Capability-generating address calculating instruction

1. An apparatus comprising:

processing circuitry hardware to perform data processing;

instruction decoder hardware to decode instructions to control the processing circuitry hardware to perform the data processing; and

a plurality of capability registers including a result capability register, each capability register to store a capability comprising a pointer and constraint metadata for constraining valid use of the pointer or the capability, the capability registers including a program counter capability register for which the pointer represents a program counter address indicative of a current point of program flow; in which:

in response to a capability-generating address calculating instruction specifying an offset value the instruction decoder hardware is configured to control the processing circuitry hardware to:

select a reference capability register as one of the program counter capability register and a further capability register; and

write to the result capability register a result capability for which the pointer of the result capability indicates a window address identifying a selected window within an address space, where a window comprises a contiguous block of addresses of a predetermined size, the selected window is offset from a reference window by a number of windows determined based on the offset value specified by the capability-generating address calculating instruction, and the reference window comprises the window which comprises an address indicated by the pointer of the reference capability register.

2. The apparatus according to claim 1 , in which the processing circuitry hardware has a capability mode and a non-capability mode, and

the capability-generating address calculating instruction comprises an address calculating instruction processed by the processing circuitry hardware in the capability mode.

3. The apparatus according to claim 1 , in which the instruction decoder hardware is configured to control the processing circuitry hardware to select whether the reference capability register is the program counter capability register or the further capability register based on a selection parameter specified by an instruction encoding of the capability-generating address calculating instruction.

4. The apparatus according to claim 3 , in which:

the processing circuitry hardware has a capability mode and a non-capability mode,

the capability-generating address calculating instruction comprises an address calculating instruction processed by the processing circuitry hardware in the capability mode or the non-capability mode;

in response to the address calculating instruction processed by the processing circuitry hardware in the non-capability mode, the instruction decoder hardware is configured to control the processing circuitry hardware to write to a destination register an integer window address determined based on the offset value relative to a window address of a window including a non-capability program counter address; and

for the address calculating instruction processed by the processing circuitry hardware in the capability mode, the selection parameter is encoded using a bit of an instruction encoding of the address calculating instruction which, in the non-capability mode, represents a most significant bit of the offset value.

5. The apparatus according to claim 1 , in which the constraint metadata specifies an allowable range for the pointer; and

in response to the capability-generating address calculating instruction, the instruction decoder hardware is configured to control the processing circuitry hardware to:

select the program counter capability register as the reference capability register when a program-counter-relative address is within the allowable range specified by the constraint metadata of the program counter capability register, the program-counter-relative address corresponding to a result of applying the offset value to the pointer stored in the program counter capability register; and

select the further capability register as the reference capability register when the program-counter-relative address is outside the allowable range specified by the constraint metadata of the program counter capability register.

6. The apparatus according to claim 5 , wherein

the plurality of capability registers includes the further capability register; and

in response to the capability-generating address calculating instruction, the instruction decoder hardware is configured to control the processing circuitry hardware to:

determine the program-counter-relative address;

compare the program-counter-relative address with the allowable range specified by the constraint metadata of the program counter capability register;

when the program-counter-relative address is within the allowable range specified by the constraint metadata of the program counter capability register, return the program-counter-relative address as the pointer of the result capability; and

when the program-counter-relative address is outside the allowable range specified by the constraint metadata of the program counter capability register, return as the pointer of the result capability a pointer corresponding to P+B−U−C, where P is the program-counter-relative address, B is a base address of the allowable range specified by the constraint metadata of the further capability register, U is an upper limit address of the allowable range specified by the constraint metadata of the program counter capability register, and C is a constant value.

7. The apparatus according to claim 1 , wherein

the plurality of capability registers includes the further capability register; and

in response to at least one type of capability-controlled data access instruction the instruction decoder hardware is configured to control the processing circuitry hardware to trigger signalling of a fault when a target address determined based on at least one parameter of the capability-controlled data access instruction is outside both:

an allowable range indicated by the constraint metadata of the program counter capability register; and

an allowable range indicated by the constraint metadata of the further capability register.

8. The apparatus according to claim 1 , wherein

the plurality of capability registers includes a target-address capability register; and

in response to a relative-addressed capability-controlled data access instruction specifying the target-address capability register and an intra-window offset value, the instruction decoder hardware is configured to perform a data access to a target address determined based on adding the intra-window offset value to the pointer stored in the target-address capability register.

9. The apparatus according to claim 1 , in which the constraint metadata specifies access permissions for use of the pointer of the capability, the access permissions specifying at least one of:

a read permission value indicating whether a read permission is granted to provide permission to use the capability for controlling a read data access;

a write permission value indicating whether a write permission is granted to provide permission to use the capability for controlling a write data access; and

an execute permission value indicating whether an execute permission is granted to provide permission to use the capability for determining a branch target address or for controlling fetching of an instruction for execution.

10. The apparatus according to claim 9 , in which, in response to the capability-generating address calculating instruction, the instruction decoder hardware is configured to set the access permissions specified in the constraint metadata of the result capability to indicate different access permissions depending on whether the reference capability register is the program counter capability register or the further capability register.

11. The apparatus according to claim 9 , wherein

the plurality of capability registers includes the further capability register; and

in response to the capability-generating address calculating instruction:

when the reference capability register is the program counter capability register, the processing circuitry hardware is configured to copy the read permission value and the execute permission value specified in the constraint metadata of the program counter capability to the constraint metadata of the result capability, and to set the write permission value for the result capability to indicate that write permission is not granted; and

when the reference capability register is the further capability register, the processing circuitry hardware is configured to copy the read permission value and the write permission value specified in the constraint metadata of the further capability register to the constraint metadata of the result capability, and to set the execute permission value for the result capability to indicate that execute permission is not granted.

12. The apparatus according to claim 9 , in which the capability registers comprise a default data capability register to store a default data capability for constraining use of pointers represented using non-capability operands.

13. The apparatus according to claim 12 , in which in response to at least one type of capability-controlled data access instruction the instruction decoder hardware is configured to control the processing circuitry hardware to perform a data access to a target address determined based on at least one capability operand of the capability-controlled data access instruction, without relocating said target address based on the default data capability stored in the default data capability register.

14. The apparatus according to claim 12 , in which the further capability register is the default data capability register.

15. The apparatus according to claim 1 , in which the plurality of capability registers comprise a plurality of general purpose capability registers accessible by capability-specifying instructions in at least one configuration of the processing circuitry hardware; and

the further capability register is a predetermined one of the general purpose capability registers.

16. The apparatus according to claim 1 , in which the window address is an absolute address identifying the selected window.

17. The apparatus according to claim 1 , wherein

the plurality of capability registers includes a target capability register;

the constraint metadata specifies an allowable range for the pointer;

the window address is a relative address identifying the selected window relative to a base address of the allowable range specified by the constraint metadata of the program counter capability register; and

in response to a relative-addressed capability-controlled data access instruction specifying the target capability register and an intra-window offset value, the instruction decoder hardware is configured to control the processing circuitry hardware to perform a data access to a target address determined based on adding the intra-window offset value and the base address of the allowable range specified by the constraint metadata of the program counter capability register to the pointer stored in the target capability register.

18. A data processing method for an apparatus comprising processing circuitry hardware and a plurality of capability registers including a result capability register, each capability register to store a capability comprising a pointer and constraint metadata for constraining valid use of the pointer or the capability, the capability registers including a program counter capability register for which the pointer represents a program counter address indicative of a current point of program flow;

the data processing method comprising:

in response to a capability-generating address calculating instruction specifying an offset value, controlling the processing circuitry hardware to:

select a reference capability register as one of the program counter capability register and a further capability register; and

write to the result capability register a result capability for which the pointer of the result capability indicates a window address identifying a selected window within an address space, where a window comprises a contiguous block of addresses of a predetermined size, the selected window is offset from a reference window by a number of windows determined based on the offset value specified by the capability-generating address calculating instruction, and the reference window comprises the window which comprises an address indicated by the pointer of the reference capability register.

19. A non-transitory computer-readable storage medium comprising a computer program to control a host data processing apparatus to provide an instruction execution environment for execution of target code, the computer program comprising:

instruction decoding program logic to decode instructions of the target code to control the host data processing apparatus to perform data processing; and

register maintenance program logic to maintain a data structure representing a plurality of capability registers including a result capability register, each capability register to store a capability comprising a pointer and constraint metadata for constraining valid use of the pointer or the capability, the capability registers including a program counter capability register for which the pointer represents a program counter address indicative of a current point of program flow; in which:

in response to a capability-generating address calculating instruction specifying an offset value, the instruction decoding program logic is configured to control the host data processing apparatus to:

select a reference capability register as one of the program counter capability register and a further capability register; and

write to the result capability register a result capability for which the pointer of the result capability indicates a window address identifying a selected window within an address space, where a window comprises a contiguous block of addresses of a predetermined size, the selected window is offset from a reference window by a number of windows determined based on the offset value specified by the capability-generating address calculating instruction, and the reference window comprises the window which comprises an address indicated by the pointer of the reference capability register.