Access control for processor registers based on execution domains
Systems, apparatuses, and methods related to a processor having configurable permission data for controlling access to a register of the processor from instructions running in different domains are described. Instructions can be used in predefined execution domains, such as hypervisor, operating system, application, etc. Different permission bits can be set for instructions running in different domains. In response to an instruction executed in the processor generates a request to access the register, the processor is configured to determine whether to accept or reject the request based on a permission bit provided in the permission data corresponding to an execution domain in which the instruction is running.
1. A method, comprising:
storing a set of permission bits for a plurality of predefined domains and for a register of a processor in a set of permission registers, wherein each of the plurality of predefined domains has its own corresponding permission register in the set of permission registers, and wherein each corresponding permission register is accessible only to a predefined domain of the plurality of predefined domains to which the respective corresponding permission register is associated, wherein the plurality of predefined domains comprises at least one of each of a domain for hypervisor, a domain for operating system, and a domain for application;
receiving, in the processor, a first request to access the register during a first execution of a first set of instructions;
identifying, among the plurality of predefined domains, a first execution domain that contains the first execution of the first set of instructions;
retrieving, from a first permission register of the set of permission registers, a first permission bit corresponding to the first execution domain; and
controlling, by the processor and based on the first permission bit, the first request to access the register;
receiving, in the processor, a second request to access the register during a second execution of a second set of instructions;
identifying, among the plurality of predefined domains, a second execution domain that contains the second execution of the second set of instructions;
retrieving, from a second permission register of the set of permission registers, a second permission bit corresponding to the second execution domain; and
controlling, by the processor and based on the second permission bit, the second request to access the register.
2. The method of claim 1 , wherein the storing comprises:
storing the set of permission bits in a predefined portion of a second register of the processor.
3. The method of claim 2 , wherein the first request to access the register is controlled for a type of operations based at least in part on a value of the permission bit corresponding to the first execution domain.
4. The method of claim 3 , wherein the type comprises at least one of read, write, or execution, or a combination thereof.
5. A computer processor, comprising:
at least one privileged register;
at least one execution unit; and
a plurality of permission registers each configured to store permission data corresponding to the privileged register and one of a plurality of predefined domains of instruction execution, wherein each one of the plurality of permission registers is accessible by only a single one of the plurality of predefined domains, wherein the plurality of predefined domains comprises at least one of each of a domain for hypervisor, a domain for operating system, and a domain for application;
wherein the computer processor is configured to control a request to access the privileged register based on a permission bit in the permission data corresponding to a domain in which an instruction is being executed in the computer processor to generate the request, and
wherein the plurality of predefined domains comprises instructions for execution of all stored in a single memory that are executable based on the permission data in the plurality of permission registers permissions.
6. The computer processor of claim 5 , wherein the at least one privileged register includes a plurality of privileged registers; and the at least one permission register has a plurality of portions storing permission data for the plurality of privileged registers respectively.