Tag Protection Order

Abstract

The access control circuit (15), in response to a memory access request, compares a tag value determined based on the tag portion (40) of the address pointer (42) with an allocation tag (32) associated with a memory location identified by the memory address determined from the address pointer. In response to a comparison showing a given result, a tag error response is performed. The processing circuit (4) that executes the tag protection instruction detects whether the operation involves an attempt to set a bit in the identified portion (74) of the output value to a value other than the value of the corresponding bit in the input operand. If the processing circuit detects this attempt, it sets a given portion of the output value to an error indication value. The identified portion is the portion of the output value used as the tag portion when the output operand is used as an address pointer for a memory access instruction.

Description

Technical Field

[0001] This technique relates to the field of data processing.

[0002] Software executed by a data processing device is typically written in a high-level programming language and can then be compiled into code according to an instruction set architecture supported by the device on which the software is executed. For example, the software can originally be written in a higher-level language such as Java, C, or C++, and then be compiled into an instruction set architecture natively supported such as x86 or Arm (registered trademark).

[0003] Some higher-level programming languages such as Java include runtime error detection checks to check for certain errors related to memory access and are thus considered memory-safe languages. In contrast, memory-unsafe languages such as C and C++ do not include such runtime error checks. The continued prevalence of the use of memory-unsafe languages means that there can be a number of memory-related errors in code compiled according to a given instruction set architecture that can be vulnerable to exploitation by attackers or other malicious parties. Such errors can include the following. · A boundary violation where the index of an array supplied by the code is outside the valid bounds of the array, · A freed memory use error where access to a memory location is made after that memory location has already been deallocated or freed, · A use-after-return where memory access to an address associated with a variable used within a function (such as a value on the stack) is made after already returning from the function, · A scope-outside-use error where a variable is accessed outside the scope in which it was declared, · A use-before-initialization error where the memory address associated with a variable is accessed before the variable is initialized.

[0004] These are just a few examples of memory-related errors that can lead to unpredictable behavior and potentially provide attackers with avenues to exploit. Therefore, to aid in the runtime detection of a particular class of memory errors, it may be desirable to provide architectural support within the instruction set architecture supported by a given processor.

[0005] One technique for protecting against certain types of memory usage errors described above may be to provide guard tags stored in the memory system in association with blocks of one or more memory locations. When a tag-protected memory access operation is requested based on a target address that identifies a specific addressed location in the memory system, the memory access circuit may compare an address tag associated with the target address with a guard tag stored in the memory system in association with blocks of one or more memory locations that contain the addressed location identified by the target address. The memory access circuit may generate an indication of whether a match is found between the guard tag and the address tag. This indication can be used to control whether the memory access is allowed to succeed or whether subsequent operations can succeed, or it can simply be reported while the memory access is allowed to continue normally.

[0006] This can be useful, for example, for compilers compiling code based on non-memory-safe languages ​​such as C or C++, because when initializing memory regions, they can set guard tags to specific values ​​for blocks of memory that the code is expected to access, and associate the corresponding address tag values ​​with target addresses pointing to those blocks. If a memory usage error occurs, for example, if an address pointer is used out of scope or extends beyond the boundaries of its initialized valid range, the guard tag associated with the addressed location may not match the address tag associated with the target address. In this case, an indication of whether a match was detected can be used to trigger some error handling response or error reporting mechanism. The specific response taken may depend on the specific needs of the software being executed or the specific microarchitectural implementation of the architecture. Therefore, even if a high-level language does not have means to perform runtime error checking to protect against memory access errors, the ISA used for the compiled code may include architectural features to perform such checking.

[0007] Although the term "guard tag" was used above, the term "allocation tag" may also be used.

[0008] Looking at the first example of this technology, A processing circuit for executing data processing operations in response to an instruction, The processing circuit, in response to a memory access instruction that identifies an address pointer, issues a memory access request that includes a request to access data stored at a memory location identified by a memory address determined based on the address portion of the address pointer. An access control circuit for responding to a memory access request by comparing a tag value determined based on the tag portion of an address pointer with an allocation tag associated with a memory location identified by a memory address, and for performing a tag error response in response to a comparison showing a given result, Equipped with, The processing circuit, in response to a tag protection instruction that identifies the input operand, performs an operation on the input operand to generate an output value. The processing circuit is configured to detect whether the operation involved an attempt to set the value of at least one bit in an identified portion of the output value to a value other than the value at the corresponding bit position in the input operand. The processing circuit is configured to set at least a given portion of the output value to an error indicator value in response to detecting that the operation involved an attempt to set the value of at least one bit in an identified portion of the output value to a value other than the value at the corresponding bit position in the input operand. The identified portion is the part of the output value that is used as the tag portion when the output operand is used as an address pointer for a memory access instruction. The device is provided.

[0009] Looking at the second example of this technology, Executing data processing operations in response to commands, In response to a memory access instruction that identifies an address pointer, issuing a memory access request that includes a request to access data stored at a memory location identified by a memory address determined based on the address portion of the address pointer, In response to a memory access request, the system compares the tag value determined based on the tag portion of the address pointer with the allocation tag associated with the memory location identified by the memory address, and in response to the comparison showing a given result, it performs a tag error response. In response to a tag protection instruction that identifies an input operand, the system performs an operation on the input operand to generate an output value, To detect whether the operation involved an attempt to set the value of at least one bit in an identified portion of the output value to a value other than the value at the corresponding bit position in the input operand, In response to detecting that the operation involved an attempt to set the value of at least one bit in an identified portion of the output value to a value other than the value at the corresponding bit position in the input operand, set at least a given portion of the output value to an error indicator value, Includes, The identified portion is the part of the output value that is used as the tag portion when the output operand is used as an address pointer for a memory access instruction. A method is provided.

[0010] A third example of this technology includes a computer program that, when executed by a host data processing device, includes instructions to control the host data processing device to provide an instruction execution environment for executing target program code, wherein the computer program Processing program logic for executing data processing operations in response to instructions in target program code, The processing program logic, in response to a memory access instruction that identifies an address pointer, issues a memory access request that includes a request to access data stored at a memory location identified by a memory address determined based on the address portion of the address pointer. Access control program logic for responding to a memory access request by comparing a tag value determined based on the tag portion of an address pointer with the allocation tag associated with the memory location identified by the memory address, and executing a tag error response in response to a comparison showing a given result. Equipped with, The processing program logic, in response to a tag protection instruction that identifies the input operand, performs an operation on the input operand to generate an output value. The processing program logic is configured to detect whether the operation involved an attempt to set the value of at least one bit in an identified portion of the output value to a value other than the value at the corresponding bit position in the input operand. The processing program logic is configured to set at least a given portion of the output value to an error indicator value in response to detecting that the operation involved an attempt to set the value of at least one bit in an identified portion of the output value to a value other than the value at the corresponding bit position in the input operand. The identified portion is the part of the output value that is used as the tag portion when the output operand is used as an address pointer for a memory access instruction. A computer program is provided.

[0011] A third example of this technology provides a computer-readable storage medium for storing the aforementioned computer program. The computer-readable storage medium may be temporary or non-temporary. [Brief explanation of the drawing]

[0012] Further aspects, features, and advantages of this technique will become apparent from the following example description, which should be read in conjunction with the attached drawings. [Figure 1] A schematic diagram of an example of a data processing device is shown. [Figure 2] This example shows tag-protected memory access behavior, which includes checking whether the address tag matches the guard tag. [Figure 3] This is a flowchart illustrating how to perform tag-protected memory access operations. [Figure 4] This demonstrates addition using carry values. [Figure 5] Here is an example of how a tag protection order might be implemented. [Figure 6] An example of an invalid address pointer is shown below. [Figure 7] This is a flowchart illustrating how to execute a tag protection command. [Figure 8] It is a flowchart showing an execution method of a memory access instruction. [Figure 9] Illustrates an implementation form of a simulator.

[0013] Before considering exemplary implementation forms with reference to the accompanying drawings, the following explanations are provided regarding exemplary implementation forms and related advantages.

[0014] According to an example of the present technology, an apparatus is provided that includes a processing circuit that executes a data processing operation in response to an instruction. The processing circuit issues a memory access request that includes a request to access data stored in a memory location identified by a memory address determined based on an address portion of an address pointer in response to a memory access instruction that identifies the address pointer. The apparatus also includes an access control circuit for executing a tag error response in response to a comparison that shows a given result, by comparing a tag value determined based on a tag portion of the address pointer with an allocated tag associated with the memory location identified by the memory address in response to the memory access request.

[0015] The access control circuit of the present technique may include the above-described memory access circuit, the tag value may include the above-described address tag, and the allocated tag may include the above-described guard tag. Similarly, the tag error response may be executed in response to the generation of an indication that a mismatch has been detected between the guard tag and the address tag, and the tag error response may include, for example, preventing the memory access from succeeding (e.g., rejecting the memory access request and / or generating a processor exception), or may simply include reporting an error while allowing the memory access to continue as normal. Thus, the apparatus of the present technique implements memory tagging.

[0016] In systems that perform memory tagging, tagged pointers can be manipulated as integers, which can lead to changes in the tag value. Changes to the tag can be problematic because they potentially reduce the security benefits associated with memory tagging by allowing attackers to manipulate the tag value.

[0017] To address these security concerns, this technique provides a tag protection command.

[0018] The processing circuit, in response to a tag protection instruction that identifies an input operand, performs an operation on the input operand to generate an output value. For example, the input operand identified by the tag protection instruction may be an address pointer. However, the processing circuit may not recognize the meaning of the input operand; for example, when executing a tag protection instruction, the processing circuit may treat the input operand as if it were any other integer value. Note that a tag protection instruction may identify multiple input operands.

[0019] The processing circuit is configured to detect whether an operation (for example, an operation performed in response to a tag protection instruction) involved an attempt to set the value of at least one bit in an identified portion of the output value to a value other than the value at the corresponding bit position in the input operand, the identified portion being the portion of the output value used as the tag portion when the output operand is used as an address pointer for a memory access instruction.

[0020] Therefore, tag protection instructions provide a mechanism to detect whether an attempt to modify the tag portion of an address pointer was intentional (e.g., an attacker inserts a tag modification instruction into program code) or unintentional (e.g., an operation performed on another part of an address pointer unintentionally affects the tag portion).

[0021] In response to detecting that the operation involved an attempt to set the value of at least one bit in an identified portion of the output value to a value other than the value at the corresponding bit position in the input operand, the processing circuit sets at least a given portion of the output value to the error indicator value.

[0022] One possible response to detecting an attempt to set the value of at least one bit in an identified portion of an output value to a value other than the value at the corresponding bit position in the input operand is to raise an exception. However, there may be a significant performance cost associated with raising a processor exception, which may not be justifiable in all cases. For example, an output operand is never used as an address pointer, in which case an attempt to change the identified portion is not a problem. Therefore, the inventors of this technique have proposed an alternative response that does not incur such a high performance cost. In particular, the processing circuit of this technique responds to an attempt to set a portion (e.g., part or all) of the output value to some error indicator value. This makes it possible to detect the error at a later stage without incurring the performance cost associated with immediately raising an exception.

[0023] A tag-protected instruction may be a dedicated instruction with instruction coding indicating that it should be executed as a tag-protected instruction. For example, there may be various tag-protected instructions provided in the instruction set architecture (ISA) for different operations that may be performed on input operands. However, given the limited coding space available for coding new instructions, the processing circuit may operate in any of several operating modes, and some instructions may be treated / decoded as tag-protected instructions in some modes but not in others. In another example, all instructions of a given type (e.g., all arithmetic instructions) may be treated as tag-protected instructions. In any of these examples, there may be certain dedicated tag-setting instructions that are permitted to modify identified parts of the output value (e.g., these instructions may be prevented from being executed as tag-protected instructions).

[0024] In some examples, the access control circuit identifies the operand containing the error indicator value as an address pointer in order to trigger a pointer error response in response to a memory access instruction.

[0025] In this way, if there is an attempt to set an identified portion of the output value to a value different from the corresponding portion of the input value, an error response can be triggered when the output value is subsequently used as an address pointer for memory access. Executing this error response when the output value is used as an address pointer, rather than when a tag protection instruction is executed, protects the memory system while reducing the likelihood of "false positives" occurring (e.g., executing an error response even when the output value is not used as an address pointer), which can improve performance.

[0026] In some examples, the processing circuit is configured to detect whether the operand identified by the memory access instruction contains an error instruction value, depending on at least one of the following: - Current operating mode of the processing circuit, -operand, - A value generated using at least a portion of the operands.

[0027] A processing circuit can be configured to operate in one of several operating modes, and the current operating mode of the processing circuit may be indicated by a mode indicator value stored in a memory circuit (e.g., a register) accessible from the processing circuit. In some examples, the processing circuit may detect or respond to an error indicator value in different ways depending on the current operating mode. This may include performing different error responses in different operating modes. Furthermore, the detection of an error indicator value may be based on the operand itself or on some value (e.g., a hash) generated using at least a portion of the operand.

[0028] In some examples, a pointer error response includes at least one of the following: - Raise an exception, - Record the error instruction in the status register.

[0029] The pointer error response may be the same as or different from the tag error response described above.

[0030] When an attempt to modify the identified portion is detected, there are several possibilities regarding which portion of the output value is set to the given error display value. In some examples, the given portion includes the identified portion. For example, the identified portion may be set to a value that does not indicate a valid tag (and therefore trigger a tag error response if the output value is used as an address pointer).

[0031] In some examples, a given portion includes an address identification portion, and the processing circuit identifies the output value as an address pointer in order to treat the address identification portion of the output value as the address portion in response to a memory access instruction. For example, the address indication portion may be set to a non-standard value (e.g., a value that does not identify a valid address) as an error indication value.

[0032] In some examples, a given portion of the output address pointer contains an error indicator field in the output value. For example, there may be a portion of the output value reserved to indicate an error. For instance, the error identification field may be one or more bits in the output value that are not normally used for any other purpose.

[0033] Note that in some examples, the processing circuit may set multiple parts of the output value to error indicator values.

[0034] In some examples, the processing circuit is configured to set the value of a given portion of the output value according to at least one of the following: - Current operating mode of the processing circuit, -The operands to be entered, -Output value.

[0035] For example, the processing circuit may set different parts of the output value to error indicator values ​​depending on one or more of the factors mentioned above. Alternatively, the specific value used as the error indicator value may change depending on any of these factors.

[0036] When performed on an address operand, several operations can unintentionally modify the tag portion of the operand. One example is the logical "OR" operation. In some examples, the operations include arithmetic operations.

[0037] As described above, some implementations can treat any arithmetic instruction (and / or any logical OR instruction) as tag protection in at least some operating modes (potentially excluding dedicated tag-setting instructions). Other implementations may include dedicated instruction coding in the ISA for tag protection of arithmetic instructions.

[0038] In some examples, the arithmetic operation involves an operation with addition, and the processing circuit is configured to detect if the carry generated during the addition contains a non-zero value in the corresponding bit position, as an attempt to set the value of at least one bit in the identified portion of the output value to a value other than the value in the corresponding bit position in the input operand.

[0039] Arithmetic operations may be performed in response to an ADD instruction, or as part of an arithmetic operation performed in response to any other arithmetic instruction (e.g., subtraction, multiplication, or division instructions, each of which may be performed using addition). When performing an addition operation where one addend is an address pointer, even if the other addend has only zeros in the portion aligned with the tag portion of the address pointer (e.g., even if the addition is not intended to modify the tag portion), the carry value generated during the addition may overflow to the bit position corresponding to the tag portion (e.g., to the identified portion of the output value). Thus, the identified portion of the output operand may be unintentionally modified. This technique provides protection from this type of unintentional modification of the identified portion, in addition to protection from intentional (e.g., malicious) attempts to modify the identified portion.

[0040] In some examples, the processing circuit, in response to a further tag protection instruction, identifies the output value obtained from the tag protection instruction as a further input operand, performs further operations on the output value, and generates further output values. In these examples, the processing circuit is configured to detect whether the output value contains an error instruction value, and in response to detecting that the output value contains an error instruction value, the processing circuit is configured to perform an error response.

[0041] In this way, the error indicator value is propagated to further output values. This makes it more difficult to remove the error indicator value by performing further actions on the output value, and therefore the security of the device is further improved.

[0042] Implementation of memory tagging The specific form of the generated instruction indicating whether a match is found between a guard tag and an address tag may vary from implementation to implementation. In some cases, tag-protected memory access behavior may include controlling whether memory access to an addressed location is permitted depending on whether a match is found between the guard tag and the address tag. However, in other examples, tag-protected memory access may include performing memory access to an addressed location regardless of whether a match is found between the guard tag and the address tag. For example, a guard tag associated with a given block of memory locations may be stored in a different block of memory locations in the memory system, and therefore accessing the guard tag may require a separate read operation. Thus, if memory access is delayed until the guard tag and the address tag are compared, it may delay the actual processing of the memory access, and therefore it may be desirable to perform memory access to an addressed location regardless of whether a match is found between the guard tag and the address tag before the guard tag becomes available, and then, once the guard tag is retrieved and compared with the address tag, generate a separate instruction indicating whether a match is found.

[0043] For example, an indication of whether a match has been detected could be a signal representing a fault condition, generated when a mismatch is detected between a guard tag and an address tag. For instance, a memory access circuit could signal a memory fault similar to one generated when an access permission is violated or when an unmapped address is accessed, or it could indicate a different type of fault condition. The fault signal can trigger a processing circuit to execute an exception handling routine in response to the detected fault.

[0044] Alternatively, a status indication may be recorded in a control register accessible by the device's processing circuit to show whether a match or mismatch was detected in the comparison between the guard tag and the address tag. The status information may then be read by a subsequent instruction to check whether the memory access was valid.

[0045] Another option for reporting whether address tags and guard tags match or mismatch is to log the information in an error log associated with the executed portion of the code, which tracks any guard tag errors detected throughout the entire portion of the code. For example, in response to a mismatch between a guard tag and an address tag, the error log could log the target address that triggered the mismatch, or the instruction address of the instruction that triggered the mismatched memory access. In this case, the error may simply be logged in the error log, rather than performing any specific action to prevent the code from working. The error log can be made available to the software provider of the code, allowing them to assist in removing the error in subsequent versions of the software.

[0046] Therefore, it can be understood that there are various ways in which the guard tag match / mismatch indication is generated by the memory access circuit.

[0047] In some embodiments, each block of memory locations having a corresponding guard tag may comprise a single memory location. In this case, each individual memory location may have a different guard tag, thereby providing a finer granularity of guard tags that allows for the detection of a wider range of memory errors.

[0048] However, in practice, the overhead of setting an individual guard tag for each addressed location may be too high, and it may be more efficient to associate each guard tag with a block of multiple memory locations. In this case, several adjacent memory locations may share the same guard tag, which may be sufficient to detect common forms of memory-related errors.

[0049] A guard tag associated with a given block of memory location may be stored in any other memory location within the memory system. The specific method by which the location of the guard tag within the memory system is selected can vary considerably from implementation to implementation or at runtime. In some examples, the location storing the guard tag may be architecturally accessible by the processing circuitry; that is, the guard tag storage location may be a location mapped to the same part of the address space as the addressed location. In this case, the mapping between the addressed location itself and the address of the corresponding tag storage location may be fixed, hardwired, or variable, and may be tracked, for example, in a tracking table maintained by the memory access circuitry or in a translation lookaside buffer. Alternatively, other implementations may store the guard tag associated with a given addressed location in a further storage location that is not architecturally accessible to the processing circuitry, for example, in additional storage provided within the microarchitecture that is not mapped to an address space that can be addressed by instructions executed by the processing circuitry. In this case, the memory access circuitry may determine a specific internal address used to reference the corresponding tag storage location based on the address of the addressed location and trigger any additional memory access necessary to read the tag data from the tag storage location. Regardless of whether the tag storage location is architecturally accessible to the processing circuit, the tag value may also be cached in a cache for faster access, either in the same cache used for the data value or in a dedicated tag cache.

[0050] Address tags can be associated with target addresses in different ways. In some cases, address tags can be specified separately from target addresses, for example, using a separate register specified by a tag-protected memory access instruction that triggers tag-protected memory access operations. However, in other examples, address tags can be determined as a function of one or more selected bits of the target address; that is, address tags may contain information derived from a portion of the target address itself. Often, instruction set architectures can support addresses with a certain number of bits (e.g., 64 bits), but a given hardware device may not actually require so much memory capacity that it can use all possible addresses that can be represented using that number of bits. For example, current trends in device usage still suggest that 2 64 It is not necessary to provide individual addressable locations. Therefore, often some bits of a memory address may be effectively unused and may either always have the same value or be set as a sign extension of the most significant "real" address bit (thus the unused portion is set to all 0 or all 1). Thus, whenever an address is manipulated or moved between registers, the address tag can naturally be transported along with the address, and this unused portion can be reused to represent the address tag or the value that derives the address tag, avoiding the need to access a separate register to obtain the address tag, and making it easier to track the correspondence between addresses and their corresponding address tags.

[0051] In embodiments where an address tag is determined using a portion of a target address, it should be noted that this address tag is different from the tag portion of the target address that the cache can use to determine whether information from the addressed location identified by the target address is stored in the cache. Many caching schemes can store the tag portion of the address of cached data in parallel with the data itself, so that when the cache is searched for a given address, a portion of the address can be compared with the tag stored in parallel with the cached data to determine whether the cached data actually corresponds to the requested address. However, in this case, the tag portion of the address compared with the tag in the cache is the portion of the address that actually identifies the specific addressed location from which the data is requested, meaning that changing the cached tag portion of the address will naturally result in the address pointing to a different addressed location in the memory system. In contrast, when address tags are used in tag-protected memory operation, the memory access circuit may select the addressed location from which the data is requested independently of the address tag. That is, even if the address tag has a different value, the selection of the addressed location depends only on the other portion of the target address, so the addressed location referenced by the target address may still be the same. This gives the compiler the freedom to set the address tag associated with a particular address to any value that matches the corresponding guard tag value assigned to the relevant block of data in the memory system.

[0052] In some implementations, the instruction decoder can support separate tag-protected and tag-protected variations of a memory access instruction. In this case, tag-protected memory access behavior may be triggered in response to the tag-protected variation of the memory access instruction. In contrast, an untag-protected memory access instruction can simply trigger access to the addressed location identified by the target address specified by the instruction, without needing to acquire a guard tag or perform a comparison between the address tag and the protection tag.

[0053] However, in other implementations, all memory accesses may be considered tag-protected memory accesses. Therefore, in some cases, any memory access instruction may be considered to trigger the memory access circuit to perform tag-protected memory access operation as described above.

[0054] However, even if all memory access instructions are interpreted as tag-protected memory access instructions, other methods may still exist in the instruction set architecture that support selectively disabling protected tag comparison for specific operations. For example, control parameters in the processor's control registers can selectively disable tag comparison. Another option is for a certain value in the address tag to be interpreted in a special way to indicate that the address tag should be considered to match any possible value of the guard tag, effectively disabling the effect of tag comparison in the same way, so that no error is reported regardless of whether the address tag matches the guard tag or not.

[0055] Simulator implementation The techniques described above can be implemented in a hardware device having circuit hardware that implements the processing circuit and access control circuit described above, and this circuit hardware supports tag protection instructions and memory access instructions as part of the native instruction set architecture supported by the decoding circuit and processing circuit.

[0056] However, in another embodiment, the same technique may be implemented in a computer program (e.g., an architecture simulator or model) that can be provided to control a host data processing device to provide an instruction execution environment for executing instructions from target code. The computer program may include processing program logic for controlling the host data processing device to perform data processing. The program may also include access control program logic for emulating the functionality of the access control circuit described above. Thus, the processing program logic emulates the functionality of the processing circuit of the hardware device described above. The processing program logic includes support for tag protection instructions having the same functionality as described above for the hardware example. Thus, such a simulator computer program can present, for target code executed on the simulator computer program, an instruction execution environment similar to that provided by an actual hardware device capable of directly executing the target instruction set, even if no actual hardware providing these functions exists on the host computer running the simulator program. This can be useful for executing code written for one instruction set architecture on a host platform that does not actually support that architecture. The simulator can also be useful during the development of software for a new version of an instruction set architecture while software development is running in parallel with the development of hardware devices that support the new architecture. This could allow software to be developed and tested on a simulator, enabling software development to begin before hardware devices supporting the new architecture become available.

[0057] RTL / EDA implementation The concepts described herein may be embodied in computer-readable code for the fabrication of devices that embody the described concepts. For example, computer-readable code may be used in one or more stages of a semiconductor design and fabrication process, including an electronic design automation (EDA) stage, to fabricate an integrated circuit comprising a device that embodies the concepts. The computer-readable code described herein may additionally or alternatively enable the definition, modeling, simulation, verification, and / or testing of devices that embody the concepts described herein.

[0058] For example, computer-readable code for fabricating a device embodying a concept described herein may be embodied in code that defines a Hardware Description Language (HDL) representation of the concept. For example, the code may define a Register-Transfer-Level (RTL) abstraction of one or more logic circuits for defining a device embodying the concept. The code may define HDL representations of one or more logic circuits embodying the device in Verilog, SystemVerilog, Chisel, or VHDL (Very High-Speed ​​Integrated Circuit Hardware Description Language), as well as intermediate representations such as FIRRTL. The computer-readable code may provide definitions that embody the concept using system-level modeling languages ​​such as SystemC and SystemVerilog, or other behavioral representations of the concept that can be interpreted by a computer to enable simulation, functional and / or formal verification, and testing of the concept.

[0059] Additionally or alternatively, computer-readable code may embody computer-readable representations of one or more netlists. These netlists may be generated by applying one or more logic synthesis processes to the RTL representations. Alternatively or additionally, one or more logic synthesis processes may generate from the computer-readable code bitstreams to be loaded into a Field Programmable Gate Array (FPGA) to embody the described concepts. The FPGA may be deployed for verification and testing purposes before fabrication in an integrated circuit, or the FPGA may be deployed directly into a product.

[0060] Computer-readable code may include a mixture of code representations for the fabrication of a device, for example, a mixture of one or more RTL representations, netlist representations, or other computer-readable definitions used in semiconductor design and fabrication processes for fabricating a device embodying the present invention. Alternatively or additionally, the concept may be defined as a combination of computer-readable definitions used in semiconductor design and fabrication processes for fabricating a device and computer-readable code that defines instructions to be executed by the device once it is fabricated.

[0061] Such computer-readable code may be placed on any known temporary computer-readable medium (such as wired or wireless transmission of code over a network) or on a non-temporary computer-readable medium such as a semiconductor, magnetic disk, or optical disk. An integrated circuit fabricated using computer-readable code may include components such as a central processing unit, a graphics processing unit, a neural processing unit, a digital signal processor, or one or more other components that individually or collectively embody a concept.

[0062] Here, a specific embodiment will be described with reference to the drawings.

[0063] Examples of data processing devices Figure 1 schematically illustrates an example of a data processing device 2. This is merely a high-level representation of a subset of the device's components, and it will be understood that the device may include many other components not shown. Device 2 comprises a processing circuit 4 for performing data processing in response to instructions decoded by an instruction decoder 6. The instruction decoder 6 decodes instructions fetched from the instruction cache 8 and generates control signals 10 to control the processing circuit 4 to perform the corresponding processing operation represented by the instruction. The processing circuit 4 may include one or more execution units for performing operations on values ​​stored in registers 14 and producing result values ​​written back to the registers. For example, the execution units may include an arithmetic / logic unit (ALU) for performing arithmetic or logical operations, a floating-point unit for performing operations using floating-point operands, and / or a vector processing unit for performing vector operations on operands containing multiple independent data elements. The processing circuit also includes a memory access unit (or load / store unit) 15 for controlling the transfer of data between registers 14 and the memory system. In this example, the memory system includes an instruction cache 8, a level 1 data cache 16, a level 2 cache 17 shared between data and instructions, and main memory 18. Other cache hierarchies are possible, and this is just one example. A memory management unit (MMU) 20 is provided to support address translation functions that enable memory access triggered by the load / store unit 15. The MMU has a translation lookaside buffer (TLB) 22 for caching a subset of entries from page tables stored in the memory systems 16, 17, and 18.Each page table entry can provide an address translation mapping for the corresponding page of an address, and can also specify access control parameters, such as permissions that specify whether the page is read-only or read-and-write, or permissions that specify which privilege levels can access the page.

[0064] In Figure 1, processing circuit 4 is an example of a processing circuit that performs data processing operations in response to an instruction. The processing circuit, in response to a memory access instruction that identifies an address pointer, issues a memory access request that includes a request to access data stored in a memory location identified by a memory address determined based on the address portion of the address pointer. On the other hand, load / store unit (memory access circuit) 15 is an example of an access control circuit that, in response to a memory access request, compares a tag value determined based on the tag portion of the address pointer with an allocation tag associated with a memory location identified by a memory address, and performs a tag error response in response to a comparison showing a given result.

[0065] Memory tagging Figure 2 schematically illustrates the concept of tag-protected memory access. The physical address space used to reference memory locations within the memory system can be logically divided into several blocks 30, each containing a certain number of addressable locations. For simplicity, in the example in Figure 2, each block 30 contains four memory locations, but other block sizes may be used as well. Each block 30 is associated with a corresponding guard tag 32. Guard tags associated with a certain number of blocks 30 can be collected together and stored either in a different architecturally accessible memory location 34 within the physical address space, or in an additional storage location provided within main memory 18 that is not architecturally accessible (not mapped to the same physical address space). The use of separate, non-architecturally accessible storage may, in some cases, be preferable to avoid exhausting space in data caches 16, 17 for caching guard tag values, which may affect the performance of regular code and make coherency management more complex. To access tags faster than when they must be accessed from main memory 18, the microarchitecture may be provided with an additional tag cache 19 for caching tag values ​​from non-architecturally accessible storage. The specific mapping of which tag storage location 34 corresponds to each block 30 may be controlled by the load / store unit 15, and may be hardwired or programmable. In Figure 2, each tag 32 is associated with a block of physical addresses, while it is also possible to provide guard tags 32 associated with virtual memory locations in the virtual memory address space, although this may require some additional address translation for each memory access. Therefore, performance can be improved by associating guard tags 32 with physical memory locations. In general, how exactly guard tags 32 are associated with corresponding blocks 30 in the physical address space is a choice for a particular microarchitecture implementation.Generally, the only requirement is the ability to access and compare guard tags 32 associated with a given block of memory.

[0066] Therefore, when tag-protected memory access is required, the address tag 40 (associated with the target address 42 that identifies the addressed location 44 to be accessed) is compared with the guard tag 32 associated with the block 30 of memory locations containing the addressed location 44. For example, in Figure 2, the target address 42 points to a specific location B1 in memory, marked as 44 in the address space of Figure 2. Therefore, the guard tag B associated with the block of location B containing location B1 is compared with the address tag 40 associated with the target address 42. As shown at the top of Figure 2, the address tag 40 can be determined as a function of selected bits of the target address itself. In particular, the address tag can be determined from bits within a portion of the target address that are not used to indicate a specific memory location selected as the addressed location 44. For example, in some architectures, the upper part of the bits of the target address may always have a certain fixed value, such as sign extension (all 0 or all 1), and therefore the address can be tagged with the address tag 40 by overwriting these unused bits with an arbitrary tag value. A specific address tag value may be selected, for example, by the programmer or compiler. The address tag and guard tag 32 can be relatively small in number of bits, for example, 4 bits, and therefore do not need to occupy much space in memory and at the target address. A 4-bit tag space, i.e., providing 16 possible values ​​for the tag, is often sufficient to detect many common types of memory access errors.

[0067] Therefore, when a tag-protected memory access is performed, the load / store unit 15 compares the address tag 40 with the guard tag 32 associated with the block 30 containing the addressed location 44 to determine if they match. The load / store unit 15 generates a match instruction indicating whether the address tag 40 and the guard tag 32 match. For example, this match instruction could be a fault signal 60 generated if there is a mismatch between the address tag 40 and the guard tag 32, or an instruction placed in a status register indicating whether a match was found, or an entry added to an error report to indicate the address where the error was detected and / or the instruction address of the instruction that triggered the error.

[0068] Figure 3 shows a flowchart for handling tag-protected memory access. The instruction that triggers the memory access may specify an address tag and a target address. As shown in Figure 2, in some cases the address tag may actually be derived from a subset of bits of the target address itself, but in other examples it may be specified in a separate register. In step 50, the instruction that triggers the tag-protected memory access is encountered. In response, in step 52, the memory access circuit 15 triggers a memory access to the addressed location 44 identified by the target address. Also in step 54, the memory access circuit 15 retrieves the guard tag 32 stored in the memory system in relation to the block of memory location 30 containing the addressed location 44 identified by the target address. In step 56, the memory access circuit 15 compares the address tag 40 with the guard tag 32 retrieved in step 54. In step 58, the memory access circuit 15 generates an indication (e.g., one of the types of match / mismatch reporting indications described above) indicating whether a match was found between the guard tag and the address tag. The exact indication used to report any mismatch may vary depending on the implementation.

[0069] Tag Protection Order In systems that perform memory tagging, tagged pointers can be manipulated as integers, which can lead to changes in the tag value. Even if an operation targets only the untagned portion of a pointer, the tag can still be unintentionally affected by an overflow from that operation. While this unintentional change to the tag may have a minor beneficial effect, for example, by highlighting errors in operations performed on address pointers, it also reduces the security benefits of such a system by potentially enabling an attacker to manipulate the tag value. In many systems, this security reduction outweighs any minor benefits that may be offered.

[0070] An example of an operation that may involve manipulating an address pointer is pointer arithmetic, where the pointer is specified as an input operand for an arithmetic operation (e.g., addition, subtraction, multiplication, division, etc.). Note that although the term “pointer arithmetic” is used herein, the processing circuit is typically unaware of the meaning of the operands used in a given operation; that is, a “pointer arithmetic” operation is simply an arithmetic operation to the processing circuit, and the address pointer specified as an input operand is simply an input operand to the processing circuit.

[0071] Most arithmetic operations performed by processing circuits involve addition (for example, even subtraction, multiplication, or division operations can be represented using one or more addition operations). A processing circuit may include an arithmetic logic unit (ALU) for performing arithmetic operations, and the ALU may include an ADD circuit for performing addition operations. An example of an addition operation is shown in Figure 4.

[0072] Figure 4 shows the addition of two 3-bit binary addends 62, namely 0b100 + 0b111 (note that here the prefix "0b." is used to indicate that the following value is a binary value, where the value 0b100 is represented as "4" in decimal and the value 0b111 is "7" in decimal). As shown in Figure 4, even though both addends are 3-bit values, the addition produces a carry value 64 with a non-zero value (in this case, "1") in the higher bit position (i.e., the carry value is a 4-bit value 0b1000). This is because when the third least significant bit 66 is added together (0b1 + 0b1), the result is a 2-bit value (0b10), and therefore "1" is carried to the next most significant bit position. This means that the resulting value 68 is a 4-bit value (0b1011, "11" in decimal). Therefore, carries generated during addition operations can overflow to higher bit positions.

[0073] Figure 5 illustrates how generating a carry value leads to a change in the tag within the address pointer. In particular, Figure 5 represents an addition operation that adds the value "Y" to the address pointer "X" to produce the output "Z". For example, Y could be an offset value added to the base address represented by the address pointer X, but this is just one example of why arithmetic operations can be performed on address pointers.

[0074] As shown in Figure 5, both the address pointer X and the other augment Y have a value of "1" at position 70, which corresponds to the most significant bit of the address portion 72 of pointer X. This means that when augmenters X and Y are added together, a carry is generated that overflows into portion 74 of the resulting value Z, which is the tag portion 40 when Z is used as an address pointer. (Note that this is not the only way to generate such a carry; i.e., bit 70 being "1" in both augmenters is not mandatory.)

[0075] Therefore, even if the addendum Z does not contain any non-zero values ​​in the portion 74 corresponding to the tag portion 40 of the address pointer Y, the carry values ​​generated during addition can still lead to the corresponding portion 74 of the output value Z being different from the tag portion 40 of the input address pointer Y. As mentioned above, this can lead to a decrease in security.

[0076] Arithmetic operations are one example of pointer manipulation operations, but it should be noted that other operations can also be applied to address pointers and modify their tag portions. For example, a logical "OR" operation can be performed on a value that may later be used as an address pointer, and such an operation can also modify the tag. For example, two operands may have the following tag portions: 0b1010 0b0001

[0077] When a logical OR operation is performed on these two operands, the tag portion of the output value will be as follows: 0b1011

[0078] Therefore, in this case, the tag portion of the output value is different from the tag portions of both input operands.

[0079] To prevent the security risks associated with allowing modification of the tag portion of an operand, one can consider providing instructions that operate only on the address portion of the pointer, thereby avoiding tag modification. For example, the operand Y in Figure 5 may be carefully selected so as not to cause an overflow to the resulting portion 74. In such a system, an attempt to set portion 74 (i.e., the portion that becomes the tag portion when the resulting value Z is used as an address pointer) can usually be assumed to be an error and therefore can trigger an error response.

[0080] There are several possibilities for responding to such errors. For example, one possibility is to simply ignore the error. This limits the overhead associated with performing pointer manipulation operations, but does not address security concerns related to modifications to the tag portion.

[0081] Another potential response is to raise a processor exception. However, raising a processor exception can significantly degrade performance, and in this situation, since the result of the operation is used as an address pointer only in a very small number of cases, raising an exception may not be justified.

[0082] Another potential response is to log information about the error in a status register, the contents of which could, for example, be used in debugging. This has a lower performance cost than raising a processor exception, but it can still result in "false positives" (an error is logged even though the result value is not used as an address pointer).

[0083] The improved approach involves triggering an error response by modifying the output value Z and subsequently using the modified value Z' as an address pointer. For example, the processor circuitry detects an overflow into area 74 corresponding to the tag portion and, in response to this detection, generates a modified result value Z' containing some error indicator value. The error indicator value is a value that causes the value Z' to be treated as invalid if it is subsequently used as an address pointer.

[0084] Figure 6 shows an example of an invalid pointer. The modified result value Z' can be set to be invalid, for example, by one of the methods shown in this figure.

[0085] Figure 6 shows an example where the address pointer contains 64 bits. In the valid address pointer 78, these bits can be interpreted as follows: - The lowest 56 bits (bits 55:0) can be interpreted as address bits, which are bits that identify a location in memory. -Bits 59:56 represent a 4-bit address tag. - The upper four bits (bits 63:60) may be used to provide spare bits and / or any other information.

[0086] The processing circuit may modify the value in one of several different ways to represent an invalid address pointer. For example, some implementations of this technique may utilize some of the higher bits and set them to a specific value to indicate that the pointer is invalid. For example, Figure 6 shows an example of an invalid pointer 80 where bits 61:60 are set to the value 0b01. (It should be understood that the value 0b01 for these bits is used as an example, and the exact value used as the error indicator may depend on the implementation.)

[0087] In some exemplary implementations, the tag bit may be set to some specific value to indicate that a pointer is invalid. For example, certain tag values ​​may be reserved to indicate errors, and therefore the tag value may be set to one of those values. For example, Figure 6 shows an example of an invalid pointer 82 with its tag portion set to the value 0b1110. (This is just one example of a value that can be used as an error indicator value.)

[0088] In some exemplary implementations, if not all address bits are required to define addressable memory, the address portion may be set to some non-standard value (e.g., an address guaranteed to cause a failure if accessed). As a specific example, Figure 6 shows an invalid pointer 84 where all address bits are set to zero. Again, this is just one example of a value that could be used as an error indicator. It is fairly common to reserve this address value to provide some alternative information (e.g., indicating an error, as in this example), although other implementations may use a different address value as the error indicator.

[0089] Note that the specific values ​​used as error-generating values ​​in Figure 6 are merely examples, and the specific values ​​used may depend on the specific architecture used by the system. Furthermore, note that some implementations may use some combination of these techniques to force pointers to invalid values.

[0090] Figure 7 is a flowchart illustrating an example of how the processing circuit may perform actions in response to the decoding (86) of a tag protection instruction. The tag protection instruction identifies an input operand, and the processing circuit generates an output value in response to the instruction being decoded by performing an operation on the input operand (88). As mentioned above, this operation could be, for example, an arithmetic operation. However, it will be understood that the operation performed in response to a tag protection instruction could be any operation that has the potential to modify the tag portion of the address pointer.

[0091] The processing circuit also detects whether the operation performed on the input operand involved an attempt to set the value of at least one bit in an identified portion of the output value to a value other than the value at the corresponding bit position in the input operand (90), where the identified portion is the portion of the output value that would be used as the tag portion if the input operand were used as an address pointer in a memory access instruction. If it is determined that no such attempt was made (N), the output operand is returned without modification (92) (for example, it may be recorded in a register). On the other hand, if it is determined that such an attempt was made (Y), the processing circuit sets at least a given portion of the output value to an error indicator value (94) before returning the modified output value (96).

[0092] Figure 8 is a flowchart illustrating an example of how the access control circuit is executed in response to the decoding of a memory access instruction (98). The access control circuit is configured to determine (100) whether the address pointer identified by the memory access instruction is valid when the memory access instruction is decoded. If the pointer is invalid, a pointer error response is executed (102). For example, the error response may include raising an exception or recording a value in the status register. In some cases, after executing the error response (102) (for example, if the response is recording a value in the status register), the method proceeds to step 104. Alternatively, instead of executing steps 104, 103, 105, and 106, the error response may be executed, for example, by raising an exception to stop processing.

[0093] The method in Figure 8 also includes determining a memory address based on an address pointer identified by a memory access instruction (104). Note that this example executes step 104 only if it is determined that the address pointer is valid (Y) (100), but in alternative implementations, it is also possible to execute step 104 before checking whether the address pointer is valid (100).

[0094] This method also includes step 103, which compares a tag value (address tag) determined based on the tag portion of an address pointer with an allocation tag (guard tag) associated with the memory location identified by the determined memory address, and determines whether the comparison results in a given outcome. If the comparison results in a given response (Y), a tag error response is performed (105) (for example, this may be the same as or different from the error response shown above). On the other hand, if it is determined that the comparison does not result in a given outcome (N), the requested data access is performed (105) (provided that other access requirements are met).

[0095] Simulator implementation Figure 9 illustrates possible implementations of simulators. While the above embodiments implement the present invention in terms of devices and methods for operating specific processing hardware that supports the technique, it is also possible to provide an instruction execution environment according to the embodiments described herein, which are implemented using a computer program. Such computer programs are often referred to as simulators, insofar as they provide a software-based implementation of a hardware architecture. Various simulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators.

[0096] Typically, a simulator implementation may run on a host processor 730, optionally running the host operating system 720 and supporting the simulator program 710. In some configurations, multiple layers of simulation may exist between the hardware and the provided instruction execution environment, and / or multiple different instruction execution environments may exist on the same host processor. Historically, powerful processors have been necessary to provide simulator implementations that run at reasonable speeds, but such techniques may be justified in certain situations, such as when it is desirable to run native code on a different processor for compatibility or reuse reasons. For example, a simulator implementation may provide an instruction execution environment with additional functionality not supported by the host processor hardware, or it may provide an instruction execution environment typically associated with a different hardware architecture. An overview of the simulation is provided in "Some Efficient Architecture Simulation Techniques," Robert Bedichek, 1990 Winter USENIX Conference, pp. 53-63.

[0097] While embodiments have been described so far with reference to specific hardware components or features, in simulated embodiments, equivalent functionality may be provided by suitable software components or features. For example, certain circuits may be implemented as computer program logic in simulated embodiments. Similarly, memory hardware such as registers or caches may be implemented as software data structures in simulated embodiments. In arrangements where one or more of the hardware elements referenced in the embodiments described above reside on host hardware (e.g., host processor 730), some simulated embodiments may, if preferred, utilize the host hardware.

[0098] For example, simulator code 710 may include instruction decoding program logic 712 for decoding instructions in target code, and thus instruction decoding program logic may emulate the instruction decoder 6 described above. Simulator code 710 may also include register emulation program logic for emulating the register 14 described above. The simulator program also includes processing program logic 716 for processing instructions in target code 700 (and thus emulating processing circuit 4), as well as access control program logic 718 for emulating access control circuits such as MMU 20.

[0099] The simulator program 710 can be stored on a computer-readable storage medium (which may be a non-temporary medium) and provides a program interface (instruction execution environment) to the target code 700 (which may include an application, operating system, and hypervisor), which is the same as the interface of the hardware architecture modeled by the simulator program 710. Thus, the program instructions of the target code 700, including the memory access instructions and tag protection instructions described above, can be executed from within the instruction execution environment using the simulator program 710, thereby enabling the host computer 730, which does not actually possess the hardware functions of the device 2 described above, to emulate these functions.

[0100] Therefore, the simulator code 710 is an example of a computer program that includes instructions to control the host data processing device to provide an instruction execution environment for executing the target program code when executed by the host data processing device, and the computer program is - Processing program logic for executing data processing operations in response to instructions in target program code, wherein the processing program logic issues a memory access request in response to a memory access instruction that identifies an address pointer, and the request includes a request to access data stored at a memory location identified by a memory address determined based on the address portion of the address pointer. - Access control program logic for performing a tag error response in response to a memory access request, which compares a tag value determined based on the tag portion of an address pointer with the allocation tag associated with the memory location identified by the memory address, and which performs a tag error response in response to a comparison showing a given result. Equipped with, - The processing program logic, in response to a tag protection instruction that identifies the input operand, performs an operation on the input operand to generate an output value. - The processing program logic is configured to detect whether the operation involved an attempt to set the value of at least one bit in an identified portion of the output value to a value other than the value at the corresponding bit position in the input operand. - The processing program logic is configured to set at least a given portion of the output value to an error indicator value in response to detecting that the operation involved an attempt to set the value of at least one bit in an identified portion of the output value to a value other than the value at the corresponding bit position in the input operand. - The identified portion is the part of the output value that is used as the tag portion when the output operand is used as an address pointer for a memory access instruction.

[0101] In this application, the phrase "configured to..." is used to mean that an element of the device has a configuration that enables it to perform a defined operation. In this context, "configuration" means the arrangement or interconnection of hardware or software. For example, the device may have dedicated hardware to provide the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured to" does not mean that an element of the device must be modified in any way to provide the defined operation.

[0102] Furthermore, the phrase "including at least one of..." in this application is used to mean that any one of the following options or any combination of the following options is included. For example, "at least one of A, B, and C" is intended to mean A or B or C or any combination of A, B and C (e.g., A and B or A and C or B and C).

[0103] While illustrative embodiments of the present invention are described in detail herein with reference to the accompanying drawings, it will be understood that the present invention is not limited to those exact embodiments, and that various changes and modifications can be made to the embodiments without departing from the scope of the present invention as defined by the appended claims.

Claims

1. It is a device, A processing circuit for executing data processing operations in response to an instruction, The processing circuit includes a processing circuit that, in response to a memory access instruction that identifies an address pointer, issues a memory access request that includes a request to access data stored at a memory location identified by a memory address determined based on the address portion of the address pointer, An access control circuit for performing a tag error response in response to the memory access request, which compares a tag value determined based on the tag portion of the address pointer with an allocation tag associated with the memory location identified by the memory address, and for performing a tag error response in response to the comparison which shows a given result. Equipped with, The processing circuit, in response to a tag protection command that identifies an input operand, performs calculations with respect to the input operand to generate an output value. The processing circuit is configured to detect whether the calculation involved an attempt to set the value of at least one bit in the identified portion of the output value to a value other than the value at the corresponding bit position in the input operand. The processing circuit is configured to set at least a given portion of the output value to an error indicator value in response to detecting that the calculation included an attempt to set the value of at least one bit in the identified portion of the output value to a value other than the value at the corresponding bit position in the input operand. The identified portion is the portion of the output value that is used as the tag portion when the output operand is used as the address pointer for the memory access instruction. Device.

2. The access control circuit, in response to the memory access instruction, identifies the operand containing the error instruction value as the address pointer and triggers a pointer error response. The apparatus according to claim 1.

3. The processing circuit determines whether the operand identified by the memory access instruction includes the error instruction value. The current operating mode of the processing circuit, The operands, and A value generated using at least a portion of the operands, It is configured to detect by relying on at least one of the following: The apparatus according to claim 2.

4. The aforementioned pointer error response is: To cause an exception, and Record the error instruction in the status register. Including at least one of the following: The apparatus according to claim 2 or claim 3.

5. The given portion includes the identified portion, The apparatus according to any one of claims 1 to 4.

6. The aforementioned given portion includes an address identification portion, and The processing circuit, in response to the memory access instruction, identifies the output value as the address pointer and treats the address identification portion of the output value as the address portion. The apparatus according to any one of claims 1 to 5.

7. The given portion of the output address pointer includes the error indicator field of the output value. The apparatus according to any one of claims 1 to 6.

8. The processing circuit controls the value of the given portion of the output value. The current operating mode of the processing circuit, The aforementioned input operands, and The aforementioned output value, It is configured to depend on at least one of the following: The apparatus according to any one of claims 1 to 7.

9. The aforementioned operation includes arithmetic operations, The apparatus according to any one of claims 1 to 8.

10. The aforementioned arithmetic operations include operations involving addition. The processing circuit is configured to detect that the carry value generated during the addition includes a non-zero value at the corresponding bit position, as an attempt to set the value of at least one bit in the identified portion of the output value to a value other than the value at the corresponding bit position in the input operand. The apparatus according to claim 9.

11. The processing circuit, in response to a further tag protection command, identifies the output value obtained from the tag protection command as a further input operand, performs further calculations on the output value to generate a further output value, The processing circuit is configured to detect whether the output value includes the error instruction value. The processing circuit is configured to perform an error response in response to detecting that the output value includes the error instruction value. The apparatus according to any one of claims 1 to 10.

12. It is a method, Executing data processing operations in response to commands, In response to a memory access instruction that identifies an address pointer, a memory access request is issued that includes a request to access data stored at a memory location identified by a memory address determined based on the address portion of the address pointer. In response to the memory access request, the tag value determined based on the tag portion of the address pointer is compared with the allocation tag associated with the memory location identified by the memory address, and in response to the comparison showing a given result, a tag error response is performed. In response to a tag protection command that identifies an input operand, the system performs an operation on the input operand to generate an output value, The operation involves detecting whether the operation included an attempt to set the value of at least one bit in the identified portion of the output value to a value other than the value at the corresponding bit position in the input operand. In response to detecting that the calculation included an attempt to set the value of at least one bit in the identified portion of the output value to a value other than the value at the corresponding bit position in the input operand, set at least a given portion of the output value to an error indicator value, Includes, The identified portion is the portion of the output value that is used as the tag portion when the output operand is used as the address pointer for the memory access instruction. method.

13. A computer program that includes instructions to control the host data processing device to provide an instruction execution environment for executing target program code when executed by the host data processing device, wherein the computer program A processing program logic for executing data processing operations in response to instructions in the target program code, The processing program logic includes, in response to a memory access instruction that identifies an address pointer, a processing program logic that issues a memory access request that includes a request to access data stored at a memory location identified by a memory address determined based on the address portion of the address pointer, Access control program logic for performing a tag error response in response to the memory access request, which compares a tag value determined based on the tag portion of the address pointer with the allocation tag associated with the memory location identified by the memory address, and for performing a tag error response in response to the comparison which shows a given result. Equipped with, The processing program logic, in response to a tag protection instruction that identifies an input operand, performs an operation on the input operand to generate an output value. The processing program logic is configured to detect whether the operation involved an attempt to set the value of at least one bit in the identified portion of the output value to a value other than the value at the corresponding bit position in the input operand. The processing program logic is configured to set at least a given portion of the output value to an error indicator value in response to detecting that the calculation included an attempt to set the value of at least one bit in the identified portion of the output value to a value other than the value at the corresponding bit position in the input operand. The identified portion is the portion of the output value that is used as the tag portion when the output operand is used as the address pointer for the memory access instruction. Computer program.

14. A computer-readable storage medium for storing the computer program described in claim 13.

15. A computer-readable medium for storing computer-readable codes for the manufacture of the apparatus according to any one of claims 1 to 11.

Images