it is often desirable to request corresponding changes to both the request-side and completion-side isolated address region assignment information; therefore, a combined instruction that requests updates to both types of information can reduce the total number of instructions to be executed.

[0045] In some examples, in response to a failover variant of an isolated address region assignment update instruction, the processing circuitry is configured to trigger the invalidation of a cache entry corresponding to the target physical address. The failover variant may be helpful in allowing the elimination of stale cache entries for the target physical address in response to the same instruction that also triggers an update of the isolated address region assignment. For example, the entries to be invalidated may include cache entries corresponding to the target physical address that were associated with a previous isolated address region assignment, and / or cache entries corresponding to the target physical address that are associated with the updated isolated address region assignment (these cache entries may still reside in the cache from a previous time when the target physical address was associated with the updated isolated address region assignment). Providing a failover variant reduces the need to execute separate cache maintenance instructions in addition to the isolated address region assignment update instruction. The invalidation of cache entries triggered by the failover variant may also include cleaning up the cache entry by writing the data from the cache entry back to a subsequent cache or memory if the cached data is dirty.

[0046] In some examples, the completion-side update variant, request-side update variant, and / or request-side and completion-side update variant of the instruction may also behave as a invalidation variant by default, causing any stale cache entries (if present) to be invalidated upon any update. In other examples, the instruction's parameters, or parameters stored in the control register, may select whether a given instance of the completion-side update variant, request-side update variant, and / or request-side and completion-side update variant of the instruction should also behave as a invalidation variant.

[0047] In some examples, in response to an erase variant of an isolated address region assignment update instruction, the processing circuitry may trigger the issuance of at least one memory system request to request that the memory system location identified by the target physical address be set to a predetermined value, and to update the isolated address region assignment information. For some use cases, when switching the type of isolated address region assigned to a given target physical address, it may also be desirable to overwrite any previously stored data in the corresponding memory location. For example, when switching a memory region assignment from a more secure isolated address region assignment to a less secure one, it may be desirable to perform an "erase" process to ensure that sensitive information previously stored in the more secure region of the memory address space cannot be accessed by a less secure process performed using that memory region after the update of the isolated address region assignment. Therefore, by providing ISA support for erase variants of instructions that update the isolated address region assignment and also clear the memory system location identified by the target physical address to a predetermined value (e.g., 0), this reduces the number of instructions required to perform the update and erase operations, thereby contributing to improved performance.

[0048] Similarly, in some examples, the completion-side update variant, request-side update variant, request-side and completion-side update variant, and / or fail variant of the instruction may also behave as an erase variant by default, causing an erase of the memory system location associated with the target physical address to be triggered on any update. In other examples, the parameters of the instruction or parameters stored in the control register may select whether a given instance of the completion-side update variant, request-side update variant, request-side and completion-side update variant, and / or fail variant of the instruction should also behave as an erase variant.

[0049] In some examples, the processing circuitry is configured to signal a fault in response to an attempt to execute an isolated address region assignment update instruction when the processing circuitry is in an operating state with a privilege level below a threshold. Therefore, the isolated address region assignment update instruction can be restricted to execution only in specific operating states deemed to have sufficient privileges to justify changing the isolated address region assignment. This prevents less privileged software from circumventing the security protections provided by the isolated address region assignment by updating the isolated address region assignment information. For example, the threshold privilege level could be the highest privilege level supported.

[0050] There are several ways to control how memory accesses to a given physical address are handled, including by using an isolated address region assignment associated with that physical address.

[0051] In some examples, the apparatus may include access control circuitry configured to control whether a given memory access request is permitted access to a given physical address region based on whether a combination of the requested isolated address region type specified by the given memory access request and the isolated address region assignment specified by isolated address region assignment information associated with the given physical address is a permitted combination of selected isolated address region and isolated address region assignment. For example, this could facilitate the implementation of access restrictions to prevent a request associated with a less secure isolated address region assignment from accessing a memory region assigned a more secure isolated address region. The access control circuitry may include request-side access control circuitry and / or completion-side access control circuitry, as discussed above.

[0052] In some examples, the apparatus may include at least one memory system component configured to treat aliased physical addresses associated with different isolated address region assignments as if they specify different memory system resources, even if these aliased physical addresses actually correspond to the same memory system resource. This can be helpful in reducing the risk of attackers leaking side-channel information about address access patterns of more secure software. Therefore, in some cases, the isolation observed by program code associated with more secure isolated address region assignments by program code associated with less secure isolated address region assignments can be implemented not only by restricting the ability to read or write data with more secure isolated address region assignments, but also by preventing less secure program code from learning side-channel information about which addresses have been accessed by program code associated with more secure isolated address region assignments.

[0053] In some examples, the device includes memory encryption circuitry for encrypting or decrypting data associated with a given physical address based on a key selected based on information verified according to isolation address region assignment information specified for the given physical address. Therefore, by selecting different encryption keys at least in part based on information verified using isolation address region assignment information for a given physical address, isolation can be implemented between software workloads provided by different, mutually distrustful parties, as the use of different encryption keys provides confidentiality for corresponding data stored in regions with different isolation address region assignments.

[0054] In some examples, the device may include a general-purpose central processing unit (CPU) comprising instruction decoding circuitry and processing circuitry. Therefore, isolated address region assignment update instructions can be supported by a general-purpose CPU (which may differ from a dedicated security processor or hardware accelerator). By introducing support for updating isolated address region assignment information into the ISA used by a general-purpose CPU, this can help simplify software development for managing trusted computing workloads on the processing system and allow for more efficient circuit implementations of the memory system hardware (e.g., circuitry at the device interface).

[0055] In some examples, in response to an isolated address region assignment update instruction, the processing circuitry may issue at least one memory system request to a memory system bus interface configured to control the routing of at least one memory system request based on the target physical address specified by the isolated address region assignment update instruction. Therefore, the target physical address specified by the instruction can be used for routing control just like a target physical address for regular memory access, even if the location to be updated is not actually identified by that target physical address, but rather a location storing access control information used to control access to that target physical address.

[0056] The techniques discussed above can be implemented within a device having hardware circuitry for implementing instruction decoding circuitry and the processing circuitry discussed above. However, the same techniques can also be implemented within a computer program that executes on a host data processing unit to provide an instruction execution environment for executing target code. Such a computer program can control the host data processing unit to emulate the architectural environment provided on the hardware device, which actually supports target code according to a specific instruction set architecture, even if the host data processing unit itself does not support that architecture. The computer program may have instruction decoding program logic and processing program logic that emulate the functionality of the instruction decoding circuitry and processing circuitry discussed above. The instruction decoding program logic can assign update instructions to the claimed isolated address region and map them to the corresponding instruction set defined according to the host instruction set architecture supported by the host data processing unit.

[0057] For example, such emulation programs can be useful when executing legacy code written for one instruction set architecture on a host processor that supports different instruction set architectures. Additionally, emulation can allow software development for a newer version of the instruction set architecture to begin before the processing hardware supporting the new architecture is ready, because executing the software on a emulation environment allows software testing to be performed in parallel with ongoing development of hardware that supports the new architecture.

[0058] In the context of software-based simulation, a reference to “register” (when made in the context of a hardware-supported implementation) can be understood to refer to a simulated register of the target instruction set architecture, which is mapped by the simulator program to host storage resources (e.g., registers and / or memory) provided by the host device. Similarly, in the context of a hardware-supported implementation, a reference to “physical address” or “physical address space” can be understood for the context of a simulation implementation to refer to a simulated physical address or a simulated physical address space, which can be similarly mapped to host storage resources (registers and / or memory) of the host device.

[0059] The simulation program can be stored on a storage medium, which can be a non-transitory storage medium.

[0060] Figure 1 An example of device 6 is illustrated schematically. This device can be, for example, a processing element such as a central processing unit (CPU), a graphics processing unit (GPU), or other types of processor. In some examples, the CPU can be, for example, a general-purpose CPU that supports general arithmetic, logic, and load / store instructions, rather than a dedicated processor such as a security processor.

[0061] Apparatus 6 includes an instruction fetch circuit 103 for fetching program instructions (program instructions defined according to a specific instruction set architecture (ISA) supported by apparatus 6) from an instruction cache and / or other parts of the memory system. The instructions fetched by instruction fetch circuit 103 are passed to instruction decoding circuit 104, which decodes the instructions to generate micro-operations (decoded instructions), which are then passed to processing circuit 105. These micro-operations control processing circuit 105 to execute corresponding processing operations. Processing circuit 105 can access various registers 106 that provide operands for the executed processing operations, store the results of the processing operations executed by processing circuit 105, and / or provide control information controlling how processing circuit 105 processes certain types of operations. When load / store instructions are decoded by instruction decoding circuit 104, processing circuit 105 generates one or more memory system requests, which are issued to the memory system to request that data be loaded from the memory system into register 106 or stored from register 106 into the memory system, and processing circuit 105 processes any responses received from the memory system.

[0062] like Figure 2As shown, the system physical address space (the address space that identifies a specific hardware storage location of the system including device 6) can be logically divided into multiple isolated address regions, such that a given physical address can be associated with isolated address region assignment information, which defines an isolated address region assignment from a set of supported isolated address region assignments selected for that region. The isolated address region assignment information serves as access control information for controlling access to the corresponding physical address. The supported isolated address region assignments include at least one more secure isolated address region assignment and at least one less secure isolated address region assignment. For the at least one more secure isolated address region assignment, data associated with the at least one more secure isolated address region assignment will be isolated to prevent it from being observed by program code associated with the at least one less secure isolated address region assignment. An example mechanism for implementing this isolation is described in more detail below. However, generally speaking, in systems where the developer of one piece of software coexists with a second piece of software on the same hardware platform and does not trust the second piece of software, the ability to define various types of isolated address regions can help enhance security. Therefore, it is desirable to prevent the second piece of software from accessing data associated with the first piece of software and / or gaining any visibility into the address access patterns requested by the first piece of software. Some examples may support only two types of isolated address region assignments (a more secure isolated address region assignment and a less secure isolated address region assignment). However, as... Figure 2 As the example shows, other specific implementations may support more than two types of isolated address region assignments (e.g., in...). Figure 2 In this context, at least four different isolated address regions are supported for assignment, labeled as isolated address region 0, isolated address region 1, isolated address region 2, and isolated address region X. For example... Figure 2 As shown, the physical address regions associated with a specific isolated address region assignment can be non-contiguous (e.g., Figure 2 An example is shown illustrating two non-contiguous regions, both assigned to Isolation Address Region Type 0. It should be understood that a particular isolation scheme can vary depending on design objectives, and therefore the number of isolated address regions assigned, as well as the rules governing the relative licensing and security protocols associated with each type of isolated address region assignment, can vary. However, in general, such an isolation scheme can be helpful in allowing confidential computing applications to be supported on physical platforms that can be shared with other untrusted software.

[0063] like Figure 2 As shown, an isolated address region assignment information table can be used to track isolated address region assignments. This table is stored at the memory system location corresponding to a given set of physical addresses. Although for ease of understanding... Figure 2The diagram illustrates a single contiguous block of addresses allocated for an isolated address region assignment information table within an isolated address region X, but this table is not necessarily contiguous in the physical address space. In some examples, a multi-level table structure can be used, where entries selected from an initial level table based on a given physical address contain pointers to further level tables that provide region assignment information for that physical address or provide yet another pointer to an even further level table. In a multi-level structure, subsequent levels of tables can be non-contiguous in the memory address space. Multi-level structures can be helpful in reducing the memory footprint associated with tables describing a given memory address space region, avoiding the need to reserve a single large contiguous block of physical memory for a single linear table whose size is commensurate with the size of the address region to be described by the table.

[0064] When a table structure defining the assignment information for isolated address regions is stored in the memory system, it is expected that the mechanism typically used to update this table structure will be software execution of generic memory instructions (e.g., ...). Figure 2 The STR shown in the diagram specifies an address operand (directly or possibly based on at least one stage of address translation) that identifies the physical address PAy in a region allocated for use in a storage table structure. Using this type of instruction, page tables can be set by software with access permissions that ensure that processes lacking sufficient privileges to update isolated address region assignment information cannot successfully perform the storage of the physical address PAy.

[0065] like Figure 2 As shown, in the example discussed below, the ISA-defined isolated address region assignment update instruction is supported by instruction decoding circuitry 104 and processing circuitry 105. This instruction specifies the value of a physical address PAz (again, directly or indirectly via at least one stage of address translation) as its address operand, for which an associated entry in the isolated address region assignment information controlling access to physical address PAz is to be updated. In response to the instruction specifying physical address PAz, the hardware of the processing system can identify the location PAy of the corresponding entry in the isolated address region assignment information table and trigger an update of the isolated address region assignment information at address PAy, which controls memory access for a memory access request for the specified address PAz.

[0066] This simplifies software development because the software is less required to track the relationship between the addresses of corresponding entries in the isolated address region assignment information for a given data address. Furthermore, such isolated address region assignment update instructions better support address isolation schemes used in more complex memory system topologies, such as where devices (e.g., input / output (peripheral) devices, hardware accelerators, or external memory storage devices) can be associated with their own form of isolated address region implementation. If such table updates were performed using generic memory instructions, this might require additional, relatively complex system-specific software code snippets to manage the table structure used locally on the device to control address region isolation, and in the case of isolated address region assignment update instructions, the software might be less aware of the specific details of the particular system.

[0067] Furthermore, when updates to isolated address region assignments are triggered using specific instruction types instead of general storage operations, other related operations associated with the updates (such as cache misses and / or erasures of associated physical addresses controlled by the isolated address region assignments) become likely to be triggered by the same instruction. This is because the update instructions supported by the ISA indicate the software's intention to specifically update the isolated address region assignments (unlike regular storage of arbitrary data other than isolated address region assignments), which is not possible with general storage instructions. Therefore, depending on the additional options supported in the ISA for update instructions targeting isolated address region assignments, this can make related operations around updates to isolated address region assignments more efficient, as it reduces the need for the software to execute other separate instructions to trigger cache misses, erasures, or any other related operations that might be required when updating isolated address region assignments.

[0068] Furthermore, if the fact that a given write request is related to an update of the isolated address region assignment information can be detected based on the instruction type without comparing the physical address with information defining which addresses are used in the isolated address region assignment information table, the device interface can be simplified in the hardware design of the device interface (and associated with lower latency in processing the update of the isolated address region assignment information on the end side).

[0069] While the isolated address region assignment update instruction can be used in a variety of use cases involving assigning isolated address region information to specific physical addresses, it will now refer to Figure 3 Discuss a specific example use case.

[0070] Figure 3 The illustration schematically illustrates that it may include Figure 1An example of a data processing system 2 in the illustrated device 6. The data processing system 2 includes a host system 4, which may be implemented as a system-on-a-chip or as a collection of interconnected chiplets. The host system 4 includes one or more processing elements (processors) 6. Each processor 6 may be, for example, a central processing unit (CPU, such as a general-purpose CPU), a graphics processing unit (GPU), a neural processing unit (NPU), or any other processor capable of executing instructions. Figure 3 Any one or more of the processors in the processor 6 shown may have according to, Figure 1 Circuits 103, 104, 105, and 106 of the device 6 shown.

[0071] like Figure 3 As shown, each processing element 6 may include at least one dedicated cache 8 for caching data obtained from memory storage device 12 via interconnect 10. Each memory storage unit 12 has an associated memory controller 14 for mapping requests made according to the bus protocol used by interconnect 10 to a specific protocol for addressing a specific type of memory storage implemented in the corresponding memory storage unit 12 (e.g., depending on various types of memory storage technologies, memory storage unit 12 may include volatile or non-volatile memory). Interconnect 10 may include a system cache 34 that acts as a shared cache accessible to each processing element 6.

[0072] Therefore, each of the multiple processing elements 6 can have access to the shared memory 12 within the host system 4. However, besides the processing elements 6 themselves, another source of memory access requests to the shared memory 12 could be devices 20, 22 coupled to the host system via corresponding root ports 26. Each root port 26 acts as a gateway to the host system for the corresponding device or a group of devices. Although Figure 3Each device 20, 22 is shown to have a separate root port 26, but it is also possible for a group of devices to share a single root port. Devices 20, 22 may include, for example, any one or more of the following: I / O (input / output) devices (e.g., network controllers, display controllers, user input devices, etc.) used to control the interaction between the host system and the user or the external world; hardware accelerators used to perform certain custom processing functions (e.g., neural network processing, cryptographic functions, etc.) in a more efficient manner than by using the general-purpose processor 6 in software; and / or external memory storage devices configured to provide additional storage capacity beyond that provided in the memory storage device 12 of the host system 4. Devices 20 and 22 access shared memory 12 via a system memory management unit (SMMU, also known as an input / output memory management unit or IOMMU) 30, which performs address translation and access permission checks on requests made by devices 20 and 22 in a manner similar to that of a memory management unit within processing element 6. Such translation and permission checks are based on address mappings and access permissions defined in a translation table structure (page table structure) stored in memory system 12 and configured by software executed on processing element 6.

[0073] Interconnector 10 may be associated with master node circuitry 32, which is responsible for maintaining consistency among cached data stored in dedicated caches 8, 24 of multiple cache agents in data processing system 2. Cache agents may include processing element 6 and any consistency device 22 having its own dedicated consistency cache 24 (other devices 20 may be non-cached devices (or "I / O consistency" devices) that do not have dedicated caches requiring consistency with the host device). For example, consistency device 22 may be a device whose interface between device 22 and host system 4 is compatible with a given device interface protocol such as the CXL (Compute Fast Link) standard.

[0074] The master node circuit 32 implements a given consistency protocol that defines a set of request types and response protocols associated with those request types. For a given cache broker, each address can be considered to be stored in the dedicated cache of that cache broker in a specific consistency state. For example, for a given address and given cache brokers 6 and 22, the consistency state can specify whether valid data for that address is stored in the dedicated cache 24 of the given cache broker, and if valid data is stored, whether the data is clean or dirty and / or stored in a unique or shared state (unique data is exclusively stored in the cache of that cache broker and not in the caches of other cache brokers, while shared data can also be stored in the caches of other cache brokers). The consistency protocol may require that certain request types or responses to such requests can be associated with certain transitions in the consistency state of cached data items associated with the target address of the request. When a read / write request for a read / write operation on a given physical address is received from one of the cache brokers 6, 22 or the I / O coherence device 20, the master node circuit 32 sends a snoop request to one or more other cache brokers that may potentially hold valid cached data for that physical address. The snoop request may query the corresponding cache broker for the current consistency state of the cached data for the specified address and / or trigger a change in the consistency state at the cache broker (e.g., invalidating the cached data if the requesting end of the original read / write request requires data to be cached in a unique state in its cache, and / or returning dirty data held in cache 8 of the snooped cache broker, making that dirty data accessible to the requesting end that sent the read / write request).

[0075] like Figure 3As shown, the master node circuit 32 may be associated with a snoop filter 36 for (at least partially) tracking which data addresses are cached at certain cache proxies 6, 22. The snoop filter 36 can be used to reduce snoop traffic by allowing the consistency interconnect 10 to determine when data is not cached at a particular requesting end. Without a snoop filter, when a requesting end 6, 20, 22 issues a read or write transaction for data that can be shared with other cache proxies 6, 22, the consistency interconnect 10 may trigger snoop requests to each other cache proxies that may have cache copies of data from the same address. However, if there are many cache proxies, this method of broadcasting snoops to all cache requesting ends can be complex and can result in a large amount of consistency traffic being exchanged within system 2. By providing a snoop filter 36 that can at least partially track which addresses are cached at the respective cache proxies 6, 22, this helps reduce the amount of snoop traffic, enabling more efficient use of available request bandwidth and improving system performance. In modern systems with multiple cache proxies, achieving an exact snooping filter scheme that precisely tracks the addresses stored at each cache proxygent 6, 22 may be impractical, as such accuracy could be unacceptably expensive in terms of storage and bandwidth costs. Therefore, snooping filter 36 may not precisely track cache contents. If there are no erroneous snooping suppression instances—that is, data actually stored at a given dedicated cache 8, 24 is incorrectly flagged as absent, causing snooping to that given dedicated cache 8, 24 to be incorrectly suppressed—a less precise tracking scheme can be permitted, allowing for cases where snooping requests are issued to a given cache proxygent but (due to a lack of precise information) the cache proxygent does not actually hold a valid copy of the data for the address specified in the snooping request. In some examples, system cache 34 and snooping filter 36 can be combined, where a single structure for address-based lookup provides both the cache data associated with that address and the snooping filter information. In some cases, additional eavesdropping filtering circuitry 142 may be provided at the root port 26 (device interface) associated with at least one conformance device 24 and / or within the device itself (see description below). Figure 7 This allows for further filtering of snooping requests targeting the device.

[0076] like Figure 3As shown, host system 4 may also include memory encryption / decryption circuitry 50 for encrypting / decrypting data written to or read from memory storage device 12. Providing an onboard encryption engine can be useful for improving security in confidential computing scenarios. The encryption / decryption applied by memory encryption / decryption circuitry 50 may depend on key information 52 accessible to memory encryption / decryption circuitry 50. The key information 52 used to encrypt / decrypt data for a given memory request may be selected based on a Physical Address Space Identifier (PASID) and / or a Memory Encryption Context Identifier (MECID) associated with a given memory request, as will be further described below. MECID distinguishes two or more different memory encryption contexts associated with the same physical address space, allowing corresponding portions of mutually untrusted software with access to portions of the same physical address space to subject their data to different encryption mechanisms (e.g., different encryption keys) to help maintain confidentiality between them.

[0077] Figure 4 A more detailed example of the circuitry provided at processing element 6 is shown. As previously discussed... Figure 1 The aforementioned processing element 6 includes an instruction fetch circuit 103, an instruction decode circuit 104, a processing circuit 105, and a register 106 (for simplicity, in...). Figure 4 The extraction circuit 103 and some registers 106 are omitted in the text. Figure 4 Register 106 may include some control registers 62 for storing control status information. Processing element 6 may also include a memory management unit (MMU) 106, which includes a translation back buffer (TLB) for controlling access to memory by processing element 6 based on address translation mappings and access permission information defined in a translation table structure stored in memory 12. The TLB caches translation table information derived from the translation table structure (also known as a page table structure). In this example, control register 62 includes indications of the current security state 64 and the current exception level 66, as well as a set of MECID registers 68 for assigning MECIDs to requests issued in the current operating state.

[0078] Processing element 6 also includes a requesting end-side access control circuit 108, which is used to assign information based on the requesting end-side isolated address region (about...). Figure 2 (Example of isolated address region assignment information described) to perform access control functions. For example, the requesting end-side isolated address region assignment information may include a granular protection table that associates each physical address described by the table with a corresponding physical address space assignment selected from multiple architectural physical address spaces supported by the ISA supported by processing element 6.

[0079] like Figure 5 As shown, in this example, processing element 6 supports multiple different architecture physical address spaces 84 that can be used to address the memory system. The data processing system may support the use of virtual memory, where address translation circuitry (e.g., MMU 106) is configured to translate the virtual address specified by a memory access request from virtual address space 80 into a physical address associated with the location in the memory system to be accessed. The mapping between virtual and physical addresses can be defined in one or more page table structures. Page table entries within the page table structures may also define access permission information that controls whether a given software procedure executing on the processing circuitry is allowed to access a specific virtual address. For some translation mechanisms, the translation may involve two-stage address translation. If two-stage translation is used, the mapping from virtual address space 80 to physical address space 84 is performed via intermediate address space 82 based on two separate sets of translation table structures (one for stage 1 (virtual to intermediate address translation) and one for stage 2 (intermediate to physical address translation)).

[0080] In some processing systems, address translation circuitry maps all virtual addresses to a single physical address space, which the memory system uses to identify locations in memory to be accessed. In such systems, control over whether a particular address is accessible to a specific software process is based solely on the page table structure used to provide the virtual-to-physical address translation mapping. However, this page table structure is typically defined by the operating system and / or hypervisor. If the operating system or hypervisor is compromised, this can introduce security vulnerabilities, allowing attackers to access sensitive information.

[0081] Therefore, for systems that require certain processes to be executed securely in isolation from other processes, the system can support operations in multiple security states (domains) and multiple different architecture physical address spaces 84. Memory access requests whose virtual addresses are translated into physical addresses in different architecture physical address spaces 84 are treated as if they were accessing completely separate addresses in memory, even if the physical addresses in the corresponding physical address spaces actually correspond to the same location in memory. By isolating accesses from different operational domains of the processing circuitry into corresponding different physical address spaces as perceived by some memory system components, this provides stronger security guarantees independent of page table permission information set by the operating system or hypervisor.

[0082] In this example, processing circuitry 105 can execute instructions in one of four security states: non-secure, secure, domain, and root. The current security state indicator 64 in control register 62 specifies which security state is currently in use. Each of the four security states is associated with a corresponding Architectural Physical Address Space (PAS) 84. Therefore, there are four Architectural PAS: non-secure PAS, secure PAS, domain PAS, and root PAS.

[0083] The root state is the highest privileged state and is used by software to control transitions to / from other security states. The root state enables its virtual addresses to be translated from virtual address space 80 to any of the four physical address spaces 84. Information (NSE, NS) specified in the page table structure used to control the virtual address (VA) to physical address (PA) mapping controls which physical address space (PAS) is selected for a given memory access request issued in the root security state.

[0084] The insecure state is the lowest privilege secure state, and its memory accesses are translated by default into physical addresses in the insecure PAS (potentially via a two-stage address translation from virtual address space 80 to intermediate address space 82 and from intermediate address space to insecure physical address space 84). Instructions executed in the insecure state are not allowed to result in access requests that generate physical addresses in the specified secure PAS, realm PAS, and root PAS.

[0085] The secure state and the domain state are orthogonal secure states; they cannot access each other's physical address space or root physical address space, but they can choose whether to access their own corresponding PAS (the domain PAS of the domain state and the secure PAS of the secure state) or whether they should access the non-secure PAS. Therefore, the address translation control information (NS) specified in the page table structure can be used to select whether a given memory access request translates its address to a non-secure PAS or a secure PAS (when the request originates from the secure state) or to a non-secure PAS or a real PAS (when the request originates from the domain secure state).

[0086] like Figure 6As shown, the memory system may include a Physical Alias ​​Point (PoPA) 94, which is a point within the memory system where aliased physical addresses from different architecture physical address spaces 84 corresponding to the same memory system resource are mapped to a single physical address that uniquely identifies the memory system resource in the hardware physical address space 86 used by downstream memory system components (e.g., memory controller 14 and memory storage device 12). While more complex mappings between alias addresses are possible (e.g., based on a mapping table that tracks which values ​​in PAS 84 map to the same hardware physical address), this can be the simplest approach if addresses in the corresponding architecture PAS 84 that are considered aliased to the same location in the hardware physical address space 86 are those addresses with the same physical address value (e.g., PA=X in a secure PAS and PA=X in a non-secure PAS are considered aliased addresses). The location of the PoPA 94 can vary; for example, it can be upstream or downstream of the interconnect 10. Figure 3 In the example, PoPA 94 is downstream of interconnect 10 (and upstream of memory controller 14), causing system cache 34 to precede PoPA, but other examples may place PoPA 94 upstream of interconnect 10. Furthermore, although Figure 6 An example is shown with at least one cache 98 downstream of PoPA 94, but this is not required, and other examples may have no other cache downstream of PoPA 94 (e.g., Figure 3 (No post-PoPA cache shown).

[0087] Pre-PoPA memory system components (such as, Figure 3 and Figure 6In the example, caches 8, 34 (or other similar cache structures, such as translation lookaside buffers within MMU 106 or SMMU 30) can treat aliased physical addresses of different PAS 84 as if they correspond to different memory system resources, even if they ultimately map to the same memory system location in the system physical address space 86 used by the underlying memory 12, outside of PoPA 94. For example, pre-PoPA caches 8, 34 can cache data, program code, or address translation information for aliased physical addresses in separate entries, such that if requests to access the same memory system resource from different physical address spaces are made, these accesses will result in the allocation of separate cache or TLB entries. Furthermore, pre-PoPA memory system components may include master node circuitry 32 and a snoop filter 36 that tracks the consistency status of data stored at the corresponding cache agents 6, 22 for aliased addresses in different architecture physical address spaces 84. Therefore, for consistency, aliased physical addresses are treated as separate addresses, even if they actually correspond to the same underlying memory system resource. Figure 6 As shown, one way to ensure that alias addresses from different architecture PAS 84s are treated as separate addresses is to include a PAS identifier (PASID) 96, which distinguishes which architecture PAS 84 is associated with a given memory access request, as additional address bits in the representation used to look up the physical address of these pre-PoPA memory system components. Furthermore, a PAS tag value identifying the architecture PAS associated with a given cache entry can be specified in a given cache entry, and a lookup of the pre-PoPA cache can depend on a comparison between the PAS tag associated with the memory access request that caused the cache lookup (derived from page table information and / or the current security state 64 used to select which PAS to specify for a given request) and the PAS tag of the cache entry (derived from request-side isolated address region assignment information associated with the corresponding physical address).

[0088] Regardless of the form of the pre-PoPA memory system component, it is useful for such a PoPA memory system component to regard the aliased physical addresses in the corresponding architecture address space 84 as corresponding to different memory system resources, because this provides hardware-enforced isolation between accesses issued to different physical address spaces, so that information associated with one domain cannot leak to another domain through features such as cache timing side channels or side channels involving consistency changes triggered by consistency control circuitry.

[0089] Conversely, once a request crosses PoPA 94, the alias address from the corresponding PAS 84 architecture is mapped to a single, unique physical address in the hardware PAS 86. For example, if the alias physical addresses in the PAS 84 architecture are simply those physical addresses with the same physical address value, the mapping to the hardware PAS (System PAS) 86 can be easily performed by stopping the use of the PASID as an additional address bit when looking up the memory structure. Figure 6 As shown, for example, unlike the pre-PoPA cache 98 which used PASID 96 for address lookup and cache tagging, the post-PoPA cache 98 may no longer use PASID as part of the address lookup information for its lookup, and may no longer tag its cache entries with PASID 96.

[0090] The hardware physical address space 86 can be segmented so that a particular physical memory system location can only be accessed by a specific architecture PAS. This can be based on static mappings of some regions of the system physical address space (e.g., memory regions assigned to certain devices 20, 22 can be statically reserved to be accessible only by a certain architecture PAS). However, for other regions, dynamic mappings can be defined in a control structure looked up by the requesting end-side access control circuitry 108 to determine whether access to the target physical address from within the target architecture PAS 84 is permitted for a memory access request that has caused a translation from the virtual address specified by the request to a specific target physical address in the target architecture PAS 84. This control structure (also known as a granular protection table or GPT, used to support granular protection checks or GPC) is an example of requesting end-side isolated address region assignment information used by the requesting end to control memory access as described above. Each entry in a GPT can specify which architecture PAS in these architectures is assigned to a given physical address region to allow access to that physical address (some examples may also support GPT settings that allow more than one or even all architecture PASs to access the corresponding physical address in the system's physical address space).

[0091] like Figure 4 As shown, the requesting end-side access control circuit 108 may have one or more caches for caching portions of the GPT (or information derived from the GPT). Although Figure 4 This type of GPT cache is shown as separate from the corresponding TLB in MMU 106, but in other examples, the combined cache structure caches information from both the page table (translation table structure) for address translation and the GPT for granular protection checks. Similarly, while MMU 106 and the request-side access control circuitry 108 are in Figure 4 In the example shown, they are separated, but in other examples, a single circuit unit can perform both functions.

[0092] Using multiple architecture PAS 86 to address some pre-PoPA memory system components (such as caches 8 and 34) can be useful for improving the security of some use cases, enabling software operating in a domain or secure state to be isolated from untrusted software running in an insecure state (through hardware enforcement mechanisms). However, despite this, a given architecture PAS (e.g., a domain PAS) can support multiple pieces of software that do not trust each other and may distrust the operating system or hypervisor that sets the translation table structure to set access permissions to prevent unauthorized access to its data by other software sharing the same architecture PAS 84. Therefore, as Figure 4 As shown, for at least some of the architecture PAS 84 (e.g., for the domain PAS), it may be useful to provide support for MECID (Memory Cryptographic Context Identifier) ​​to distinguish different cryptographic contexts within the same architecture PAS 84.

[0093] like Figure 4 As shown, processing element 6 may include a MECID register 68, which can be used by software to configure which MECID values ​​should be assigned to memory requests issued by processing circuitry 60 at a given time. For example, some approaches may simply provide a single MECID register 68 indicating the MECID currently in use (which may be updated by privileged software during context switching between one cryptographic context and another). Multiple MECID identifier status entries may also be provided (e.g., in different fields within a single MECID register 68 or in different MECID registers 68), each MECID identifier status entry associated with a corresponding operating state of processing element 6 (e.g., anomaly level or privilege level), such that the appropriate MECID for that operating state can be selected based on the current anomaly level indication 66 or another indication of the current operating state. By supporting MECIDs defined simultaneously for multiple operating states (e.g., anomaly levels), this reduces the amount of reprogramming of MECID registers required when transitioning back and forth between different operating states (e.g., such frequent transitions can be common when handling anomalies). Furthermore, multiple MECID definition status entries may be defined, which can be applied to different categories of memory access operations. For example, which MECID definition status entry is used to provide the MECID for a given memory access request may depend on the type of load / store instruction executed to issue the memory access request. Therefore, it should be understood that various architectural mechanisms exist through which the software configuration state in control register 62 can be specified to influence the assignment of MECIDs to specific memory access requests.

[0094] Therefore, as Figure 4 As shown, when a given memory access request is issued by processing element 6 to memory systems 8, 10, and 12, in addition to the physical address translated from the virtual address by MMU 70 and the PAS ID identifying the target architecture PAS 84, the request may also specify a MECID that distinguishes the selected memory encryption context associated with the request from other memory encryption contexts of the target architecture PAS. The memory encryption / decryption circuit 50 can select from different key information items based on the combination of PASID and MECID, allowing different software within the same architecture PAS (and different software within different architecture PAS) to use different encryption keys to ensure mutual data privacy. Although Figure 4 An example is shown of register 68 defined at processing element 6 and an example derived from a translation table structure for controlling the assignment of PASID and MECID to memory access requests, but requests transmitted to the memory system by devices 20, 22 can be similarly identified using MECID. Software executing on processing element 6 can configure status information associated with a given device 20, 22, specifying which PASID and MECID are assigned to a device-initiated memory system request from that device.

[0095] It should be understood that support for MECID is not required, and other examples may select key information for encrypting / decrypting data stored in the memory system solely based on the PASID specified by a given memory access request. The PASID is an example of information verified using isolated address region assignment specified by isolated address region assignment information for a given physical address, because the GPC check performed by the requesting end-side access control circuit 108 uses the isolated address region assignment information (GPT entry) for the given physical address to determine whether a request associated with the architecture PAS specified by the PASID is permitted to access the given physical address.

[0096] The GPT described above is an example of request-side isolated address region assignment information, used to implement request-side access control checks when a requesting entity issues a corresponding memory access request. If the request-side access control check fails, a fault is signaled, and the memory access request is prevented from successfully accessing the associated memory system location.

[0097] However, as Figure 7 As shown, completion-side access control checks can also be implemented closer to the "completion end" entity, based on completion-side isolation address region assignment information. This entity responds to a given memory access request by performing an associated load / store operation or other operation represented by the memory access request. The completion-side isolation address region assignment information can be in a different format than the requesting-side isolation address region assignment information.

[0098] For example, the completion end could be device 20, 22 or memory storage unit 12. Figure 7 Specific examples (which show) Figure 3 In the subset of components of the system shown, the completion end is a cache device 22 that supports the CXL standard, but other examples may provide other types of completion end devices that support completion end-side access control checks based on completion end-side isolated address region assignment information.

[0099] therefore, Figure 7 Another example of a host system 4 is shown, which includes various processing elements 6 and host caches 8, 34 that cache information from main memory 12 associated with host 4. The host also has a host port 26 (device interface) that is responsible for communicating with one or more CXL-enabled devices 22 via CXL switch 140. Figure 7 A subset of the characteristics of the host system is shown, but it should be understood that regarding Figures 3 to 6 Other features discussed can also be set in host system 4.

[0100] Device 22 has its own device cache 24 and may have one or more snoop filters 142 for filtering lookups to device cache 24. In other examples, the snoop filter 142 for a particular device may be located at host port 26 as an alternative to or supplement to setting snoop filters internally within the device. In this example, CXL supports the device being associated with external memory storage device 144. While CXL is used as an example of a coherent device protocol, other protocols may also be used.

[0101] In some use cases, where a confidential computing application is associated with certain regions of host memory 12, these regions are assigned to the domain architecture PAS 84 by requesting side-side isolated address region assignment information to isolate the application's data and program code from access to and observation of program code provided by other parties. The confidential computing application may also benefit from the use of certain devices 22 accessible via host port 26 and CXL switch 140. Therefore, to maintain the same guarantees of confidentiality, tamper resistance, and unobservable side-channel information in terms of address access patterns, a given device 22 itself may support a scheme for assigning isolated address region assignment information to specific physical addresses used by the device. This scheme can be used to control access to and caching of data associated with these physical addresses (addresses within the overall system physical address space used by host 4).

[0102] Specifically, the CXL specification supports the ability to define “TEE Exclusivity” states (TE states) for a specific physical address using a device management table structure (an example of end-side isolated address region assignment information) stored in a given region of the host physical memory address space (typically a region mapped to memory storage device 144 of device 22). This table structure assigns one of the following TE states to each physical address described by the table:

[0103] TE status = 0: Non-TEE exclusive.

[0104] TE status = 1: TEE exclusive.

[0105] Similar to the request-side access control circuit 108 at processing element 6, the device 22 supporting the TE state has, for example, Figure 7 The TE status check circuit 150 shown, for a memory access transmitted to device 22 that is not hit in the device's cache 24, looks up the completion-side isolated address region assignment information for the corresponding physical address to identify whether the physical address is TEE exclusive or non-TEE exclusive. Host port 26 can specify whether the request transmitted to device 22 is associated with TE status = 0 or TE status = 1. The TE status specified by the request is compared with any indication of the TE status defined for the corresponding physical address in the completion-side isolated address region assignment information, and the TE status check circuit 150 prevents requests specifying TE status = 0 (non-TEE exclusive) from being indicated by the completion-side isolated address region assignment information as physical addresses assigned to TEE exclusive regions. When data is cached in device cache 24 of such device 22, cache entries are marked with a corresponding TE status indication from the completion end-side isolated address region assignment information, and during subsequent lookups in the cache, the cache lookup is limited based on the TE status specified by the request transmitted via host port 26 and CXL switch 140, such that a request specifying TE status=0 will not hit an entry reserved for TE status=1, and vice versa.

[0106] The TE states defined in the CXL specification can be nominally mapped to the architecture PAS supported by the ISA of Processing Element 6, as follows:

[0107]

[0108] Therefore, in this example, the requesting end-side isolated address region assignment information supports more types of region assignments than the completed end-side isolated address region assignment information. The completed end-side check supports states corresponding to only a finite subset of the states supported by the requesting end-side check. At host port 26, if a memory access request routed to the host port specifies a PASID that specifies a secure PAS or a root PAS, the request can be rejected because there is no equivalent TE state at device 22. If a memory access request received at the host port specifies a non-secure or domain PAS using its PASID, that PASID is mapped to the corresponding setting of the TE state in the request transmitted to device 22 via the CXL device interface (i.e., if the PASID indicates a non-secure PAS, the TE state is set to 0, or if the PASID indicates a domain PAS, the TE state is set to 1).

[0109] In systems supporting device 22 that provides such complete end-side address region isolation (such as TE status check 150 supported in the CXL protocol), the assignment of isolated address regions for a specific physical address can be particularly inefficient for software executing on processing element 6 in host system 4, whether it's the request end-side table (e.g., GPT) for updating isolated address region assignment information or the complete end-side table for isolated address region assignment information (e.g., a device management table defining the TE status associated with a specific physical address). This is especially true for complete end-side isolated address region assignment information, because the specific table structure used by a particular device 22 to manage its TE status definition can be highly implementation-dependent, and the software may struggle to manage this table structure in a platform-agnostic manner. Furthermore, if a generic memory instruction is used to trigger updates to complete end-side isolated address region assignment information, operations at host port 26 and device 22 may be inefficient because the circuitry may have difficulty distinguishing whether a given write memory access request triggered by a generic memory instruction is related to an update to complete end-side isolated address region assignment information or to any other data. Furthermore, if general instructions are used to manage table updates, associated operations (such as clearing device cache 24) may require separate software-managed failure operations, which can easily lead to excessive failures and thus cause performance penalties.

[0110] Therefore, particularly in modern processing systems that may increasingly support such end-side checks, it may be beneficial to provide support for isolated address region assignment update instructions in the ISA supported by processing element 6. These instructions express a specific intent to update isolated address region assignment information and specify the address of the location controlled by the isolated address region assignment information, rather than the address storing the isolated address region assignment information itself, as their target physical address. The target physical address specified by the instruction can be used to control the routing of corresponding access requests issued in response to the instruction across host system 6 via any interconnect 10 and host port 26, ensuring that device actions for updating control tables and / or triggering cache misses can be triggered if necessary. Since the instruction does not directly identify the address of the memory system location storing the actual control structure including the isolated address region assignment information to be updated, the hardware of system 2 may include circuitry for mapping the target physical address PAz of the isolated address region assignment update instruction to a physical address PAy, which represents the actual storage location of the information to be updated in response to the instruction. In practice, the requesting end-side access control circuit 108 and / or the completing end-side access control circuit 150 may already have such circuitry for performing such address mapping from PAz to PAy, because this may have already been used to look up the table structure that provides isolated address region assignment information and to perform access control checks in response to a general load / store memory access request. Therefore, this circuitry can be reused when a given processing element 6 executes an isolated address region assignment update instruction.

[0111] Figure 8 The steps for processing an isolated address region assignment update instruction are illustrated. At step 200, the instruction decoding circuit 104 decodes the isolated address region assignment update instruction. At step 202, in response to the decoding of the isolated address region assignment update instruction, the instruction decoding circuit 104 controls the processing circuit 105 to issue at least one memory system request, thereby requesting an update of isolated address region assignment information (on the requesting end and / or the completing end), which defines access control information for controlling access to the target physical address specified by the isolated address region assignment update instruction.

[0112] For example, when responding to an instruction to update the isolated address region assignment information on the requesting end side, based on the same mapping function used by the requesting end side access control circuit 108 during granular protection checks to identify the isolated address region assignment information corresponding to the target physical address, the target physical address specified by the instruction operand can be mapped to the corresponding physical address where the isolated address region assignment information to be updated is stored. For example, a base address register defining the table base address can be combined with a portion of the target physical address to generate one or more memory system requests that traverse the table structure to identify the location of the isolated address region assignment information to be updated. Therefore, in this case, an instruction specifying the address of the location where access to the isolated address region assignment information is controlled by the isolated address region assignment information can cause (at CPU 6 or other requesting end) the generation of a memory system access request that specifies the physical address where the isolated address region assignment information to be updated is stored.

[0113] On the other hand, when responding to an instruction to update the completed end-side isolated address region assignment information, the issued memory system request can specify the target physical address as its target request, as specified by the instruction itself. This allows the use of existing routing circuitry via interconnect 10 and host port 26 to route the request to the corresponding device 22, just as with any other load / store request specifying that target physical address. The parameters of the memory system request issued via interconnect 10 distinguish that the request represents an update to the completed end-side isolated address region assignment information, rather than a regular store request. When host port 26 and / or device 22 receive this request, it triggers a mapping from the target physical address to the physical address of the corresponding entry storing the completed end-side isolated address region assignment information, and thus updates the completed end-side isolated address region assignment information.

[0114] Regardless of whether the requesting end-side isolated address region assignment information and / or the completed end-side isolated address region assignment information are being updated, the isolated address region assignment information can be updated to a value selected based on the parameters of the instruction indicating the updated isolated address region assignment for the target physical address. The updated isolated address region assignment can be indicated according to the requesting end-side isolated address region assignment scheme, regardless of whether the information to be updated is the requesting end-side isolated address region assignment information and / or the completed end-side isolated address region assignment information. If the information to be updated is the completed end-side isolated address region assignment information, but the completing end does not support a completed end-side state (e.g., TE state) corresponding to the specific requesting end-side state (e.g., PAS) specified by the updated isolated address region assignment parameters of the instruction, the requested update can be ignored without triggering a fault.

[0115] Figure 9A first example of an isolated address region assignment update instruction is illustrated, in which the instruction is limited to triggering updates only to completed end-side isolated address region assignment information and does not support updates to requesting end-side isolated address region assignment information. The isolated address region assignment update instruction (referred to in this example as STPAS or a set PAS instruction) has: an opcode that distinguishes the instruction type as an isolated address region assignment update instruction, rather than another type of instruction; and a register field of an identifier register Xt that identifies a register operand in register 106 that stores other parameters for the instruction. The register operand specifies the target physical address of the corresponding item in the completed end-side isolated address region assignment information to be updated, and also specifies updated isolated address region assignment parameters to indicate the state to which the item in the completed end-side isolated address region assignment information should be updated in response to the STPAS instruction.

[0116] In this example, the two bits NSE and NS, encoded as follows, are used to specify the updated isolated address region assignment parameters to select one of the four architecture PAS 84 described earlier. It should be understood that this is merely an example encoding, and other encodings may also be used. When the target physical address corresponds to a location associated with device 22 that supports the CXL version (which supports TE status check 150 as discussed previously), the corresponding values ​​of the NSE and NS bits can trigger a corresponding update to the corresponding entry in the completed end-side isolated address region assignment information (TE status), as follows:

[0117]

[0118] Furthermore, if the target physical address specified by the STPAS instruction does not actually correspond to any device 22 (the route for the memory access request specifying the target physical address will not reach any host port 26), or corresponds to a device 22 that does not support the TE status check circuit 150 (e.g., a device that does not support CXL or supports a CXL version that does not support CXL-TSP), then the requested update can again be completely ignored, and no update to the isolated address region assignment information is performed in response to the instruction. No fault generation is required.

[0119] Figure 10 Examples are given based on Figure 9 Examples of variations of operations that can be triggered by the STPAS instruction. Originally (by...) Figure 10(As indicated by arrow 1 in the diagram), the processing of the STPAS instruction causes the processing element 6 executing the STPAS instruction to issue a memory system request (this memory system request is indicated as an STPAS request, which is different from a general memory request), specifying the target physical address as the target address identified by the register operand of the STPAS instruction. The STPAS request may also specify a PAS identified by the updated isolation address region assignment parameter of the STPAS instruction.

[0120] If the target physical address is mapped to a specific system location within device 22, the memory access request will be routed based on the target physical address (according to the conventional memory system routing mechanism of interconnect 10), such that STPAS reaches the host port 26 associated with the device 22 mapped to the target physical address. As shown by arrow 2, host port 26 can trigger a lookup of snooping filter 36 on host system 4 to determine whether any previous PoPA host caches 8, 34 have cached entries associated with the target physical address that are marked with a PAS state different from the PAS indicated by the updated isolation address region assignment parameters of the STPAS instruction. If any such entries exist, snooping filter 36 can (as indicated by arrow 3) issue one or more cache maintenance operations to host caches 8, 34 to trigger the invalidation (and, if necessary, cleanup, because the data is dirty) of cache entries that cache data associated with the target physical address for the previous PAS assignment for that target physical address. As shown by arrow 4, if cleanup is required, this can trigger the dirty data to be written back to the underlying storage location in device 22 corresponding to the target physical address. Once host port 26 has confirmed that no stale copies of the target physical address associated with the previous address region assignment remain valid in host caches 8 and 34, host port 26 can then map the STPAS request (defined according to the internal memory system protocol used by the host memory system) to a TEUpdate command (defined according to the device interface protocol (e.g., CXL) used by device 22) and forward the TEUpdate command to device 22 to request the device to update the TE state associated with the location identified by the target physical address. According to the example in the table above, the updated PAS indicated by the STPAS request is mapped to the updated TE state. Although Figure 10 Examples of cleanup of host caches 8 and 34 are shown, but in some examples, a similar cleanup operation can be performed on device cache 24 in response to an STPAS request.

[0121] like Figure 11As shown, if an STPAS request transmitted from processing element 6 in response to an STPAS instruction is determined by interconnect 10 to specify a target physical address that does not correspond to any device 22, the request can be simply discarded / ignored without triggering any external abort or other type of failure.

[0122] Similarly, such as Figure 12 As shown, if the STPAS request specifies a PAS that does not correspond to any TE state supported by device 22 (e.g., using the NSE, NS bits to specify a safe or root PAS, as shown above), the STPAS request can be discarded / ignored again without triggering a fault, and thus the execution of subsequent instructions after the STPAS instruction can continue uninterrupted.

[0123] Therefore, the STPAS command provides a convenient way for software to trigger both the update of the Complete End-Side Isolated Address Region Assignment Information (TE status) and any associated cache miss operations in a single command, while also making it easier for host port 26 to determine when a TEUpdate command needs to be generated according to the CXL device interface protocol. Figure 9 In the example, the STPAS instruction also does not support updating the requesting end-side isolated address region assignment information. Therefore, if the requesting end-side PAS assignment also needs to be updated in the same way, a separate instruction (which could be a general-purpose memory instruction) will be required. However, in systems that need to manage the completion-side table of isolated address region assignment instructions according to CXL or other similar protocols, the completion-side variant of the isolated address region assignment instruction can be extremely useful for simplifying both hardware system implementation and software development.

[0124] However, as Figure 13 As shown, more flexible instructions can also be provided, which can also support updates to the requesting end-side isolated address region assignment information (as a replacement or supplement to the corresponding update to the completed end-side isolated address region assignment information). For example, Figure 13 The STPAS instruction in the example specifies the following parameters (in this example, register operands are used again, but it should be understood that some parameters other than PA can also be specified directly in the instruction code):

[0125] PA -- The target physical address of the location of the corresponding item in the requesting / completing side isolation address region assignment information to be updated;

[0126] PAS - The PAS to be updated for this location, which can be used to determine the value to be updated for the update item of the requesting / completing side isolated address region assignment information;

[0127] C&I - Does the cache need to be cleared and invalidated?

[0128] GPT - Should the requesting end-side isolated address region assignment information (e.g., the GPT entry corresponding to the target physical address) be updated to reflect the updated PAS?

[0129] Erase - Indicates whether the location should be explicitly erased by instruction (i.e., the storage location corresponding to the target PA should be set to a specific predetermined value, such as 0).

[0130] Should the CXL instruction generate a TEUpdate command to update the TE status table on the CXL side (example of completing the end-side isolation address region assignment information)?

[0131] Therefore, this example of the instruction can be used as any of the following:

[0132] • Request the client-side update variant (if the GPT parameter is set to request the corresponding GPT update).

[0133] • Complete the end-side update variant (if the CXL parameter is set to request the corresponding CXL-side TE status table update).

[0134] • If supported, request-side and completion-side update variants are available (if both the GPT and CXL fields are set to request the corresponding update). Some examples may not support the ability to update both types of tables simultaneously in a single instruction; in this case, encoding where both GPT and CXL fields are set to request the corresponding update can be considered undefined and trigger a failure. Using this approach, while a single opcode can be shared between GPT and CXL updates to save coding space, any given instance of the instruction will request only one of the request-side and completion-side updates for isolated address region assignment information. Other examples may support the ability to atomically update both the GPT and CXL side tables in a single instruction, which could be helpful in reducing the number of instructions that need to be executed by the software as a whole to implement specific changes to address region assignments for both request-side and completion-side checks.

[0135] • An erase variant of the command if the erase parameter is set to request erase.

[0136] • A failure variant of the instruction if the C&I parameter is set to request failure.

[0137] It should be understood that, although Figure 13Variants supporting all C&I, GPT, erase, and CXL parameters are shown to implement any arbitrary combination of these parameter values. However, other specific implementations may not support all of these options and may be considered to have a specific value for one of these parameters by default (e.g., erase is performed by default or not by default to avoid occupying coding space when encoding a specific erase parameter). Furthermore, in some examples, the ISA may support multiple opcodes corresponding to different variants of STPAS, which are related to... Figure 13 The different combinations of control parameters shown correspond to each other, rather than providing a single opcode that can be configured to select a specific variant of the instruction.

[0138] therefore, Figure 14 Another example of the steps for processing isolated address region assignment update instructions is shown, such as Figure 9 Example (due to ISA design limitations, this is a variant that performs a complete end-side update by default). Figure 13 Examples (providing more flexibility to support different variations of the instruction), or support Figure 14 Any other specific implementation of the instructions of one or more variants described herein. It should be understood that some instances of the instructions may be expressed as... Figure 14 More than one variant among the variants shown (e.g., Figure 13 Examples support single commands for requesting end-side update variants and / or completing end-side update variants and / or erasing variants and / or failing variants.

[0139] At step 300, the instruction decoding circuit 104 within processing element 6 decodes the assigned update instruction for the isolated address region. In response to the instruction decoding, processing circuit 105 is controlled to execute... Figure 14 The subsequent steps are as follows. At step 302, processing circuitry 105 (e.g., based on an indication of the current exception level 66) determines whether the current operating state has sufficient privileges to execute an isolated address region assignment update instruction. For example, in some implementations, the ability to execute this type of instruction may be limited to cases where the current exception level 66 is the highest privilege exception level. If the current operating state does not have sufficient privileges, at step 304, processing circuitry 105 signals a fault, and the update requested by the instruction will not be executed.

[0140] If the current operating state has sufficient privileges to execute instructions, subsequent processing depends on a specific variant of the instruction indicated by the instance of the instruction currently decoded at step 300.

[0141] If the decoded instruction is a completion-side update variant (yes at step 306), then at step 308, the processing circuit 105 determines that one or more memory system requests should be issued to request an update of completion-side isolated address region assignment information, which controls access to the target physical address specified by the instruction.

[0142] If the decoded instruction is a request-side-update variant (yes at step 310), then at step 312, the processing circuit 105 determines that one or more memory system requests should be issued to request an update of the request-side-isolated address region assignment information, which controls access to the target physical address specified by the instruction.

[0143] If the decoded instruction is an erase variant (yes at step 314), then at step 316, processing circuitry 105 further determines that one or more memory system requests should be issued, triggering the setting of the memory system location identified by the target physical address to a predetermined value (such as zero or another arbitrary value). This can be helpful for security purposes, ensuring that once the physical address has been reassigned to a less secure isolation address region, it is no longer possible to read data stored in a region previously designated as associated with a more secure isolation address region assignment.

[0144] If the decoded instruction is an invalid variant (yes at step 318), then at step 320, the processing circuit 105 further determines that the issued one or more memory system requests should also trigger the invalidation (and cleanup if necessary) of cache entries corresponding to the target physical address (e.g., entries associated with previous or updated isolated address region assignments).

[0145] At step 324, processing circuit 105 issues a desired memory access request that was identified as needed at one or more of steps 308, 312, 316, and 320. It should be understood that in some cases, the same memory system request may serve more than one of the various purposes indicated at steps 308, 312, 316, and 320.

[0146] Although Figure 14 A series of sequential steps is shown, but it should be understood that the same steps can be implemented in different orders or at least partially in parallel. Furthermore, although... Figure 14The instructions indicate support for each variant among the variants checked at steps 306, 310, 314, and 318. However, some implementations may not support each of these variants, and therefore steps for unsupported variants may be omitted. Similarly, in some implementations, isolated address region assignment update instructions may by default behave as a specific variant on each instance of the instruction being executed, and it is not possible to choose whether the instruction behaves as that variant. Therefore, in this case, the corresponding step in steps 306, 310, 314, and 318 will result in a "yes" result for each execution, and the "no" branch following that step will not be followed.

[0147] Although Figure 9 and Figure 13 Two examples are shown of specific implementations of the instruction: a complete end-side variant and an instruction that can act as either a complete end-side or a request end-side update variant (and possibly both request and complete end-side update variants). However, it should be understood that a request end-side update variant that does not support updates to complete end-side isolated address region assignment information may also be supported.

[0148] The above example describes an isolated address region assignment update instruction that specifies a single target physical address.

[0149] However, it is also possible to provide isolated address region assignment update instructions capable of specifying multiple target physical addresses, for each of these target physical addresses, an update to the isolated address region assignment information can be applied (and, if specified, any other associated operations, such as cache miss or erase, can be applied). In this case, any one or more of these target physical addresses can be considered as a "target physical address" as defined in the claims. For example, the instructions can specify size information indicating the size of the address range to which the update of the isolated address region assignment information is to be applied. In this case, a "target physical address" can be considered any address within a specified size address range, starting from the address determined based on the target address operand of the instructions.

[0150] The concepts described herein may be embodied in computer-readable code used to manufacture devices embodying the described concepts. For example, the computer-readable code may be used in one or more stages of the semiconductor design and manufacturing process, including the electronic design automation (EDA) stage, to manufacture integrated circuits including devices embodying these concepts. The aforementioned computer-readable code may additionally or alternatively enable the definition, modeling, simulation, verification, and / or testing of devices embodying the concepts described herein.

[0151] For example, computer-readable code for manufacturing a device embodying the concepts described herein may be embodied in code that defines the hardware description language (HDL) representation of these concepts. For instance, the code may define a register-transfer level (RTL) abstraction of one or more logic circuits for defining a device embodying these concepts. The code may define an HDL representation of one or more logic circuits embodying the device using Verilog, SystemVerilog, Chisel, or VHDL (Very High Speed ​​Integrated Circuit Hardware Description Language) and intermediate representations such as FIRRTL. Computer-readable code may provide definitions of the concepts or other behavioral representations of the concepts embodying the concepts using system-level modeling languages ​​such as SystemC and SystemVerilog, which can be interpreted by a computer to enable simulation, functional and / or formal verification and testing of the concepts.

[0152] Additionally or alternatively, computer-readable code may define a low-level description of an integrated circuit component embodying the concepts described herein, such as one or more netlists or integrated circuit layout definitions, including representations such as GDSII. Other computer-readable representations of one or more netlists or integrated circuit components may be generated by applying one or more logic synthesis processes to the RTL representation to generate definitions for manufacturing devices embodying the present invention. Alternatively or additionally, one or more logic synthesis processes may generate a bitstream from the computer-readable code to be loaded into a field-programmable gate array (FPGA) to configure the FPGA to embody the described concepts. The FPGA may be deployed for the purpose of verifying and testing the concepts prior to manufacturing integrated circuits, or the FPGA may be deployed directly in a product.

[0153] Computer-readable code may include a mixture of code representations for manufacturing apparatus, such as one or more of RTL representations, netlist representations, or other computer-readable definitions used in the semiconductor design and manufacturing process for manufacturing apparatus embodying the present invention. Alternatively or additionally, the concept may be defined in a combination of computer-readable definitions used in the semiconductor design and manufacturing process for manufacturing apparatus and computer-readable code defining instructions that will be executed by the defined apparatus once manufactured.

[0154] Such computer-readable code can be contained in any known transient computer-readable medium (such as wired or wireless transmission of code over a network) or non-transitory computer-readable medium such as semiconductors, disks, or optical discs. Integrated circuits manufactured using computer-readable code may include components such as a central processing unit, a graphics processing unit, a neural processing unit, a digital signal processor, or other components that embody the concept independently or collectively.

[0155] Figure 15Examples of emulator implementations that can be used are illustrated. While the previously described embodiments implement the invention in terms of means and methods for operating specific processing hardware supporting the technologies involved, it is also possible to provide an instruction execution environment according to the embodiments described herein, which is implemented using a computer program. Such computer programs are generally referred to as emulators, in part because they provide a software-based implementation of a hardware architecture. Types of emulator computer programs include simulators, virtual machines, models, and binary converters, including dynamic binary converters. Typically, the emulator implementation can run on a host processor 730, which optionally runs a host operating system 720, thereby supporting the emulator program 710. In some arrangements, multiple emulation layers may exist between the hardware and the provided instruction execution environment and / or multiple different instruction execution environments provided on the same host processor. Historically, powerful processors were required to provide emulator implementations that execute at a reasonable speed, but such approaches may be reasonable in certain situations, such as when it is desirable to run code native to another processor for compatibility or reuse reasons. For example, the emulator implementation may provide additional functionality to the instruction execution environment that is not supported by the host processor hardware, or provide an instruction execution environment that is typically associated with a different hardware architecture. An overview of the simulation is given in the following literature: “Some Efficient Architecture Simulation Techniques”, Robert Bedichek, Winter 1990 USENIX Conference, pp. 53-63.

[0156] With respect to embodiments previously described with reference to specific hardware constructions or features, equivalent functionality may be provided in simulated embodiments by suitable software constructions or features. For example, specific circuitry may be implemented as computer program logic in simulated embodiments. Similarly, memory hardware such as registers or cache memory may be implemented as software data structures in simulated embodiments. Where one or more of the hardware elements referenced in the previously described embodiments are present in an arrangement on host hardware (e.g., host processor 730), some simulated embodiments may utilize the host hardware where appropriate.

[0157] The simulator program 710 can be stored on a computer-readable storage medium (which may be a non-transitory medium) and provides a program interface (instruction execution environment) to the target code 700 (which may include applications, operating systems, and management programs). This program interface is identical to the interface of the hardware architecture modeled by the simulator program 710. Therefore, the simulator program 710 can be used to execute the program instructions of the target code 700 from within the instruction execution environment, enabling a host computer 730, which does not actually possess the hardware features of the devices 2 or 6 discussed above, to emulate these features.

[0158] For example, simulator code 710 may include instruction decoding logic 712 and processing logic 714, which simulate instruction decoding and processing in a manner functionally equivalent to that provided by instruction decoding circuitry 104 and processing circuitry 105 described above. Instruction decoding logic 712 includes conditional logic (e.g., if / then clauses) for decoding instructions of target code 700, and processing logic 714 includes a sequence of instructions (defined in a native instruction set supported by host device 730) selected for execution by instruction decoding logic 712, these sequences corresponding to specific instructions decoded by instruction decoding logic 712. When target code 700 includes an isolated address region assignment update instruction, instruction decoding logic 712 may select a portion of processing logic 714 that, when executed, causes host device 730 to update the isolated address region assignment information in a manner corresponding to the examples discussed above. Device emulation program logic 716 emulates the behavior of one or more devices 22 and may include instructions for implementing completion-side access control checks (such as those described above) based on completion-side isolated address region assignment information, which may be maintained based on completion-side variants of the update instructions discussed above. Host memory mapping program logic 718 maps accesses to emulated registers or emulated memory (as requested by target code 700 according to target ISA supported by target code 700) to host memory resources (e.g., registers and / or memory) provided in the hardware of host device 730. For example, if the operation requested by target code 700 requires access to a given register, the register access may be mapped by host memory mapping program logic 718 of emulation program 710 to a register of a data structure maintained in emulated host memory, while when the operation requested by target code 700 requires access to an address in emulated physical memory, this is mapped by host memory mapping program logic 718 to a host virtual address in the host virtual address space. These host virtual addresses can be translated into host physical addresses using a host-supported address translation mechanism (the translation from host virtual address to host physical address is outside the scope controlled by the emulator program 710).

[0159] In this application, the phrase "configured as..." is used to mean that the elements of the device are configured to perform the defined operations. In this context, "configuration" means the arrangement or manner of interconnection of hardware or software. For example, the device may have dedicated hardware that provides the defined operations, or a processor or other processing device may be programmed to perform the function. "Configured as" does not imply that the elements of the device need to be changed in any way to provide the defined operations.

[0160] In this application, a list of features beginning with the phrase “at least one of” means that any one or more of those features can be provided independently or in combination. For example, “at least one of [A], [B], and [C]” covers any of the following options: A only (without B or C), B only (without A or C), C only (without A or B), a combination of A and B (without C), a combination of A and C (without B), a combination of B and C (without A), or a combination of A, B, and C.

[0161] While exemplary embodiments of the invention have been described in detail herein with reference to the accompanying drawings, it should be understood that the invention is not limited to those precise embodiments, and various changes and modifications can be made therein by those skilled in the art without departing from the scope of the invention as defined in the appended claims.

Claims

1. An apparatus, the apparatus comprising: An instruction decoding circuit is used to decode instructions according to an instruction set architecture. and Processing circuitry, the processing circuitry being configured to perform processing operations in response to a decoded instruction decoded by the instruction decoding circuitry; wherein: In response to the instruction decoding circuit decoding a specified target physical address and an isolated address region assignment update instruction for updating the isolated address region assignment for the target physical address, the processing circuit is configured to trigger the issuance of at least one memory system request to request an update of the isolated address region assignment information, the isolated address region assignment information defining access control information for controlling access to the target physical address; The update includes setting the isolated address region assignment information for the target physical address to indicate one of a plurality of isolated address region assignments selected based on the updated isolated address region assignment specified by the isolated address region assignment update instruction; and The plurality of isolated address region assignments includes at least one more secure isolated address region assignment, for which data associated with the at least one more secure isolated address region assignment will be isolated so that it can be observed by program code associated with at least one less secure isolated address region assignment.

2. The apparatus according to claim 1, wherein, In response to a completion-side update variant of the isolated address region assignment update instruction, the processing circuitry is configured to trigger the issuance of at least one memory system request to request the application of the update to completion-side isolated address region assignment information, which is used by completion-side access control circuitry to control access to the target physical address by completion-side memory system components associated with the completion-side access control circuitry.

3. The apparatus of claim 2, wherein the completion end-side memory system component includes a device that shares access to the memory system of the apparatus and communicates with the apparatus via a device interface according to a device interface protocol.

4. The apparatus of claim 3, wherein the device interface protocol includes Compute Fast Link (CXL).

5. The apparatus according to any one of claims 3 and 4, wherein the completed end-side isolated address region assignment information includes information indicating the TEE exclusive status associated with the target physical address according to CXL-TSP.

6. The apparatus of any one of claims 3 to 5, wherein, in response to the completed end-side update variant of the isolated address region assignment update instruction, the at least one memory system request issued by the processing circuitry includes a first request defined according to a host memory system protocol and a request for the device interface to generate a second request to be transmitted to the device according to the device interface protocol if the first request is routed to the device interface based on the target physical address, the second request including a request for the device to update the completed end-side isolated address region assignment information associated with the target physical address.

7. The apparatus of claim 6, wherein the first request instructs at least one cache entry in a cache that specifies data associated with the target physical address to be invalidated.

8. The apparatus according to any one of claims 2 to 7, wherein, in response to the completion-side update variant of the isolated address region assignment update instruction, when the target physical address does not correspond to any memory system location accessed under the control of the completion-side access control circuitry, the processing circuitry is configured to allow continued execution of the instruction without applying the update to the completion-side isolated address region assignment information corresponding to the target physical address.

9. The apparatus according to any one of claims 2 to 8, wherein the isolated address region assignment update instruction designates one of a plurality of requesting end-side isolated address region assignments defined according to the instruction set architecture as the updated isolated address region assignment; and In response to the completed end-side update variant of the isolated address region assignment update instruction, when the target physical address corresponds to a memory system location accessed under the control of the completed end-side access control circuitry, the completed end-side access control circuitry does not support any completed end-side isolated address region assignment corresponding to the one requested end-side isolated address region assignment specified as the updated isolated address region assignment by the completed end-side update variant of the isolated address region assignment update instruction among the plurality of requested end-side isolated address region assignments: The processing circuit is configured to allow continued execution of instructions without applying the update to the completion end-side isolated address region assignment information corresponding to the target physical address.

10. The apparatus according to any of the preceding claims, wherein, In response to a request-side update variant of the isolated address region assignment update instruction, the processing circuitry is configured to trigger the issuance of at least one memory system request to request the application of the update to request-side isolated address region assignment information, which will be used by request-side access control circuitry to control the processing circuitry's access to the target physical address.

11. The apparatus according to any of the preceding claims, wherein, In response to both the requesting and completing end-side update variants of the isolated address region assignment update instruction, the processing circuitry is configured to trigger the issuance of at least one memory system request to request the application of the corresponding update to both of the following: Complete end-side isolated address region assignment information, which is used by the complete end-side access control circuit to control the access of the target physical address by the complete end-side memory system components associated with the complete end-side access control circuit; and The requesting end-side isolated address region assignment information will be used by the requesting end-side access control circuit to control the processing circuit's access to the target physical address.

12. The apparatus according to any of the preceding claims, wherein, In response to a failure variant of the isolated address region assignment update instruction, the processing circuitry is configured to trigger the invalidation of the cache entry corresponding to the target physical address.

13. The apparatus according to any of the preceding claims, wherein, In response to an erase variant of the isolated address region assignment update instruction, the processing circuitry is configured to trigger the issuance of at least one memory system request to request setting the memory system location identified by the target physical address to a predetermined value, and to update the isolated address region assignment information.

14. The apparatus according to any of the preceding claims, wherein the processing circuitry is configured to signal a fault in response to an attempt to execute the isolated address region assignment update instruction when the processing circuitry is in an operating state having a privilege level less than a threshold.

15. The apparatus according to any preceding claim, the apparatus comprising access control circuitry configured to control whether to allow the given memory access request to access the given physical address region based on whether a combination of a requested isolated address region type specified by a given memory access request and an isolated address region assignment specified by isolated address region assignment information associated with a given physical address is a permitted combination of the selected isolated address region and the isolated address region assignment.

16. The apparatus according to any of the preceding claims, the apparatus comprising at least one memory system component configured to treat aliased physical addresses associated with different isolated address regions as if they specify different memory system resources, even if the aliased physical addresses actually correspond to the same memory system resource.

17. The apparatus according to any preceding claim, the apparatus comprising memory encryption circuitry for encrypting or decrypting data associated with a given physical address based on a key selected based on information verified by the isolation address region assignment specified by the isolation address region assignment information for the given physical address.

18. The apparatus according to any of the preceding claims, wherein the apparatus includes a general-purpose CPU, i.e., a central processing unit; The general-purpose CPU includes the instruction decoding circuit and the processing circuit.

19. The apparatus according to any of the preceding claims, wherein, In response to the isolated address region assignment update instruction, the processing circuitry is configured to issue the at least one memory system request to a memory system bus interface, the memory system bus interface being configured to control the routing of the at least one memory system request based on the target physical address specified by the isolated address region assignment update instruction.

20. A computer-readable code for manufacturing an apparatus according to any of the preceding claims.

21. A method, the method comprising: Decode instructions according to the instruction set architecture; as well as In response to the decoded instruction, perform processing operations; where: In response to the instruction decoding circuit decoding a specified target physical address and an isolated address region assignment update instruction for updating the isolated address region assignment for the target physical address, at least one memory system request is issued to request an update of the isolated address region assignment information, wherein the isolated address region assignment information defines access control information for controlling access to the target physical address. The update includes setting the isolated address region assignment information for the target physical address to indicate one of a plurality of isolated address region assignments selected based on the updated isolated address region assignment specified by the isolated address region assignment update instruction; and The plurality of isolated address region assignments includes at least one more secure isolated address region assignment, for which data associated with the at least one more secure isolated address region assignment will be isolated so that it can be observed by program code associated with at least one less secure isolated address region assignment.

22. A computer program for controlling a host data processing device to provide an instruction execution environment for executing target program code, the computer program comprising: The instruction decoding program logic is used to control the host data processing device to decode the instructions of the target program code according to the simulated instruction set architecture; and The processing logic controls the host data processing device to perform processing operations in response to the decoded instructions; wherein: In response to decoding of a specified target emulated physical address and an isolated address region assignment update instruction for an updated isolated address region assignment for the target emulated physical address, the processing logic is configured to request an update of the isolated address region assignment information, which defines access control information for controlling access to the target emulated physical address. The update includes setting the isolated address region assignment information for the target simulated physical address to indicate one of a plurality of isolated address region assignments selected based on the updated isolated address region assignment specified by the isolated address region assignment update instruction; and The plurality of isolated address region assignments includes at least one more secure isolated address region assignment, for which data associated with the at least one more secure isolated address region assignment will be isolated so that it can be observed by program code associated with at least one less secure isolated address region assignment.

23. A storage medium storing computer-readable code according to claim 20 or a computer program according to claim 22.

Images