# US 2024/0202139 A1 · Technique for constraining access to memory using capabilities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2024/0202139 A1 - Document ID: US20240202139A1 - Status: Published application - Kind: A1 - Application number: 18/556,477 - Filed: 2022-02-17 - Published: 2024-06-20 - Earliest claimed: 2021-05-04 - Assignees: Arm Limited - Applicants: Arm Limited - Inventors: François Christopher Jacques Botman; Thomas Christopher Grocutt; Bradley John Smith - Web page: https://patentgrep.com/patent/US20240202139A1 ## CPC - G06F 12/1441: {for a range} - G06F 12/1458: {by checking the subject access rights} - G06F 12/1491: {in a hierarchical protection system, e.g. privilege levels, memory rings} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 12/0284: {Multiple user address space allocation, e.g. using different base addresses (interprocessor communication G06F15/163)} - G06F 12/1036: for multiple virtual address spaces, e.g. segmentation (G06F12/1045 takes precedence) - G06F 12/145: {the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism} - G06F 2212/1016: Performance improvement - G06F 2212/1052: Security improvement - G06F 2212/151: Emulated environment, e.g. virtual machine - G06F 2212/502: using adaptive policy - G06F 2212/657: Virtual address space management - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract There is provided an apparatus, method and computer program for constraining memory accesses. The apparatus comprises processing circuitry to perform operations during which access requests to memory are generated. The processing circuitry is arranged to generate memory addresses for the access requests using capabilities that identify constraining information. The apparatus further comprises capability checking circuitry to perform a capability check operation to determine whether a given access request whose memory address is generated using a given capability is permitted based on given constraining information identified by the given capability. The capability check operation includes performing a range check based on range constraining information provided by the given constraining information, and when a determined condition is met, to perform the range check in dependence on both the range constraining information and an item of state information of the apparatus which varies dynamically during performance of the operations of the processing circuitry. ## Claims ### Claim 1 An apparatus comprising: processing circuitry to perform operations during which access requests to memory are generated, wherein the processing circuitry is arranged to generate memory addresses for the access requests using capabilities that identify constraining information; and capability checking circuitry to perform a capability check operation to determine whether a given access request whose memory address is generated using a given capability is permitted based on given constraining information identified by the given capability, the capability check operation including performing a range check based on range constraining information provided by the given constraining information; wherein the capability checking circuitry is further configured, when a determined condition is met, to perform the range check in dependence on both the range constraining information and an item of state information of the apparatus which varies dynamically during performance of the operations of the processing circuitry. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the item of state information is a pointer value that points to a location within a region of memory. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein the pointer value is a stack pointer value and the region of memory is configured to be used as a stack. ### Claim 4 (depends on 2) The apparatus of claim 2, wherein the capability checking circuitry is further configured, when the determined condition is met, to perform the range check based on a first bound derived from the range constraining information and a second bound derived from whichever of the range constraining information and the pointer value results in the second bound being more restrictive. ### Claim 5 (depends on 4) The apparatus of claim 4, wherein the capability checking circuitry is further configured to permit the memory access when the memory address is within an allowable region of memory bounded between the first bound and the second bound. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the capability checking circuitry is configured to determine that the determined condition is met when the given capability is of a determined type. ### Claim 7 (depends on 6) The apparatus of claim 6, wherein the given constraining information of the given capability comprises dynamic check indication metadata to indicate whether the given capability is of the determined type. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the dynamic check indication metadata comprises a dedicated metadata field within the given capability. ### Claim 9 (depends on 6) The apparatus of claim 6, wherein the given capability is of the determined type when the given capability references a further capability of a specified type. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein: the given constraining information is arranged to provide capability indication metadata to identify the further capability; and the further capability is arranged to provide an associated pointer value and associated constraining information, and the associated pointer value forming the item of state information. ### Claim 11 (depends on 10) The apparatus of claim 10 wherein: the further capability is a stack pointer capability; the processing circuitry has multiple operating modes each having a corresponding associated stack in memory with a corresponding stack pointer capability; and the capability indication metadata is arranged to provide stack pointer indication metadata to identify which corresponding stack pointer capability forms the item of state information. ### Claim 12 (depends on 10) The apparatus of claim 10, wherein: the constraining information of each capability comprises a first subset of permission bits and a second subset of permission bits; and when the given capability is of the determined type, the first subset of permission bits are repurposed to provide the capability indication metadata. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the capability checking circuitry is configured, when the given capability is of the determined type, to determine permissions of the given capability from the second subset of permission bits and a set of inferred first permission bits. ### Claim 14 (depends on 13) The apparatus as claimed in claim 13, wherein the set of inferred first permission bits are determined by values of equivalent permission bits provided by the further capability of the specified type. ### Claim 15 (depends on 12) The apparatus of claim 12, wherein the first subset of permission bits comprises a read permission bit indicating whether a given pointer value provided by the given capability is allowed to be used to generate a memory address for a data item to be read, and an execute permission bit indicating whether the given pointer value provided by the given capability is allowed to be used to generate a memory address for an instruction to be fetched for execution by the processing circuitry. ### Claim 16 (depends on 9) The apparatus of claim 9, wherein: the constraining information of the further capability of the specified type comprises dynamic check indication metadata set to indicate that that further capability is of the determined type; the apparatus further comprises capability generation circuitry to generate derived capabilities from existing capabilities; and the capability generation circuitry is arranged, when a derived capability is generated from the further capability, to cause the dynamic check indication metadata for that derived capability to be inherited from the further capability. ### Claim 17 (depends on 9) The apparatus of claim 9, further comprising: capability generation circuitry to generate derived capabilities from existing capabilities; and the capability generation circuitry is arranged, when a derived capability is generated, to cause that derived capability to have dynamic check indication metadata set in dependence on whether that derived capability is derived from the further capability of the specified type. ### Claim 18 (depends on 1) The apparatus of claim 1, wherein the capability checking circuitry is configured to, when the determined condition is met, perform a lookup, based on the given constraining information, in a lookup table associating a subset of capabilities with metadata and, when the lookup hits in the lookup table, to determine the item of state information based on the metadata. ### Claim 19 (canceled) ### Claim 20 (canceled) ### Claim 21 (canceled) ### Claim 22 A method comprising: employing processing circuitry to generate, during operations, memory addresses for access requests to memory using capabilities that identify constraining information; employing capability checking circuitry to perform a capability check operation to determine whether a given access request whose memory address is generated using a given capability is permitted based on given constraining information identified by the given capability, the capability check operation including performing a range check based on range constraining information provided by the given constraining information; and when a determined condition is met, arranging the capability checking circuitry to perform the range check in dependence on both the range constraining information and an item of state information of the apparatus which varies dynamically during performance of the operations of the processing circuitry. ### Claim 23 A computer program for controlling a host data processing apparatus to provide an instruction execution environment, comprising: processing program logic to perform operations during which access requests to memory are generated, wherein the processing program logic is arranged to generate memory addresses for the access requests using capabilities that identify constraining information; and capability checking program logic to perform a capability check operation to determine whether a given access request whose memory address is generated using a given capability is permitted based on given constraining information identified by the given capability, the capability check operation including performing a range check based on range constraining information provided by the given constraining information; wherein the capability checking program logic is further configured, when a determined condition is met, to perform the range check in dependence on both the range constraining information and an item of state information of the apparatus which varies dynamically during performance of the operations of the processing program logic.