Technique for constraining access to memory using capabilities

A method comprising:

• employing processing circuitry to generate, during operations, memory addresses for access requests to memory using capabilities that identify constraining information;
• employing capability checking circuitry to perform a capability check operation to determine whether a given access request whose memory address is generated using a given capability is permitted based on given constraining information identified by the given capability, the capability check operation including performing a range check based on range constraining information provided by the given constraining information;
• and
• when a determined condition is met, arranging the capability checking circuitry to perform the range check in dependence on both the range constraining information and an item of state information of the apparatus which varies dynamically during performance of the operations of the processing circuitry,
• wherein:
• the item of state information is a pointer value that points to a location within a region of memory;
• and
• when the determined condition is met, the range check is performed based on a first bound derived from the range constraining information and a second bound derived from whichever of the range constraining information and the pointer value results in the second bound being more restrictive.

A computer program for controlling a host data processing apparatus to provide an instruction execution environment, comprising:

• processing program logic to perform operations during which access requests to memory are generated, wherein the processing program logic is arranged to generate memory addresses for the access requests using capabilities that identify constraining information;
• and
• capability checking program logic to perform a capability check operation to determine whether a given access request whose memory address is generated using a given capability is permitted based on given constraining information identified by the given capability, the capability check operation including performing a range check based on range constraining information provided by the given constraining information;
• wherein:
• the capability checking program logic is further configured, when a determined condition is met, to perform the range check in dependence on both the range constraining information and an item of state information of the apparatus which varies dynamically during performance of the operations of the processing program logic;
• the item of state information is a pointer value that points to a location within a region of memory;
• and
• the capability checking program logic is further configured, when the determined condition is met, to perform the range check based on a first bound derived from the range constraining information and a second bound derived from whichever of the range constraining information and the pointer value results in the second bound being more restrictive.