# US 2020/0401441 A1 · Masking of architectural state associated with a realm > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0401441 A1 - Document ID: US20200401441A1 - Status: Published application - Kind: A1 - Application number: 16/623,569 - Filed: 2018-06-11 - Published: 2020-12-24 - Earliest claimed: 2017-06-28 - Assignees: Arm Limited - Applicants: Arm Limited - Inventors: Matthew Lucien EVANS; Jason PARKER; Gareth Rhys STOCKWELL; Martin WEIDMANN - Web page: https://patentgrep.com/patent/US20200401441A1 ## CPC - G06F 9/4812: {by interrupt, e.g. masked} - G06F 9/30098: {Register arrangements} - G06F 9/461: {Saving or restoring of program or task context} - G06F 12/1425: {the protection being physical, e.g. cell, word, block} - G06F 12/1491: {in a hierarchical protection system, e.g. privilege levels, memory rings} - G06F 2209/481: Exception handling - G06F 2212/1052: Security improvement - G06F 2212/152: Virtualized environment, e.g. logically partitioned system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Processing circuitry (8) processes software processes at one of a plurality of exception levels and in one of a plurality of realms, each realm corresponding to a portion of at least one software process and being associated with a boundary exception level indicating a most privileged exception level at which the realm can be processed by the processing circuitry (8). In response to a realm exiting exception condition during processing of a given realm, where the exception condition is to be handled by an exception handler at a more privileged exception level than the boundary exception level of the given realm, the processing circuitry (8) performs state masking to make inaccessible, to software processes processed at a more privileged exception level than the boundary exception level, architectural state of a subset of registers selected depending on the boundary exception level of the given realm. ## Claims ### Claim 1 An apparatus comprising: processing circuitry configured to process software processes at one of a plurality of exception levels and in one of a plurality of realms, where each realm corresponds to at least a portion of at least one software process and is associated with a boundary exception level indicative of a most privileged exception level corresponding to the realm; and a plurality of registers to store architectural state data; wherein in response to a realm-exiting exception condition occurring during processing of a given realm, the realm-exiting exception condition comprising an exception condition to be handled by an exception handler at a more privileged exception level than the boundary exception level of the given realm, the processing circuitry is configured to trigger a state masking process for making inaccessible, to software processes processed at a more privileged exception level than the boundary exception level, architectural state data of a subset of registers selected depending on the boundary exception level of the given realm. ### Claim 2 (depends on 1) The apparatus according to claim 1, comprising memory access circuitry to enforce ownership rights for a plurality of memory regions, wherein a given memory region is associated with an owner realm specified from among the plurality of realms, the owner realm having a right to prevent access to the given memory region by a software process processed at a more privileged exception level than the owner realm. ### Claim 3 (depends on 1) The apparatus according to claim 1, wherein the state masking process comprises triggering saving the architectural state data of the subset of registers to memory. ### Claim 4 (depends on 1) The apparatus according to claim 1, wherein the processing circuitry is configured to commence processing of the exception handler while at least part of the architectural state data of the subset of registers is still stored in the registers. ### Claim 5 (depends on 1) The apparatus according to claim 1, wherein the state masking process comprises a register scrubbing operation for said subset of registers, to ensure that a subsequent read access to a given register of said subset of registers, performed by the processing circuitry without an intervening write access to the given register between the realm-exiting exception condition and the subsequent read access, returns a predetermined value for the given register. ### Claim 6 (depends on 1) The apparatus according to claim 1, wherein in response to an exception return to said given realm, the processing circuitry is configured to restore access to previously masked architectural state data of said subset of registers. ### Claim 7 (depends on 1) The apparatus according to claim 1, wherein each exception level is associated with a corresponding group of registers accessible to the processing circuitry when processing a software process at that exception level. ### Claim 8 (depends on 7) The apparatus according to claim 7, wherein for a given exception level other than a least privileged exception level, the group of registers accessible at the given exception level includes the group of registers accessible at a less privileged exception level than the given exception level. ### Claim 9 (depends on 1) The apparatus according to claim 1, wherein each realm other than a root realm is a child realm having a corresponding parent realm which initialised the child realm. ### Claim 10 (depends on 9) The apparatus according to claim 9, wherein when the realm-exiting exception condition is to be handled by an exception handler within the parent realm of the given realm, said subset of registers comprises a group of registers accessible to the processing circuitry at the boundary exception level of the given realm. ### Claim 11 (depends on 9) The apparatus according to claim 9, wherein when the exception condition is to be processed by an exception handler at a target exception level more privileged than the boundary exception level of the parent realm of said given realm, the processing circuitry is configured to trigger a nested realm exit comprising a plurality of successive realm exits from child realm to parent realm, until a target realm is reached having a boundary exception level corresponding to the target exception level or a more privileged exception level than the target exception level. ### Claim 12 (depends on 11) The apparatus according to claim 11, wherein the processing circuitry is configured to trigger a respective state masking process for each of the plurality of successive realm exits from child realm to parent realm during the nested realm exit, each respective state masking process for masking a corresponding subset of registers selected depending on the boundary exception level of the child realm. ### Claim 13 (depends on 12) The apparatus according to claim 12, wherein for a realm exit from a given child realm having a boundary exception level other than a least privileged exception level, said corresponding subset of registers comprises at least one register accessible to the processing circuitry at the boundary exception level of the given child realm, excluding at least one register accessible to the processing circuitry at a less privileged exception level than the boundary exception level of the given child realm. ### Claim 14 (depends on 11) The apparatus according to claim 11, wherein in response to a realm exit to an intermediate realm encountered between the given realm and the target realm during the nested realm exit, the processing circuitry is configured to set a status value associated with the intermediate realm to a predetermined value. ### Claim 15 (depends on 14) The apparatus according to claim 14, wherein in response to an exception return to a particular realm having a boundary exception level other than a least privileged exception level, the processing circuitry is configured to restore access to architectural state associated with the particular realm for a subset of registers selected in dependence on said status value and the boundary exception level of the particular realm. ### Claim 16 (depends on 15) The apparatus according to claim 15, wherein when the status value has a value other than said predetermined value, the subset of registers comprises the registers accessible to the processing circuitry at the boundary exception level of the particular realm. ### Claim 17 (depends on 15) The apparatus according to claim 15, wherein when the status value has said predetermined value, the subset of registers comprises at least one register accessible to the processing circuitry at the boundary exception level of the particular realm, excluding at least one register accessible to the processing circuitry at a less privileged exception level than the boundary exception level of the particular realm. ### Claim 18 (depends on 1) The apparatus according to claim 1, wherein when the realm-exiting exception condition comprises a voluntary-realm-exiting exception condition triggered by the given realm, the processing circuitry is configured to suppress said state masking process. ### Claim 19 (depends on 1) The apparatus according to claim 1, wherein each realm is associated with a realm descriptor indicative of properties of the realm, including the boundary exception level for the realm. ### Claim 20 (depends on 1) The apparatus according to claim 1, wherein the processing circuitry is configured to support a realm comprising software processes executed at a plurality of different exception levels. ### Claim 21 (canceled) ### Claim 22 A data processing method comprising: processing software processes at one of a plurality of exception levels and in one of a plurality of realms, where each realm corresponds to at least a portion of at least one software process and is associated with a boundary exception level indicative of a most privileged exception level corresponding to the realm; and storing architectural state data in a plurality of registers; wherein in response to a realm-exiting exception condition occurring during processing of a given realm, the realm-exiting exception condition comprising an exception condition to be handled by an exception handler at a more privileged exception level than the boundary exception level of the given realm, triggering a state masking process for making inaccessible, to software processes processed at a more privileged exception level than the boundary exception level, architectural state data of a subset of registers selected depending on the boundary exception level of the given realm. ### Claim 23 A non-transitory storage medium storing a computer program for controlling a host data processing apparatus to provide an instruction execution environment comprising: processing program logic configured to process software processes in the instruction execution environment at one of a plurality of exception levels and in one of a plurality of realms, where each realm corresponds to at least a portion of at least one software process and is associated with a boundary exception level indicative of a most privileged exception level corresponding to the realm; and a plurality of data structures to store architectural register state data; wherein in response to a realm-exiting exception condition occurring in the instruction execution environment during processing of a given realm, the realm-exiting exception condition comprising an exception condition to be handled by an exception handler at a more privileged exception level than the boundary exception level of the given realm, the processing program logic is configured to trigger a state masking process for making inaccessible, to software processes processed at a more privileged exception level than the boundary exception level, architectural register state data of a subset of data structures selected depending on the boundary exception level of the given realm. ### Claim 24 (canceled)