Technique for handling sealed capabilities
An apparatus and method are described for handling sealed capabilities. The apparatus has processing circuitry to perform processing operations during which access requests to memory are generated, wherein the processing circuitry is arranged to generate memory addresses for the access requests using capabilities that identify constraining information. Checking circuitry then determines whether a given access request whose memory address is generated using a given capability is permitted based on the constraining information identified by that given capability, and based on a level of trust associated with the given access request. Each capability has a capability level of trust associated therewith, and the level of trust associated with the given access request is dependent on both a current mode level of trust associated with a current mode of operation of the processing circuitry, and the capability level of trust of the given capability. At least one of the capabilities is settable as a sealed capability, and the apparatus further comprises sealed capability handling circuitry to prevent the processing circuitry performing at least one processing operation using a given sealed capability when the current mode level of trust is a lower level of trust than the capability level of trust of the given sealed capability.
1 . An apparatus comprising:
processing circuitry to perform processing operations during which access requests to memory are generated, wherein the processing circuitry is arranged to generate memory addresses for the access requests using capabilities that identify constraining information; and
checking circuitry to determine whether a given access request whose memory address is generated using a given capability is permitted based on the constraining information identified by that given capability, and based on a level of trust associated with the given access request;
wherein:
each capability has a capability level of trust associated therewith, and the level of trust associated with the given access request is dependent on both a current mode level of trust associated with a current mode of operation of the processing circuitry, and the capability level of trust of the given capability;
at least one of the capabilities is settable as a sealed capability; and
the apparatus further comprises sealed capability handling circuitry to prevent the processing circuitry performing at least one processing operation using a given sealed capability when the current mode level of trust is a lower level of trust than the capability level of trust of the given sealed capability.
2 . The apparatus as claimed in claim 1 , wherein:
each capability has a sealed flag associated therewith, and
the sealed capability handling circuitry is responsive to a seal request for a chosen capability to determine whether to set the sealed flag of the chosen capability to identify the chosen capability as a sealed capability, dependent on a comparison of the capability level of trust of the chosen capability with the current mode level of trust.
3 . The apparatus as claimed in claim 2 , wherein the sealed capability handling circuitry is arranged, in response to the seal request, to inhibit setting the sealed flag when the capability level of trust of the chosen capability is greater than the current mode level of trust.
4 . The apparatus as claimed in claim 3 , wherein the sealed capability handling circuitry is arranged, in response to the seal request, to set the sealed flag when the capability level of trust of the chosen capability matches the current mode level of trust.
5 . The apparatus as claimed in claim 1 , wherein each capability has a sealed flag associated therewith that is settable to indicate that capability as a sealed capability, and the sealed capability handling circuitry is responsive to an unseal request for a chosen sealed capability to inhibit clearing of the sealed flag of the chosen sealed capability when the capability level of trust of the chosen sealed capability is greater than the current mode level of trust.
6 . The apparatus as claimed in claim 5 , wherein the sealed capability handling circuitry is arranged, in response to the unseal request, to clear the sealed flag when the capability level of trust of the chosen sealed capability matches the current mode level of trust.
7 . The apparatus as claimed in claim 1 , wherein the sealed capability handling circuitry is arranged, when the current mode level of trust is a lower level of trust than the capability level of trust of the given sealed capability, to prevent the processing circuitry performing any of a plurality of processing operations using the given sealed capability, but to allow moving of the given sealed capability between storage elements.
8 . The apparatus as claimed in claim 1 , wherein the sealed capability handling circuitry is arranged to require the given sealed capability to be unsealed before that capability is allowed to be used by the processing circuitry in subsequent processing operations, irrespective of the current mode level of trust.
9 . The apparatus as claimed in claim 1 , wherein the sealed capability handling circuitry is arranged, at least when the current mode level of trust is the same as the capability level of trust of the given sealed capability, to allow the processing circuitry to perform one or more processing operations using the given sealed capability without unsealing the given sealed capability.
10 . The apparatus as claimed in claim 9 , wherein the sealed capability handling circuitry is arranged to allow the one or more processing operations to be performed using the given sealed capability, provided the current mode level of trust is the same as, or greater than, the capability level of trust of the given sealed capability.
11 . The apparatus as claimed in claim 9 , wherein the one or more processing operations allowed to be performed comprises at least one of: a dereferencing operation to generate a memory address using the given sealed capability; and/or a capability modifying operation to modify information identified by the given sealed capability.
12 . The apparatus as claimed in claim 1 , wherein:
the processing circuitry is arranged to execute program code in one of a plurality of states comprising at least a privileged state and an unprivileged state, and
the current mode level of trust is dependent on which of the plurality of states the current program code is executed in.
13 . The apparatus as claimed in claim 1 , wherein;
the processing circuitry is arranged to execute program code in one of a plurality of security domains comprising at least a secure domain and a less secure domain, and
the current mode level of trust is dependent on which of the plurality of security domains the current program code is executed in.
14 . The apparatus as claimed in claim 1 , further comprising: a set of capability registers; and memory circuitry to store one or more capabilities;
wherein:
the processing circuitry is arranged to perform a load operation to load a chosen capability from the memory circuitry into a selected capability register from the set of capability registers in which capabilities are stored for reference by the processing circuitry; and
the processing circuitry is arranged, during the load operation, to selectively modify the capability level of trust such that the chosen capability as stored into the selected capability register has a capability level of trust constrained not to exceed the current mode level of trust or the capability level of trust of the chosen capability as stored in the memory circuitry; and
the processing circuitry is further arranged, when the chosen capability is a sealed capability, to inhibit modification of the capability level of trust during the load operation.
15 . The apparatus as claimed in claim 1 , wherein:
each capability has a sealed flag associated therewith that is settable to indicate that capability as a sealed capability, and
the sealed capability handling circuitry is responsive to an unseal request for a chosen sealed capability to inhibit clearing of the sealed flag of the chosen sealed capability when the capability level of trust of the chosen sealed capability is greater than the current mode level of trust; and
the sealed capability handling circuitry is arranged to generate outcome information indicative of an outcome of processing the unseal request for the chosen sealed capability.
16 . The apparatus as claimed in claim 15 , wherein the sealed capability handling circuitry is arranged to generate the outcome information by setting one or more status flags accessible to the processing circuitry.
17 . The apparatus as claimed in claim 1 , wherein the sealed capability handling circuitry is arranged to inhibit unsealing of at least one predetermined type of capability irrespective of the current mode level of trust.
18 . The apparatus as claimed in claim 1 , wherein the level of trust associated with the given access request is constrained to be whichever of the current mode level of trust and the capability level of trust represents a lower level of trust.
19 . A method of handling sealed capabilities, comprising:
employing processing circuitry to perform processing operations during which access requests to memory are generated, wherein the processing circuitry generates memory addresses for the access requests using capabilities that identify constraining information; and
employing checking circuitry to perform determining whether a given access request whose memory address is generated using a given capability is permitted based on the constraining information identified by that given capability, and based on a level of trust associated with the given access request;
wherein:
each capability has a capability level of trust associated therewith, and the level of trust associated with the given access request is dependent on both a current mode level of trust associated with a current mode of operation of the processing circuitry, and the capability level of trust of the given capability; and
at least one of the capabilities is settable as a sealed capability; and
the method further comprises employing sealed capability handling circuitry to prevent the processing circuitry performing at least one processing operation using a given sealed capability when the current mode level of trust is a lower level of trust than the capability level of trust of the given sealed capability.
20 . A non-transitory computer-readable storage medium storing a computer program for controlling a host data processing apparatus to provide an instruction execution environment, comprising:
processing program logic to perform processing operations during which access requests to memory are generated, wherein the processing program logic is arranged to generate memory addresses for the access requests using capabilities that identify constraining information; and
checking program logic to determine whether a given access request whose memory address is generated using a given capability is permitted based on the constraining information identified by that given capability, and based on a level of trust associated with the given access request;
wherein:
each capability has a capability level of trust associated therewith, and the level of trust associated with the given access request is dependent on both a current mode level of trust associated with a current mode of operation of the processing program logic, and the capability level of trust of the given capability;
at least one of the capabilities is settable as a sealed capability; and
the apparatus further comprises sealed capability handling program logic to prevent the processing program logic performing at least one processing operation using a given sealed capability when the current mode level of trust is a lower level of trust than the capability level of trust of the given sealed capability.