Region identifier based on instruction fetch address

Abstract

an instruction fetch circuit (105) that, in response to an instruction fetch address, fetches an instruction associated with the instruction fetch address; a processing circuit (125) that, in response to an instruction, performs an operation dependent on the target memory address when the instruction includes a request specifying a target memory address and the request specifying the target memory address is permitted; and a memory security circuit (135) that, when the instruction includes a request specifying the target memory address, determines a current region identifier based on a predetermined slice of the instruction fetch address, identifies permission information for a request issued in response to an instruction associated with the current region identifier based on the current region identifier, determines whether the request is prohibited based on the permission information, and, in response to determining that the request is prohibited, issues a response to the processing circuit indicating that the request is prohibited.

Description

[Technical Field]

[0001] The present technology relates to the field of data processing.

[0002] In a data processing system, instructions may be executed that involve accessing data or instructions in memory. For example, some instructions may comprise a request to read a location in memory or write to a location in memory, while other instructions may comprise a request to execute an instruction stored in a location in memory. It may be useful to be able to define permissions for these accesses.

[0003] Looking at the first example of this technique, an instruction fetch circuit responsive to an instruction fetch address to fetch an instruction associated with the instruction fetch address; processing circuitry responsive to an instruction to perform an operation dependent on the target memory address when the instruction includes a request specifying a target memory address and the request specifying the target memory address is granted; When an instruction includes a request specifying a target memory address, determining a current region identifier based on a predetermined slice of the instruction fetch address; Identifying authorization information for requests issued in response to instructions associated with the current realm identifier based on the current realm identifier; Determine whether the request is forbidden based on the authorization information; and a memory security circuit for, in response to determining that the request is forbidden, issuing a response to the processing circuit indicating that the request is forbidden.

[0004] In another example, a method is provided, the method comprising: fetching an instruction associated with the instruction fetch address in response to the instruction fetch address; When an instruction includes a request to specify a target memory address In response to the instruction, when a request specifying the target memory address is granted, performing an operation dependent on the target memory address; determining a current region identifier based on a predetermined slice of the instruction fetch address; identifying, based on the current region identifier, authorization information for requests issued in response to commands associated with the current region identifier; determining whether the request is prohibited based on the authorization information; and and in response to determining that the request is forbidden, issuing a response indicating that the request is forbidden.

[0005] In another example, a computer program is provided that, when executed on a computer, causes the computer to: providing instruction fetch program logic responsive to an instruction fetch address to fetch an instruction associated with the instruction fetch address; causing the processing program logic, in response to the instruction, to execute the request indicating the target memory location when the instruction includes a request specifying a target memory address and the request specifying the target memory address is permitted; In the memory security program logic, when an instruction includes a requirement to specify a target memory address, determining a current region identifier based on a predetermined slice of the instruction fetch address; Identifying authorization information for requests issued in response to instructions associated with the current realm identifier based on the current realm identifier; Determine whether the request is forbidden based on the authorization information; In response to determining that the request is forbidden, the processing program logic is caused to issue a response indicating that the request is forbidden.

[0006] In another embodiment, a computer-readable storage medium storing the computer program described above is provided. The computer-readable storage medium may be a temporary storage medium or a non-temporary storage medium. [Brief explanation of the drawings]

[0007] Further aspects, features, and advantages of the present technology will become apparent from the following description of examples, read in conjunction with the accompanying drawings. [Figure 1] 1 shows a schematic diagram of a data processing device; [Figure 2A] Here is an example of permissions defined for a specific address space: [Figure 2B] Here is an example of permissions defined for a specific address space: [Figure 3A] 1 shows an example of how instructions in different code regions can be executed. [Figure 3B] 1 shows an example of how instructions in different code regions can be executed. [Figure 4] 10 illustrates various examples of determining a spatial region identifier (SRegionID) based on an instruction fetch address. [Figure 5] 10 illustrates various examples of determining a spatial region identifier (SRegionID) based on an instruction fetch address. [Figure 6] 10 illustrates various examples of determining a spatial region identifier (SRegionID) based on an instruction fetch address. [Figure 7] An example of how read, write and execute permissions can be defined in a permissions table is shown below. [Figure 8] 1 illustrates an example of a circuit that may be used to identify and access one or more permission tables. [Figure 9] FIG. 1 is a flow diagram illustrating an example of a method that may be performed in response to a memory access request being issued. [Figure 10] FIG. 2 is a flow diagram illustrating an example of how a data processing apparatus may react to the execution of several branch instructions. [Figure 11] 1 shows an implementation of a simulator that can be used.

[0008] Before discussing example implementations with reference to the accompanying drawings, the following description of example implementations and associated advantages is provided.

[0009] According to one exemplary configuration, an apparatus is provided that includes an instruction fetch circuit that, in response to an instruction fetch address, fetches an instruction associated with the instruction fetch address. For example, the instruction fetch circuit may fetch the instruction from a memory location indicated by the instruction fetch address (which may be, for example, a virtual address or a physical address). In a particular example, the instruction fetch address may be a program counter (PC) address associated with the instruction.

[0010] The apparatus also includes processing circuitry responsive to the instruction to perform an operation dependent on the target memory address when the instruction includes a request specifying a target memory address and the request specifying the target memory address is granted. For example, a load or store instruction specifying a target memory request may comprise a request to read from or write to a target memory location associated with the target memory address, while a branch instruction (which may be a function call instruction or a function return instruction in some examples) specifying a target memory address may comprise a request for execution to branch to an instruction stored at the target memory location. However, it should be understood that other types of instructions (other than load, store, and branch instructions) may also include such requests.

[0011] It may be useful to provide a mechanism to protect data and instructions stored in memory from read and write accesses issued by code regions within processes that are not authorized to access those data / instructions, preventing execution from branching to certain regions of code. One way to do this may be to define permissions that depend on the target memory address, and such permissions may be defined in a table such as a page table. However, such permissions do not consider the source of the request, and the permissions do not define which process or portion of a process is authorized to access / branch to which location in memory. Thus, unless the permissions in the page table are updated, all instructions have the same access rights to a given memory page. Updating these permissions requires that memory accesses be made, and therefore such updates may only be performed between processes, in which case significant latency may be incurred within any one process (or application), since all of the code within that application typically has equal privileges to read / write / execute data / instructions from any given memory location.

[0012] Another approach may be to further include a "permission overlay" or "permission key" mechanism that can dynamically revoke certain permissions according to programming of CPU registers that revoke or modify certain permissions. For example, if permissions are defined in (for example) a page table, there may be an "overlay index" of several bits in the page table entry. Thus, each page of memory is annotated with a "key," and there is a programmable "overlay interpretation" register that can subtract permissions. For example, the overlay interpretation register may indicate changes such as "remove write access from page with index 2" or "toggle index 3 from writable to executable."

[0013] However, even this approach only provides a temporal view of permissions. None of the approaches defined above consider the source of the access request (e.g., the instruction containing the request), since permissions are determined only from "what was last written to a configuration register?" and not from "what code is currently executing." As a result, because permissions are derived from the current values ​​of registers and what is currently stored in page table entries, a loss of control flow integrity (for example) can lead to a loss of integrity in other parts of memory (e.g., due to execution branching to an unexpected location without an overlay interpretation register or page table entry being updated, when the expected path of program flow to reach that location would have involved an update to an overlay interpretation register or page table entry).

[0014] To address this issue, the present technology provides a mechanism by which permissions are defined that are code-spatial (e.g., depending on the source of the memory access request), rather than simply code-temporal (e.g., depending on when the request was issued).

[0015] In particular, the apparatus of the present technology includes a memory security circuit that determines a current region identifier (also referred to as a "Region ID") based on a predetermined slice of an instruction fetch address when the instruction includes a request that specifies a target memory address. Thus, the Region ID depends on the source (e.g., the instruction) of the request, rather than solely on the target of the request (e.g., the target memory address, although it will be understood that permissions for a particular Region ID may also depend on the target of the memory access). The memory security circuit is configured to identify, based on the current region identifier, permission information for a request issued in response to an instruction associated with the current region identifier, and determine, based on the permission information, whether the request is forbidden. In response to determining that the request is forbidden, the memory security circuit is also configured to issue a response to the processing circuit indicating that the request is forbidden.

[0016] The RegionID is determined based on the instruction fetch address for the instruction that requested access / branching to the memory location identified by the target memory address (and may optionally depend on other factors as well). Therefore, because the permission information is looked up based on the RegionID, the memory security circuit determines whether a request is prohibited based on the source of the request. This allows the memory security circuit to implement fine-grained permissions that depend on the specific location within the process / application from which the request is issued, preserving the integrity of the region of code even if control flow integrity is lost. Furthermore, determining the RegionID based on a slice of the instruction fetch address provides a simple, low-cost mechanism for determining the RegionID, which may avoid the need to implement, for example, expensive / high-latency table lookups based on the instruction fetch address. Note that if the permission information indicates that the request is permitted, the access request may still ultimately be denied if, for example, it fails any other checks performed by the device.

[0017] The present technique also provides a mechanism for defining different permissions for different instructions, which may be, for example, different parts of a single process or application (e.g., because the permissions depend on the source of the request rather than solely on the target of the request, or on values ​​in configuration registers that need to be updated to update the permission set). Thus, the present technique may be useful, for example, in applications and operating system (OS) kernels to harden core security components of software. In OS kernels, the mechanism may be used, for example, to harden kernel memory management code and structures against accidental or malicious tampering by other kernel components. It may also be used to sandbox kernel drivers without the performance overhead of delegating such components to separate processes. The same benefits apply within applications, for example, by protecting memory allocation library code / structures and / or dynamic linker code / structures from tampering by the rest of the application. It may also provide benefits to applications that include sandbox environments or just-in-time (JIT) environments for processing untrusted input.

[0018] In some examples, the memory security circuit is configured to determine whether the request is forbidden based on page table access permission information derived from a page table entry associated with the target memory address. In these examples, the memory security circuit is configured to issue a response indicating that the request is forbidden in response to determining that the request is forbidden based on at least one of the permission information and the page table permission information.

[0019] While defining permissions based on the source of the request is advantageous for the reasons discussed above, the present technique can be particularly effective if these permissions are provided in addition to page table access permissions defined in a page table that depend on the target memory address specified by the request. In such an example, if the permissions defined with respect to the RegionID differ from the permissions defined based on the page table entry for the target memory address, the memory security circuitry is configured to treat the more restrictive permissions as correct (e.g., by issuing a response indicating that the request is forbidden if one or both sets of permissions indicate that the request is forbidden).

[0020] In some examples, the memory security circuit is configured to determine a source region identifier corresponding to a region of memory that stores the instruction based on a predetermined slice of the instruction fetch address, and to determine a current region identifier depending on the source region identifier.

[0021] As mentioned above, the current region identifier depends on the instruction fetch address. In this example, this dependency is represented by a source region identifier (also called a spatial region identifier (SRegionID)), which corresponds to the region of memory that stores the instruction (and therefore the region of address space that contains the instruction fetch address).

[0022] In some examples, the processing circuitry is responsive to a return space identifier instruction that identifies a destination register to determine a current source region identifier and store the current source region identifier in the destination register.

[0023] This provides a mechanism by which, for example, a shared library can identify which region of code has been called (branched into). Note that the return space identifier instruction may be a dedicated instruction or a modification to an existing instruction, for example, the current source region identifier may be stored in a system register field and the return space identifier instruction may be an instruction that reads that field in the system register.

[0024] In some examples, the apparatus includes a register for storing a current time identifier, and the memory security circuit is configured to determine the current region identifier dependent on the source region identifier and the current time identifier, where the current time identifier is looked up independently of the instruction fetch address. In these examples, the processing circuit sets the current time identifier to a predetermined value in response to detecting an instruction having a given source region identifier that differs from a source region identifier associated with a previous instruction.

[0025] In addition to a spatial component (e.g., a source region identifier), the current region identifier in this example also has a temporal component (e.g., based on the current time domain identifier TRegionID), which is forced to a predetermined value (e.g., which may be 0) in response to a change in the source region identifier. This approach provides additional security against loss of control flow integrity, as branching to a different region of code forces the time domain identifier to a predetermined value that can be associated with (e.g.) a predetermined set of permissions.

[0026] In some examples, the apparatus comprises a configuration register for storing slice identification information indicating a predetermined slice of the instruction fetch address.

[0027] The bits of the instruction fetch address used as a given slice may be hardwired (e.g., not configurable by software) in some examples. However, in this example, a given slice is identified by slice identification information stored in a configuration register. This configuration register may be accessible to software, allowing the slice identification information to be configurable by software.

[0028] The manner in which the slice identification information is expressed is not particularly limited. It may be expressed, for example, as an indication of the first and last bit positions (i.e., the most significant and least significant bit positions) of the instruction fetch address to be used as a given slice (e.g., if bits 44:38 of the instruction fetch address are used, the slice identification information may identify bit positions 44 and 38). Alternatively, the configuration register may store an indication of either the first or last bit position of the slice and the number of bits in the slice (e.g., in an example in which bits 44:38 are used, either bit position 44 or bit position 38 can be identified, and the number of bits in the slice can be indicated as 7).

[0029] In some examples, the memory security circuit determines that the source region identifier is a default source region identifier in response to determining that the further slice of the instruction fetch address has a value other than the predetermined value.

[0030] It can be useful to identify an additional slice of the instruction fetch address and use this to provide additional information about the source region identifier. For example, it can be determined that if this additional slice holds a particular value (or a value other than some predetermined value), a default source region identifier should be used. This provides additional flexibility in which regions of memory are associated with which source region identifiers. For example, this technique can be used to require that region identification be done only for a specific, larger region of the address space, so that (for example) an application can operate with a “surrounding” address space (e.g., with a default source region identifier of 0) from which some regions are carved out. This allows for the selection of a small set of regions of the address space for sandboxing within a process / application, while the majority of the address space is for any less trusted components within the application. Using the additional slice as a mask to provide this surrounding address space has only a small hardware cost, as it is a simple mask that can be applied at the front end of the microarchitecture, meaning that the rest of the device (e.g., the CPU pipeline) can be informed of the source region identifier in advance.

[0031] In the above examples, the manner in which the predetermined slice of the instruction is used to determine the source region identifier is not particularly limited. However, in certain examples, the predetermined slice may be used directly as the source region identifier. This provides an approach that requires less circuitry complexity than alternative approaches, for example, in which the predetermined slice is used to indirectly determine the identifier (e.g., by applying some function to the predetermined slice or by using the predetermined slice to look up a memory structure to determine the source region identifier). However, a disadvantage of using the predetermined slice directly as the source region identifier may be less flexibility in which regions or memory are assigned to which source region identifiers.

[0032] In some examples, the instruction fetch address includes a virtual address, the instruction fetch circuitry is configured to fetch instructions depending on a given portion of the instruction fetch address, the given portion of the instruction fetch address indicating a location in memory where the instruction is stored, and the given portion of the instruction fetch address and the predetermined slice of the instruction fetch address overlap by at least one bit.

[0033] In some architectures, processes can refer to locations in memory using virtual addresses, which can be translated into physical addresses that identify locations in memory. This can, for example, allow multiple different virtual address spaces to be defined, each with its own mapping to the physical address space. For example, different processes may have different virtual address spaces.

[0034] This can lead to a situation where multiple different virtual addresses are mapped to the same physical address; for example, if multiple different processes with different virtual address spaces want to access a given instruction in a shared library of code, each may reference that instruction using a different virtual address. This is known as aliasing. However, aliasing can affect device performance; for example, entries in a translation lookaside buffer or instruction cache may be indexed and / or tagged by the virtual address, meaning that each aliased virtual address maps to a different entry. This can lead to multiple copies of the same instruction / translation being stored in separate entries in the cache / TLB, taking up space that could otherwise be used to store other instructions.

[0035] Problems such as these can be addressed by not allowing aliasing, for example, by requiring that a given portion of an instruction fetch address be the same for each virtual address that maps onto a particular physical address. However, it may be useful to retain some information in the given portion that indicates which process / section of code a particular instance of an aliasing virtual address originates from. To address this, the inventors of this technique propose allowing one or more bits of the given portion (used to identify the corresponding physical address) to overlap with one or more bits of a given slice (used to determine the source region identifier). These bits can be different, for example, for the aliasing virtual address, while other bits in the given portion are kept the same. This allows lookups in structures such as caches based on the given portion excluding the overlapping bits, resulting in only one copy of an instruction from a given physical address being stored in the cache while still retaining information to distinguish aliasing addresses.

[0036] In some examples, the memory security circuitry is configured to determine whether the request is prohibited based on permission information that identifies at least one of the following: · Read access permission; · Write permissions; Permission to perform branching; and · Permission to execute a branch without remembering the return address.

[0037] Thus, the access permission information can indicate any combination of read, write, and execute instructions, and can also indicate when a branch should be executed as a function call (preserving the return address).

[0038] In some examples, the memory security circuit is configured to determine a destination region identifier based on the target memory address. In these examples, the memory security circuit includes table access circuitry for looking up a permission table in memory based on the current region identifier and the destination region identifier, the permission table defining permission information. Further, in these examples, the table access circuitry is configured to support at least one encoding of the permission table in which different permission information is defined for different combinations of the current region identifier and different destination region identifiers.

[0039] In this example, the permission table can be thought of as a two-dimensional table in that it is looked up based on both the current region identifier (determined depending on the instruction fetch address) and the destination region identifier (determined depending on the target memory address). This allows permission information to be defined for multiple different combinations of current region identifier and target region identifier, thereby determining whether the currently executing portion of code is allowed to access / branch to the particular memory location indicated by the target memory address of the request. This allows specific regions of code to be given or denied access to specific regions of memory.

[0040] In some examples, the memory security circuit includes a table access circuit that accesses in memory a permission table that defines the permission information, and the device includes a table identification register that stores address information indicating the location of the permission table in the memory.

[0041] For example, the address information may be a base address of a table in memory. The table access circuitry uses the address information to locate the table in memory.

[0042] In some examples, the apparatus is configured to operate at one of a plurality of privilege levels, the apparatus comprising a plurality of registers, each register configured to store address information indicating a location of a corresponding permission table in memory, and the apparatus also comprises a register selection circuit for selecting one of the plurality of registers as a permission table identification register based on a current privilege level.

[0043] In this example, a separate permission table can be defined for each privilege level. For example, there may be one register for the kernel and one for user space. This allows, for example, to define more restrictive permissions when the device is running at a lower privilege level.

[0044] In some examples, the memory security circuit includes a table access circuit that accesses in memory a permission table that defines permission information, and the device includes a register that stores a current set of permissions indicating the permission information defined in the permission table for the current region identifier, and the table access circuit is responsive to determining that the current region identifier has changed to the new region identifier to look up, based on the new region identifier, an updated set of permissions stored in the permission table and register for the identifier.

[0045] Thus, the permission information associated with the current region identifier may, in this example, be loaded into a register so that it may be accessed with reduced latency. Then, whenever the current region identifier changes, the permission information in the register may be replaced with an updated set of permissions associated with the new region identifier.

[0046] The format of the register is not particularly limited, but the register may, for example, include a field for each of multiple target region identifiers, with each field storing corresponding permission information (e.g., bits indicating each permission, such as a read bit, a write bit, and an execute bit).

[0047] In some examples, the memory security circuit includes a table access circuit for accessing in the memory a permission table defining permission information, and the device includes a cache for storing a subset of the permissions defined in the permission table. In these examples, the device is configured to operate in one of a plurality of contexts, each associated with a context identifier, and the cache includes a plurality of entries, each associated with a corresponding context identifier.

[0048] Thus, in this example, some authorization information can be cached so that future accesses to the authorization information can be performed with reduced latency, thus improving performance. Furthermore, associating each entry with a context identifier (e.g., this can be a combination of a virtual machine identifier (VMID) and an address space identifier (ASID)) avoids the need to flush the cache on a context switch, thus improving performance because the cached data may still be available for future access.

[0049] In some examples, the apparatus comprises a plurality of registers, including a register for storing, for each of a plurality of current region identifiers, a set of permissions indicating permission information for that current region identifier.

[0050] These registers may be provided instead of, or in addition to, a permission table in memory. Adding additional registers may increase the circuit area occupied by the device, but may be advantageous because such registers may be accessible with reduced latency (thus allowing the performance of the device to be improved).

[0051] As with the above example, the format of the registers is not particularly limited, but each of the registers may, for example, include a field for each of a plurality of target region identifiers, with each field storing corresponding access permission information.

[0052] The above-described techniques may be implemented in a hardware device having circuit hardware that implements the instruction fetch circuitry, processing circuitry, and memory security circuitry described above. However, in another embodiment, the same techniques may be implemented in a computer program (e.g., an architecture simulator or model) that may be provided to control a host data processing apparatus to provide an instruction execution environment for executing instructions from target code. These instructions may, in some particular examples, include any of a return space identifier instruction, a time identifier update instruction, a time identifier branch modify instruction, and a time identifier branch hold instruction.

[0053] The computer program may include instruction fetch program logic for fetching instructions of the target code, and processing program logic for controlling the host data processing apparatus to perform data processing in response to the instructions, the instruction fetch program logic thus emulating the function of instruction fetch circuitry and the processing program logic emulating processing circuitry of a hardware device such as those described above.

[0054] Also, in some examples, some or all of the registers described above may be emulated. In particular, the program may include register maintenance program logic that maintains (in the host device's memory or architectural registers) data structures that represent (emulate) the architectural registers of the instruction set architecture being simulated by the program. The emulated registers may include any of the registers described in some examples above.

[0055] Thus, such a simulator computer program can present, to target code executed on the simulator computer program, an instruction execution environment similar to that which would be provided by an actual hardware device capable of directly executing a target instruction set, even if there is no actual hardware providing these capabilities on the host computer running the simulator program. This can be useful for executing code written for one instruction set architecture on a host platform that does not actually support that architecture. Simulators can also be useful during the development of software for new versions of instruction set architectures, while software development is performed in parallel with the development of hardware devices that support the new architecture. This can allow software to be developed and tested on the simulator so that software development can begin before hardware devices supporting the new architecture are available.

[0056] Specific embodiments will now be described with reference to the drawings.

[0057] FIG. 1 schematically illustrates a data processing apparatus 100 in which an example of the present technology may be implemented. As shown, the data processing apparatus 100 includes an instruction fetch circuit 105 that fetches instructions from memory (optionally via one or more caches). The fetch circuit 105 fetches instructions from a memory location identified by an instruction fetch address (e.g., these may be memory addresses defining the location in memory where the instruction is stored) or from one or more intervening caches (not shown). In the example of FIG. 1, the instruction fetch address of the next instruction to be fetched by the instruction fetch circuit 105 is held in a program counter (PC) register 110, which is one of a set of registers 115 provided in this example. The PC register 110 identifies the next instruction to be fetched and is therefore incremented each time an instruction is fetched (thus pointing to the next instruction in program order). The register file 115 also includes other registers, including, in this example, a time domain identifier register 130 that stores a time domain identifier (TRegionID), which will be described in more detail below.

[0058] Instruction fetch circuitry 105 decodes the instructions and provides them to instruction decode circuitry 125, which issues control signals to processing circuitry 125 to control processing circuitry 120 to execute the decoded instructions. Processing circuitry 125 executes the decoded instructions by reference to data stored in registers 115 (e.g., the processing circuitry may read operands for a data processing operation from registers and store results of the data processing operation in registers).

[0059] Processing circuit 125 also issues memory access requests to access data or instructions stored in memory in response to some instructions. For example, processing circuit 125 may issue memory access requests to a memory controller (not shown) to load data from memory to a register or to store data from a register to memory. Processing circuit 125 can also update the value stored in PC register 110 in response to a control flow instruction, such as a branch instruction, to alter the flow of instructions fetched by instruction fetch circuit 105.

[0060] The data processing device in this example also includes a memory security circuit 135, which is described in more detail below.

[0061] In many modern hardware and software architectures, read and write permissions for loading or storing data to / from particular regions of memory, as well as execute permissions for fetching instructions from particular regions of memory, are controlled by permissions described in page tables (e.g., multi-level page tables) programmed by an operating system and stored in memory. For example, a memory controller or memory management unit (which controls access to memory in response to memory access requests, including requests to load / store data and requests to fetch instructions) may include page table walk circuitry for accessing the page table and identifying permissions for a particular access request. In particular, the page table is looked up based on the target memory address of the access request (e.g., the address of the data or instruction to be accessed) to identify the relevant permissions. Thus, such access permissions are defined based on the target of the access request, rather than based on the instruction for which the access request is issued.

[0062] Within any one process (or application), all of the code within that application has equal privileges to read / write / execute any memory within its address space in a typical data processing device; for example, different instructions within a given process typically have the same permissions. As explained above, some architectures further include a “permission overlay” or “permission key” mechanism that can dynamically revoke certain permissions according to the programming of CPU registers that allow certain permissions to be revoked or modified; for example, page table entries may be annotated with these overlay bits / keys, and the programming of the CPU registers may indicate that a given permission should be revoked for any page associated with (for example) a particular key value (e.g., “revoke read access for permission key 2”). This allows the access permissions defined in the page table to be modified, but only provides a temporal view of the permissions. The inventors of the present technology have recognized that this can lead to potential problems, for example, if there is a loss of control flow integrity (e.g., if the control flow is allowed to branch to an unexpected region of code).

[0063] 2-3 help illustrate how this problem can arise. In particular, FIGS. 2A and 2B show example permissions that may be desired to define for a particular address space 200. As shown, different portions of code ("Code 1," "Code 2," and "Code 3") and different data ("Data A" and "Data B") may be stored in different regions of the address space. Each of these different regions may have different read / write access permissions, which may further depend on which code is being executed at any particular time. For example, as shown in FIG. 2A, instructions fetched from Code Region 1 (Code 1) may have read (R) and write (W) access to Data Region A (Data A) (e.g., permission to load data from and store data to Data Region A), but no access to data stored in Data Region B (Data B). Meanwhile, Code Region 3 (Code 3) may have read-only (RO) access to Data Region A and read and write access to Data Region B.

[0064] 2B, each code region may have different execution access permissions (e.g., defining whether instructions from a given code portion are allowed to branch to instructions in a different code portion). For example, instructions from Code Region 1, in this example, are allowed to branch to instructions in Code Region 2 and Code Region 4 (Code 4), while instructions from Code Region 3 are allowed to branch to instructions in Code Region 2 but not to instructions in Code Region 4.

[0065] It is anticipated that the permission overlay mechanism defined above could be used to enforce these permissions, for example by changing the contents of an overlay interpretation register when switching from one code region to another. However, this mechanism is less effective in the presence of loss of control flow integrity, as explained below with reference to Figures 3A and 3B.

[0066] 3A and 3B show examples of how instructions from different code regions may be executed. Figure 3A shows an example of a possible flow of instructions. As shown, before switching from Code Region 3 to Code Region 1, an instruction is executed that updates the configuration register, resulting in an update to the access permissions defined by the page table in combination with the overlay bit. Following this update, an instruction from Code Region 1 (Instruction C) is executed, causing the processing circuitry to issue an access request to read data in Region B. However, the configuration register in combination with the overlay bit and the permissions in the page table indicate that read access to Data Region B is prohibited, and therefore the access request is denied.

[0067] However, Figure 3B illustrates how a loss of control flow integrity can lead to a loss of data integrity. For example, Figure 3B illustrates what can happen if an instruction from code region 3 unexpectedly branches to an instruction to code region 1. In this case, instruction A branches to instruction C without updating the configuration registers. This means that when instruction C executes, the permissions defined by the configuration registers in combination with the page tables remain those for code region 3. The instruction from code region 3 is authorized for both read and write access to data region A, and therefore is authorized for read access to data region B. Therefore, a loss of control flow integrity can result in a loss of integrity or confidentiality of the data stored in data region B. In other words, the integrity / confidentiality of the data stored in data region B depends on control flow integrity being maintained.

[0068] The present technique provides a mechanism to address this problem. In particular, the technique defines a source region identifier (also called a spatial region identifier SRegionID) that depends on the instruction fetch address of an instruction requesting access to a particular memory location (whether it is a read access, a write access, or an execute access). This allows access permission information to be defined depending on the source of the access request, rather than simply depending on the destination of the access request and / or the timing of the access request.

[0069] 4 illustrates how a spatial region identifier (SRegionID) may be determined based on an instruction fetch address (which may be obtained from the PC register). The spatial region identifier may be determined by memory security circuitry 135 in response to a memory access request issued by a processing circuit.

[0070] 4, a 64-bit instruction fetch address is shown, but this is merely an example, and the instruction fetch address may have an implementation-dependent size, although it will be understood that the example shown in FIG. 4 may be more suitable for architectures that use a larger address width, such as a 64-bit address width or more. The spatial region identifier is determined based on a selected portion of the instruction fetch address, and some state (e.g., a register) 400 within the memory security circuit 135 indicates which bits of the instruction fetch address should be used; for example, state 400 within the memory security circuit may indicate the first and last bit positions of the portion to be used, or the first / last bit positions and the size of the portion. In an alternative example, the portion of the instruction fetch address used may be hardwired rather than programmable in a configuration register.

[0071] FIG. 4 shows at "A" an example of a typical format for a 64-bit PC. The figure also shows three examples (B, C, D) of portions of the instruction fetch address that are used as or to derive a spatial region identifier. In all four examples, the instruction fetch address includes some canonical / tag bits and useful VA (virtual address) bits that define the location in memory where the instruction is stored. Examples B, C, and D each include a portion (SRegionID) that is used to derive a spatial region identifier. Note that while this example shows a virtual instruction fetch address used to determine a spatial region identifier, a physical address may instead be used.

[0072] The first example (A) shows an example of a typical instruction fetch address: the canonical / tag bits occupy bit positions 63:49 of the instruction fetch address, and the remaining bits 48:0 are all useful VA bits.

[0073] In a second example (B), the same bits 63:49 are used as the canonical / tag bits, but bits 44:38 are used to derive the spatial domain identifier. In this example, an additional constant is defined in bit positions 48:45 that can provide additional information; for example, the memory security circuitry can be configured to determine that when the constant has a certain value, a default spatial domain identifier should be used. This leaves bits 37:0 to define useful VA bits.

[0074] In the third example (C), the same bits 63:49 are again used as canonical / tag bits, but bits 48:45 are used to derive the spatial domain identifier, which leaves bits 44:0 to define useful VA bits.

[0075] In the fourth example (D), bit positions 63:55 are used to derive the spatial domain identifier, and the number of canonical / tag bits is reduced to occupy bit positions 54:49, which leaves bits 48:0 to define useful VA bits.

[0076] In all of Examples B-D, a selection of bits of the instruction fetch address is used to determine the spatial domain identifier such that the spatial domain identifier depends on the source of the memory access request (e.g., depends on the instruction fetch address of the instruction that caused the memory access request to be issued) rather than the destination of the memory access request (e.g., the target address of the data or instruction being accessed). The manner in which the selected bits are used to determine the spatial domain identifier is not particularly limited. In some examples, the selected bits may be used directly as the spatial domain identifier, while in other examples, the selected bits may be mapped to the spatial domain identifier by the memory security circuitry in some other manner.

[0077] In some examples, the SRegionID portion and the useful VA bits may overlap by some bits (e.g., some bits are used both to determine the SRegionID and to determine the location in memory where the instruction is stored). As explained above, this can provide a mechanism to distinguish between aliasing virtual addresses in situations where software is forced to keep all of the other VA bits constant between aliasing virtual addresses. Furthermore, the useful VA bits may, in some examples, include all of the SRegionID bits.

[0078] In some examples, the architecture may support multiple techniques for determining the SRegionID based on the instruction fetch address. For example, two or more of the approaches shown in Figure 4 may be supported. For example, PC bits register 400 may be configurable so that the bits to be treated as the SRegionID slice are programmable.

[0079] Furthermore, in addition to supporting the use of slices of the instruction fetch address to determine the SRegionID, additional mechanisms may be supported by the architecture. This may provide further flexibility to chip designers using the architecture. For example, FIG. 5 illustrates another approach to determining a spatial region identifier. In particular, the memory security circuit 135 illustrated in FIG. 5 includes a set of registers 500 that map different regions of address space (e.g., virtual or physical) to region identifiers. In the particular example illustrated in FIG. 5, a pair of registers is provided for each of a plurality of spatial region identifiers, the pair including a base address register 505 that identifies the base address of the corresponding region in memory and a size register 510 that identifies the size of the corresponding region in memory. The memory security circuit, in this example, is configured to compare all or a portion of the instruction fetch address with the base address and size indicated by the registers to determine which region the instruction fetch address falls into. The spatial region identifier is the identifier corresponding to that region.

[0080] Note that the size of each region can be indicated, for example, as the number of bytes of memory in the corresponding region, the number of pages in the memory region, the number of bits of the base address to mask out as part of the region identification, or the end address of the region in memory.

[0081] 6 illustrates another additional mechanism that may be supported in the architecture. In this example, memory security circuit 135 includes a table access circuit (also referred to as an SRegionID table access circuit, a spatial region identifier table access circuit, or a source region identifier table access circuit) 600. In response to a memory access request, the SRegionID table access circuit looks up a table in memory 605 based on the instruction fetch address of the instruction that caused the memory access request to be issued. Table 610 defines a mapping of spatial region identifiers to instruction fetch addresses.

[0082] When a table in memory is used to define the mapping of instruction fetch addresses to spatial region identifiers, such as in the example shown in FIG. 6, the memory security circuit may also include one or more caches for caching data from the table in memory.

[0083] The spatial region identifier thus depends on the source of the memory access and is therefore sometimes referred to as the source region identifier. A set of memory access permissions (e.g., read / write permissions) can then be defined that depends on the spatial region identifier (and optionally may also depend on the target address of the memory access). Such permissions may be defined in addition to those defined in the page table.

[0084] Furthermore, while much of the above description has focused on permissions defined for memory accesses (e.g., loading and storing data or instructions to / from memory), it should be understood that execution permissions may also be defined depending on the spatial domain identifier. For example, the spatial domain identifier of a branch instruction may be used to determine whether the branch is permitted.

[0085] The access permission may further depend on a time domain identifier (TRegionID), which may be stored in the time identifier register 130 shown in Figure 1. This register may be software accessible, in which case the time domain identifier can be updated by instructions executed by the processing circuit. In a particular example, a region identifier (RegionID) is defined that is a concatenation of the spatial domain identifier (SRegionID) and the time domain identifier (TRegionID).

[0086] 7 illustrates an example of how read, write, and execute permissions may be defined based on region identifiers. In this particular example, access permissions for a given memory access or branch request are defined for each of several combinations of a current region identifier (e.g., a concatenation of the spatial region identifier of the request instruction and the current time region identifier) ​​and a target region identifier (e.g., a concatenation of the spatial region identifier of the target address and the current time identifier). Thus, the table illustrated in FIG. 7 can be considered a two-dimensional (2D) table because it is looked up by both the current region identifier and the target region identifier.

[0087] In the table, "RW" indicates that read and write access is allowed, "RO" indicates that read access is allowed but write access is not allowed, "X" indicates that branching is allowed, "XL" indicates that this is a function call (a branch where the return address is saved in the link register, for example), but that other types of branching are not allowed, and a dash "-" indicates that no access is allowed.

[0088] The table (e.g., sometimes referred to as a permission table) may be stored in memory. The table may be a single table or, for example, a multi-level table. In some examples, branch and function call permissions ("X" and "XL") may be defined in a separate table or bitmap, and the permission table defines only read and write permissions.

[0089] FIG. 8 illustrates an example of a circuit that may be used to identify and access one or more permission tables such as those shown in FIG. 7. In this example, the memory security circuit 135 includes a permission table access circuit 800 for accessing a permission table 805 in the memory 605. The base address of the permission table is defined in a set of registers 810. In this particular example, it is assumed that the data processing apparatus can operate at any of three privilege levels and that a table is defined for each privilege level. Accordingly, registers 815 are provided to store the base address of each table in the memory, and the permission table access circuit accesses the permission table based on the base address stored in the corresponding register. The memory security circuit in this example also includes one or more permission table caches 820 configured to cache a subset of the contents of the permission table. Entries in the permission table cache may be tagged with a virtual machine identifier (VMID) and an address space identifier (ASID) so that the cache does not need to be flushed after every context switch. Alternatively, the cache may be tagged with some alternative context identifier.

[0090] 8 shows only a portion of the circuitry that may be present in memory security circuit 135. It should be understood that the memory security circuitry in this example may also include circuitry such as SRegionID table access circuit 600, SRegionID register 500, or PC bit register shown in other figures. Furthermore, although this example assumes that the data processing apparatus is capable of operating at multiple different privilege levels, this is not required.

[0091] 9 is a flow diagram illustrating an example of a method that may be performed by a data processing apparatus in response to a memory access request being issued. It should be noted that a similar method may also be performed in response to the execution of a branch instruction.

[0092] As shown in the figure, the method includes step 900 of reading a current time domain identifier from a TRegionID register and step 905 of determining a current spatial domain identifier (SRegionID) based on an instruction fetch address of an instruction whose execution leads to the issuance of a memory access request. The method also includes step 910 of determining a target spatial domain identifier (i.e., a spatial domain identifier corresponding to the target of the access request) based on a target address of the memory access request. Upon determining the current time domain identifier and the current spatial identifier, the method includes step 915 of determining a current region identifier (RegionID) based on the current spatial and temporal domain identifiers (e.g., the RegionID may be a concatenation of the SRegionID and the TRegionID, as described above). The method also includes step 920 of determining a target region identifier (RegionID) based on the target spatial domain identifier and the current time domain identifier. Upon determining the current and target region identifiers, the method includes step 925 of looking up a permission table based on these two identifiers. For example, this may be a lookup in a table such as that shown in FIG. 7.

[0093] 10 is another flow diagram, this time showing an example of how a data processing apparatus may react to execution of a branch instruction. In particular, in some examples, the data processing apparatus may be configured to set the time domain identifier to 0 (or some other default value) when execution of the branch instruction changes the spatial domain identifier (SRegionID) (e.g., when the branch instruction is associated with one spatial domain identifier and the target of the branch instruction is associated with a different spatial domain identifier). This helps to maintain the integrity of the control flow.

[0094] 10 includes determining whether a branch instruction is executed 1000. If it is determined that the branch instruction is executed, the method includes determining whether the spatial domain identifier has changed due to the execution of the branch instruction 1005. If it is determined that this is the case, the time domain identifier is set to 0 (1010).

[0095] FIG. 11 illustrates a simulator implementation that may be used. While the above embodiments implement the present invention in terms of apparatus and methods for operating specific processing hardware supporting the technology, it is also possible to provide an instruction execution environment according to the embodiments described herein implemented through the use of a computer program. Such computer programs are often referred to as simulators, insofar as they provide a software-based implementation of a hardware architecture. Various simulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators. Typically, a simulator implementation may run on a host processor 1330, optionally running a host operating system 1320 and supporting the simulator program 1310. In some arrangements, there may be multiple layers of simulation between the hardware and the provided instruction execution environment, and / or there may be multiple different instruction execution environments provided on the same host processor. Historically, powerful processors have been required to provide simulator implementations that run at reasonable speeds, but such an approach may be justified in certain situations, such as when it is desirable to run code native to another processor for compatibility or reuse reasons. For example, a simulator implementation may provide an instruction execution environment that has additional functionality not supported by the host processor hardware, or that is typically associated with a different hardware architecture. An overview of simulation is given in "Some Efficient Architecture Simulation Techniques," Robert Bedichek, Winter 1990 USENIX Conference, pp. 53-63.

[0096] While embodiments have been described above with reference to specific hardware constructs or features, equivalent functionality may be provided in simulated embodiments by suitable software constructs or features. For example, certain circuits may be implemented as computer program logic in simulated embodiments. In the example shown in FIG. 11 , instruction fetch program logic 1340 is provided, providing the same functionality as the instruction fetch circuitry in the previous example. Additionally, processing program logic 1350 is provided, providing the same functionality as the processing circuitry described above, and memory security program logic 1360 is provided, providing the functionality of the memory security circuitry in the previous example. Similarly, memory hardware, such as registers or caches, may be implemented as software data structures in simulated embodiments. In arrangements where one or more of the hardware elements referenced in the preceding embodiments reside on host hardware (e.g., host processor 1330), some simulated embodiments may use the host hardware where suitable.

[0097] Simulator program 1310, which may be stored in a computer-readable storage medium (which may be a non-transitory medium), provides a program interface (an instruction execution environment) to target code 1300 (which may include an application, an operating system, and a hypervisor) that is the same as the interface of the hardware architecture being modeled by simulator program 1310. Thus, program instructions of target code 1300, including instructions that require memory access requests to be issued, branch instructions, function call instructions, and function return instructions, as described above, can be executed from within the instruction execution environment using simulator program 1310, as a result of which host computer 1330, which does not actually have the hardware functions of apparatus 100 described above, can emulate these functions.

[0098] In this application, the term "configured to" is used to mean that elements of a device have a configuration that is capable of performing a defined operation. In this context, "configuration" refers to a manner of arrangement or interconnection of hardware or software. For example, a device may have dedicated hardware that provides the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured to" does not imply that device elements need to be modified in any way to provide the defined operation.

[0099] Furthermore, the term "comprising at least one of" in this application is used to mean including any one of the following options or any combination of the following options. For example, "at least one of: A; B and C" is intended to mean A or B or C or any combination of A, B and C (e.g., A and B or A and C or B and C).

[0100] Although illustrative embodiments of the present invention have been described in detail herein with reference to the accompanying drawings, it will be understood that the invention is not limited to those precise embodiments, and that various changes and modifications can be made to the embodiments by those skilled in the art without departing from the scope of the invention as defined by the appended claims.

Claims

1. 1. An apparatus comprising: an instruction fetch circuit responsive to an instruction fetch address to fetch an instruction associated with the instruction fetch address; processing circuitry responsive to the instruction, when the instruction includes a request specifying a target memory address and the request specifying the target memory address is granted, to perform an operation dependent on the target memory address; When the instruction includes the request specifying the target memory address, determining a current region identifier based on a predetermined slice of the instruction fetch address; Identifying authorization information for requests issued in response to commands associated with the current realm identifier based on the current realm identifier; determining whether the request is prohibited based on the authorization information; and a memory security circuit for, in response to determining that the request is forbidden, issuing a response to the processing circuit indicating that the request is forbidden.

2. the memory security circuit determining whether the request is forbidden based on page table access permission information derived from a page table entry associated with the target memory address; configured to issue the response indicating that the request is forbidden in response to determining that the request is forbidden based on at least one of the permission information and the page table permission information.

10. The apparatus of claim 1.

3. the memory security circuit is configured to determine a source region identifier corresponding to a region of memory storing the instruction based on the predetermined slice of the instruction fetch address, and to determine the current region identifier in dependence on the source region identifier.

3. The device according to claim 1 or 2.

4. the processing circuitry is responsive to a return space identifier instruction identifying a destination register to determine a current source region identifier and store the current source region identifier in the destination register; 4. The apparatus of claim 3.

5. a register for storing a current time identifier; the memory security circuit is configured to determine the current region identifier dependent on the source region identifier and the current time identifier, the current time identifier being looked up independently of the instruction fetch address; the processing circuitry sets the current time identifier to a predetermined value in response to detecting an instruction having a given source domain identifier that differs from a source domain identifier associated with a previous instruction.

5. The device according to claim 3 or 4.

6. a configuration register for storing slice identification information indicating the predetermined slice of the instruction fetch address; An apparatus according to any one of claims 1 to 5.

7. the memory security circuit determines that the source region identifier is a default source region identifier in response to determining that the further slice of the instruction fetch address has a value other than a predetermined value; An apparatus according to any one of claims 1 to 6.

8. the instruction fetch address includes a virtual address; the instruction fetch circuitry is configured to fetch the instruction in dependence on a given portion of the instruction fetch address, the given portion of the instruction fetch address indicating a location in memory where the instruction is stored; the given portion of the instruction fetch address and the predetermined slice of the instruction fetch address overlap by at least one bit; An apparatus according to any one of claims 1 to 7.

9. The memory security circuitry may include: Read access permission, Write permissions and Permission to perform branching, and and a permission to execute a branch without storing a return address. An apparatus according to any one of claims 1 to 8.

10. the memory security circuitry is configured to determine a destination region identifier based on the target memory address; the memory security circuit comprises a table access circuit for looking up a permission table in memory based on the current region identifier and the destination region identifier, the permission table defining the permission information; the table access circuitry is configured to support at least one encoding of the permission table, in which different permission information is defined for different combinations of the current region identifier and different destination region identifiers; An apparatus according to any one of claims 1 to 9.

11. the memory security circuit includes a table access circuit for accessing in memory a permission table defining the permission information; the apparatus comprises a table identification register for storing address information indicating a location of the permission table in memory; An apparatus according to any one of claims 1 to 10.

12. the device is configured to operate at one of a plurality of privilege levels; The device comprises: a plurality of registers each configured to store address information indicating the location of a corresponding permission table in memory; a register selection circuit for selecting one of the plurality of registers as the permission table identification register based on a current privilege level; 12. The apparatus of claim 11.

13. the memory security circuit includes a table access circuit for accessing in memory a permission table defining the permission information; the device comprising a register for storing a current set of permissions indicating the permission information defined in the permission table for the current region identifier; the table access circuit, in response to determining that the current region identifier has been changed to a new region identifier, looks up the permission table based on the new region identifier to identify an updated set of permissions to be stored in the register; An apparatus according to any one of claims 1 to 12.

14. the memory security circuit includes a table access circuit for accessing in memory a permission table defining the permission information; the device comprising a cache that stores a subset of the permissions defined in the permission table; the apparatus is configured to operate in one of a plurality of contexts, each associated with a context identifier; the cache includes a plurality of entries, each associated with a corresponding context identifier; An apparatus according to any one of claims 1 to 13.

15. a plurality of registers including a register for storing, for each of a plurality of current region identifiers, a set of permissions indicating permission information for the current region identifier; An apparatus according to any one of claims 1 to 14.

16. 1. A method comprising: In response to an instruction fetch address, fetching an instruction associated with the instruction fetch address; When the instruction includes a request specifying a target memory address: in response to the instruction, when the request specifying the target memory address is granted, performing an operation dependent on the target memory address; determining a current region identifier based on a predetermined slice of the instruction fetch address; identifying, based on the current realm identifier, authorization information for requests issued in response to commands associated with the current realm identifier; determining whether the request is prohibited based on the authorization information; and in response to determining that the request is forbidden, issuing a response indicating that the request is forbidden.

17. A computer program that, when executed on a computer, causes the computer to instruction fetch program logic responsive to an instruction fetch address to fetch an instruction associated with the instruction fetch address; causing processing program logic in response to said instruction to perform an operation dependent on said target memory address when said instruction includes a request specifying a target memory address and said request specifying said target memory address is granted; in memory security program logic, when the instruction includes the request specifying the target memory address; determining a current region identifier based on a predetermined slice of the instruction fetch address; Identifying authorization information for requests issued in response to commands associated with the current realm identifier based on the current realm identifier; determining whether the request is prohibited based on the authorization information; In response to determining that the request is forbidden, the computer program causes the processing program logic to issue a response indicating that the request is forbidden.

18. 20. A computer-readable storage medium storing the computer program of claim 17.

Images