Apparatus and method for managing capabilities - Patents.com

Abstract

An apparatus is described having a processing circuit for performing operations in which a request for access to a memory is generated. The processing circuit generates a memory address for the access request using capabilities, each capability indicating a pointer value and constraint information used to constrain access to the memory using a memory address derived from the pointer value. A marker indication field is stored in association with each capability to provide a marker value used to distinguish between static capabilities used to access statically allocated memory and dynamic capabilities used to access dynamically allocated memory. A capability tracking circuit maintains a tracking structure providing a tracking field for each of a plurality of memory regions, the capability tracking circuit setting the tracking field for a given memory region of the plurality of memory regions when at least one capability having an associated marker indication field having a specified marker value is written to the given memory region. The specified marker value indicates that writing of the associated capability to the memory should be tracked by the capability tracking circuit to facilitate subsequent invalidation of the associated capability.

Description

[Technical field]

[0001] The present techniques relate to the field of data processing, and more particularly to techniques for managing capabilities.

[0002] There is growing interest in capability-based architectures, where certain capabilities are defined for a given process and an error can be triggered if there is an attempt to perform an operation outside the defined capabilities. Capabilities can take a variety of forms, but one type of capability is a bounded pointer (which may also be referred to as a "fat pointer").

[0003] Each capability may include constraint information used to limit the operations that may be performed when using that capability. For example, considering a bounded pointer, this may provide information used to identify a non-extensible range of memory addresses accessible by the processing circuit when using that capability, along with one or more permission flags that identify associated permissions.

[0004] When a block of memory is allocated, one or more capabilities may be provided for use when accessing the allocated block of memory, for example to enable that block of memory to be used by a processing circuit when performing a data processing operation. A problem that may arise is that when the block of memory is later deallocated, freeing up the memory space for reallocation, one or more of the capabilities mentioned above may still be available to the processing circuit. The possibility of such a capability being used after the associated block of memory has been deallocated is referred to as the "use-after-free" problem. In particular, using a capability after the associated block of memory has been deallocated may result in undefined software behavior if the use occurs due to a programming error. Additionally, if the use of such a capability occurs as an action intentionally caused by a security attacker, this may potentially lead to security leaks of information and / or remote code execution.

[0005] It would therefore be desirable to provide techniques to mitigate the use-after-free problem. Summary of the Invention

[0006] In one exemplary configuration, an apparatus is provided that includes a processing circuit that performs operations in which a request for access to a memory is generated, the processing circuit being configured to generate a memory address for the access request using capabilities, each capability configured to indicate a pointer value and constraint information used to constrain access to the memory using a memory address derived from the pointer value, and a marker indication field is stored in association with each capability to provide a marker value used to distinguish between static capabilities used to access statically allocated memory and dynamic capabilities used to access dynamically allocated memory; and a capability tracking circuit that maintains a tracking structure providing a tracking field for each of a plurality of memory regions, the capability tracking circuit being configured to set the tracking field for a given memory region of the plurality of memory regions when at least one capability, the associated marker indication field having a specified marker value, is written to the given memory region, the specified marker value indicating that writing of the associated capability to the memory is tracked by the capability tracking circuit to facilitate subsequent invalidation of the associated capability.

[0007] In another exemplary configuration, a method is provided for operating an apparatus to track capabilities for invalidation, the method including: using a processing circuit to perform operations in which requests to access a memory are generated, the processing circuit being configured to generate a memory address for the access request using the capabilities, each capability indicating a pointer value and constraint information used to constrain access to the memory using a memory address derived from the pointer value; storing a marker indication field associated with each capability to provide a marker value used to distinguish between static capabilities used to access statically allocated memory and dynamic capabilities used to access dynamically allocated memory; maintaining, using a capability tracking circuit, a tracking structure providing a tracking field for each of a plurality of memory regions; and setting the tracking field for a given memory region of the plurality of memory regions when at least one capability, the associated marker indication field having a specified marker value, is written to the given memory region of the plurality of memory regions, the specified marker value indicating that writing of the associated capability to the memory should be tracked by the capability tracking circuit to facilitate subsequent invalidation of the associated capability.

[0008] In yet another exemplary arrangement, a computer program for controlling a host data processing apparatus to provide an instruction execution environment is provided, the computer program comprising: processing program logic for performing operations in which a request for access to a memory is generated, the processing program logic being configured to generate a memory address for the access request using capabilities, each capability being configured to indicate a pointer value and constraint information used to constrain access to the memory using a memory address derived from the pointer value, a marker indication field being stored in association with each capability to provide a marker value used to distinguish between static capabilities used to access statically allocated memory and dynamic capabilities used to access dynamically allocated memory; and capability tracking program logic for maintaining a tracking structure providing a tracking field for each of a plurality of memory regions, the capability tracking program logic being configured to set the tracking field for a given memory region of the plurality of memory regions when at least one capability having an associated marker indication field having a specified marker value is written to the given memory region, the specified marker value indicating that writing of the associated capability to memory is tracked by the capability tracking program logic to facilitate subsequent invalidation of the associated capability. The computer program may be provided in a non-transitory or transitory form. [Brief description of the drawings]

[0009] The present technology will now be further described, by way of example only, with reference to examples of the technology illustrated in the accompanying drawings. [Figure 1] FIG. 1 is a block diagram of an apparatus according to an exemplary implementation. [Diagram 2] FIG. 1 is a block diagram of an apparatus according to one exemplary implementation. [Figure 3A]1 illustrates different ways in which a valid capability indication (which in one example takes the form of a tag bit) and a marker indication may be stored in association with a capability, according to some example implementations. [Figure 3B] 1 illustrates different ways in which a valid capability indication (which in one example takes the form of a tag bit) and a marker indication may be stored in association with a capability, according to some example implementations. [Figure 4] 1 is a flow diagram illustrating a capability allocation process according to one exemplary implementation. [Figure 5A] 1 is a flow diagram illustrating steps taken when a capability is determined to be written to memory according to one exemplary implementation. [Figure 5B] 5B illustrates one example configuration of a tracking structure that may be used when performing the process of FIG. 5A, according to one example implementation. [Figure 6] 1 is a flow diagram illustrating steps performed upon detecting an invalidation trigger, according to one exemplary implementation. [Figure 7] 7 is a flow chart showing a series of steps that may be used to implement step 310 of FIG. 6 in one exemplary implementation, where the valid capability indication and the marker indication are stored in separate memory areas according to the exemplary configuration of FIG. [Figure 8] 1 is a flow diagram illustrating how an attempt to change a marker value in a marker indication field of a capability is handled according to one exemplary implementation. [Figure 9] 1 is a flow diagram illustrating how a capability can be created from an existing capability, according to one exemplary implementation. [Figure 10A] 1 illustrates various different formats of a marker indication field according to some example implementations. [Figure 10B] 1 illustrates various different formats of a marker indication field according to some example implementations. [Figure 10C]1 illustrates various different formats of a marker indication field according to some example implementations. [Figure 11A] 1 illustrates how, in one example implementation, different marker values ​​can be associated with different memory allocation generations. [Figure 11B] 1 illustrates steps that may be taken when performing invalidation for capabilities of a particular memory allocation generation, according to one exemplary implementation. [Figure 12A] 13 illustrates another example scenario in which different marker values ​​may be used in relation to capabilities to be tracked. [Figure 12B] 13 illustrates another example scenario in which different marker values ​​may be used in relation to capabilities to be tracked. [Figure 13] FIG. 2 illustrates a schematic diagram of the use of multiple capability trackers in one exemplary implementation. [Figure 14] 1 is a flow diagram illustrating steps that may be performed when it is detected that a capability determination instruction should be executed, according to one exemplary implementation. [Figure 15] 4 is a flow diagram illustrating steps that may be taken upon detecting that access to a capability is sought, according to one exemplary implementation. [Figure 16] An example of a simulator implementation that may be used is provided. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] According to the techniques described herein, an apparatus is provided having a processing circuit for performing operations during which a request for access to a memory is generated. The processing circuit is configured to generate a memory address for the access request using capabilities, each capability configured to indicate a pointer value and constraint information used to constrain access to the memory using a memory address derived from the pointer value. In some implementations, the capabilities may also include additional metadata in addition to the constraint information. The memory address generated by the processing circuit may be a virtual address in a system in which address translation is performed, or alternatively may be a physical address in a system that does not support address translation.

[0011] There are several ways in which the constraint information (and indeed any additional metadata provided on top of the constraint information) may be identified by an associated capability. For example, a capability may directly include the constraint information in one exemplary implementation. However, in alternative implementations, a capability may instead indicate (directly or indirectly) a location in memory where the constraint information is located.

[0012] Software executing on a data processing device can use pointers to control access to memory. However, pointers sometimes provide an avenue that a malicious attacker can use to attack a victim's software, for example, exploiting a buffer overflow by using a pointer to identify a location within a buffer to access an area of ​​memory beyond the buffer that the attacker would not otherwise be allowed to access. As previously mentioned, some processor architectures can support the use of capabilities, which associate pointers with constraint information that specifies one or more usage restrictions that limit the scenarios in which the pointers can be used effectively. This can help to protect against some forms of attacks.

[0013] While the use of capabilities can provide strong spatial memory protection with respect to memory accesses, capabilities do not, of course, provide temporal protection. This means that once a capability is issued, it typically cannot be revoked and therefore the capability retains the right to access memory. For example, if software issues a capability as part of a dynamic memory allocation procedure (e.g., "malloc()"), the capability retains permission to access memory regardless of future deallocation procedures (e.g., "free()"). This is generally undesirable, and as previously mentioned, such "use-after-free" effects can be exploited by an attacker to cause software to behave in problematic ways, potentially leading to system exploitation. The techniques described herein aim to mitigate such problems.

[0014] According to the techniques described herein, a marker indication field is stored in association with each capability to provide a marker value used to distinguish between static capabilities used to access statically allocated memory and dynamic capabilities used to access dynamically allocated memory. Capabilities may be established for use by the processing circuit in a variety of ways. For example, in one exemplary implementation, a set of root capabilities may be provided in the memory, and other capabilities may then be derived from those root capabilities (typically, only when deriving such capabilities is it possible to configure the derived capabilities to have constraint information that is more restrictive, or at least more restrictive, than the capabilities from which they are derived). Capabilities that can be used to access statically allocated memory regions (which may take various forms, such as, e.g., flash memory, statically allocated stack objects, SRAM data structures, or peripheral devices) (such capabilities are referred to herein as static capabilities) may be configured in accordance with the techniques used herein to have a marker value indicating that fact, while capabilities that can be used to access dynamically allocated memory regions (e.g., memory regions that are available for allocation using a memory allocation procedure such as malloc) (such capabilities are referred to herein as dynamic capabilities) may be configured in accordance with the techniques used herein to have a marker value that differs from the marker value used in association with static capabilities.

[0015] It should be noted that in one exemplary implementation, the marker indication field may be a single-bit field to distinguish between static and dynamic capabilities, while in alternative implementations the marker indication field may be a multi-bit field, e.g., to allow for distinguishing between various different forms of dynamic capabilities.

[0016] In addition to the above-mentioned marker indication fields stored in association with each capability, the apparatus described herein further provides a capability tracking circuit that may be used to maintain a tracking structure that provides a tracking field for each of a plurality of memory regions. The size of the memory regions for which the tracking structure provides tracking fields may be varied depending on the implementation, thus allowing the capability tracking circuit to track at either a coarse-grained level or a fine-grained level, or indeed for a mix of memory regions of different sizes.

[0017] The capability tracking circuit is configured to set a tracking field for a given memory region of the plurality of memory regions when at least one capability having an associated marker indication field having a designated marker value is written to the given memory region, the designated marker value indicating that the writing of the associated capability to the memory is tracked by the capability tracking circuit to facilitate subsequent disabling of the associated capability. The designated marker value may indicate, for example, that the associated capability is a dynamic capability, and in implementations where the marker value may be a multi-bit value to distinguish between different forms of dynamic capabilities, the capability tracking circuit may be configured, for example, to track only certain forms of dynamic capabilities as desired.

[0018] The tracking field may take a variety of forms, and thus in one exemplary implementation it may be a single-bit field that is set when a capability having a specified marker value is written to a memory region associated with that tracking field. However, in alternative implementations, the tracking field may be a multi-bit field to allow more detailed information to be captured. For example, the tracking field may take the form of a saturating counter that may be used to track the number of instances of a capability having a specified marker value written to an associated memory region, e.g., the capability tracking circuit increments a saturating counter for a given memory region each time a capability whose associated marker indication field has a specified marker value is written to that memory region. It will be appreciated that in such an implementation, the "set" state of the tracking field not only indicates that a capability having a specified marker value has been written to the associated memory region, but also provides an indication of the number of capabilities having the specified marker value that have been written to that memory region. In some implementations, the tracking structure may be configured to monitor multiple different marker values ​​and implement a different saturating counter for each marker value being monitored.

[0019] By using a tracking structure as described above, it is possible to track memory regions into which capabilities having a specified marker value are written. Also, it is not necessary to track the writing of all capabilities to memory, since only capabilities having a particular associated marker value need to be tracked; other capabilities may be written to memory without being tracked. By tracking the writing of target capabilities to memory in this manner, this can greatly improve the efficiency with which such capabilities can be later invalidated if necessary.

[0020] For example, in one exemplary implementation, the processing circuitry may be configured to implement an invalidation process that, in response to an invalidation trigger, identifies, for each memory region for which a tracking field in the tracking structure is set, each stored capability in that memory region for which an associated marker indication field has a specified marker value, and for each identified stored capability, causes the identified stored capability to be invalidated if an invalidation condition is met for that identified stored capability. For any memory region monitored by the tracking structure for which an associated tracking field is not set, thus indicating that there are no associated capabilities stored in that memory region, that memory region may be skipped during the invalidation process, thereby providing improved performance when searching for invalidation candidate capabilities.

[0021] The invalidation trigger can take a variety of forms, but in one exemplary implementation, it may be an indication that one or more previously allocated blocks of memory are now being deallocated, at which point it is desirable to seek to identify any dynamic capabilities that allow access to such deallocated memory blocks.

[0022] For each memory region for which a tracking field in a tracking structure is set indicating that at least one capability having a specified marker value has been written to that memory region, each such capability can be identified, and if a disable condition is met for the identified capability, the identified capability can be disabled.

[0023] The manner in which the invalidation condition is determined to be satisfied may vary depending on the implementation, however, in one exemplary implementation, for each capability, the constraint information includes at least range constraint information indicating an allowable range of memory addresses accessible using the pointer value, and for a given identified stored capability, the invalidation condition is determined to be satisfied when the allowable range of memory addresses includes one or more memory addresses within the block of deallocated memory.

[0024] There are several strategies that can be adopted to evaluate whether the invalidation condition is met. For example, one may choose to invalidate a given capability when only a portion of the range of memory addresses accessible using that capability is within the memory block identified for invalidation. Conversely, however, an alternative strategy may be to only invalidate capabilities whose allowed range of memory addresses is entirely contained within the block of memory identified for invalidation. Indeed, some implementations may choose to only perform a "fast" check of this, and thus only check whether the base bound, the current address, or the top bound (or any combination thereof) is contained within the block of memory being deallocated.

[0025] There are various different ways in which the marker indication field may be stored in association with each capability. For example, in one implementation, the marker indication field may be considered to be part of the capability and stored in memory together with the capability. However, in an alternative implementation, the marker indication field may be stored in a separate memory area that is independently accessible from the memory address space that stores the associated capability. When the marker indication field is stored in this manner, this may provide some performance improvements when performing the invalidation process described above. For example, the processing circuitry may be configured to retrieve, for a given memory area in which a tracking field in the tracking structure is set, from the separate memory area, the marker indication field associated with each capability stored in the given memory area. The processing circuitry may then be configured to read the associated capability from the given memory area for each retrieved marker indication field whose marker value is the specified marker value, and determine whether the invalidation condition is met for the associated capability. Such an approach therefore allows the invalidation process to be implemented as a two-stage process, where the marker indication field is first obtained so that it is known that only those capabilities whose associated marker indication field has the specified marker value need to be read from the memory region and evaluated to determine whether the invalidation condition is met.

[0026] In one exemplary implementation, the separate memory region may be further configured to store a valid capability indication field associated with each capability-sized data block in the memory, and each valid capability indication field is used to identify whether the associated capability-sized data block in the memory stores a valid capability. The processing circuitry may then be configured to identify, for a given memory region in which the tracking field in the tracking structure is set, each valid capability having a specified marker value depending on the valid capability indication field and the marker indication field stored in the separate memory region. In one such example implementation, the values ​​of both the valid capability indication field and the marker indication field associated with each capability stored in a given memory area are retrieved from a separate memory area so that the values ​​in those fields can be evaluated to determine which capabilities need to be reviewed, while in an alternative implementation, the separate memory area may be configured to return a combined condition that indicates only when the valid capability indication field indicates that the associated capability is valid and the marker indication field indicates that the associated capability is associated with a specified marker value, such that the information returned from the separate memory area directly indicates the capabilities that need to be evaluated for the presence of the invalidating condition.

[0027] In one exemplary implementation, the apparatus further comprises a memory processing circuit that allocates one or more blocks of memory for use by the processing circuit and subsequently deallocates the previously allocated blocks of memory when the processing circuit no longer requires access to the previously allocated blocks of memory. The memory processing circuit may be implemented in a variety of ways, and thus may be implemented, for example, by dedicated hardware or by software executing on the processing circuit. In response to the memory processing circuit allocating a given block of memory for use by the processing circuit, the processing circuit may be configured to be provided with one or more capabilities for use by the processing circuit when accessing the given block of memory. The provided capabilities may be existing capabilities, or may be capabilities derived from existing capabilities, for example (as mentioned above, such derived capabilities are typically restricted such that the constraint information is at least as restrictive as the constraint information provided by the capability from which the derived capability is generated).

[0028] In one exemplary implementation, each marker indication field is constrained such that once a marker value is stored in that marker indication field, the marker value in the marker indication field is prohibited from being modified unless the associated capability is disabled. Thus, in some implementations, the initial marker value stored in the marker indication field may be set by software, but once set, it cannot be changed. In one exemplary implementation, any attempt to modify a marker value in a marker indication field will result in the associated capability being disabled, such that it can no longer be used as a capability. Optionally, in an alternative implementation, the above prohibition against modifying a marker value may be associated with a marker indication field whose value is set to indicate that writing to memory of the associated capability should be tracked, such that it is not possible to subsequently identify that the capability should not be tracked without disabling the capability. However, in such an implementation, it may be possible to modify a marker value in a marker indication field that indicates that the associated capability should not be tracked to a marker value that indicates that the associated capability should be tracked.

[0029] In one exemplary implementation, each marker indication field is constrained such that once a marker value is stored in that marker indication field, any attempt to modify the marker indication field will cause a fault signal to be asserted, so that the fact that an attempt has been made to modify the marker indication field can be flagged and any desired further action can be taken.

[0030] As previously mentioned, if desired, in one exemplary implementation, the processing circuitry may be capable, in at least one mode of operation, of performing capability generation operations to derive new capabilities from existing capabilities, where the new capabilities may be constrained when deriving them to ensure that the new capabilities inherit the marker values ​​associated with the existing capabilities. The ability to perform such capability derivation processes may be permitted in all modes of operation of the processing circuitry, or may alternatively be restricted to certain modes, such as those in which privileged or trusted software is executing.

[0031] In one exemplary implementation, the designated marker value is used solely to control the tracking of writes of a particular capability to memory, in the manner described above. However, in alternative implementations, the designated marker value may also be used for additional purposes. For example, in one exemplary implementation, the capability tracking circuitry may be configured to prevent capabilities having a designated marker value from being written to memory addresses in one or more restricted memory regions. This may be useful in a variety of situations. For example, certain forms of capabilities, such as the dynamic capabilities discussed above, may only be legitimately written to defined memory regions, and any attempt to write them to other memory regions outside of those defined memory regions may represent suspicious behavior. By associating a designated marker value with the capability of interest, the capability tracking circuitry may also monitor such activity and prevent such writes from occurring if an attempt is made to write to one or more restricted memory regions (i.e., a memory region other than one of the defined regions to which such capability is expected to be written). There are various ways in which such write operations may be prevented. For example, the capability tracking circuitry may block the memory access being made (if desired, such behavior may be associated with read accesses as well as write accesses), may generate some form of memory fault if an attempt is made to write such a capability to a restricted memory region, or, in some instances, may allow the access to occur but then clear the valid capability indication field to identify that the capability is invalid.

[0032] As a purely specific example with respect to memory regions that may be considered to be restricted memory regions, such an approach may be used to allow capabilities with specified marker values ​​to be written to a stack region of memory (provided that the tracking fields in the tracking structure are set as described above), while preventing capabilities with specified marker values ​​from being written to one or more other regions of memory, such as a temporary data buffer, a scratch pad, or peripheral memory.

[0033] In one exemplary implementation, the marker indication field is a single bit value, the specified marker value is a first value settable in the marker indication field, and a second value settable in the marker indication field is used to identify that the storage of the associated capability in memory is not tracked by the capability tracking circuit. This can provide a simple implementation in which the storage requirements for the marker indication field are minimized. Furthermore, such an approach allows a distinction to be made between dynamic capabilities provided for use in conjunction with memory regions that can be dynamically allocated and deallocated, and static capabilities that are permanently available to the processing circuit, e.g., capabilities that may be provided by a compiler.

[0034] However, if desired, the marker indication field may instead be a multi-bit field, and the marker value used to indicate that a given capability should be tracked may be selected depending on the assignment conditions that exist when the given capability is provided for use by the processing circuit. This may provide additional enhancement and flexibility in the use of the marker indication field, for example allowing a distinction to be made between different forms of dynamic capabilities.

[0035] For example, the allocation conditions may be configured to depend on a current generation of memory allocations to which the capabilities are assigned, and the memory processing circuitry is configured to allocate one or more blocks of memory for use by the processing circuitry in a series of generations of memory allocations. In such a configuration, different marker values ​​may be associated with different generations of memory allocations, allowing, for example, writing of dynamic capabilities to be tracked separately depending on the generation of memory allocations with which they are associated. Such an approach then facilitates generational invalidation of capabilities, and the invalidation process described above may be limited to dynamic capabilities associated with a particular generation of memory allocations and subsequent deallocations.

[0036] As another example, the assignment conditions may be configured to depend on the execution thread of the processing circuit to which the capability is assigned, such that different marker values ​​can be associated with different execution threads and writing of such capabilities can be tracked separately for different threads, if desired.

[0037] As yet a further example, the allocation condition may be configured to depend on an allocation identifier associated with a capability allocation process, the capability allocation process being configured to implement multiple capability allocator instances, the allocation identifier indicating a current capability allocator instance, thus enabling, for example, an invalidation process to be performed in due course with respect to capabilities allocated by a particular capability allocator instance.

[0038] In one exemplary implementation, the capability tracking circuitry may include a plurality of capability trackers, each capability tracker having at least one associated marker value. Each capability tracker may be configured to maintain a separate tracking structure providing a tracking field for each of a plurality of memory regions, and may be configured to set a tracking field for a given memory region of the plurality of memory regions when at least one capability whose associated marker indication field has at least one associated marker value is written to the given memory region. Such an approach provides great flexibility in how capabilities are tracked for subsequent invalidation. For example, several separate capability trackers may be provided, each tracking the same memory, but with different marker values. As another example, there may be several capability trackers with different memories associated with each. As yet another example, there may be several capability trackers, each tracking a different memory and using multiple marker values.

[0039] In situations where the marker indication field is a multi-bit field, there are various ways in which the marker indication field may be implemented. In one exemplary implementation, the marker indication field may be formed by a single-bit marker indication subfield and an existing field of the associated capability, and the marker value provided by the marker indication field may be determined from a combination of the value of the single-bit marker indication subfield and the value of the existing field. The existing field may take various forms, and in one exemplary implementation, may be an object type field provided for each capability to indicate the type of the associated capability. As a specific example, the object type field may traditionally be used to identify whether the associated capability is a normal capability or a sealed capability. Some capability architectures have introduced the concept of sealed capabilities. By sealing a capability, this allows the capability to be marked as non-dereferenceable (meaning that memory addresses cannot be accessed using the capability) and immutable, and causes a hardware exception if an attempt is made to modify or dereference such a capability. In the above example implementation, the information in the object type field may be reused in combination with a single bit marker indication subfield to provide a marker value, thus allowing the marker value to vary depending on, for example, the type of capability indicated by the object type field.

[0040] There are various ways in which capabilities may be provided for use by a processing circuit when accessing a particular allocated block of memory. In one exemplary implementation, the processing circuit may be configured to execute a capability determination instruction to determine capabilities for use by the processing circuit, and execution of the capability determination instruction causes a marker value of the determined capability to be derived from a control value in a system control register of the device. Execution of the capability determination instruction may cause a new capability to be created (which in one example can be conceptually seen as deriving a capability from an implicit maximum allowed capability) or may cause a capability to be derived from an existing capability. According to the above exemplary implementation, the marker value associated with the capability determined as a result of executing the capability determination instruction is set depending on a control value held in the system control register. The control value may be a single bit value that allows for a distinction between static and dynamic capabilities, as previously discussed, or may be a multi-bit value that allows for additional information to be captured in the marker value. Such an approach may, for example, allow the marker value to be set dependent on a thread identifier or a current address space identifier (ASID) value being used by the processing circuit. Note that the control value in the system control register may be used directly to form the marker value, or alternatively, the marker value may be derived from the control value, for example, by performing a predetermined calculation using the control value to determine the marker value.

[0041] In one example implementation, in addition to using the control value in the system control register to derive a marker value for a determined capability, the control value may also be used to control the specified marker value that the capability tracking circuitry looks for when reviewing capabilities that have been written to memory. This thus allows both the marker value that is set in association with capabilities when they are provided for use by the processing circuitry, and the marker value(s) that the capability tracking circuitry is monitoring, to be set in dependence on the control value in the system control register.

[0042] If desired, the marker value may also be used to restrict the capabilities that may be accessed, for at least one or more defined memory regions. For example, in one exemplary implementation, the capability tracking circuit may be configured to only allow at least one type of memory access to be performed for a valid capability whose marker value matches one or more predefined values, for at least one or more defined memory regions. Thus, if the marker value of a capability that the processing circuit is attempting to access matches one or more predefined values, the capability tracking circuit may be configured to allow the access to proceed, and if the access is a write access, the above-described technique for setting a tracking field if the capability has a specified marker value may be used. However, if the marker value does not match one or more predefined values, the capability tracking circuit may be configured to prevent the access from being performed. Such mechanisms for preventing accesses may be applied for write accesses, read accesses, or both.

[0043] The one or more predefined values ​​can take a variety of forms. For example, such predefined values ​​can be, for example, all-zero values ​​(e.g., as may be used in connection with static capabilities that are not tracked), or one or more other specific non-zero values ​​that the processing circuit is currently permitted to use. Such an approach can prevent old / stale capabilities from being accessed, thus enhancing the generational invalidation approach described above. Alternatively, such a scheme can be used, for example, to prevent accessing a capability associated with a different thread than the thread currently being executed by the processing circuit. The manner in which access is prevented can vary depending on the implementation. For example, a fault can be generated to allow the software to handle the situation, or the capability can be disabled (e.g., by allowing the access to the capability to proceed but clearing the capability's valid capability indication field).

[0044] The above approach of selectively preventing access to capabilities whose marker values ​​do not match one or more predefined values ​​may be generally applicable or may be limited in its application to one or more defined regions of memory. Thus, by way of example, this functionality may be limited to a particular memory management unit (MMU) or memory protection unit (MPU) region of memory.

[0045] In one particular example implementation, the capability tracking circuitry may be configured to prevent a valid capability from being loaded from memory unless that capability has an associated marker value that matches one or more predefined values, thereby allowing stale capabilities to be prevented from being loaded or any attempt to load such a stale capability may, for example, invalidate the loaded capability.

[0046] In one exemplary implementation, the capability tracking circuitry may be permanently enabled, but if desired, the device may further comprise an enable flag storage device whose value can be set to selectively enable and disable the capability tracking circuitry. The ability to enable and disable the functionality of the capability tracking circuitry may provide additional flexibility in the operation of the device. For example, the capability tracking circuitry may be disabled if no dynamic memory allocation is being performed and therefore any capabilities being used are static capabilities.

[0047] In one exemplary implementation, the capability tracking circuit may be configured to clear the tracking field of a given memory region upon invalidating all capabilities written to the given memory region whose associated marker indication field had a specified marker value. Thus, the tracking field may be cleared once the aforementioned invalidation process has been performed for the given memory region, thus invalidating any capabilities that caused the associated tracking field to be set. In an implementation in which the aforementioned saturating counter approach is used for the tracking field, the value of the saturating counter in the tracking field may be decremented after invalidation of each capability that previously incremented the saturating counter.

[0048] Specific example implementations will now be described with reference to the accompanying drawings.

[0049] FIG. 1 illustrates in schematic form an example of a data processing apparatus 2 according to one exemplary implementation. It will be understood that this is a simplified diagram for ease of explanation, and that in practice the apparatus may have many elements not shown in FIG. 1 for brevity. The apparatus 2 comprises a processing circuit 4 for performing data processing in response to instructions decoded by an instruction decoder 6. Program instructions are fetched from a memory system 8 and decoded by the instruction decoder to generate control signals that control the processing circuit 4 to process the instructions in a manner defined by the architecture. For example, the decoder 6 may interpret the opcode of the decoded instruction and any additional control fields of the instruction to generate control signals that cause the processing circuit 4 to activate appropriate hardware units to perform an operation, such as an arithmetic operation, a load / store operation, or a logical operation. The apparatus has a set of scalar registers 10 and a set of capability registers 12. Although the capability registers 12 are shown as separate from the scalar registers 10, in one exemplary implementation the capability registers may at least partially reuse some of the scalar registers (e.g., by storing a capability pointer value in the scalar register). The apparatus may also have other registers, such as a system control register or registers 28 for storing control information used to configure the operation of the processing circuitry, and / or vector registers (not shown) for providing vector operands in implementations in which the processing circuitry may be configured to perform vector processing operations.

[0050] In response to an arithmetic or logic instruction, the processing circuitry typically reads source operands from registers 10 and writes the result of the instruction back to registers 10. In response to a load / store instruction, data values ​​are transferred between registers 10 and memory system 8 via load / store units 18 in processing circuitry 4. Capabilities may also be loaded from memory into capability registers 12 or stored back to memory 8 from capability registers 12 via load / store units 18. Memory system 8 may include one or more levels of data caches and main memory.

[0051] The processing circuitry 4 may include several separate hardware blocks for processing different classes of instructions. For example, load / store instructions that interact with the memory system 8 may be processed by a dedicated load / store unit 18, while arithmetic or logical instructions may be processed by an arithmetic logic unit (ALU). The ALU itself may be further divided into a multiply-accumulate unit (MAC) for performing operations including multiplication, and further units for processing other types of ALU operations. A floating point unit may also be provided for processing floating point instructions.

[0052] 1, processing circuitry 4 may include memory processing circuitry 22 that may be used to allocate one or more blocks of memory for use by the processing circuitry, and to subsequently deallocate the previously allocated blocks of memory when the processing circuitry no longer requires access to them. The memory processing circuitry may be implemented by dedicated hardware or by software executing on processing circuitry 4 (e.g., software that performs malloc() and free() operations).

[0053] The processing circuitry 4 may also be configured to execute the process 20 to allocate capabilities for use by the processing circuitry, and also to execute a disabling process that seeks to disable capabilities that are no longer needed. As discussed above, the capabilities used by the device may be both static capabilities, used to access statically allocated memory, and dynamic capabilities, used to access dynamically allocated memory. While both types of capabilities may in principle be assigned by the capability assignment process 20 executing on the processing circuitry 4, in one exemplary implementation the static capabilities may be assigned by the compiler as a literal pool in the program code, and thus it may be only the dynamic capabilities that are provided for use by the processing circuitry 4 using the capability assignment process 20, and thus in such a scenario it is only the dynamic capabilities that need to be later disabled when they are no longer needed.

[0054] As explained above, capabilities can be used when generating memory addresses for access requests to memory, rather than using standard pointer values, with each capability configured to indicate a pointer value and constraint information used to constrain access to memory using memory addresses derived from the pointer value. The device 2 can be provided with a capability access check circuit 16 capable of performing a capability check operation in relation to an access request whose memory address is generated using a specified capability, to determine whether the access request is permitted based on the constraint information identified by the capability. This can be performed, for example, with reference to the range information and limit / permission information discussed above, which collectively may be referred to as capability constraint information. Thus, purely by way of example, if a write access request to a memory address seeks to be performed using a capability indicating that the capability is only used for reading and not for writing, the capability check circuit 16 may determine that the access request cannot proceed, and may, for example, issue a fault signal in such circumstances.

[0055] As described in more detail herein, capability tracking circuitry 24 may be provided to monitor the writing of capabilities to memory system 8, and optionally also the reading of capabilities from memory system 8, and to maintain a tracking structure 26 that may be subsequently used to improve the efficiency of invalidation process 20 performed by processing circuitry 4. In accordance with the techniques described herein, a marker indication field may be stored in association with each capability to provide a marker value used to distinguish between static capabilities used to access statically allocated memory and dynamic capabilities used to access dynamically allocated memory, and capability tracking circuitry 24 may be configured to monitor the marker value of each capability written to memory in order to track capabilities written to memory having one or more particular marker values.

[0056] The capability tracking circuit 24 is configured to maintain a tracking structure 26 that provides a tracking field for each of a plurality of memory regions (as previously noted, the size of the memory regions for which the tracking structure provides a tracking field may vary depending on the implementation). The capability tracking circuit is configured to set a tracking field for a given memory region of the plurality of memory regions when at least one capability is written to the given memory region, the specified marker value indicating that the writing of the associated capability to memory is tracked by the capability tracking circuit to facilitate subsequent disabling of the associated capability. The specified marker value may indicate, for example, that the associated capability is a dynamic capability, and in implementations in which the marker value may be a multi-bit value to distinguish between different forms of dynamic capabilities, the capability tracking circuit may be configured to track only certain forms of dynamic capabilities, for example, as desired.

[0057] The tracking field may take a variety of forms, and thus in one exemplary implementation may be a single-bit field that is set when a capability having a specified marker value is written to the memory region associated with that tracking field. However, in alternative implementations, the tracking field may be a multi-bit field to allow more detailed information to be captured. For example, as previously described, the tracking field may take the form of a saturating counter.

[0058] The capability tracking circuit 24 may, in one exemplary implementation, be shared with multiple processing circuits (only one of which is shown in FIG. 1), and further, different tracking circuits may be associated with different memory controllers, as shown, by way of example, and diagrammatically, in FIG. 2. In particular, as shown in FIG. 2, multiple processing circuits 50, 52, 54 in the form of central processing units (CPUs) are connected via an interconnect 56 to memory controllers 58 and 60, each of which controls access to an associated memory. According to this exemplary implementation, a separate capability tracker 62, 64 may be provided in association with each memory controller 58, 60.

[0059] Also, while in FIG. 1 tracking structure 26 is shown as being internal to capability tracking circuitry 24, in alternative implementations it may be a dedicated hardware storage unit or may be provided by a data structure within memory system 8.

[0060] 3A illustrates generally how tag bits T (an example of a valid capability indication field) can be used in association with individual data blocks to identify whether they represent capabilities or normal data, and how marker indication field M can be used in association with individual data blocks to provide a marker value used to distinguish between static and dynamic capabilities when the tag bits indicate that the data block represents a valid capability. Specifically, memory address space 110 stores a series of data blocks 115 that typically have a specified size. Purely for illustrative purposes, in this example, each data block is assumed to include 64 bits, although in other exemplary implementations, data blocks of different sizes may be used, for example, 128-bit data blocks when a capability is defined by 128 bits of information. Associated with each data block 115 is provided a tag field 120, which in one example is a single bit field referred to as the tag bit, that is set to identify that the associated data block represents a capability and that is cleared to indicate that the associated data block represents normal data and therefore cannot be treated as a capability. It will be appreciated that the actual values ​​associated with a set or clear state may vary depending on the exemplary implementation, but purely for purposes of illustration, in one exemplary implementation, when the tag bit has a value of 1 it indicates that the associated data block is a capability and when it has a value of 0 it indicates that the associated data block contains normal data.

[0061] 3A, associated with each data block 115 is also provided a marker indication field 125 for storing a marker value used to identify whether the associated capability is a static or dynamic capability. As previously mentioned, in one exemplary implementation a single-bit marker indication field may be used, although alternative implementations may use a multi-bit marker indication field, for example, to distinguish between different forms of dynamic capabilities.

[0062] When a capability is loaded into a register 100 accessible to a processing circuit (e.g., one of the capability registers 12 shown in FIG. 1), the tag bits travel with the capability information. Thus, when a valid capability is loaded into the register 100, an address indication 102 (sometimes referred to herein as a pointer) and metadata 104 providing constraint information (such as the range and permission information discussed above) are loaded into the register. In some implementations, additional metadata may also be provided. Additionally, in association with the register, or as a particular field therein, a tag bit 106 is set to identify that the contents represent a valid capability, and a marker indication field 108 is provided to distinguish between static and dynamic capabilities (by copying a marker value from an associated marker indication field 125 in memory). Similarly, when a valid capability is stored back into memory, the associated tag bit 120 is set in association with the data block in which the capability is stored, and the marker value in the marker indication field 108 of the register is copied to the marker indication field 125 in memory. With such an approach, it is possible to distinguish between capabilities and normal data, and therefore ensure that normal data cannot be used as a capability; for valid capabilities, the marker indication field can be used to provide information about the capability that can be used to track the capability for later disabling.

[0063] 3A, the tag bits and marker values ​​are stored in the normal memory address space 110, but this is not a requirement and in an alternative exemplary implementation, the tag bits may instead be stored "out of band", for example in a separate memory area, as shown in FIG. 3B. Thus, each data block 115' is stored in the normal memory address space 110', but the tag field 120' and marker indication field 125' are stored in a separate memory area 127 that is accessible independently of the memory address space 110' storage capabilities and general purpose data. As will be explained in more detail below with reference to the flow diagram of FIG. 7, such an arrangement may enable improved efficiency and performance when performing an invalidation process with respect to capabilities.

[0064] Figure 4 is a flow diagram illustrating a capability assignment process that may be performed according to one exemplary implementation using the capability assignment process 20 shown generally in Figure 1. Such a capability assignment process may be performed for a variety of reasons, but may be performed, for example, in response to a block of memory being assigned by memory processing circuit 22 to processing circuit 4, at which point the assignment process may be used to provide one or more capabilities for use by the processing circuit when accessing that block of memory. There are several ways in which capabilities may be assigned using the process of Figure 4. As an example, a set of root capabilities may be provided in memory, and then other capabilities may be derived from those root capabilities using the process of Figure 4.

[0065] In step 150, it is determined whether the capability should be assigned for use by the processing circuit, and if so, the process proceeds to step 155, where it is determined whether the capability should be tracked for later invalidation. In one exemplary implementation, this may be the case when the capability is provided in association with dynamically allocated memory, but not when the capability is provided in association with statically allocated memory. It is also possible that in some implementations it may be deemed appropriate to track certain dynamic capabilities but not others. If it is determined that the capability should not be tracked, then in step 165, a marker value is cleared in association with the assigned capability to indicate that the capability is a non-tracked capability. However, if the capability should be tracked, then the marker value is set in step 160 to indicate that the capability is a tracked capability. In situations where the marker value is a single bit value, the set and clear states may be indicated by logical 1 and 0 values ​​(a logical 1 value indicates either a set or clear state, and a logical 0 value indicates the other state). However, when multi-bit marker values ​​are used, there may be several different marker values, each capable of indicating a capability to be tracked, and an appropriate one of those marker values ​​is selected in step 160.

[0066] While the process of FIG. 4 may in principle be performed for both static and dynamic capabilities, in one exemplary implementation it may be the case that static capabilities have already been allocated in the program code by the compiler as a literal pool, and therefore the process of FIG. 4 may not be performed with respect to static capabilities in such an implementation; it is only dynamic capabilities that are allocated by the process shown in FIG. 4.

[0067] 5A is a flow diagram illustrating a series of steps that may be performed when it is determined that a capability is being written to memory, according to one exemplary implementation. Once it is determined in step 200 that a capability is being written to memory, it is determined in step 205 whether a marker value associated with the capability indicates that the capability should be tracked. If not, the process may proceed to step 210, where the tracking structure 26 maintained by capability tracking circuitry 24 is not updated, and the write operation is allowed to proceed, subject to any conditions controlling the ability to perform the write operation being satisfied.

[0068] However, if in step 205 it is determined that the marker value indicates that the capability should be tracked, then in step 215 the memory region to which the capability should be written is identified from the memory address specified by the write access request. In the example shown in Figure 5A, steps 205 and 215 are shown as separate steps, but in alternative implementations they may be implemented as a single step. In particular, whether or not a write of a given capability should be tracked may depend on the configuration of a tracker associated with the memory region to which the given capability is being written, and thus a circular dependency may exist between steps 205 and 215.

[0069] In one example implementation, the process can then proceed directly to step 230, where, subject to any other conditions controlling the ability to perform the write operation being satisfied, the write operation is allowed to proceed, and, assuming the write operation is performed, the tracking field for that memory region is set if it has not already been set due to a previous write of a tracked capability to that memory region.

[0070] In the above example, the tracking field is assumed to be a single bit field that is simply set or cleared. However, as previously mentioned, it is possible in alternative implementations for the tracking field to take a multi-bit form to allow more information to be captured within the tracking field. For example, in one example, as previously mentioned, the tracking field may be a saturating counter, in which case, in step 230, the value of the saturating counter is incremented.

[0071] In another alternative implementation, in addition to setting the tracking fields in step 230, the tracking structure 26 in the capability tracking circuit 24 may be extended to allow addresses of tracked capabilities written to the memory region (i.e., those with marker values ​​indicating that those capabilities should be tracked) to be stored within the tracking structure to provide a dense list of associated addresses that can be queried later. This increases the size of the tracking structure, but may allow the performance of subsequent invalidation processes to be further improved.

[0072] As indicated by the dotted boxes 220 and 225, the process of FIG. 5A may optionally include some additional steps. In particular, according to such an alternative implementation, the marker value may also be used to restrict access to certain memory regions, in particular one or more restricted memory regions may be specified to which the tracked capabilities should not be written. Thus, once the memory region to which the capabilities are to be written is determined in step 215, it may be determined in step 220 whether the memory region is a restricted memory region. If not, the process may proceed to step 230 as previously described, but if the memory region is a restricted memory region, the process may instead proceed to step 225, where the writing of the capabilities is prevented. There are various ways in which the write operation may be prevented. For example, the capability tracking circuit 220 may block the memory access being made, may generate some form of memory fault, or alternatively may allow the write operation to occur but clear the tag bit to disable the capability.

[0073] One or more restricted memory regions can be established, e.g., memory regions to which dynamic capabilities are not expected to be legally written. By way of example only, such restricted memory regions can be temporary data buffers, scratch pads, or peripheral memory.

[0074] 5B illustrates a schematic of a tracking structure 250 according to one exemplary implementation. The tracking structure may include multiple entries, each having a first field 255 that identifies a memory region and a second field 260 that forms the tracking field described above. The size of the memory region for which the tracking structure provides a tracking field may be varied depending on the implementation, thus allowing the capability tracking circuitry to track at either a coarse-grained level or a fine-grained level, or indeed for a mix of memory regions of different sizes.

[0075] 6 is a flow diagram illustrating steps that may be performed to selectively disable capabilities upon the occurrence of an invalidation trigger. In step 300, it is determined whether an invalidation trigger has been detected. The invalidation trigger may take a variety of forms, but in one exemplary implementation, the invalidation trigger may occur when one or more previously allocated blocks of memory are deallocated, thus indicating that any dynamic capabilities that have been allocated for use by the processing circuitry to access now-deallocated blocks of memory are candidates to be disabled.

[0076] Having to sweep the entire memory system to identify capabilities that may need to be disabled is a very resource intensive process. However, through the use of the capability tracking circuitry 24 described herein, and in particular by using the tracking structure 26 maintained by that capability tracking circuitry, it is possible to perform a more targeted process when attempting to identify capabilities that may need to be disabled.

[0077] In particular, once an invalidation trigger is detected in step 300, in step 305 capability tracking circuit 24 may be referenced to determine each memory region for which a tracking field has been set (i.e., the tracking field has a value indicating that one or more capabilities have been written to that memory region where the marker indication field indicates that those capabilities should be tracked). As previously mentioned, in some systems, there may be multiple capability tracking circuits, and which capability tracking circuit is referenced at this point may depend on a number of factors, such as, for example, which portion of memory each capability tracking circuit is associated with (in an exemplary implementation where different capability tracking circuits are associated with different portions of memory), which marker values ​​are being tracked by the various capability tracking circuits (e.g., in a generational memory allocation implementation where different capability tracking circuits track capabilities associated with different generations of memory allocations, then one or more capability tracking circuits that track capabilities associated with the generation of memory allocation associated with the block of memory being deallocated may be referenced).

[0078] Once each memory region having a tracking field set has been identified in step 305, for each identified memory region, the memory region may be scanned in step 310 to identify each stored capability whose marker value indicates that the capability is a candidate for disabling, i.e., is being tracked for disabling. In implementations where multi-bit marker values ​​are used, at this point the memory may have been scanned to identify capabilities having one or more particular marker values ​​of interest, i.e., marker values ​​that indicate that the associated capability is a candidate for disabling in response to the current disabling trigger.

[0079] In implementations in which the tracking structure is extended to allow the addresses of relevant capabilities to be captured directly within the tracking structure, the performance of the scanning process of step 310 can be improved because the addresses stored in the tracking structure can be used to retrieve each capability that is a candidate for disabling.

[0080] Once each stored capability whose marker value indicates that the capability is a candidate for invalidation has been located, it may then be determined for each located capability whether the invalidation condition is satisfied. There are various ways in which the invalidation condition may be evaluated. In one exemplary implementation, it may be determined that the invalidation condition is satisfied for a given capability if the range constraint information associated with the given capability falls at least partially within the block of deallocated memory. However, an alternative strategy may be to only invalidate capabilities whose allowed range of memory addresses is entirely contained within the block of memory identified for invalidation.

[0081] Finally, in step 315, each capability for which it is determined that the disabling condition is met may be disabled, for example, by clearing the tag bit associated with that capability.

[0082] FIG. 7 is a flow diagram showing a series of steps that may be performed to implement step 310 of FIG. 6 in an implementation in which separate memory regions are used for tag and marker bits, such as in the previous example of FIG. 3B. In step 350, the separate memory region may be accessed to read the tag and marker values ​​of each capability-sized data block in the identified memory region. This process may be repeated for each memory region if one is identified in the step of FIG. 6. In step 355, based on the accessed tag and marker values, each valid capability having a target marker value may be identified, and these capabilities are considered as candidates for invalidation. The tag and marker values ​​may be retrieved "as is" from the separate memory region and then evaluated in step 355, although in an alternative implementation, the query performed on the separate memory region may only return an indication for each valid capability having a target marker value.

[0083] In step 360, each identified valid capability that is a candidate for disabling (as determined by step 355) may be retrieved from memory and then evaluated for whether a disabling condition is met using the process described above with reference to Figure 6. The process may then proceed to step 315 of Figure 6 described above, where each capability for which a disabling condition is met may be disabled.

[0084] FIG. 8 is a flow diagram illustrating how an attempt to change a marker value may be handled according to one exemplary implementation. In step 400, it may be detected when an attempt is made to change a marker value in a marker indication field associated with a valid capability. Upon detecting such an attempt, in step 405, the capability may be disabled, for example, by clearing the tag bit. Optionally, if desired, the marker field may also be cleared, but this is not a requirement since clearing the tag bit is always sufficient, as this would disable the capability and therefore render it unusable in connection with a subsequent memory access. In one particular exemplary implementation, a particularly robust mechanism for clearing the tag bit is to write an all-zero value to the memory location that contains the capability, which has the effect of clearing the tag bit and any other bits that actually specify the capability. As also shown in FIG. 8, instead of disabling the capability, a fault signal may be asserted in step 405 to trigger software to evaluate how to proceed.

[0085] 9 is a flow diagram illustrating restrictions that may be applied when attempting to create a capability from an existing capability. When such a situation is detected, as indicated by step 410, in step 415, assuming any checks required to allow the capability creation process to be performed are satisfied, a new capability may be created from the existing capability, with a marker value inherited from that existing capability. Thus, when capabilities are derived from existing capabilities, they may be forced to inherit the marker value of the existing capability. If desired, the ability to derive capabilities from existing capabilities may be limited to certain operating modes, for example, when the processing circuitry is executing certain privileged or trusted code.

[0086] Figures 10A-10C show different arrangements of marker indication fields that may be used. In Figure 10A, a single bit field 420 is used, and in the illustrated embodiment, a logical 1 value in that field indicates that the associated capability should be tracked, while a logical 0 value indicates that the associated capability should not be tracked. It will be appreciated that the meaning of the logical 1 and 0 values ​​may be reversed in alternative implementations.

[0087] In Figure 10B, a multi-bit marker indication field 425 is used, and specifically, K-bit marker values ​​are shown. One particular value, e.g., an all-zero value, may be used to indicate that an associated capability should not be tracked. However, a variety of other different non-zero marker values ​​may be used to indicate capabilities that should be tracked, and the marker value used in association with any given capability may depend, for example, on the assignment conditions that existed when the given capability was assigned for use by the processing circuit.

[0088] The allocation conditions can take a variety of forms. For example, as previously discussed, the allocation conditions can be configured to depend on the current generation of the memory allocation to which the capability is being allocated, such that different marker values ​​can be associated with different generations of memory allocation. As another example, the allocation conditions can be configured to depend on the execution thread of the processing circuit to which the capability is being allocated, such that different marker values ​​can be associated with different execution threads, or the allocation conditions can be configured to depend on an allocation identifier associated with a capability allocation process, the capability allocation process being configured to implement multiple capability allocator instances, and the allocation identifier indicating the current capability allocator instance.

[0089] 10C shows a further alternative implementation for the marker indication field, where the marker indication field is formed from two separate sub-fields. For example, a single bit sub-field 430 may be provided that is used in combination with the contents of an existing field 435 to form a multi-bit marker value. The existing field can take a variety of forms, but in one example is an object type field that may already be provided in association with a capability to identify the type of capability, e.g., whether the capability is a normal capability or a sealed capability. This thus allows, for example, the marker value to vary depending on the type of capability indicated by the object type field.

[0090] 11A and 11B show diagrammatically how different marker values ​​may be used with different generations of memory allocation to enable generational invalidation of capabilities. As shown in FIG. 11A, a first memory allocation generation process 450 may be used to allocate blocks of memory, which may then be used when executing code 455. There may then be another generation of memory allocation 460, for example, that is executed to obtain and allocate another portion of memory for use by subsequent code. As shown in FIG. 11A, different marker values ​​(X and Y in the illustrated example) may be used for capabilities to be tracked depending on whether those capabilities are associated with memory regions allocated by a first memory allocation generation or a second memory allocation generation. In one example implementation, a single capability tracking circuit may maintain one or more tracking structures for separately tracking writes of capabilities having marker value X and capabilities having marker value Y for each of a plurality of memory regions, or different memory tracking circuits may be provided, each configured to track writes of capabilities having one of the different marker values.

[0091] 11B , if an invalidation trigger is detected in step 470 that causes an invalidation process to be performed for a capability associated with the first memory allocation generation, then in step 475, the process described above may be used to identify valid capabilities having a marker value of X (which is the marker value associated with the tracked capability used to access the memory allocated by the first memory allocation generation). Then, in step 480, for each of the identified capabilities, the capability may be disabled if an invalidation condition is met, where the invalidation condition is evaluated using any of the techniques described above.

[0092] 12A illustrates different example situations in which different marker values ​​may be used. In this particular example, a marker value of X is used in association with capabilities assigned for use by the processing circuit when executing execution thread 1 500, and a marker value of Y is used in association with capabilities assigned for use by the processing circuit when executing execution thread 2 505. Such an approach may enable the capability tracking circuit to track certain capabilities associated with a particular execution thread, e.g., dynamic capabilities used by that execution thread, so that such capabilities can be more easily disabled later, e.g., using the disabling process described above, once the execution thread is no longer executing.

[0093] FIG. 12B illustrates yet another example of the use of different marker values, where a marker value of X is used for capabilities assigned by a first capability allocation instance 510 and a marker value of Y is used for capabilities assigned by a second capability allocation instance 515. There are various scenarios in which it may be appropriate to use different capability allocation instances. For example, a system may provide different permissions or associated memory regions to different allocators. For example, there may be an operating system level allocator that can allocate privileged memory and associated capabilities for use by kernel code, and a separate thread level allocator that operates with lower permissions and can allocate memory and associated capabilities for use by individual threads of execution. As a particular exemplary use case, one such allocator may be associated with kmalloc (kernel malloc in Linux) and another may be associated with malloc in user space.

[0094] 13 illustrates diagrammatically how different capability trackers may be used in one exemplary implementation. In this example, three capability trackers 520, 530, 540 are provided, each with its own associated tracking structure 525, 535, and 545. These different capability trackers may be used in a variety of ways, but in the illustrated example, each capability tracker is provided to monitor capabilities having different marker values, such that a first capability tracker 520 monitors capabilities having marker value X, a second capability tracker 530 monitors capabilities having marker value Y, and a third capability tracker 540 monitors capabilities having marker value Z. Each capability tracker maintains information in its associated tracking structure about several different memory regions, and in particular identifies, for each memory region, when one or more capabilities having the monitored marker value are written to that memory region.

[0095] FIG. 14 is a flow diagram illustrating one exemplary implementation in which a capability determination instruction is provided for execution by a processing circuit. When such an instruction is executed at step 550, execution of the instruction determines capabilities for assignment to the processing circuit at step 555. Such determined capabilities may be derived, for example, from existing capabilities. However, further at step 555, a marker value used in association with the determined capabilities is obtained from a system control register, such as one of the system control registers 28 shown in FIG. 1. This provides great flexibility in the selection of marker values, since the marker value (or information used to derive it) can be stored in the system control register and updated as needed by software executing at the required privilege level. There may also be cases where the value in the relevant system control register changes on a context switch, such that different marker values ​​can be used in association with different execution contexts.

[0096] Also, as shown in FIG. 14, if desired, in step 560, the value in the system control register can be used to control the marker value that the capability tracking circuit is configured to monitor in its associated tracking structure, thus controlling which capabilities are tracked depending on the information stored in the system control register.

[0097] While the contents of the system control register can directly identify the marker value, in alternative implementations, the information in the system control register can be used to derive the marker value, for example by performing some calculation on the value in the system control register.

[0098] Figure 15 is a flow diagram illustrating how the marker value, in addition to being used in conjunction with the above-mentioned tracking mechanism used to track the writing of capabilities having a particular marker value to memory, may be used in some implementations to control access to a particular capability. According to the technique described in Figure 15, if it is determined in step 600 that access to a capability in memory is sought, it is determined in step 605 whether the access is within a defined memory region. In particular, one or more defined regions in memory may be established in which certain restrictions on access to the capability apply. If the access is not within a defined memory region, the access is allowed to proceed in step 610.

[0099] If, at step 605, it is determined that the access is within one or more defined regions, then at step 615, it is determined whether the capability's marker value matches a permitted marker value. For example, one or more permitted marker values ​​can be associated with each defined region, so that only capabilities having one of the permitted marker values ​​can be accessed within those defined regions. If, at step 615, it is determined that the capability's marker value matches a permitted marker value, then the process proceeds to step 610, and the access is permitted. If the access is a read access, then the capability can simply be read from memory. Conversely, if the access is a write access, then in the situation where a write access is being performed for a defined region and the marker value indicates that the capability should be tracked, then an update is made to the appropriate tracking structure 26 by the associated capability tracking circuit 24 to track the fact that the write operation has been performed.

[0100] If, in step 615, it is determined that the marker value is not an allowed marker value, then in step 620, access to the memory is prevented. The access can be prevented in a variety of ways. For example, a fault can be generated to trigger software to evaluate the fault condition. Alternatively, a step can be taken to invalidate the capability. For example, in the case of a write access, the capability can be written to the memory, but the tag bit is cleared, effectively invalidating the capability. In the case of a read access, the underlying value in memory may remain unchanged, but the value read into the register may have the tag bit cleared to invalidate the loaded copy. Such a mechanism can be useful for a variety of reasons, for example to prevent a processing circuit from attempting to utilize a stale capability that is no longer relevant to the processing being performed by the processing circuit.

[0101] FIG. 16 illustrates a simulator implementation that may be used. Although the above examples implement the invention in terms of apparatus and methods for operating specific processing hardware that supports the technique, it is also possible to provide an instruction execution environment according to the examples described herein, which is implemented through the use of a computer program. Such computer programs are often referred to as simulators insofar as they provide a software-based implementation of a hardware architecture. Various simulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators. Typically, a simulator implementation may run on a host processor 715, which optionally runs a host operating system 710 and supports the simulator program 705. In some configurations, there may be multiple layers of simulation between the hardware and the provided instruction execution environment, and / or multiple different instruction execution environments may be provided on the same host processor. Historically, powerful processors have been required to provide simulator implementations that run at reasonable speeds, but such an approach may be justified in certain situations, such as when it is desirable to run code native to another processor for compatibility or reuse reasons. For example, a simulator implementation may provide an instruction execution environment that has additional functionality not supported by the host processor hardware, or that is typically associated with a different hardware architecture. An overview of simulation is given in "Some Efficient Architecture Simulation Techniques", Robert Bedichek, Winter 1990 USENIX Conference, pp. 53-63.

[0102] To the extent that examples have been described above with reference to particular hardware constructs or features, in a simulated implementation, equivalent functionality may be provided by suitable software constructs or features. For example, a particular circuit may be provided as computer program logic in a simulated implementation. Similarly, memory hardware such as registers or caches may be provided as software data structures in a simulated implementation. Also, the physical address space used to access memory 8 in hardware device 2 may be emulated as a simulated address space, which is mapped by simulator 705 to a virtual address space used by host operating system 710. In configurations where one or more of the hardware elements referred to in the preceding examples are present in host hardware (e.g., host processor 715), some simulated implementations may use the host hardware, if suitable.

[0103] The simulator program 705 may be stored in a computer-readable storage medium (which may be a non-transitory medium) and provides a virtual hardware interface (instruction execution environment) to the target code 700 (which may include applications, an operating system, and a hypervisor), the virtual hardware interface being the same as the hardware interface of the hardware architecture modeled by the simulator program 705. Thus, the program instructions of the target code 700 may be executed from within the instruction execution environment using the simulator program 705, so that a host computer 715 that does not actually have the hardware features of the device 2 discussed above can emulate these features. The simulator program may include processing program logic 720 for emulating the behavior of the processing circuit 4 and capability tracking program logic 725 for emulating the behavior of the capability tracking circuit 24 of the hardware device 2 of FIG. 1. Thus, in the example of FIG. 16, the techniques described herein for managing capabilities may be performed in software by the simulator program 705.

[0104] The techniques described herein provide a particularly efficient and high performance mechanism for tracking specific capabilities for subsequent invalidation. According to the described techniques, a capability tracking circuit may be used to track capabilities, and in particular, to track the writing of specific capabilities to one or more memory regions. Furthermore, by using a marker value in association with each capability, this tracking function may be limited to the specific capabilities of interest, e.g., specific dynamic capabilities provided for use by the processing circuitry in association with a dynamically allocated region of memory. With such an approach, a more targeted approach may be used to identify capabilities in memory that should be invalidated, such that when such dynamically allocated memory is subsequently deallocated, such stale capabilities remain available, mitigating the possibility of potential misuse.

[0105] In this application, the term "configured to..." is used to mean that an element of an apparatus has a configuration that is capable of performing a defined operation. In this context, "configuration" refers to a manner of arrangement or interconnection of hardware or software. For example, an apparatus may have dedicated hardware that provides the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured to" does not imply that an apparatus element needs to be modified in any way to provide the defined operation.

[0106] Although exemplary embodiments of the invention have been described in detail herein with reference to the accompanying drawings, it will be understood that the invention is not limited to those precise embodiments, and that various changes, additions, and modifications may be made by those of ordinary skill in the art without departing from the scope and spirit of the invention as defined by the appended claims. For example, various combinations of the features of the following dependent claims may be made with the features of the independent claims without departing from the scope of the invention.

Claims

1. It is a device, A processing circuit that performs an operation in which a memory access request is generated, configured to generate a memory address for the access request using a capability, each capability configured to indicate a pointer value and constraint information used to restrict access to memory using the memory address derived from the pointer value, and a marker indicator field stored in relation to each capability to provide a marker value used to distinguish between static capabilities used to access statically allocated memory and dynamic capabilities used to access dynamically allocated memory, A capability tracking circuit that maintains a tracking structure providing a tracking field for each of a plurality of memory regions, wherein the associated marker instruction field is configured to set the tracking field for a given memory region when at least one capability having a specified marker value is written to a given memory region among the plurality of memory regions, and the specified marker value indicates that the writing of the associated capability to memory is tracked by the capability tracking circuit to facilitate subsequent invalidation of the associated capability, and A device equipped with the following features.

2. The apparatus according to claim 1, wherein the processing circuit is configured to, in response to an invalidation trigger, identify each stored capability in each memory region where a tracking field in the tracking structure is set, the associated marker instruction field having the specified marker value, and for each identified stored capability, implement an invalidation process to invalidate the identified stored capability if the invalidation condition is met for that identified stored capability.

3. The apparatus according to claim 2, wherein for each capability, the constraint information includes at least range constraint information indicating an acceptable range of memory addresses accessible using the pointer value, and for a given identified stored capability, the invalidation condition is determined to be met when the acceptable range of memory addresses includes one or more memory addresses in a deallocated memory block.

4. The marker instruction field is stored in a separate memory area that is accessible independently of the memory address space that stores the associated capability. The apparatus according to claim 2, wherein the processing circuit is configured to acquire the marker instruction field associated with each capability stored in a given memory area from a separate memory area for a given memory area in which a tracking field in the tracking structure is set, and then, for each acquired marker instruction field whose marker value is the specified marker value, read the associated capability from the memory area and determine whether the invalidation condition is met for the associated capability.

5. The apparatus according to claim 4, wherein the separate memory area is further configured to store an effective capability indicator field associated with each capability size data block in the memory, each effective capability indicator field is used to identify whether the associated capability size data block in the memory stores an effective capability, and the processing circuit is configured to identify each effective capability having the specified marker value for a given memory area in which a tracking field in the tracking structure is set, depending on the effective capability indicator field and the marker indicator field stored in the separate memory area.

6. The memory processing circuit further comprises allocating one or more blocks of memory for use by the processing circuit, and then deallocating the previously allocated blocks of memory when the processing circuit no longer needs access to those previously allocated blocks. The apparatus according to any one of claims 1 to 5, wherein, in response to the memory processing circuit allocating a given block of memory for use by the processing circuit, the processing circuit is configured to provide one or more capabilities for use by the processing circuit when accessing the given block of memory.

7. The apparatus according to any one of claims 1 to 5, wherein each marker indicator field is restricted such that, once the marker value is stored in the marker indicator field, the marker value in the marker indicator field is prohibited from being modified unless the associated capability is disabled.

8. The apparatus according to any one of claims 1 to 5, wherein each marker indicator field is constrained such that, once the marker value is stored in the marker indicator field, any attempt to modify the marker indicator field will cause a fault signal to be asserted.

9. The apparatus according to any one of claims 1 to 5, wherein the processing circuit is capable of performing a capability generation operation to derive a new capability from an existing capability in at least one operating mode, and is constrained to ensure that when the new capability is derived, the new capability inherits the marker value associated with the existing capability.

10. The apparatus according to any one of claims 1 to 5, wherein the capability tracking circuit is configured to prevent capabilities having the specified marker value from being written to memory addresses in one or more restricted memory regions.

11. The apparatus according to any one of claims 1 to 5, wherein the marker instruction field is a single-bit value, the designated marker value is a first value settable within the marker instruction field, and the second value settable within the marker instruction field is used to identify that the storage of the associated capability to memory is not tracked by the capability tracking circuit.

12. The apparatus according to any one of claims 1 to 5, wherein the marker indicator field is a multi-bit field, and the marker value used to indicate that a given capability should be tracked is selected depending on the allocation conditions present when the given capability is provided for use by the processing circuit.

13. The aforementioned assignment conditions are: A current generation of memory allocation to which a capability is assigned, wherein a memory processing circuit is configured to allocate one or more blocks of memory for use by the processing circuit in a series of generations of memory allocations. The execution thread of the processing circuit to which the capability has been assigned, An allocation identifier associated with a capability allocation process, wherein the capability allocation process is configured to implement multiple capability allocator instances, and the allocation identifier indicates the current capability allocator instance. The apparatus according to claim 12, configured to depend on at least one of the following.

14. The capability tracking circuit comprises a plurality of capability trackers, Each capability tracker has at least one associated marker value, The apparatus according to claim 12, wherein each capability tracker is configured to maintain a separate tracking structure that provides a tracking field for each of a plurality of memory regions, and the associated marker indicator field is configured to set the tracking field for the given memory region among the plurality of memory regions when at least one capability having the at least one associated marker value is written to the given memory region.

15. The apparatus according to claim 12, wherein the marker instruction field is formed by a single-bit marker instruction subfield and an existing field of the associated capability, and the marker value provided by the marker instruction field is determined from a combination of the value of the single-bit marker instruction subfield and the value of the existing field.

16. The apparatus according to any one of claims 1 to 5, wherein the processing circuit is configured to execute a capability determination command to determine the capability for use by the processing circuit, and the execution of the capability determination command derives the marker value of the determined capability from a control value in the system control register of the apparatus.

17. The apparatus according to claim 16, wherein the control value in the system control register is also used to control the specified marker value that the capability tracking circuit is looking for when reviewing capabilities written to memory.

18. The apparatus according to any one of claims 1 to 5, wherein the capability tracking circuit is configured to allow only at least one type of memory access performed with respect to an effective capability whose marker value matches one or more predefined values ​​for at least one defined memory region.

19. The apparatus according to claim 18, wherein the capability tracking circuit is configured to prevent a capability from being loaded from memory unless the effective capability has associated marker values ​​that match one or more predefined values.

20. The apparatus according to any one of claims 1 to 5, further comprising an activation flag storage device whose value can be set to selectively activate and deactivate the capability tracking circuit.

21. The apparatus according to any one of claims 1 to 5, wherein the tracking field is a saturation counter, and the capability tracking circuit is configured to increment the saturation counter in the given memory area whenever an associated marker indicator field has a capability having the specified marker value written to the given memory area.

22. The apparatus according to any one of claims 1 to 5, wherein the capability tracking circuit is configured to clear the tracking field of the given memory area when the associated marker instruction field invalidates all capabilities written to the given memory area that had the specified marker value.

23. A method for operating a device to track the capability for disabling, A step of using a processing circuit to perform an operation that generates a request to access a memory, wherein the processing circuit uses capabilities to generate a memory address for the access request, and each capability is configured to indicate a pointer value and constraint information used to restrict access to the memory using the memory address derived from the pointer value, The steps include storing a marker indicator field associated with each capability in order to provide a marker value used to distinguish between static capabilities used to access statically allocated memory and dynamic capabilities used to access dynamically allocated memory, The steps include: maintaining a tracking structure that provides a tracking field to each of multiple memory regions using a capability tracking circuit; The associated marker indicator field is configured to set a tracking field for a given memory region among a plurality of memory regions when at least one capability having the specified marker value is written to a given memory region, and the specified marker value indicates that the write of the associated capability to memory is tracked by the capability tracking circuit to facilitate subsequent deactivation of the associated capability, and Methods that include...

24. A computer program for controlling a host data processing device to provide an instruction execution environment, Processing program logic that performs an operation that generates a request to access memory, configured to generate a memory address for the request using capabilities, each capability configured to indicate a pointer value and constraint information used to restrict access to memory using the memory address derived from the pointer value, and a marker indicator field stored in relation to each capability to provide a marker value used to distinguish between static capabilities used to access statically allocated memory and dynamic capabilities used to access dynamically allocated memory, Capability tracking program logic that maintains a tracking structure providing a tracking field for each of a plurality of memory regions, wherein the capability tracking program logic is configured to set the tracking field for a given memory region when at least one capability having a specified marker value is written to a given memory region among the plurality of memory regions, and the specified marker value indicates that the write of the associated capability to memory is tracked by the capability tracking program logic to facilitate subsequent invalidation of the associated capability, and A computer program that includes the following features.

Images