Two-Stage Address Translation

Abstract

The memory management circuit (28) supports two-stage address translation based on stage 1 and stage 2 translation table structures. The stage 2 access permission information specified by the stage 2 translation table entry has an encoding specifying whether the corresponding memory region has partial read-only permission indicating that a write request to a memory region corresponding to a target intermediate address issued when the processing circuit (4) is in a given execution state is permitted for a restricted subset of write request types (including metadata update write requests to update access tracking metadata in the translation table entry) but prohibited for other write request types. The memory management circuit (28) denies the memory access request when the stage 2 access permission information of the corresponding stage 2 translation table entry specifies partial read-only permission and the memory access request is a write request other than the restricted subset of write request types issued in the given execution state.

Description

[Technical field]

[0001] This application relates to the field of data processing, and more particularly, to memory management. [Background technology]

[0002] The data processing device may have a memory management circuit that performs address translation and controls whether access to a particular address is permitted based on address mapping and access permission information defined in a translation table. The memory management circuit may support two-stage address translation, where a translation from a virtual address to a physical address relies on a stage 1 mapping of the virtual address to an intermediate address, and a stage 2 mapping of the intermediate address to a physical address. This is useful for supporting virtualization, where multiple guest operating systems can coexist on the same hardware platform, with the stage 1 mapping being primarily controlled by the guest operating system and the stage 2 mapping being primarily controlled by the hypervisor, so that intermediate addresses (which appear to point to physical memory from the perspective of the guest operating system) can be remapped to different physical addresses. The two-stage address translation may be useful for avoiding collisions between competing intermediate addresses set by different guest operating systems and for mapping between the virtualized view of hardware resources seen by the guest operating systems and the actual hardware resources provided within the processing device. Summary of the Invention

[0003] At least some examples provide an apparatus that includes a processing circuit that processes instructions in one of a plurality of execution states associated with different privilege levels; and a memory management circuit that, in response to a memory access request, converts a target virtual address specified by the memory access request into a target physical address indicative of a memory system location to be accessed, wherein the memory management circuit is configured to support two stage address translation based on a stage 1 translation table structure including stage 1 translation table entries and a stage 2 translation table structure including stage 2 translation table entries, wherein a mapping from the target virtual address to a target physical address depends on a stage 1 address mapping and a stage 2 address mapping, wherein the stage 1 address mapping includes a mapping from the target virtual address to a target intermediate address specified by a corresponding stage 1 translation table entry corresponding to the target virtual address, and the stage 2 address mapping includes a mapping from the target intermediate address to a target intermediate address specified by a corresponding stage 1 translation table entry corresponding to the target virtual address. a memory management circuit configured to perform a permission check on the memory access request based at least on stage 2 access permission information specified by the corresponding stage 2 translation table entry, the stage 2 access permission information having an encoding specifying whether the memory region corresponding to the target intermediate address has partial read-only permission indicating that write requests to the memory region corresponding to the target intermediate address issued when the processing circuit is in a predetermined execution state of the plurality of execution states are permitted for a restricted subset of write request types but prohibited for write request types outside the restricted subset, the restricted subset of write request types including metadata update write requests generated by the memory management circuit to update the access tracking metadata in the translation table entry, the memory management circuit configured to determine whether the memory access request is a write request issued in the predetermined execution state, and the stage 2 access permission informationand configured to specify that the memory region corresponding to the target intermediate address has partial read-only permission, and to reject the memory access request in response to determining that the memory access request is a write request type other than the restricted subset of write request types.

[0004] At least some examples provide a method, the method comprising: processing instructions in one of a plurality of execution states associated with different privilege levels; and, in response to a memory access request, performing a two-stage address translation of a target virtual address specified by the memory access request to a target physical address indicative of a memory system location to be accessed, the two-stage address translation being based on a stage 1 translation table structure including stage 1 translation table entries and a stage 2 translation table structure including stage 2 translation table entries, a mapping from the target virtual address to a target physical address dependent on a stage 1 address mapping and a stage 2 address mapping, the stage 1 address mapping including a mapping from the target virtual address to a target intermediate address specified by a corresponding stage 1 translation table entry corresponding to the target virtual address, and the stage 2 address mapping including a mapping from the target intermediate address to a target physical address specified by a corresponding stage 2 translation table entry corresponding to the target intermediate address. performing a permission check on the memory access request based at least on stage 2 access permission information specified by a corresponding stage 2 translation table entry, the stage 2 access permission information having an encoding specifying whether the memory region corresponding to the target intermediate address has partial read-only permission indicating that write requests to the memory region corresponding to the target intermediate address issued when the processing circuitry is in a predetermined execution state of the plurality of execution states are permitted for a restricted subset of write request types but prohibited for write request types outside the restricted subset, the restricted subset of write request types including metadata update write requests generated by the memory management circuitry to update access tracking metadata in the translation table entry; and rejecting the memory access request in response to determining that the memory access request is a write request issued in the predetermined execution state, the stage 2 access permission information having an encoding specifying whether the memory region corresponding to the target intermediate address has partial read-only permission indicating that write requests to the memory region corresponding to the target intermediate address issued when the processing circuitry is in a predetermined execution state of the plurality of execution states are permitted for a restricted subset of write request types but prohibited for write request types outside the restricted subset, the restricted subset of write request types including metadata update write requests generated by the memory management circuitry to update access tracking metadata in the translation table entry.and specifying that the memory region corresponding to the target intermediate address has partial read-only permission, and rejecting the memory access request if the memory access request is of a write request type other than the restricted subset of write request types.

[0005] At least some examples provide a computer program including instructions for controlling a host data processing apparatus to provide an instruction execution environment for executing target code, the computer program including: processing program logic for simulating processing of instructions of the target code in one of a plurality of execution states associated with different privilege levels; memory management program logic for responsive to a simulated memory access request triggered by the target code to translate a target virtual address specified by the memory access request into a target physical address indicating the simulated memory system location being accessed; and in the computer program, the memory management program logic is configured to support two stage address translation based on a stage 1 translation table structure including stage 1 translation table entries and a stage 2 translation table structure including stage 2 translation table entries, wherein a mapping of the target virtual address to the target physical address depends on the stage 1 address mapping and the stage 2 address mapping. wherein the stage 1 address mapping includes a mapping from a target virtual address to a target intermediate address specified by a corresponding stage 1 translation table entry corresponding to the target virtual address, and the stage 2 address mapping includes a mapping from the target intermediate address to a target physical address specified by a corresponding stage 2 translation table entry corresponding to the target intermediate address, and the memory management program logic is configured to perform a permission check on the simulated memory access request based at least on stage 2 access permission information specified by the corresponding stage 2 translation table entry, the stage 2 access permission information having an encoding specifying whether the memory region corresponding to the target intermediate address has partial read-only permission indicating that write requests to the memory region corresponding to the target intermediate address, issued when the processing program logic is in a predetermined execution state of a plurality of execution states, are permitted for a restricted subset of write request types but are prohibited for write request types outside the restricted subset;The restricted subset of write request types includes a metadata update write request generated by the memory manager logic to update the access tracking metadata in the translation table entry, and the memory manager logic is configured to reject the simulated memory access request in response to determining that the simulated memory access request is a write request issued in the predetermined execution state, the stage 2 access permission information specifies that the memory region corresponding to the target intermediate address has partial read-only permission, and the simulated memory access request is a write request type other than the restricted subset of write request types.

[0006] The computer program can be stored in a computer-readable storage medium. The storage medium may be a non-transitory storage medium. [Brief description of the drawings]

[0007] Further aspects, features, and advantages of the present technique will become apparent from the following description of examples, read in conjunction with the accompanying drawings. [Figure 1] 1 illustrates an example of a data processing apparatus having a processing circuit and a memory management circuit. [Diagram 2] 1 shows an example of an execution state of a processing circuit. [Diagram 3] Shows two stage address translation. [Figure 4] 13 shows an example of a translation table walk for stage 1 and stage 2 address translation, respectively. [Diagram 5] 13 shows an example of a translation table walk for stage 1 and stage 2 address translation, respectively. [Figure 6] 1 illustrates the table lookups performed for a full translation table walk for both stage 1 and stage 2 translations, when considering that each table base address and final intermediate address determined in stage 1 are translated to a physical address using the respective stage 2 translation. [Figure 7]2 illustrates an example of a memory management circuit and control registers for controlling memory management. [Figure 8] 1 shows an example of a translation table entry for stage 1 and stage 2 address translation. [Figure 9] Indicates the types of write requests that are permitted and prohibited from writing to the partial read-only memory region defined by the stage 2 translation table entry. [Figure 10] We show how to perform address translation and permission checks. [Figure 11] FIG. 13 is a flow diagram illustrating a check based on partial read-only permission. [Figure 12] 13 illustrates the processing of different variants of a protection entry check type read check write instruction. [Figure 13-1] 13 illustrates the processing of different variants of a protection entry check type read check write instruction. [Figure 13-2] 13 illustrates the processing of different variants of a protection entry check type read check write instruction. [Figure 14-1] 13 illustrates the processing of different variants of a protection entry check type read check write instruction. [Figure 14-2] 13 illustrates the processing of different variants of a protection entry check type read check write instruction. [Figure 15] Indicates aliasing of virtual addresses onto the same intermediate address. [Figure 16] Indicates anti-aliasing check. [Figure 17] 3 shows stage 1 top-level table existence check and stage 1 top-level partial read-only check. [Figure 18] 1 illustrates a simulator implementation that may be used. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Partial Read-Only Stage 2 Access Permissions The apparatus has a processing circuit for processing instructions in one of a plurality of execution states associated with different privilege levels, and a memory management circuit for, in response to a memory access request, translating a target virtual address specified by the memory access request into a target physical address indicative of a memory system location to be accessed. The memory management circuit supports two stages of address translation based on a stage 1 translation table structure including stage 1 translation table entries and a stage 2 translation table structure including stage 2 translation table entries, where a mapping from the target virtual address to the target physical address depends on the stage 1 address mapping and the stage 2 address mapping. The stage 1 address mapping includes a mapping from the target virtual address to a target intermediate address specified by a corresponding stage 1 translation table entry corresponding to the target virtual address. The stage 2 address mapping includes a mapping from the target intermediate address to a target physical address specified by a corresponding stage 2 translation table entry corresponding to the target intermediate address.

[0009] In systems that support two-stage address translation, stage 1 address mappings are typically controlled by the operating system, while stage 2 address mappings are typically controlled by a hypervisor. Thus, the memory system locations used to store stage 1 address mappings are typically writable by the operating system, so that the operating system can maintain the address mappings and permissions represented by the stage 1 translation table entries. Modern operating system software can be relatively large and therefore have many lines of code that involve writing to memory, which can cause updates to stage 1 translation table entries if the address operand of a store instruction is set to correspond to a memory region used to hold the stage 1 translation table entries. Thus, operating systems can present a large attack surface that can be used by attackers to attempt to gain access to sensitive data or code, or to corrupt the functionality of software running on the device, by causing the operating system code to corrupt some of the stage 1 translation table entries in order to change the access permissions or address mappings and circumvent the memory management controls that were intended to be performed using the stage 1 translation table entries. Therefore, it may be desirable to provide a countermeasure to protect against corruption of some stage 1 translation table entries (although it may not be necessary to apply this countermeasure to all stage 1 translation table entries, since some stage 1 translation table entries may correspond to memory areas used to hold non-sensitive information).

[0010] One approach that has been proposed to harden stage 1 translation tables against attacks is to provide an alternate base address that is separate from the base address used to point to the normal stage 1 translation tables. The alternate base address points to an alternate set of stage 1 translation tables. The alternate translation table base address and the alternate set of stage 1 translation tables may be controlled by the hypervisor rather than the operating system and may be used to control access to a subset of the sensitive region of the address space. The translation table entries at each level of the alternate translation table structures may specify a resume indicator that indicates whether the translation table walk of the alternate set of stage 1 translation tables should be stopped and resumed using the normal stage 1 translation tables instead. If no indication to resume the translation table walk is encountered during the walk of the alternate translation table structures, an address mapping (controlled by the hypervisor as part of the alternate translation tables) will eventually be reached, and this can be used to identify intermediate addresses of memory regions that hold sensitive information. However, if the restart indicator specifies that the translation table walk should be stopped and restarted at a given level of the translation table structures, a further translation table walk will commence, starting from the base address used for the normal stage 1 translation tables controlled by the operating system. This approach allows access to certain sensitive memory regions to be controlled based on an alternate translation table structure that cannot be tampered with by the operating system, while other memory regions that do not need to be protected against attacks can have access controlled based on the normal set of stage 1 translation tables established by the operating system.However, a problem with this approach is that an already slow translation table walk operation becomes even slower (up to twice as long) because for any access to a non-sensitive memory region, two separate translation table walk operations must be performed: a first operation to walk the alternate translation table structure, and a second operation to walk the normal translation table structure after stopping walking the alternate structure. This can have a significant impact on performance, especially if a large portion of the address space is not intended to be sensitive and therefore uses normal stage 1 translation tables.

[0011] Another approach is to use the stage 2 access permission set for the stage 2 translation table entry corresponding to the memory region used to store the stage 1 translation table entry to mark that memory region as read-only, which prevents the operating system from being able to update the stage 1 translation table entry. However, a problem with this approach is that it is often useful for the operating system to be able to update access tracking metadata in the stage 1 translation table entry to record information about how frequently a given memory region is accessed or written to. For example, the metadata may include an access flag that is set to track that the corresponding memory region has been accessed at least once since the access flag was previously cleared, and / or a dirty flag that is set to indicate that at least one write to the corresponding memory region has occurred since the dirty flag was cleared. Another example of access tracking metadata may be an access counter that counts the number of accesses to a corresponding given memory region. Such access tracking metadata may be useful to allow the operating system to more efficiently manage paging of memory regions to external storage (e.g., to allow the operating system to identify the least frequently accessed pages that are the best candidates for paging out to external storage). Thus, if the memory area used to store stage 1 translation table entries were marked as read-only using stage 2 access permission information, this would prevent updates to the access tracking metadata and therefore potentially reduce the efficiency of management of paging and other operations managed by the operating system, with the risk of performance loss due to frequently accessed data being paged out to external storage due to loss of information regarding access frequency.

[0012] In an example described below, the memory management circuit performs a permission check on the memory access request based at least on stage 2 access permission information specified by a corresponding stage 2 translation table entry corresponding to a target intermediate address of the memory access. The stage 2 access permission information has an encoding that specifies whether the memory region corresponding to the target intermediate address has partial read-only permission. The partial read-only permission may be another permission option available for selection for a given memory region as an alternative to other types of permission such as read-only, read / write, execute, read / execute, etc. In contrast to the read-only permission that may prohibit all writes to the corresponding memory region, the partial read-only permission specifies that write requests are permitted for a restricted subset of write request types, but are prohibited for write request types outside the restricted subset, of write requests to the memory region corresponding to the target intermediate address issued when the processing circuit is in a given execution state of the multiple execution states. The restricted subset of write request types includes at least metadata update write requests generated by the memory management circuit to update the access tracking metadata in the translation table entry. The memory management circuit rejects the memory access request in response to determining that the memory access request is a write request issued in the given execution state, the stage 2 access permission information specifies that the memory region corresponding to the target intermediate address has partial read-only permission, and the memory access request is a write request type other than the restricted subset of write request types.

[0013] Thus, with this approach, a hypervisor controlling stage 2 access permissions can set memory regions used to store stage 1 translation table entries as having partial read-only permissions, which still allows updates to access tracking metadata to be made (which tends to help improve performance by increasing the efficiency of control of operations such as paging to external storage), but prevents at least some other request types from writing to the corresponding memory region. By restricting the ability to write to regions associated with partial read-only permissions to a limited subset of write request types, this reduces the attack surface available for an attacker to exploit and increases protection against such attacks.

[0014] In some examples, a metadata update write request may be the only type of write request in the restricted subset. In this case, if the operating system needs to update a stage 1 translation table entry stored in a memory region marked as partially read-only by the stage 2 access permission information, the update may fail and be trapped to the hypervisor, which can determine whether the update requested by the operating system is appropriate and can emulate the update before returning control to the operating system.

[0015] However, in practice, updates to stage 1 translation table entries may be relatively frequent, and thus trapping to the hypervisor at each update may impact performance. It may therefore be useful for the restricted subset of write request types to also include write requests issued in response to at least one predefined type of translation table entry update instruction executed by a processing circuit in a predefined execution state. On the other hand, write requests issued in response to at least one predefined type of store instruction executed by a processing circuit in a predefined execution state may be excluded from the restricted subset of write request types. Thus, by restricting the types of write requests that are permitted to write to the partial read-only region, this reduces the opportunity for an attacker to modify the behavior of a store instruction to cause corruption of stage 1 address translation table entries. Since the ability to write to the partial read-only region is restricted to a limited subset of dedicated instruction types intended to update translation table entries, this means that other types of general-purpose store instructions used in parts of the operating system code (that the code writers did not intend to update translation table entries) cannot be hacked to corrupt translation table entries stored in the partial read-only region of memory. The translation table entry update instruction may cause the processing circuitry to perform at least one additional check that is not performed in response to other types of store instructions used to trigger writes to memory, to provide added security.

[0016] The predetermined execution state may be an execution state associated with a privilege level of the operating system. For example, in the following example, the predetermined execution state may be exception level EL1. In some examples, the write restrictions imposed by the predetermined execution state may only apply when the processing circuit is in the predetermined execution state or a less privileged execution state. Alternatively, the write restrictions on the regions marked as partial read-only may apply regardless of the current execution state, and thus apply in all execution states including the predetermined execution state. Nevertheless, since restrictions on the write capability are imposed based on the partial read-only permission such that at least for memory access requests issued in the predetermined execution state, some write request types issued in the predetermined execution state are permitted and other write request types are not permitted, this provides an additional control orthogonal to any privilege-based control also implemented that allows further restrictions on the operating system's ability to update data in some memory regions used to store stage 1 translation table entries without compromising the ability of the memory management circuit to issue writes to update the access tracking metadata in the translation table entries.

[0017] In some implementations, the memory management circuitry is configured to permit a write request issued in response to at least one type of store instruction executed by the processing circuitry in an execution state more privileged than the given execution state to write to a memory region having partial read-only permission. In practice, however, this is not required, and typically, a hypervisor operating in a more privileged execution state may in any case use a different set of translation tables than the stage 2 translation tables used by the operating system in the given execution state, and thus, even if a memory region used to store a stage 1 translation table entry is marked as partial read-only in the stage 2 translation table used by the operating system, this does not mean that the same memory region must be marked as partial read-only in the translation table used by the hypervisor. That memory region may be defined as writable in the translation table used by the hypervisor, and thus, even if the stage 2 translation table used by the operating system marks that region as partial read-only, the hypervisor may still set information in the corresponding stage 1 translation table entry (such as the bit fields that define the stage 1 address mapping itself and / or the protection entry, as further described in the examples below).

[0018] The stage 2 access permission information may be specified directly or indirectly (or a combination of both) by the corresponding stage 2 translation table entry. In a direct specification, the encoding of the stage 2 translation table entry itself specifies the stage 2 access permission information. In an indirect specification, the encoding of the stage 2 translation table entry may specify a value that references one of multiple sets of stage 2 access permission information stored in a structure separate from the stage 2 translation table entry. For example, a permission indirect register may be provided that includes several permission fields that can each be set to an encoding that indicates a corresponding permission type. A portion of the stage 2 translation table entry may be interpreted as an index value that is used to select which of the permission fields of the permission indirect register provide the stage 2 access permission information for that stage 2 translation table entry. Thus, in some examples, information specifying partial read-only permission may be specified directly in the stage 2 translation table entry. In other examples, information specifying partial read-only permission may be specified indirectly by a stage 2 translation table entry that specifies an index to a field of the stage 2 permission indirect register (or other data structure) that is encoded to indicate partial read-only permission. Using access permission indirection can be useful because it allows software to update the permissions of several different translation table entries that each reference the same field of an indirection register with a single write to that field of the indirection register, without having to update each translation table entry individually. In some implementations, using an indirection register can also help support a larger number of permission type options than can be encoded in the translation entry itself.

[0019] Protection Stage 1 Translation Table Entries Some implementations may assume that all translation table entries stored in memory regions marked as partially read-only by the stage 2 access permission should be considered read-only for write requests that are not one of the restricted subset of request types issued in a given execution state. However, in practice, a given memory region corresponding to a stage 2 translation entry may store a translation table that includes many different stage 1 translation table entries corresponding to different memory regions, not all of which require a corresponding stage 1 translation table entry to be protected from corruption by an improper write access request from the operating system. For example, memory regions represented by different stage 1 translation table entries may correspond to a mix of sensitive and non-sensitive information. If it is still desirable to allow the operating system to update stage 1 translation table entries associated with non-sensitive information, even though the corresponding memory region is set in the stage 2 access permission to have partial read-only permission, one approach may be to trap each update to the hypervisor, which can determine whether the update is allowed. However, such update requests may be relatively frequent, and thus this may cause a loss of performance.

[0020] Thus, in the example described below, each stage 1 translation table entry may have an encoding that specifies whether the entry is a protected entry that is restricted from being updated compared to stage 1 translation table entries that are not coded as protected entries. This enables entries corresponding to sensitive and non-sensitive information to be differentiated from one another, and allows for stricter checks on updates to those protected entries compared to non-protected entries. For example, a given type of translation table entry update instruction described above, where writing to a partial read-only memory region is permitted, may include a check whether data stored in the memory region targeted by the write request is coded as a protected entry, and may inhibit writing to at least some bits of the memory region when the contents of the memory region are found to be coded as a protected entry. For non-protected entries, on the other hand, writing may be permitted in response to the translation table entry update instruction (assuming any other access permission checks are satisfied). Thus, by providing support for coding stage 1 translation table entries as protected entries in distinction from other non-protected entries, this may allow non-protected entries to be updated without hypervisor intervention, which may help improve performance.

[0021] The device may have a protection entry checking circuit for checking whether to restrict updates to an access permission or address mapping specified by a given stage 1 translation table entry based on whether the given stage 1 translation table entry is marked as a protection entry. If the translation table entry specifies access tracking metadata, updates to the access tracking metadata may not be restricted based on whether the entry is protected, and thus a metadata update write request generated by a memory management circuit in hardware (e.g., during a page table walk operation) may be allowed even if the stage 1 translation table entry being updated is a protection entry.

[0022] The combination of partial read-only permissions defined in the stage 2 access permission information and the protected entry encoding used for the stage 1 translation table entries may be particularly effective when compared to using either feature alone. Although it is possible to support partial read-only permissions in stage 2 without supporting the protected stage 1 translation table entry encoding, as discussed above, this tends to require more frequent traps to the hypervisor. Thus, the combination of these features may be particularly effective.

[0023] In some examples, the information in the stage 1 translation table entry that encodes whether the entry is a protected entry may be a dedicated bit or field that is treated as indicating whether the entry is a protected entry in all modes or operational states of the processing circuit. However, it is also possible that the information in the stage 1 translation table entry used to encode whether the entry is a protected entry may be interpreted differently depending on the operational mode of the processing circuit or the control state stored in the control register. For example, a control value in the control register may indicate whether a particular bit or bit field in the stage 1 translation table entry should be interpreted as indicating whether the entry is a protected entry or should be interpreted in another manner (e.g., according to a legacy encoding used in systems that do not support protected entry encoding). Thus, while an apparatus may support encoding a stage 1 translation table entry as a protected entry in at least one operational state, it is not required to encode whether the stage 1 translation table entry is protected in all operational states of the processing circuit. In some examples, whether a stage 1 translation table entry is protected may depend in part on the encoding of the entry itself and in part on the control value stored in the control register.

[0024] Protection entry check type read check write instruction The processing circuit may support a protection entry check type read-check-write (RCW) instruction to request an update to a given memory system location. In response to the processing circuit executing the protection entry check type RCW instruction, the protection entry check circuit may read data from the given memory system location, check whether the data read from the given memory system location has a value that matches a stage 1 translation table entry designated as a protection entry, and in response to determining that the data read from the given memory system location has a value that matches a stage 1 translation table entry designated as a protection entry, prevent an update-restricted subset of bits of the stage 1 translation table entry from being updated in response to the read-check-write instruction. Thus, in an instruction set architecture supported by the processing circuit, by supporting an instruction that triggers a check whether the data to be updated has a value that matches an encoding of a protected stage 1 translation table entry, this avoids the need to trap each update to the hypervisor, thus providing a mechanism for an operating system to update unprotected stage 1 translation table entries without hypervisor intervention to improve performance.

[0025] Note that a check of the read data may not be able to reliably distinguish whether the data is actually intended to be a stage 1 translation table entry or is just some data with a value set for some other purpose. The check may determine whether the value of the data matches the encoding of a stage 1 translation table entry designated as a protected entry (e.g., checking whether certain bits of the data match the value those bits would have if a protected stage 1 translation table entry were stored in a given memory system location).

[0026] The protection entry check type of the RCW instruction may be one of a restricted subset of write request types permitted to write to a partially read-only region of memory, and therefore it may pass the stage 2 access permission check when the region of memory is marked as partially read-only.

[0027] The setting of the information specifying whether a given stage 1 translation table entry is a protected entry may be controlled by software, such as a hypervisor, executing at a privilege level higher than a given execution state. For example, the hypervisor may specify a particular protected stage 1 translation table entry when it first writes a set of stage 1 translation table entries to memory when initializing a corresponding operating system. This is possible because the stage 2 translation table entries of the translation table structures used by the hypervisor may not restrict writes to the corresponding memory structures from being written by the hypervisor. The operating system may subsequently be permitted to update non-protected stage 1 translation table entries, but the protected entries may have at least some bits that are immutable in response to instructions executed by the operating system.

[0028] The read, check, and write of the protection entry check type RCW instruction can be executed as an atomic operation by the protection entry check circuit. Therefore, since the read, check, and write can be treated as an indivisible set of operations whose results are either completely observed or not observed at all, it is not possible for other software processes executing on the data processing apparatus to see partial results of executing the protection entry check type RCW instruction or to write to the memory location read / written by the RCW instruction in the period between the read and write executed for the RCW instruction. This prevents the occurrence of a race condition that could occur if it were possible for another software process to write to a given memory system location in the period between the read and write executed in response to the protection entry check type RCW instruction.

[0029] If updates to a memory system location are permitted following a check of the protection entry encoding, and thus at least one bit of the given memory system location is updated in response to a protection entry check type RCW instruction, the protection entry check circuitry can prohibit updates to the given memory system location from changing the protection specification of a stage 1 translation table entry stored at the given memory system location. Thus, for an unprotected entry, the operating system is permitted to update parts of the entry, but the operating system cannot use an RCW instruction to make the entry a protected entry. Also, a protected entry cannot be converted to an unprotected entry by executing an RCW instruction of the protection entry check type. This ensures that protections put in place by the hypervisor for a particular stage 1 translation table entry cannot be circumvented by the operating system executing an RCW instruction, and that an attacker cannot cause any translation table entry created by the attacker to be marked as protected, which could cause other security checks that rely on the assumption that protected entries are permitted by the hypervisor to be circumvented.

[0030] Different implementations may have different mechanisms for controlling the degree to which updates to protection stage 1 translation table entries are restricted.

[0031] In some examples, the subset of update-restricted bits may include all bits of a stage 1 translation table entry. Thus, if a protection entry check type RCW instruction is executed and data read from a given memory system location is found to have a value that matches a protection stage 1 translation table entry, the requested update to the data at the given memory system location may be suppressed in its entirety. Nevertheless, this does not prevent the access tracking metadata in the stage 1 translation table entry from being updated in response to a metadata update write request generated in hardware by the memory management circuitry during the translation table walk (the protection entry check used to restrict updates in response to an RCW instruction does not apply to the metadata update write request).

[0032] In another example, the subset of update-restricted bits may include a suitable subset of bits of a stage 1 translation table entry, such that some bits may still be updated by a protected entry check type RCW instruction, even in the case of a protected entry, while other bits are prohibited from being updated. The subset of update-restricted bits may include at least any one or more bits used to encode whether a stage 1 translation table entry is a protected entry, as described above, to protect against an operating system being able to convert a protected entry to an unprotected entry or vice versa. However, it is recognized that there may be other bits of a stage 1 translation table entry that may be updated by an operating system without risk of circumventing the protection intended by the hypervisor, and thus it may be useful to allow some bits to be updated even in the case of an entry being a protected entry.

[0033] In examples where the subset of update-restricted bits includes a subset of proper bits (at least one other bit does not have update restricted in response to a protection entry check type RCW instruction), some implementations may fix the selection of which subset of bits is the subset of update-restricted bits. Thus, the selection of which bits are in the subset of proper bits may be non-programmable. For example, the selection of the update-restricted bits may be a hardwired architectural selection defined by the instruction set architecture supported by the processing circuit.

[0034] Alternatively, the selection of which bits are in the subset of update restricted bits may be programmable according to a software programmable selection value stored in a control register. This may allow a particular piece of software to program which particular bits should have their updates restricted according to the needs of that software. For example, the ability to update the software programmable selection value stored in the control register may be restricted to software executing in an execution state with at least a certain threshold level of privilege, which may be, for example, a hypervisor level privilege. Software executing in certain execution states as described above may not be allowed to write to the software programmable selection value.

[0035] In some implementations, each valid stage 1 translation table entry may have an encoding that specifies whether the entry is a protected entry. However, an invalid stage 1 translation table entry may not be encoded as protected or unprotected and may be assumed to be an unprotected entry by default. In this case, the invalid entry may be permitted to be updated by an RCW instruction, and any portion of the entry is permitted to be updated as long as the update does not cause the entry to be both valid and protected. Thus, in response to determining that data read from a given memory system location has a value that matches an invalid stage 1 translation table entry, the protected entry check circuitry may permit updates of the invalid stage 1 translation table entry other than updates that would cause the data at the given memory system location to become a valid stage 1 translation table entry designated as a protected entry.

[0036] However, in other implementations, both the valid and invalid stage 1 translation table entries may have an encoding that specifies whether the entry is a protection entry. In this case, in response to determining that data read from a given memory system has a value that matches an invalid stage 1 translation table entry designated as a protection entry, the protection entry check circuitry may prevent a subset of the invalid entry update restricted bits of the given memory system location from being updated in response to a read check write instruction, and in response to determining that data read from a given memory system has a value that matches a valid stage 1 translation table entry designated as a protection entry, the protection entry check circuitry may prevent a subset of the valid entry update restricted bits of the given memory system location from being updated in response to a read check write instruction. This approach may be useful because it allows the hypervisor to initialize a set of stage 1 translation table entries in which some entries are protected, including some invalid entries that cannot currently be used to allow access to memory but may be enabled later, while still being protected against unauthorized updates during periods when the translation table entries are not yet valid.

[0037] In some implementations, the subset of valid entry update restricted bits may be in the same bit positions as the subset of invalid entry update restricted bits. Alternatively, the subset of valid entry update restricted bits may be a different subset of bits of the translation table entry encoding compared to the subset of invalid entry update restricted bits. The subset of valid entry update restricted bits may be either all bits of the stage 1 translation table entries, a non-programmably selected appropriate subset of the stage 1 translation table entries, or a programmably selected appropriate subset of the stage 1 translation table entries according to a software programmable valid entry update restricted bit selection value stored in a control register. Similarly, the subset of invalid entry update restricted bits may be either all bits of the stage 1 translation table entries, a non-programmably selected appropriate subset of the stage 1 translation table entries, or a programmably selected appropriate subset of the stage 1 translation table entries according to a software programmable invalid entry update restricted bit selection value stored in a control register. The approach taken to select which bits are a subset of valid entry update restricted bits may be the same as or different from the approach taken to select which bits are a subset of invalid entry update restricted bits. For example, all bits of a valid protection entry may have restricted updates, and only a subset of bits of an invalid protection entry may have restricted updates. Alternatively, the update restricted bits may be programmably selected for one of the invalid / valid entries, but not for the other. For example, one exemplary implementation may provide a mask register to select which bits are a subset of valid entry update restricted bits, but the selection of which bits are a subset of invalid entry update restricted bits may be a fixed selection defined by the instruction set architecture.It will thus be appreciated that there are a wide variety of options for selecting which bits are restricted from being updated in both valid and invalid stage 1 translation table entries.

[0038] In some examples, a valid stage 1 translation table entry may include a first bit field indicating whether the valid stage 1 translation table entry is a protected entry, and an invalid stage 1 translation table entry may include a second bit field indicating whether the invalid stage 1 translation table entry is a protected entry. The first bit field and the second bit field may be in the same bit position in the stage 1 translation table entry encoding, or may be in different bit positions in the stage 1 translation table entry encoding. In some cases, placing the first bit field and the second bit field in different bit positions may provide more flexibility to the software in how it lays out its data. The invalid translation table entry encoding is used by the software for any non-translation table data. In a valid translation table entry encoding, there may only be limited bits available to encode the “protection status”. Thus, if the bit field used to encode the protection status was in the same bit position in both a valid entry and an invalid entry, this may constrain how the software can use that data in memory locations that are not intended to be used as a translation table entry. By allowing the bit field positions of the first bit field and the second bit field to be different, the second bit field in the invalid stage 1 translation table entry encoding can be placed in a position that is unlikely to cause inconvenience to software's use of normal data, even if that position is not suitable for a valid stage 1 translation table entry due to bit positions already allocated for other information in the valid stage 1 translation table entry.

[0039] Suppression of updates to a subset of update-restricted bits of a (valid or invalid) protected stage 1 translation table entry may be permitted in different ways. In some examples, if at least one of the subset of update-restricted bits is requested to be updated and it is determined that the data read from a given memory system location has an encoding that matches the data representing the protected entry, the protection entry check circuitry may simply suppress updates to the given memory system location in its entirety, including any updates to bits other than the subset of update-restricted bits. In this case, a write will fail if attempting to write to any update-restricted bit.

[0040] In another example, updates of only a subset of the update-restricted bits may be suppressed, while updates of at least one other (non-update-restricted) bit of a given memory system location may still be permitted. In this case, for a protected entry, a write succeeds for updates to bits that the write is permitted to update, but does not modify the update-restricted bits, even if requested to do so based on the operand of the RCW instruction.

[0041] In response to a protection entry check type read check write instruction, the processing circuitry may set at least one condition status value indicating whether at least a portion of the update requested by the protection entry check type read check write instruction is suppressed based on checking whether the data read from the given memory system is a stage 1 translation table entry designated as a protection entry. The at least one condition status value may be tested by a subsequent conditional instruction (such as a conditional compare instruction or a conditional branch instruction) to make a subsequent operation conditional on whether the update requested by the RCW instruction was successful or not. In cases where it is useful to know whether the RCW instruction succeeded or failed, this may help improve performance as it means that a further set of instructions does not need to be executed to determine whether the write was successful.

[0042] The protection entry check type of the RCW instruction may be implemented in various ways. For example, the processing circuitry may support any one or more of the following variants of the protection entry check type of the RCW instruction: A swap variant of a protected entry check type read check write instruction, in response to which the processing circuitry is configured to write data read from a given memory system location to a destination register for use as an operand by a subsequent instruction. This variant may be useful to enable a subsequent instruction to perform an operation that is conditional on the previous state of a translation table entry before it is updated. A store variant of a read check write instruction of the protection entry check type. For the store variant, the processing circuitry is configured to process the store variant without writing the data read from the given memory system location to the destination register. This variant may be useful to avoid unnecessarily consuming a destination register when a subsequent operation does not need to depend on the old contents of the given memory system location. In some examples, the swap variant and the store variant may have a common encoding, and when the destination register specifier of the swap variant specifies a predetermined value, this may cause the instruction to be treated as a store variant that does not need to return the data read from the given memory system location. Other architectures may provide the store variant as a standalone instruction separate from the swap variant. ● A compare and swap variant of a protection entry check type read check write instruction that specifies a comparison operand. For the compare and swap variant, the protection entry check circuit is configured to determine whether a comparison of data read from a given memory system location with a comparison operand satisfies a comparison condition, inhibit updates to the given memory system location when the comparison condition is not satisfied, and write the data read from the given memory system location to a destination register for use as an operand by a subsequent instruction. The compare and swap variant may also cause status information to be set to indicate whether the comparison condition was satisfied (e.g., set one or more condition flags that may be tested by a subsequent conditional instruction). In response to the compare and swap variant, when an update to a write-restricted bit is requested, the read data is encoded as a protection stage 1 translation table entry such that at least a portion of the requested write operation is inhibited, but the status information may be set to a different state when the comparison condition is not satisfied compared to when the comparison condition is satisfied. ● Bit set / clear instructions. For set / clear instructions, updating a given memory system location includes setting or clearing at least one selected bit of the data at the given memory system location. For example, the operand of a set / clear instruction may specify a bitmask that indicates the positions of bits to be set or cleared in the data at the given memory system location. Optionally, the set / clear instruction, like the swap and compare and swap variants, may also return data read from a given memory system location to a destination register for use as an operand by a subsequent instruction.

[0043] It will be appreciated that not all of these variants need to be supported in any given implementation of a data processing apparatus.

[0044] Anti-aliasing The techniques described above may be useful in allowing a particular set of stage 1 translation table entries to be protected from corruption by an operating system under attack by a malicious party. This allows entries that map a particular virtual address to a particular intermediate address to be protected from corruption. However, it is possible to provide two or more different stage 1 translation table entries that map different virtual addresses to the same intermediate address. Thus, even if a particular stage 1 translation table entry is protected against corruption (by using partial read-only permissions and optionally protected entry encoding), there may be a risk that an attacker may attempt to set another stage 1 translation table entry that maps a different virtual address to the same intermediate address specified by the protected stage 1 translation table entry, thereby circumventing the protection applied to that protected entry. One approach to address this issue may be to introduce checks when setting or using stage 1 translation table entries to check that they do not map to an intermediate address already mapped using a protected stage 1 translation table entry, but this is very costly in terms of performance and difficult to implement in practice.

[0045] In the example described below, a given stage 2 access translation table entry corresponding to a given intermediate address has an encoding that specifies whether the memory region corresponding to the given intermediate address has an anti-aliasing property indicating a requirement that each of one or more walked stage 1 translation table entries accessed in a translation table walk of the stage 1 translation structure to find a corresponding stage 1 translation table entry that specifies a stage 1 address mapping from the given virtual address to the given intermediate address must satisfy the anti-aliasing condition in order for access to the memory region corresponding to the given intermediate address to be permitted. The anti-aliasing condition for a given walked stage 1 translation table entry is considered to be satisfied when either (a) the given walked stage 1 translation table entry is specified as a protected entry and further partial read-only permission is specified by the stage 2 access permission information for the associated stage 2 translation table entry that provides the stage 2 address mapping used to derive the physical address of the memory system location that stores the given walked stage 1 translation table entry, or (b) read-only permission is specified by the stage 2 access permission information for the associated stage 2 translation table entry. The memory management circuitry denies the memory access request in response to determining that the corresponding stage 2 translation table entry specifies that the memory region corresponding to the target intermediate address has anti-aliasing properties and any of the one or more walked stage 1 translation table entries fails to satisfy the anti-aliasing condition.

[0046] This approach protects against the above-mentioned attacks based on aliasing of stage 1 translation table entries. If there is a given intermediate address corresponding to sensitive information that needs to be protected against attacks, and a stage 1 translation table entry used to identify the mapping of a virtual address to that intermediate address is protected by storing the entry in partial read-only memory and encoding the stage 1 translation table entry as a protected entry, then the hypervisor that controls the stage 2 translation table entries can also mark the given stage 2 translation table entry corresponding to the given intermediate address as having anti-aliasing properties. This means that even if an attacker gets the operating system code to create a new stage 1 translation table entry that maps to the same intermediate address, or to modify an existing stage 1 translation table entry in the path of the translation table walk traversal such that a different virtual address maps to the same intermediate address, the attacker cannot force the operating system code to store the new / modified stage 1 translation table entry in a partially read-only region of memory (since the attacker has no control over the stage 2 access permissions) and to encode the new entry as a protected entry (if the region written to by the attacker is already marked as a partially read-only region, the attacker would need to use a restricted subset of write requests to perform the write, e.g., using the RCW instruction described above, and such a write request type could impose a restriction that the value being written cannot be a protected stage 1 translation table entry). Also, the attacker cannot write a new aliasing entry into a read-only region.Thus, by checking whether each of the walked stage 1 translation table entries (which would be walked in the traversal of the stage 1 translation table structure to reach the stage 1 address mapping from a given virtual address to a given intermediate address) satisfies the anti-aliasing condition (based on either the PRO or the read-only permission set in stage 2, where the PRO specifies that the stage 1 entry is also a protected entry) upon access to a memory region for which anti-aliasing properties are defined in the corresponding stage 2 translation table entry, this prevents an attacker from being able to use aliasing as a means to circumvent the protections described above using the partial read-only permission and protected stage 1 entry features.

[0047] Similar to the partial read-only permission and protection entry encoding described above, the anti-aliasing properties may be specified directly or indirectly by the stage 2 access translation entry and may be indicated by a dedicated bit or bit field, or by a reused bit or bit field whose interpretation depends on the operating state of the processing circuit or control information specified in a control register.

[0048] Stage 1 Top-Level Base Address Protection Check The memory management circuitry can determine a stage 1 top-level base address of the stage 1 top-level translation table of the stage 1 translation table structure based on the value in the stage 1 translation table base address register. While the features described above can protect against corruption of specific stage 1 translation table entries, another way an attacker could attempt to circumvent these protections could be to modify the stage 1 top-level base address to point to an address different from that intended for authorized use, so as to replace the protected set of stage 1 translation tables with an alternative set of stage 1 translation tables defined by the attacker.

[0049] One approach to guard against such attacks may be to trap any updates to the stage 1 translation table base address register requested by the operating system and have the hypervisor check whether the updates requested by the operating system are appropriate. Thus, it may not be necessary to provide a hardware-enforced check on updates to the stage 1 translation table base address register.

[0050] However, in practice, updates to the stage 1 translation table base address register by the operating system may be relatively frequent (e.g., the operating system may do this for each context switch), and therefore trapping each update to the hypervisor may incur a performance cost. Thus, some additional checks may be useful to improve performance.

[0051] One example of such an additional check may be a stage 1 top-level table partial read-only check, which enforces the requirement that the stage 1 top-level base address should correspond to a memory region whose associated stage 2 translation table entry specifies partial read-only permission as described above. Thus, when the stage 1 top-level table partial read-only check is enabled, the memory management circuit signals a failure in response to determining that the stage 1 top-level base address corresponds to an intermediate address whose associated stage 2 translation table entry does not specify partial read-only permission. For example, this check may be performed when performing a translation table walk based on the stage 1 top-level base address stored in the stage 1 top-level base address register. This check means that the hypervisor can define as partial read-only an area of ​​memory that holds a stage 1 top-level translation table that is permitted to be used by the operating system (which may already have been verified as safe by the hypervisor). An attacker cannot define any stage 1 top-level translation table in some other region of memory and have that any stage 1 top-level translation table used for a page table walk, and therefore cannot use base address reprogramming as a means to bypass the partial read-only protection and protection mapping defined for the correct stage 1 translation table accessible via the correct base address mapping to the partial read-only region defined by the hypervisor in the corresponding stage 2 translation table entry.

[0052] In some implementations, the stage 1 top-level partial read-only check may be considered to be permanently enabled, and therefore there may not be programmable control of whether this check is enabled or disabled.

[0053] However, in other implementations, the memory management circuitry may determine whether the stage 1 top-level table partial read-only check is enabled based on a stage 1 top-level partial read-only check enable control value stored in a control register. The ability to write to the stage 1 top-level partial read-only check enable control value in the control register may be restricted to software executing at or above a threshold level of privilege (e.g., the threshold level of privilege may be a hypervisor-level privilege that is more privileged than the privilege associated with the aforementioned predetermined execution state). By providing the ability to enable or disable the stage 1 top-level table partial read-only check, this allows for backward compatibility with legacy software that is not designed to use partial read-only permissions.

[0054] Another example of a check to monitor for improper updates to the stage 1 translation table base register may be a stage 1 top level table presence permission check based on a stage 1 top level table presence permission set for a memory region using either a stage 1 translation table structure or a stage 2 translation table structure. A stage 1 top level table presence permission means that the corresponding memory region is permitted to be allocated to store a stage 1 top level translation table that can be effectively used as a top level translation table accessed in a stage 1 translation table walk based on an address in the stage 1 top level base address register. Thus, when the stage 1 top level table presence permission check is enabled, the memory management circuitry determines whether a given memory region corresponding to a stage 1 top level base address is associated with a stage 1 top level table presence permission indicating that the given memory region is permitted to be allocated to store a stage 1 top level table of a stage 1 translation table structure, and triggers a failure when the given memory region corresponding to the stage 1 top level base address does not have a stage 1 top level table presence permission.

[0055] The stage 1 top level table existence permission check helps guard against a further type of attack where an attacker can update the address in the stage 1 top level base address register to point to a memory area used to store one of the further level stage 1 translation table entries intended to be used at a further level of the stage 1 translation table structure other than the top level. In other words, rather than attempting to create an entirely new translation table entry, an attacker could cause an entry at a later level of the translation table structure to be treated as an entry at a previous level of the translation table structure, such that the bits of the target address used to select from that translation table entry are not a subset of the intended bits (a different level table indexed by a different subset of the bits of the input address to the translation table walk), causing the address mapping or access permissions specified by the improperly accessed entry at the later level of the translation table structure to apply to a different virtual address than was intended by the party who established the translation table structure. Such attacks can be protected from using stage 1 top level table existence permission because memory areas used to hold stage 1 translation table entries other than top level translation table entries can be defined to not have stage 1 top level table existence permission, and thus if an attacker updates the stage 1 top level base address to point to such an entry, the lack of permission to store a top level entry can be detected, which can then cause a failure to be signaled.

[0056] In some implementations in which at least two stage 1 top level base address registers are provided to store stage 1 top level base addresses for use in different memory access scenarios, at least two variants of stage 1 top level table presence permission may be supported, with each variant corresponding to a respective subset of the multiple stage 1 top level base address registers. When a given variant of stage 1 top level table presence permission is specified for a given memory region, the corresponding memory region is indicated as being permitted to be allocated to store a stage 1 top level translation table accessed using one of the corresponding subsets of stage 1 top level base address registers for the given variant, but not permitted to be allocated to store a stage 1 top level translation table accessed using a stage 1 top level base address register that is not a member of the corresponding subset for the given variant. Thus, if there is an attempt to perform a page table walk using a particular stage 1 top level base address register that specifies an address in a memory region assigned a stage 1 top level table presence permission where the corresponding subset of stage 1 top level base address registers does not include the particular stage 1 top level base address register, a failure may be triggered. By supporting different stage 1 top level table presence permissions that indicate permission to use the corresponding memory area for the stage 1 top level translation table for each particular subset of base address registers, this allows for more precise control, for example, it can prevent a base address intended to be used in one of the base address registers from being used for another base address register.

[0057] For example, in an implementation that supports a first stage 1 top level base address register and a second stage 1 top level base address register, a variant of the stage 1 top level table existence allowance may be: a first variant, in which the corresponding subset includes a first stage 1 top level base address register but does not include a second stage 1 top level base address register; a second variant in which the corresponding subset includes a second stage 1 top level base address register but does not include the first stage 1 top level base address register; a third variant in which the corresponding subset includes both the first stage 1 top level base address register and the second stage 1 top level base address register.

[0058] In one example, when performing a stage 1 page table walk for a given virtual address, the memory management circuitry can select whether to use the first stage 1 top level base address register or the second stage 1 top level base address register to access the top level translation table based on whether some of the most significant bits of the given virtual address are all zero. The number of most significant bits considered for this selection can be either fixed or programmable using a control value configured by software. This approach can be useful, for example, to allow upper and lower ranges of a virtual address space to be translated using different sets of translation tables. For example, a lower address range with the most significant bits of the address set to all zeros can be used for user address space, and an upper address range having at least one non-zero bit in the most significant portion of the address can be used for kernel address space.

[0059] It may be possible for the stage 1 top level table presence permission for a given memory region to be encoded within the stage 1 access permission of the stage 1 translation table entry corresponding to the given memory region, in which case it may be desirable to implement at least one further protection mechanism to prevent the bits used to encode the stage 1 top level table presence permission from being modified by instructions executing in an execution state having a privileged operating system level.

[0060] Instead, it may be more convenient for the memory management circuitry to determine whether a given memory region is associated with a stage 1 top-level table presence permission based on the encoding of an associated stage 2 translation table entry that corresponds to the stage 1 top-level base address. By using an associated stage 2 translation table entry to indicate whether a given memory region is permitted to hold a stage 1 top-level translation table, this simplifies control over updates to stage 1 translation table entries that are triggered by operating system code that generally cannot update stage 2 translation table entries.

[0061] Again, in some implementations, the stage 1 top-level table existence permission checks may be considered to be permanently enabled.

[0062] Alternatively, the memory management circuitry may determine whether the stage 1 top level table existence permission check is enabled based on a stage 1 top level table existence permission check enable control value stored in a control register. The ability to write the existence permission check enable control value in the control register to the stage 1 top level table may be restricted to software executing at or above a threshold level of privilege (e.g., the threshold level of privilege may be a hypervisor level of privilege). By providing the ability to enable or disable the stage 1 top level table partial read-only check, this provides backward compatibility with legacy software that does not use the stage 1 top level table existence permission.

[0063] Also, in an implementation where there are two or more variants of stage 1 top level table presence permission supported corresponding to different subsets of base address registers as described above, there may be at least one further control defined by at least one control value stored in a control register, which indicates whether the different variants of stage 1 top level table presence permission should be treated as enabling only the use of the corresponding memory region for the corresponding subset of stage 1 top level base address registers, or whether each variant can be used to enable the corresponding memory region to be used for any of the stage 1 top level base address registers. Thus, the above-mentioned fault triggered when the base address register used to provide the stage 1 top level base address is not one of the subsets of base address registers enabled by the variant of stage 1 top level table presence permission specified for the memory region containing the stage 1 top level base address may be enabled or disabled based on at least one further control. In some examples, a separate control may be provided to configure whether a fault is generated for a particular combination of the stage 1 top level base address register used and the variant of stage 1 top level table presence permission. For example, one control value may be provided to control whether a failure is generated on a page table walk using a base address in the second stage 1 top level base address register when the memory region containing the base address has a first variant of the stage 1 top level table presence permissions described above, and a second control value may be provided to control whether a failure is generated on a page table walk using a base address in the first stage 1 top level base address register when the memory region containing the base address has a second variant of the stage 1 top level table presence permissions.

[0064] In some examples that support both the stage 1 top-level table partial read-only check and the stage 1 top-level table existence permission check, it may be possible to enable or disable these checks individually and separately using separate enable control values. Alternatively, a single control value may enable / disable both checks together, so that the supported options may be either both checks are enabled or both checks are disabled, but it may not be possible to enable one check without the other.

[0065] Other implementations may not support both types of checks, for example, in some implementations one or the other of these checks may be deemed sufficient.

[0066] With respect to partial read-only permissions, stage 1 top-level table presence permissions may be specified directly or indirectly (or a combination of both) by the translation table entry, e.g., using information specified directly in the encoding of the translation table entry and / or information specified indirectly by the translation table entry by reference to a permission register.

[0067] Architecture Simulation The techniques described above may be implemented within a data processing apparatus having hardware circuitry provided for implementing the instruction decoder and processing circuitry described above.

[0068] However, the same technique may also be implemented in a computer program that runs on a host data processing device to provide an instruction execution environment for the execution of the target code. Such a computer program may control the host data processing device to simulate an architectural environment provided on a hardware device that actually supports the target code according to a particular instruction set architecture, even if the host data processing device itself does not support that architecture. The computer program may have processing program logic and memory management program logic that emulate the functionality of the processing circuitry and memory management circuitry described above, including support for partial read-only permissions and the various checks described above. Such a simulation program may be useful, for example, when legacy code written for one instruction set architecture is being executed on a host processor that supports a different instruction set architecture. Also, running the software on a simulation execution environment may enable testing of the software in parallel with ongoing development of hardware devices that support the new architecture, so that the simulation may enable software development of a new version of the instruction set architecture to begin before processing the hardware that supports the new architecture version. The simulation program may be stored on a storage medium, which may be a non-transitory storage medium.

[0069] Examples of data processing devices FIG. 1 shows a schematic diagram of an example of a data processing apparatus 2. The data processing apparatus has a processing pipeline 4 including several pipeline stages. In this example, the pipeline stages include a fetch stage 6 for fetching instructions from an instruction cache 8, a decode stage 10 for decoding the fetched program instructions to generate micro-operations (decoded instructions) that are processed by the remaining stages of the pipeline, an issue stage 12 for checking whether operands required for the micro-operation are available in a register file 14 and for issuing the micro-operation for execution once the operands required for a given micro-operation are available, an execute stage 16 for executing the data processing operation corresponding to the micro-operation by processing operands read from the register file 14 to generate a result value, and a writeback stage 18 for writing the result of the processing back to the register file 14. It will be appreciated that this is just one example of a possible pipeline architecture and other systems may have additional stages or different arrangements of stages. For example, in an out-of-order processor, a register renaming stage may be included for mapping architectural registers specified by a program instruction or micro-operation to physical register specifiers that identify physical registers in the register file 14. In some examples, there may be a one-to-one relationship between program instructions decoded by the decode stage 10 and corresponding micro-operations processed by the execute stage. There may also be a one-to-many or many-to-one relationship between program instructions and micro-operations, such as a program instruction being split into two or more micro-operations or two or more program instructions being fused together and processed as one micro-operation.

[0070] The execution stage 16 includes several processing units for performing different classes of processing operations. For example, the execution units may include a scalar arithmetic / logic unit (ALU) 20 for performing arithmetic or logical operations on scalar operands read from the registers 14, a floating point unit 22 for performing operations on floating point values, a branch unit 24 for evaluating the results of branch operations and adjusting a program counter representing the current execution point accordingly, and a load / store unit 26 for performing load / store operations to access data in the memory system 8, 30, 32, 34. A memory management unit (MMU) 28, an example of a memory management circuit, is provided for performing address translation between a virtual address specified by the load / store unit 26 based on the operands of a data access instruction and a physical address that identifies a storage location of the data in the memory system. The MMU has a translation lookaside buffer (TLB) 29 for caching address translation data from page tables stored in the memory system, whose page table entries define the address translation mappings and may also specify access permissions that govern, for example, whether a given process executing on the pipeline is allowed to read, write, or execute instructions from a given memory region.

[0071] In this example, the memory system includes a level 1 data cache 30, a level 1 instruction cache 8, a shared level 2 cache 32, and a main system memory 34. It will be appreciated that this is only one example of a possible memory hierarchy and other arrangements of caches can be provided. The particular types of processing units 20-26 shown in the execution stage 16 are only one example and other implementations may have different sets of processing units or may include multiple instances of the same type of processing unit such that multiple micro-operations of the same type can be processed in parallel. It will be appreciated that FIG. 1 is only a simplified representation of some components of a possible processor pipeline implementation and that the processor may include many other elements that are not shown for the sake of brevity. Although FIG. 1 shows a single processor core with access to memory 34, device 2 may also have one or more further processor cores sharing access to memory 34, each core having a respective cache 8, 30, 32.

[0072] 2 is a diagram illustrating different execution states (also called exception levels) that a processing circuit 4 may operate in when executing instructions. In this example, there are four exception levels EL0, EL1, EL2, EL3, with exception level EL0 being the least privileged exception level and exception level EL3 being the most privileged exception level. In general, when executing at a more privileged exception level, the processing circuit may access some memory locations or registers 14 that are inaccessible to less privileged exception levels.

[0073] In this example, exception level EL0 is for running applications managed by a corresponding operating system or virtual machine running at exception level EL1. When multiple virtual machines coexist on the same physical platform, a hypervisor operating at EL2 may be provided to manage each virtual machine. Although Figure 2 shows an example in which the hypervisor manages the virtual machines and the virtual machines manage the applications, it is also possible for the hypervisor to directly manage applications at EL0.

[0074] Although not required, some implementations may implement separate hardware partitioned secure and non-secure operating domains for processing circuitry. Data processing system 2 may have hardware features implemented in the processor and memory systems to ensure that data and code associated with software processes operating in the secure domain are isolated from access by processes operating in the non-secure domain. For example, a hardware architecture such as the TrustZone® architecture offered by Arm® Limited of Cambridge, UK may be used. Alternatively, other hardware-enforced security partitioning architectures may be used. Secure applications (trusted services) may run at exception level EL0 in the secure domain, and secure (trusted) operating systems or virtual machines may run at exception level EL1 in the secure domain. In some implementations, there is no support for EL2 in the secure state, and the hypervisor may only run in non-secure EL2. In other implementations, there may be support for a secure hypervisor running in secure EL2, as indicated by the asterisk in FIG. 2. In some examples, a secure monitor program may be provided running at exception level EL3 to manage transitions between non-secure and secure domains. Other implementations may monitor transitions between security domains in hardware, such that a secure monitor program may not be required.

[0075] Address Translation One task performed by the MMU 28 is address translation between virtual addresses (VA) and physical addresses (PA). Software executing on the processing circuitry 4 uses virtual addresses to specify memory locations, but these virtual addresses may be translated by the MMU 28 into physical addresses that identify the memory system locations to be accessed. An advantage of using virtual addresses is that it allows management software, such as an Operating System (OS), to control the view of memory that is presented to the software. The OS can control what memory is visible, the virtual addresses to which that memory is visible, and what accesses are allowed to that memory. This allows the OS to sandbox applications (hide the resources of one application from another) and provide abstraction from the underlying hardware. Another advantage of using virtual addresses is that the OS can present multiple fragmented physical regions of memory to an application as a single contiguous virtual address space. Virtual addresses also benefit software developers who do not know the exact memory addresses of the system when writing their applications. With virtual addresses, software developers do not need to be concerned with physical memory. Applications know that it is up to the OS and hardware to cooperate to perform the address translation.

[0076] In practice, each application can use its own set of virtual addresses that are mapped to different locations in the physical system. When the operating system switches between different applications, it reprograms the maps, which means that the virtual addresses of the current application are mapped to the correct physical locations in memory.

[0077] Virtual addresses are translated to physical addresses through a mapping. The mapping between virtual and physical addresses is stored in a translation table (sometimes called a page table). The translation table is stored in memory and managed by software, typically an OS or a hypervisor. The translation table is not static; the table can be updated as the needs of the software change. This changes the mapping between virtual and physical addresses.

[0078] For memory accesses performed when the processing circuitry 4 is in a particular subset of execution states (in particular, when the processing circuitry 4 is in non-secure EL0 or non-secure EL1), a two-stage address translation is used as shown in FIG. 3 (for other execution states, one stage of address translation using stage 1 page tables is sufficient). Thus, virtual addresses from non-secure EL0 and non-secure EL1 are translated using two sets of tables. These tables support virtualization and allow the hypervisor to virtualize the view of physical memory seen by a given virtual machine (VM) (a virtual machine corresponding to a guest operating system and the applications controlled by that guest operating system). The set of translations controlled by the OS is called stage 1. The stage 1 tables translate virtual addresses into intermediate physical addresses (IPAs - an example of the intermediate addresses mentioned above). In stage 1, the OS thinks that the IPA is a physical address space. However, the hypervisor controls a second set of translations called stage 2. This second set of translations translates the IPA into a physical address.

[0079] The stage 1 translation table and the stage 2 translation table are implemented as a hierarchical table structure that includes several levels of translation tables as shown in Figures 4 and 5 for stage 1 and stage 2, respectively. In this example, both the stage 1 table and the stage 2 table can have up to four levels of page tables, namely level 0 (level 0, L0), level 1 (level 1, L1), level 2 (level 2, L2), and level 3 (level 3, L3).

[0080] To find a physical address mapping for a given address, a translation table walk is performed that includes one or more translation table lookups. A translation table walk is the set of lookups required to translate a virtual address to a physical address. In the case of a non-secure EL1&0 translation regime, this set includes both stage 1 and stage 2 translation lookups (see FIG. 6 below). The information returned by a successful translation table walk using stage 1 and stage 2 lookups is as follows: ● The required physical address (translated based on the stage 1 mapping to intermediate addresses and the stage 2 mapping to physical addresses). Access permissions and / or memory attributes of the target memory region that provide information about how to control access to that memory region. These may include stage 1 access permissions and / or attributes defined in the stage 1 table structures and stage 2 access permissions and / or attributes defined in the stage 2 table structures.

[0081] To traverse a given one of the Stage 1 and Stage 2 structures, the walk begins with reading the top-level (L0) translation table for an initial lookup, based on the address specified in the Translation Table Base Address Register (TTBR for Stage 1, VTTBR_EL2 for Stage 2). Each translation table lookup returns a descriptor indicating one of the following: ● The entry is the final entry of the traversal of the stage 1 or stage 2 structures and provides the address mapping being explored. If the entry is in the last L3, this entry is called a page descriptor (D_Page), while if the entry providing the last entry of the walk is in one of the higher levels, it is called a block descriptor (D_Block). The final entry of the traversal contains the output address (OA, i.e. IPA in stage 1 or PA in stage 2) and the access permissions and attributes. If a block descriptor is found at a higher level of the translation table structure, this means that the block descriptor represents a memory region of a size larger than the 4kB memory page represented by a single entry in L3 (the specific size represented by the block descriptors in L1 and L2 depends on the number of index bits used to index the L1 or L2 table, in this example the L1 and L2 block descriptors represent 1GB and 2MB regions, respectively). An additional level of lookup is required. In this case, the entry is called a Table Descriptor (D_Table) because it provides the translation table base address for that lookup in the further level table. The table descriptor can optionally also provide other hierarchical attributes that can be applied to the final translation. The encoding of the translation table entries at level 1 and level 2 distinguishes block descriptors from table descriptors. The descriptor is invalid. In this case, the memory access generates a conversion failure.

[0082] FIG. 4 illustrates indexing of the stage 1 translation tables using respective bits of the virtual address provided as the input address for the table lookup. The base address of the top level table L0 is read from the TTBR, and the base addresses of the L1, L2, and L3 tables are indicated by the addresses stored in the indexed table descriptors in the L0, L1, and L2 tables, respectively (if no block descriptor is identified in the L1 or L2 tables, and if a block descriptor is found in the indexed entry of L1 or L2, the traversal stops at that level since the output address mapping has already been found). The particular entry to select within a given level of the stage 1 translation table is determined based on index values ​​a, b, c, and d that correspond to some subset of the bits of the virtual address provided as the input address for the lookup. FIG. 4 illustrates which bits of the input address are used for each index value a, b, c, and d in one particular example. The address of the associated entry in a given table is obtained by adding a multiple of index bits a, b, c, or d to the base address of that given table, as determined based on the TTBR, or to the address specified in the previous level table descriptor (the multiplier is applied to the index value corresponding to the size of one translation table entry).

[0083] Similarly, FIG. 5 illustrates indexing of the stage 2 translation table using respective bits of the intermediate address provided as the input address for the stage 2 table lookup. The indexing is similar to that shown in FIG. 4 for stage 1, but uses a different base address register VTTBR_EL2 to provide the base address of the L0 table. As shown in the example of FIG. 5, for stage 2 lookup, it is possible to change the starting level at which the walk of the stage 2 translation table begins based on the value stored in a control register VTCR_EL2.SL0, which can specify that the lookup should start from either L0 or L1. If the stage 2 lookup starts from L0, the indexing for levels 0, 1, 2, 3 uses index values ​​a, b1, c, d respectively, as in FIG. 4 for stage 1. If the stage 2 lookup starts from L1, the indexing is performed in a similar manner, but now more index bits b2 are used at the top level (L1) of the lookup, as shown in FIG. 5. Providing a variable starting level is not an essential feature and can be omitted if desired. Although not shown in FIG. 4, it is also possible to provide a variable starting level for the lookup in stage 1.

[0084] 6, in practice, when a full translation table walk is performed that includes both stage 1 and stage 2 translations, each stage 1 table base address obtained from the TTBR and table descriptor accessed in the stage 1 L0, L1, L2 translation tables becomes an intermediate address that itself needs to be translated using the stage 2 translation table. Thus, if the translation table walk does not encounter a block descriptor and continues all the way to L3 where a page descriptor is found, the full page table walk process can include accessing multiple levels of page tables in the following sequence:

[0085] Stage 2 translation of the Stage 1 L0 page table base address in a physical address. (The Stage 1 L0 base address is typically an intermediate physical address, since the Stage 1 translation is constructed by the operating system.) Stage 2 translation is four lookups (Stage 2 L0; Stage 2 L1; Stage 2 L2; Stage 2 L3). ●Stage 1 L0 lookup of an entry at the address obtained based on the L0 index portion "a" of the target virtual address and the translated stage 1 L0 base address to obtain the stage 1 L1 base address (intermediate physical address). Stage 1 in the physical address is the stage 2 translation of the L1 base address (again involving four lookups). ● Stage 1 L1 lookup of an entry at the address obtained based on the L1 index portion 'b' of the target virtual address and the translated stage 1 L1 base address to obtain the stage 1 L2 base address (intermediate physical address). Stage 1 of the physical address is the stage-2 translation of the L2 base address (again involving four lookups). ● Stage 1 L2 lookup of an entry at the address obtained based on the L2 index portion 'c' of the target virtual address and the translated stage 1 L2 base address to obtain the stage 1 L3 base address (intermediate physical address). Stage 1 in the physical address is the stage 2 translation of the L3 base address (again involving four lookups). ● A stage 1 L3 lookup of an entry at the address obtained based on the L3 index portion "d" of the target virtual address and the translated stage 1 L3 base address to identify a target intermediate physical address corresponding to the target virtual address. ●Stage 2 translation of the target intermediate physical address within the target physical address that represents a location in memory to access corresponding to the original target virtual address (again involving four lookups).

[0086] Thus, assuming no caching and the stage 2 starting level is L0, the translation will involve a total of 24 lookups. If the starting level for stage 2 is L1, this can reduce the number of lookups to 19 (one less lookup for each of the five stage 2 translations performed). Nevertheless, as can be seen from the above sequence, performing the entire page table walk process can be very slow as it may require numerous accesses to memory to step through each of the levels of page tables in each of the stages of the address translation. This is why it is often desirable to cache information derived from the translation table walk in the TLB 29 of the MMU 28. The cached information may include not only the final stage 1 address mapping of VA to IPA, the final stage 2 mapping of IPA to PA, or the combined stage 1 and stage 2 mapping of VA directly to PA (derived from previous lookups of the stage 1 and stage 2 structures), but also entries from the higher level page tables of the stage 1 and stage 2 tables may be cached in the TLB 29 of the MMU 28. This allows at least some steps of a full page table walk to be bypassed even if the last level address mapping for a given target address is not currently in the address translation cache.

[0087] 6 is annotated with information specifying certain permissions or characteristics that may be defined for some of the translation table entries involved in the two-stage address translation. These permissions and characteristics will be described below and in more detail later.

[0088] Memory Management Unit Example FIG. 7 illustrates memory management unit 28 in more detail. Although FIGS. 1 and 7 illustrate a single MMU 28 for simplicity, separate instruction-side and data-side MMUs may be provided to handle memory management operations for instruction fetch accesses initiated by fetch stage 6 and data accesses initiated by load / store unit 26, respectively, in which case both the instruction-side and data-side MMUs may have the components shown in FIG. 7. Similar to TLB 29, MMU 28 includes access control circuitry 50 for checking access permissions specified in looked-up translation table entries and controlling processing of memory access requests in accordance with those access permissions. For example, access control circuitry 50 may implement a check to determine whether a particular type of memory access request (e.g., based on whether the request is a read request, a write request, or an instruction fetch request, or based on the type of instruction executed that caused the request to be issued) satisfies the permissions specified in the corresponding translation table entry for a given region of memory being accessed. The MMU also includes a translation table walk control circuit 52 that issues memory access requests to memory to request the reading of translation table entries during the translation table walk process illustrated above in FIGS. 4-6 if the required information from the translation table is not already available in the TLB 29. The translation table walk control circuit 52 may be responsible for generating addresses of memory system locations that are read to obtain associated translation table entries in the stage 1 or stage 2 translation table structures. Additionally, while performing a translation table walk, the translation table walk control circuit 52 may generate metadata update write requests requesting updates to access tracking metadata in a particular translation table entry being traversed in the translation table walk. These metadata update write requests may update the access tracking metadata to reflect that a particular memory region has been accessed, which may be useful for managing operations such as paging.Because the address of a metadata update write request is the address of a translation table entry accessed in a translation table walk, rather than the address of the data or instruction being accessed, the metadata update write request is generated in hardware to specify an address that is not directly specified as the instruction fetch address, or a load / store target address that is derived from an operand of the load / store instruction executed by processing circuitry 4.

[0089] The MMU 28 has access to various control registers for controlling the translation table walk and other aspects of memory management operations. For example, the control registers may include a stage 1 base address register TTBR_EL1 and a stage 2 base address register VTTBR_EL2, as described above with respect to Figures 4 and 5. The stage 1 base address in register TTBR_EL1 is writeable in response to an instruction executing at exception levels EL1, EL2, or EL3. The stage 2 base address in register TTBR_EL2 is writeable in response to an instruction executing at exception levels EL2 or EL3. In some cases, a control value may be set to indicate that a write to TTBR_EL1 triggered by an instruction executing at EL1 should be trapped to EL2, so that a hypervisor running at EL2 can check for updates being requested by the operating system and prevent the updates if necessary. The control registers also include registers TCR_EL1, VTCR_EL2, which are used to specify various control status values ​​that affect the way in which stage 1 and stage 2 translation and access permission checks are performed. For example, a control value specifying the starting level for the stage 2 walk may be specified in VTCR_EL2. Also, the TCR_EL1 or VTCR_EL2 control registers may specify control values ​​specifying what type of security checks are enabled / disabled. As described in more detail below, the control registers may also include mask registers (labeled RCWMask_Valid_EL2 and RCWMask_Invalid_EL2) to specify a subset of update-restricted bits in the protected stage 1 translation table entries for valid and invalid entries, respectively. It will be appreciated that additional control registers may be provided and that the labels used for the control registers may be modified.For example, one or more permission indirect registers may be provided to specify indirect access permission information that may be referenced by a given translation table entry to specify access permission information for the given translation table entry. Also, the same information may be placed in the control registers in different formats, and thus the particular assignment of information to one control register or another is not an essential feature.

[0090] As shown in FIG. 7, the device may have a protection entry check circuit 54 for performing a protection entry check when an update is requested for a stage 1 translation table entry encoded as a protection entry (as described in more detail below). As indicated by the dotted lines in FIG. 7, it is possible to implement the protection entry check circuit 54 at different locations within the processing system. For example, the protection entry check circuit 54 may be part of the access control circuit 50 of the MMU 28. Alternatively, the protection entry check circuit may be implemented within a memory system component 56 that is closer to the physical memory system location being accessed by a given memory access request that is to be checked using the protection entry check circuit 54. For example, the memory system component 56 may be a cache 30, 32, an interconnect used to manage access to a shared memory by multiple processor cores, or a memory controller associated with a particular memory storage unit. Also, the protection entry check circuit 54 may include distributed logic at multiple locations within the system (e.g., the MMU 28, the load / store unit 26, and / or the memory system component 56).

[0091] Translation table access permissions and attributes 8 illustrates an example format of a translation table entry in a stage 1 translation table structure and a stage 2 translation table structure. It will be understood that the same information may be represented in different arrangements, and thus the particular ordering and layout of the fields in the descriptor may differ from that shown in FIG.

[0092] In this example, a valid translation table descriptor has its least significant bit set to 1 and an invalid translation table descriptor has its least significant bit set to 0. For a valid descriptor read at one of levels 0, 1, 2 of the translation table structure, the second least significant bit distinguishes whether the descriptor is a table descriptor (second least significant bit set to 1) or a block descriptor (second least significant bit set to 0). A page descriptor in L3 of the stage 1 or stage 2 structure may have its second least significant bit set to 1 to allow page descriptors to be distinguished from block descriptors. Of course, valid / invalid entries and table / block / page descriptors can also be distinguished by other encoding methods.

[0093] For both stage 1 and stage 2 entries, the valid table descriptor provides a next level table address 60 that indicates the base address of the translation table at the next level of the stage 1 or stage 2 translation table structure. The valid stage 1 block or page descriptor provides an intermediate address mapping 62 that corresponds to the virtual address used to index the stage 1 translation table structure. The valid stage 2 block or page descriptor provides a physical address mapping 64 that corresponds to the intermediate address used to index the stage 2 translation table structure.

[0094] The stage 1 block and page descriptors also provide stage 1 access permissions 66 that are used to control access to the corresponding memory region. For example, stage 1 access permissions 66 (typically set by the OS in EL1) may specify whether a region is permitted to be read, written, and / or used for instruction fetching of executable instructions.

[0095] Similarly, the stage 2 block and page descriptors provide stage 2 access permissions 68 that are used to control access to the corresponding memory region. Again, the stage 2 access permissions 68 (typically set by the hypervisor in EL2) may specify whether the region is permitted to be read, written, and / or used for instruction fetching of executable instructions. If there is a conflict between the stage 1 access permissions 66 and the stage 2 access permissions 68, the more restrictive set of attributes may take precedence.

[0096] A stage 1 block / page descriptor or stage 2 block / page descriptor may also specify other attributes associated with a memory region that are not shown in Figure 8. For example, these attributes may specify characteristics such as whether caching of data from the corresponding memory region is permitted, whether the region is defined as device memory such that reordering or merging of different memory accesses to device memory is not permitted, etc.

[0097] Stage 1 block / page descriptors may also specify access tracking metadata that may be used by the operating system to track the frequency of access to a given memory region. For example, the metadata may include access flags (AF) 70 and dirty bit modifiers (DBM) 72.

[0098] Periodically, the operating system may clear the access flags in the entries corresponding to the set of memory regions being monitored. When a read access is made to one of these memory regions, the access flag 70 may be set in the corresponding stage 1 block or page descriptor (if not already set following a previous access) (the memory access request that causes the access flag 70 to be set may be one of the metadata update write requests generated by the translation table walk control circuit 52 described above). After a monitoring period, the operating system may check the access flag 70 to assist operations that may benefit from information about how frequently a particular page is accessed. For example, the operating system may maintain in memory a further tracking data structure having an entry for each memory region that tracks how many times the memory region has been accessed, and thus increment the entries in that further tracking structure that correspond to memory regions that have the access flag 70 set at the end of each monitoring period. Thus, after several monitoring periods, the further tracking structure provides an indication of the relative frequency of accesses to the corresponding memory region. This can provide useful information for controlling operations such as paging; it can be useful to know the least frequently accessed pages of memory whose corresponding data may be prioritized for paging out to external storage compared to other, more frequently accessed pages.

[0099] Similarly, DBM 72 helps track which pages have been written to. If the operating system wants to track whether a given page has been written to, then when the page is mapped or at the start of a monitoring period, the operating system can set the access permissions for that page as "read-only" (even though the page is intended to be allowed to be written to) and set DBM bit 72. If a access permission failure is caused by a write to a read-only page when DBM bit 72 is set, the operating system can determine that this is not a "true" violation of read-only permissions because DBM bit 72 is set, and can instead cause the operating system to update data structures stored in memory that track pages that receive write requests, and update the write access permissions for the page to indicate that the page can now be written to without triggering a failure. After a monitoring period, the tracking data structures in memory can be used by software to determine whether modified data from a particular region needs to be written back to external storage when paging out that region, or (if no write has occurred) whether the corresponding data in external memory can be assumed to still be the same if the data is clean, and therefore the data stored in the on-chip memory can simply be discarded when paging out the region.

[0100] The access flags 70 and dirty bit modifiers 72 are merely some examples of possible access tracking data that may be stored in a translation table entry, and other examples may provide other types of access tracking metadata. For example, in another example, a multi-bit access counter may be provided as the access tracking metadata. Also, in another example, instead of the DBM bits 72 being used to modify the handling of read-only access permission violations for write requests and trigger updates to the write permissions, the DBM flags 72 may be updated directly in response to the first write to the page after clearing the DBM flags 72, in a manner similar to how the access flags 70 are updated on the first access to the page, as described above.

[0101] As shown in Figure 8, the various translation table descriptors may also contain several other information that may be useful in protecting stage 1 translation table entries from corruption by operating system code under attack by an attacker. Typical operating system code may contain many lines of code that may be difficult to fully verify as safe against attack, and therefore it is desirable to provide an architectural mechanism to protect against the possibility that an attacker may be able to modify the behavior of the operating system code to cause writes to memory regions used to store translation table entries, and may be able to modify the address mappings or permissions within these entries to give the attacker the right to access memory regions in an unauthorized manner.

[0102] As shown in FIG. 8, the additional attributes and permissions described below to harden the stage 1 translation table against attacks include: ●The stage 2 block / page descriptor specifies stage 2 access permissions 68 having an encoding that indicates whether the corresponding memory region has partially read-only (PRO) permission (partially read-only permission can also be referred to as ``mostly read-only'' permission). ● Valid stage 1 descriptors (including table descriptors and block / page descriptors) at all levels of the stage 1 translation table structure have an encoding that specifies whether the translation table entry is a "protected" entry, which provides additional protection against unauthorized updates compared to non-protected entries. For example, a bit field 76 in the valid stage 1 descriptor may indicate whether the entry is a protected entry. ● Invalid stage 1 descriptors at all levels of the stage 1 translation table structure may also have an encoding that specifies whether the translation table entry is a "protected" entry. This may be indicated using a bit field 78 that may be in a different position within the translation table entry encoding compared to the bit field 76 used to represent a protected entry for a valid stage 1 translation table entry. ● A stage 2 block / page descriptor may have an indicator 79 that specifies whether the corresponding memory region has anti-aliasing properties. In some examples, the presence or absence of anti-aliasing properties may be encoded in a combined bit field that may also signal other types of properties, or alternatively, the anti-aliasing bit field may be a standalone bit field that does not signal other information. If specified, the anti-aliasing property indicates that in order for access to the corresponding physical address to be permitted, all stage 1 translation table entries accessed in the translation table walk to obtain the intermediate address used to access that stage 2 descriptor must be designated as protected entries using bit field 76, and the corresponding stage 2 block / page descriptor must be stored in a region of memory that indicates partial read-only permission 74. ● The stage 2 block / page descriptor may also specify in stage 2 access permission 68 a stage 1 top level entry presence permission 80 indicating whether the corresponding memory region is permitted to hold a top level translation table for stage 1 translation (i.e., the stage 1 L0 table in the examples of Figures 4 and 6). In one example, the encoding of stage 2 access permission 68 may be such that the stage 1 top level entry presence permission is encoded as a further attribute of the PRO permission, and thus the values ​​allowed to be encoded for stage 2 access permission 68 may include values ​​indicating: ○ Stage 1 PRO permission without top-level entry existence permission, ○ PRO authorization with Stage 1 top-level entry existence authorization, or o One or more other types of permissions (eg, read-only, read / write, and / or execute) that do not have either PRO or stage 1 top-level entry existence permissions.

[0103] In this case, it may not be possible to specify the stage 1 top-level entry presence permission independently of the PRO permission. However, other implementations may encode the stage 1 top-level entry presence permission independently of the PRO permission, such that the stage 1 top-level entry presence permission may be specified even if the PRO permission is not provided.

[0104] The use of these attributes and permissions is described in more detail below. It will be understood that not all of these attributes need to be supported in every possible implementation. Although FIG. 8 shows an example where the S1 and S2 access permissions are specified directly in the encoding of the translation table entry, it is also possible to indirectly specify the same information using permissions specified in a permission register. For example, the S1 or S2 permission field 66, 68 can specify an index value that selects which of several permission fields of the permission register specify the access permissions for the corresponding translation table entry. It is also possible that some fields of the translation table entry can be interpreted differently depending on the control state stored in the control register. For example, the protected entry field 76 of the stage 1 translation table entry can be interpreted as indicating whether the stage 1 translation table entry is protected when the control value stored in the control register has a first value, and can be interpreted differently when the control value has a second value. Similarly, the anti-aliasing characteristics field 79 of the stage 2 translation table entry may be interpreted as indicating whether the stage 2 translation table entry has anti-aliasing characteristics when the control value stored in the control register has a first value, and may be interpreted in a different manner when the control value has a second value.

[0105] Partial Read-Only Permission 9 summarizes the write access control behavior for memory regions marked by stage 2 access permission 68 as having partial read-only (PRO) permission. A memory region with PRO permission is writable for a restricted subset of write request types, at least for write requests issued when the current execution state is EL1 (the state in which operating system code is expected to execute), but is treated as read-only for write request types. Since only some write request types consider the memory region read-only, the permission is therefore described as partial read-only permission.

[0106] FIG. 9 summarizes the types of write requests permitted and prohibited to write to memory regions where a corresponding stage 2 translation table entry defines the region as having PRO permission. The restricted subset of write request types permitted to write to PRO regions when the write is issued at EL1 includes metadata update write requests generated by MMU 28 to update access tracking metadata in a translation table entry, such as writes permitted when access flags 70 or dirty bit modifier 72 are set as described above. The restricted subset may also include at least one predetermined type of translation table entry update instruction executed in exception state EL1, which may be a dedicated type of instruction intended for use in updating translation table entries to express the intent of the program code to distinguish such writes to update translation table entries from writes to update data other than translation table entries. For example, the predetermined type of translation table entry update instruction may include a variant of the Protected Entry Check Read Check Write (RCW) instruction described with respect to FIGS. 12-14 below. 9, write requests issued in response to at least one other type of store instruction executed in one of exception states EL0 and EL1 are prohibited from writing to a PRO region of memory. For example, the prohibited write request types may include a majority of store instructions in the instruction set architecture supported by processing circuit 4. By restricting the ability to update translation table entries when a region is marked PRO-permitted to a limited set of instruction types, this reduces the attack surface available to an attacker when attempting to corrupt stage 1 translation table entries; for example, tampering with the address operand of a general purpose store that is not one of the restricted subset of write requests will disallow access to a PRO region of memory.

[0107] Optionally, a write request issued in response to a store instruction executed in one of execution states EL2 or EL3 may be permitted to write to a partial read-only region, even if the store instruction is of a type that would have been prohibited from writing to that region if executed in execution state EL0 or execution state EL1, although this is not required as discussed above.

[0108] FIG. 10 is a flow diagram illustrating a method for processing instructions and controlling memory management operations. In step 500, the processing circuitry 4 processes instructions in one of a plurality of execution states EL0-EL3 associated with different privilege levels. In step 502, in response to the memory access request, the MMU 28 performs a two-stage address translation of a target virtual address (VA) specified by the memory access request to a target physical address (PA), where the mapping of the target VA to the target PA depends on a stage 1 address mapping from the target VA to a target intermediate address (IPA) and a stage 2 address mapping from the target IPA to the target PA. In step 504, the access control circuitry 50 of the MMU 28 performs a permission check for the memory access request based at least on the stage 2 access permission information 68 specified in the corresponding stage 2 translation table entry. The permission check may also be based on the stage 1 access permission information 66. The stage 2 access permission information 66 has an encoding that specifies whether the memory region corresponding to the target IPA has PRO permission. In step 506, MMU 28 rejects the memory access request if the memory access request is a write request issued in a predetermined execution state (e.g., EL1), the stage 2 access permission information specifies PRO permission, and the write request is a write request type other than the restricted subset of write request types permitted for writing to a PRO region of memory. Optionally, MMU 28 can also reject the memory access request when the memory access request is a write request issued in an execution state other than the predetermined execution state (e.g., EL0) when PRO permission is specified by the stage 2 access permission information and the write request type is not one of the restricted subset of write request types.

[0109] 11 illustrates in more detail the partial read-only check performed by access control circuit 50 of MMU 28. In step 600, a write memory access request is issued when processing circuit 4 is in a predefined execution state (EL1). The write request specifies a target VA. The write request may have been issued by load / store unit 26 of processing circuit 4 in response to a load / store instruction executed by the processing circuit, or by fetch stage 6 when requesting an instruction fetch. The write request may be a metadata update write request issued by MMU 28 to update access tracking metadata in a translation table entry during a translation table walk process.

[0110] In step 602, the target VA is translated to a target PA that identifies the memory system location to be accessed. To perform the translation, MMU 28 may look up the target VA in TLB 29; if a mapping from the target VA to the target PA is already available in TLB 29, no translation table walk is required. Otherwise, at least a portion of the translation table walk process shown in FIG. 6 may be required, but it may be possible to skip some portions if information derived from the corresponding translation table entry for that portion of the translation table walk is already cached in TLB 29. For write memory access requests issued from non-secure EL1, the translation is performed as a two-stage address translation based on mappings defined in both the stage 1 translation table and the stage 2 translation table; however, this does not necessarily mean that two separate translations need to be performed, since a combined stage 1 / stage 2 TLB may be provided that caches a direct mapping from the target VA to the target PA (which depends on both the stage 1 and stage 2 mappings) along with the corresponding stage 1 permission information and stage 2 permission information to avoid the need for the target IPA to be explicitly determined.

[0111] In step 604, the access control circuit checks whether the corresponding stage-2 (S2) translation table entry (a stage-2 entry that specifies a mapping from a target IPA to a target PA) specifies PRO permission. If so, in step 606, the access control circuit checks whether the write request being processed is one of a restricted subset of write request types. If the current write request is not one of the restricted subset of write request types (including at least a metadata update write request), in step 608, the memory access request is rejected and a failure is notified. If the write request is one of the restricted subset of write request types, the partial read-only check passes, and thus the method proceeds to step 610. Also, in step 604, if the corresponding stage-2 translation table entry did not specify PRO permission, the partial read-only check in step 606 can be omitted, and thus the method proceeds directly from step 604 to step 610.

[0112] In step 610, the access control circuitry determines whether any other checks required to allow the write memory access request to proceed are satisfied. For example, these checks may include checks using stage 1 access permissions 66, checks using other stage 2 access permissions 68 if PRO permission is not specified, security checks based on whether the request was issued from a secure state or a non-secure state (in implementations that support a secure state), as well as other checks specific to a particular instruction type, such as the checks described below with respect to Figures 12-14 regarding whether the data at the target memory location is a protected translation table entry. If any of these other checks are not satisfied, then again in step 608, the memory access request is rejected and a failure is signaled. Failure syndrome information may be set to distinguish the cause of the failure. If the checks performed in step 610 are satisfied, then in step 612, the memory access request may be allowed to proceed, and thus the memory system location associated with the target PA may be updated with the write data specified by the write request.

[0113] Thus, as shown in FIG. 6 described above, PRO permissions may be specified in stage 2 access permissions 68 of stage 2 translation table entries used to provide physical addresses of memory system locations that hold various levels of stage 1 translation tables used in traversing the stage 1 table structures to obtain intermediate addresses of memory regions containing sensitive information. This protects those stage 1 translation entries from corruption by mis-functioning code or operating system code under attack by a malicious party, since PRO permissions restrict the ability to write to the corresponding memory regions to a limited subset of instruction types, greatly reducing the number of lines of code that may be vulnerable to corruption of the stage 1 translation tables. Nevertheless, hardware-generated write requests to update access tracking metadata in the translation table entries may still be permitted for such regions to avoid compromising the efficiency of paging operations by the operating system.

[0114] FIG. 11 illustrates the partial read-only check being performed for write memory access requests issued when in a given execution state EL1, but it can also be performed for other execution states. However, this may not be required since for write requests issued in the least privileged execution state EL0, the memory region holding the stage 1 translation table is likely to be marked as inaccessible to application level code running at EL0 by stage 1 access permission 66 in any case, and thus the stage 1 permission check can already prevent such write requests from corrupting the stage 1 translation table. Also, for code running at EL2 or EL3, the translation table is unlikely to use two-stage address translation and restrict writes to the region storing the stage 1 translation table entries, since the hypervisor or monitor code is likely to be the code controlling the restrictions on what updates are allowed to the stage 1 translation table. Thus, some implementations may restrict the partial read-only check to be performed only when the current execution state is EL1. Other implementations may apply the partial read-only check regardless of which execution state is the current execution state.

[0115] Protected entry encoding for stage 1 translation table entries Using PRO permissions to mark certain memory regions as read-only for write requests other than a restricted subset of write types helps protect the stage 1 tables from corruption. However, as shown in Figure 6, typically a given translation table at a given level of the translation table structure occupies an entire page in memory, and therefore PRO permissions apply to the entire translation table at a given level of the stage 1 translation table structure, which may include translation table entries for various memory regions, which may include some memory regions used for sensitive information that needs to be protected against unauthorized access and other memory regions that contain only non-sensitive information that does not require this protection.

[0116] As described further below, it is possible to provide implementations that do not support the use of protected entry encoding for stage 1 translation table entries. In this case, to allow an operating system to update certain stage 1 translation table entries associated with unprotected areas that contain non-sensitive information, a failure generated during a write access to a PRO area that is not one of the write request types permitted for writing to a PRO area may cause a trap to a hypervisor operating at EL2, which may determine in software whether the area in which the operating system wants to update a stage 1 translation table entry should be protected from being updated by the operating system, and if the area does not need to be protected, may allow the update requested by the operating system to proceed. In practice, however, an operating system may need to modify translation table entries in unprotected areas of memory relatively frequently, and therefore trapping to the hypervisor every time an update is needed may be slow in terms of performance.

[0117] The protected entry encoding for stage 1 translation table entries (e.g., using bits 76, 78) helps to allow the operating system to make updates to unprotected entries without hypervisor intervention (and, optionally, in some implementations, to make updates to the no-update restricted bits of protected entries without hypervisor intervention). This helps to improve performance because even if a given stage 1 translation table is stored in a PRO region of memory, it contains a mix of protected and unprotected entries, so hypervisor involvement can be avoided more frequently. The instruction decoder 10 and execution stage 16 of the processing circuitry 4 support at least one type of instruction, called a protected entry check type read check write (RCW) instruction, which can be used to request an update to a given memory system location, where the update is made subject to a protected entry check to check whether the data stored in the accessed memory system location has a value that matches the encoding of the protected stage 1 translation table entry. If data at an accessed memory system location is found to have a value matching data in a protected stage 1 translation table entry, updates to at least a subset of the update-restricted bits of the given memory system location are inhibited. The RCW instruction is permitted to be executed by an operating system executing at EL1. The RCW instruction is one of a restricted subset of instructions permitted to update data in a memory region marked with PRO permission by a corresponding stage 2 translation table entry.

[0118] The protection entry check is performed in hardware by a protection entry check circuit 54, which, as shown in Figure 7, may be implemented either within the MMU 28 or closer to the memory system location that stores the data, e.g., within a memory system component 56 such as a cache, interconnect, or memory controller. It is also possible to use a distributed set of logic with some parts of the protection entry check circuit 54 implemented within the MMU 28 (or execution stages 16 of the pipeline) and other parts implemented closer to the memory storage. The read, check, and write operations performed in the protection entry check are performed as atomic operations so that when access to a given memory system location is requested by another thread executing on the same processor circuit as the thread executing the RCW instruction, or by another processor core, the other access sees either the value of the given memory system location before processing the RCW instruction, or the value of the given memory system location after processing the RCW instruction, rather than any partial effect of the RCW instruction, and so that it is not possible to update the given memory system location in the period between the protection entry check reading the data at the given memory system location and the subsequent update of the data at the given memory system location in response to the RCW instruction. To implement atomicity, any known technique for performing atomic read / write operations on a memory system location can be used (e.g., locking the memory location against access by other operations during the period between the read and write, or allowing a conflicting access during that period, but resuming the RCW operation if a conflicting access is detected during the period between the read and write). By enforcing the atomicity of the read, check, and write, it avoids race conditions that can lead to incorrect processing results.Because the read, check, and write operations are performed atomically, it may be useful to implement the protection entry check circuitry 54 in a memory system component 56 closer to the storage location being updated to reduce the duration of the period between the read and write compared to the duration if the read data had to be returned all the way to the MMU 28 or another element of the processor pipeline 4 to perform a check before the write could proceed and the write data returned to the memory system location that stores the data.

[0119] In the example shown in FIG. 8, both the valid and invalid stage 1 translation table entries have an encoding that allows the entries to be designated as protected entries. However, it is not required that invalid entries can be designated as protected, and other examples may omit the protected entry encoding bit field 78 from the invalid entry format. Also, different implementations may choose different options for how many bits of a protected entry are inhibited from updating in response to an RCW instruction. Some implementations may prevent any updates to a protected entry in response to an RCW instruction, and if the data at a given memory system location is not encoded as a protected entry, updates are only allowed in response to an RCW instruction. Other implementations may specify a subset of update-restricted bits and a subset of update-unrestricted bits, and thus updates to a subset of update-unrestricted bits may be permissible even for protected entries. There may be some fields that are not critical to security, such as, for example, access flags 70 and dirty bit modifier 72, that are allowed to be updated even in protected entries. Which bits are update-restricted or update-unrestricted may either be fixed in a non-programmable manner for a given architecture, or may be programmable by software using a selection value stored in a control register. For example, the selection value may be selected from one of several different modes, each mode associated with a different setting in which the bits are update-restricted. However, in the example of FIG. 7, the selection value is encoded as a bit mask that identifies the locations of the update-restricted bits, and the selection value is stored in a mask register (e.g., the RCWMask_Valid_EL2 and RCWMask_Invalid_EL2 registers shown in FIG. 7 are for selecting the update-restricted bits of valid and invalid entries, respectively, and the RCW_Mask_Invalid_EL2 register may be omitted in implementations in which invalid entries cannot be encoded as protected entries).Updates to the selection value may be restricted to program instructions executing at or above a threshold privilege level, e.g., only instructions executing at EL2 or EL3 may be permitted to update the selection value. There may be some bits that are forced to be restricted from being updated regardless of the state of the selection value. For example, the bit fields 76, 78 used to encode whether an entry is a protected entry may not be permitted to be updated regardless of what other bits are permitted to be updated. In general, RCW instructions may be prohibited from changing the status of a particular entry as protected or unprotected. The setting of the bit fields 76, 78 may instead be controlled by program code executing at a higher level of privilege, such as EL2 or EL3, and the program code may access memory using a different set of stage 2 translation tables that do not mark the memory region storing the protected entries as partial read-only, and therefore may use standard general purpose store instructions to set the bit fields 76, 78 of the protected stage 1 entries.

[0120] There are various ways in which the protected entry check can be implemented. In one example, if the entry stored in the accessed memory system location is valid and protected, it cannot be modified, and if it is invalid, it can be modified, including enabling it (unless the entry is also protected). Alternatively, there may be a protected bit field 76 in valid entries and a protected bit field 78 in invalid entries, and modifications to protected entries may not be allowed, otherwise updates to non-protected (valid or invalid) entries are allowed (changing the status of whether the entry is protected or not). Another example may provide a protected bit field 76 in valid entries and a protected bit field 78 in invalid entries, and the RCW instruction can make any modifications to the entry if it is not protected (other than protected), while if it is protected, the RCW instruction can make modifications to some bits as described for valid entries and make modifications to some bits in the invalid entry. In some examples, the mechanism for describing which bits are protected is a hardwired architecture selection of any field except the protected field or the valid field. Alternatively, the mechanism for describing which bits are protected in valid entries can use a mask register owned by EL2, and / or the mechanism for describing which bits are protected in invalid entries is a mask register owned by EL2. Different choices for defining the update-restricted bits are possible for each of the valid and invalid entries, for example, one approach could be to define a mask register for defining the update-restricted bits of valid entries, but hardwire the update-restricted bits of invalid entries.

[0121] Also, there may be variations in how checks are applied when it is permitted to update some fields in a protected entry, but two exemplary options are: A) The protected entry check circuit 54 reads the current entry to check whether the entry is valid and / or protected, and then stores only the bits that are allowed to be written (without checking whether the RCW instruction was attempting to change update-restricted bits that are not allowed to be written). B) The protected entry check circuit 54 reads the current entry and checks if the entry is valid and / or protected. If it is protected and the RCW instruction is not trying to change a bit that is not allowed to be written, the write can proceed, but if the RCW instruction is trying to update an update-restricted bit, the write will fail and nothing will be written.

[0122] Both A and B are viable options.

[0123] In response to the RCW instruction, an indication of whether the write was successful or unsuccessful may be written to a condition status flag stored in a control register of the processing circuit 4. For example, the condition status register may include a number of condition flags (e.g., a negative flag N, a zero flag Z, a carry flag C, and an overflow flag V) that may be set depending on the outcome of the processing operation and that may be tested by a conditional instruction that may conditionally trigger an operation (such as a branch operation or an arithmetic / logic operation) depending on the state of the condition status flag. It may therefore be useful to update the condition status flag based on whether any part of the write requested by the RCW instruction was unsuccessful, to allow a subsequent instruction to take action depending on the outcome of the write without having to re-read the memory system location to check whether the write was successful.

[0124] 12, 13, and 14 show the processing of several variants of the guard entry check RCW instruction. FIG. 12 shows an example of the processing of either the store variant or the swap variant of the instruction (most of the processing steps are the same for both instructions, except for the final step 726 or 728 depending on the variant). Both the store variant and the swap variant specify a register Xd that provides an address operand used to generate the address of the given memory system location to be updated, and a source register Xs that provides the new data to be written to the given memory system location. At least the swap variant also specifies a destination register Xt to which the old data read from the given memory system location is written. The store variant differs from the swap variant in that the old data is not written to any destination register, so the store variant does not need to specify any destination register. However, in one example, the store variant and the swap variant may be encoded using the same encoding, except that the instruction may be treated as a store variant if the field used to specify the destination register Xt has a predetermined value. For example, some instruction set architectures may define a particular register specifier (e.g., register 31) as corresponding to the "0" register, which when specified as an operand of an instruction causes the operand to be treated as if it had a value of 0, without the operand having to actually be read from a register provided in hardware. Thus, in some examples, when destination register Xt is specified as the "0" register X31, the instruction may be treated as a store variant. In other examples, a store instruction may be encoded as an entirely different instruction type than a swap instruction.

[0125] In step 700 of FIG. 12, an address operand and new data to be written ("NewData") are read from registers identified by register specifiers Xd and Xs, respectively. In step 702, a target address for the memory access is determined based on the address operand. For example, the address operand can be treated as an absolute address that directly specifies the target address, or it can define an offset to a reference address, such as a value in a further base register or a program counter value that identifies the address of the RCW instruction itself. The target address calculated based on the address operand is a virtual address, which can be translated by the MMU 28 to a physical address. In step 704, assuming that any MMU checks (other than the protection entry check) on whether the target address is accessible to the current instruction are passed, a read request is issued to the memory system to obtain the data ("ReadData") read from the memory system location corresponding to the (translated) target address. This corresponds to the "read" of the RCW instruction.

[0126] As step 706, the protection entry check circuit 54 determines whether ReadData has a value consistent with the encoding of a protected stage-1 (stage-1, S1) translation table entry. This corresponds to the "check" portion of the RCW instruction. If ReadData does not have a value consistent with being a protected stage-1 translation table entry, then in step 708, the protection entry check circuit checks whether NewData is encoded as a protected stage-1 translation table entry. If so, in step 710, the write requested by the RCW instruction is denied, or alternatively, the non-update-restricted bit of the stage-1 translation table entry designated by the RCW instruction as NewData can be written to the corresponding bit of the memory system location, and at least the bit used to encode whether the entry is protected is considered to be a non-write update-restricted bit. In any case, in step 712, a condition status flag is set to report that the write requested by the RCW instruction could not be fully performed.

[0127] If, in step 706, it is determined that ReadData is encoded as a protected stage 1 translation table entry, then in step 716, protection entry check circuit 54 determines whether the read data has a value consistent with being a valid or invalid stage 1 translation table entry. If the read data has a value consistent with being an invalid protected stage 1 translation table entry, then in step 718, protection entry check circuit 54 determines whether NewData attempts to modify any invalid entry update restricted bits (including at least any bits used to encode whether the entry is protected) of the stage 1 translation table entry, and if so, the method again proceeds to steps 710 and 712 to suppress updates of at least the invalid entry update restricted bits and set a condition status flag (again, this can be done by denying writes entirely or by writing only to non-update restricted bits).

[0128] On the other hand, if, in step 716, it is determined that ReadData has a value consistent with being a valid stage 1 translation table entry encoded as a protected entry, then in step 720, protection entry check circuit 54 determines whether NewData is attempting to modify any valid entry update restricted bits (including at least any bits used to encode whether an entry is protected or not) of the stage 1 translation table entry read from the memory system location corresponding to the target address. If so, then again in step 710, the write is denied or only permitted to write non-update restricted bits, and in step 712, a condition status flag is set to report the failure of the write.

[0129] In implementations that do not support invalid translation table entries being encoded as protected entries, steps 716 and 718 can be omitted and the method can proceed directly from step 706 to step 720 when ReadData is encoded as a protected entry.

[0130] If in step 708, the NewData that would be written if the ReadData was not a protected entry, or in steps 718 or 720, the NewData (that would be written if the ReadData was a protected entry) does not attempt to change an update-restricted bit, then in step 714, the write of the RCW instruction is permitted and therefore the NewData is written to the memory system location corresponding to the target address.

[0131] Regardless of whether the write was successful or rejected (at least partially), the operation changes depending on whether the current RCW instruction being executed is a store variant or a swap variant, at step 724. If the instruction is a store variant, no further action is required and ReadData is not written to any destination register, at step 726. If the instruction is a swap variant, ReadData is written to destination register Xt, at step 728. Some implementations may not support both store and stop variants, in which case step 724 may be omitted and the method may proceed directly from step 714 to the relevant one of steps 726 and 728.

[0132] The read in step 704, the write in step 714, and the various checking operations performed between steps 704 and 714 are performed atomically as an inseparable set of operations such that it is not possible for an intervening write to a memory system location to occur between the read in step 704 and the write in steps 710 or 714, or to see the partial results of another thread of execution performing the set of operations.

[0133] Some exemplary pseudocode for expressing the functionality of the store / swap variant of the RCW instruction is provided below. It will be understood that this is merely an example and is more specific than the more general representation shown in FIG. 12. For example, the pseudocode assumes that the selection of update-restricted bits for both valid and invalid protection entries are defined in corresponding mask registers, but as noted above, this is not required and other examples may hardwire the selection of which bits are update-restricted or may consider all bits of a protection entry to be update-restricted. In this example, a write failure is signaled by setting the "0" flag Z of the condition status flags to 1. In other examples, a different condition state may be selected to encode the write failure. It will be understood that the functionality illustrated below in the pseudocode may be implemented using hardware circuit logic within the protection entry check circuit 54 described above, and thus the pseudocode is intended to illustrate the logic functionality of the circuit logic rather than implying that software performs these functions.

[0134] [Table 1]

[0135] FIG. 13 is a flow diagram illustrating the processing of a compare-and-swap (CAS) variant of the protection entry check RCW instruction. The steps in FIG. 13, designated with the same reference numbers as FIG. 12, are the same as those described above. Note that the notation used for the registers used to store ReadData and provide NewData has been swapped in FIG. 13 compared to FIG. 12, with Xt being the register providing NewData and Xs being the destination register to which the old value of ReadData was written before the write. FIG. 13 differs from FIG. 12 in that step 700 is replaced by step 750, since the CAS variant specifies an additional source operand called compare data ("CompareData"). In this example, to reduce the number of register fields required in the instruction encoding, CompareData is specified in the same register Xs used as the destination register for writing ReadData in step 728, although this is not required and other examples may specify the compare data in an additional register apart from Xs.

[0136] Steps 702 and 704 are the same as in FIG. 12. After step 704, an additional step 752 is performed to compare the ReadData read from a given memory system location corresponding to the target address with the CompareData specified by the RCW instruction in the register Xs. The protection entry check circuit 54 determines whether the comparison condition is met based on the comparison. For example, the comparison condition may be whether the CompareData and the ReadData are equal, or may be based on another comparison condition such as less than, greater than, not equal, etc. Some implementations may fix the comparison condition as an equal condition, while other implementations may allow a parameter of the instruction to select which type of comparison to perform. If the comparison condition is not met, in step 754, the write requested by the RCW instruction is rejected and a condition status flag is set to report the failure of the write caused by the comparison condition failure (e.g., set a negation flag N when the comparison condition fails). If the comparison condition is met, steps 706, 708, 710, 714, 716, 718, 720 are performed similarly to FIG. 12 to check the protection entry status of the data read from the memory system location corresponding to the target address and control whether the write is permitted based on the result of the check. If the write is permitted, step 714 is the same as described above and allows the write to write NewData to the memory system location. If the write is rejected or only partially performed in step 710, the subsequent step 712 of FIG. 12 is replaced by step 762 of FIG. 13, which is the same in that it sets a condition status flag to report a write failure, but in the case of the compare and swap variant, it can distinguish that the failure was caused by a protection entry check failure and set the condition status flag to a value different from the value used in step 754 in the case of a comparison condition failure.

[0137] Regardless of whether the comparison condition is met or the protection entry check is successful, steps 724, 726, and 728 are the same as in FIG. 12, optionally writing ReadData to destination register Xs (again, it is possible to suppress the update of destination register Xs when the destination register specifier specifies a predetermined value, e.g., 31).

[0138] Below is a pseudocode example illustrating one possible implementation of the functionality of the CAS variant of the RCW instruction:

[0139] [Table 2]

[0140] This pseudocode example illustrates the case where the comparison condition evaluation takes precedence over the protection entry check, so that if the comparison condition fails but the entry is also protected and the checks at steps 708, 718, 720 fail, the condition status code will indicate a CAS failure using the N bit. It is also possible for the protection entry check to take precedence such that if the entry is protected and the checks at steps 708, 718, or 720 fail, the condition status code will indicate a write failure due to the protection entry check using the Z bit, even though the comparison condition failed. For example, Figure 13 can be modified to implement steps 752 and 754 after step 714 instead of before step 706.

[0141] FIG. 14 is a flow diagram illustrating the processing of a bit set / clear variant of a protection entry check RCW instruction. In FIG. 14, steps 700-728 are the same as in FIG. 12, except that in FIG. 14, NewData is calculated based on a bit mask ("BitMask") provided in a source register Xs that encodes the location of the bits to be set or cleared in the addressed memory system location, rather than being specified directly in the source register. Thus, the only difference from FIG. 12 is that in step 700, register Xs defines a BitMask rather than specifying NewData directly, and additional steps 770, 772, 774 are performed between steps 704 and 706. In step 770, the method differs depending on whether a bit set or bit clear instruction is being performed (it is not necessary to support both types of instructions, and thus if only one of these instructions is supported, step 770 may be omitted and the relevant one of steps 772, 774 may be performed after step 704). If a set bit instruction is being executed, then in step 774 NewData is set to the result of performing a bitwise OR operation on the ReadData read from the addressed memory system location and the BitMask specified by the RCW instruction (thus, for a set bit instruction, the bit positions marked as "1" in the BitMask are requested to be set to 1 in the addressed memory system location). In contrast, in step 772, if a clear bit instruction is being executed, then NewData is set to the result of performing a bitwise AND operation on the ReadData and the inverse of the BitMask (thus, for a clear bit instruction, the bit positions marked as "1" in the BitMask are requested to be cleared to 0 in the addressed memory system location). For both the set bit and clear bit variants, the bits of ReadData that correspond to "0" bits in the BitMask retain their original value in NewData and are therefore not changed by the RCW instruction.After calculating NewData in step 772 or 774, all subsequent steps in FIG. 14 are the same as in FIG.

[0142] Below is a pseudocode example illustrating one possible implementation of the functionality of the bit set / clear variant of the RCW instruction:

[0143] [Table 3]

[0144] For all of the flow diagrams in this application, it will be understood that the same functions may be implemented in different orders, and thus, although a flow diagram shows a sequential sequence of steps, for any steps that are not dependent on one another, it will be understood that the steps can be reordered or performed at least partially in parallel.

[0145] Thus, as shown in FIG. 6, various stage 1 translation table entries used to traverse the translation table tree structure to reach intermediate address mappings corresponding to sensitive memory pages (e.g., pages expected to be used for sensitive data or instructions) can be set to have a protected entry encoding. This may be true even if one of these entries is temporarily set as invalid to prohibit access to the page (e.g., as a result of a paging operation). Meanwhile, other entries in the same page table as the protected entry may be unprotected entries whose updates are less restricted. By supporting protected entry encoding, this allows a given page table stored in the PRO region of memory to contain a mix of protected and unprotected entries, where the unprotected entries can be updated by operating system code running at EL1 without hypervisor intervention by executing an RCW instruction according to any of the variants described above, while the protected entries can be subject to stricter restrictions. A dedicated type of instruction (e.g., one or more of the variants of the RCW instruction described above) is provided to trigger a protection entry check, and since the PRO permission prevents other types of instructions (such as most store instructions) from being able to update the PRO area of ​​memory, this avoids the need to perform a protection entry check on every write to memory, which would be very expensive in terms of performance.

[0146] Anti-aliasing Check The above-described mechanism is useful for protecting a particular stage 1 translation entry from corruption (either intentionally by hacked code or by erroneously written code by a malicious party). However, it is possible for several different virtual addresses to alias to the same intermediate address by defining stage 1 translation table entries that specify the same intermediate address mapping 62, as shown in Figure 15. To prevent an attacker from being able to circumvent the protection provided by the PRO allow and protect entry encoding described above for the first set of stage 1 translation entries that map VA1 to IPA by defining aliasing stage 1 entries that map different virtual addresses VA2 to the same intermediate address IPA, as shown in Figure 8, the stage 2 translation table entries can have a bit field 79 that specifies whether the corresponding region of memory has anti-aliasing properties. If a region is indicated as having anti-aliasing properties, an additional anti-aliasing check is performed on accesses to that region to check whether all walked stage 1 translation table entries (accessed in the translation table walk to find the corresponding stage 1 translation table entries that specify the virtual to physical stage 1 address mapping for that region) are either (a) stored in a PRO region of memory and encoded as protected entries, or (b) stored in a read-only region of memory. Note that this does not necessarily require a page table walk through those walked stage 1 translation table entries to actually be performed for every access to the memory region associated with a stage 2 translation table entry that has anti-aliasing properties. To avoid having to perform a full translation table walk every time, information can be cached in TLB 29 to indicate whether the anti-aliasing check has passed (or, for certain walked stage 1 translation table entries, whether they have already been determined to be stored in a PRO region and / or to be protected entries).

[0147] FIG. 16 is a flow diagram illustrating a method for performing an anti-aliasing check. In step 800, a memory access request is issued that specifies a target virtual address VAx. In step 802, the MMU 28 initiates an address translation from the target virtual address VAx to a target physical address PAz in response to a stage 1 mapping of VAx to an intermediate address IPAy and a stage 2 mapping of the intermediate address IPAy to the target physical address PAz. (It is not required to perform two separate actions for stage 1 and stage 2 translations, but this is an option; another example could be to have a combined stage 1 and 2 TLB that can directly map from VAx to PAz for translations that are already cached, but upon a miss in the TLB, a new VA to PA mapping is identified by performing a stage 1 and stage 2 walk, as shown in FIG. 6.)

[0148] In step 804, MMU 28 checks whether the stage 2 translation table entry (block or page descriptor) corresponding to IPAy indicates anti-aliasing properties. If so, in step 806, MMU checks whether all walked stage 1 translation table entries satisfy the anti-aliasing condition. A walked stage 1 translation table entry is an entry that would be accessed in a translation table walk to find a corresponding S1 translation table entry that specifies an S1 address mapping from VAx to IPAy if a full translation table walk corresponding to virtual address VAx was performed (this walk may not actually be needed for the current memory access, depending on what is already cached in TLB 29). For example, in FIG. 6, the walked stage 1 translation table entries are the entries marked D_Table in the L0, L1, and L2 stage 1 page tables, and the entry marked D_Page in the L3 stage 1 page table. The anti-aliasing condition is satisfied for a given walked stage 1 translation table entry when any of the following conditions are met: (a) a given walked stage 1 translation table entry is designated as a protection entry, the given walked stage 1 translation table entry is stored at physical address PAj, and PRO permission is specified by the associated stage 2 translation table entry that provides the stage 2 address mapping used to derive PAj; or (b) Read-only permission is specified by the associated stage 2 translation table entry that provides the stage 2 address mapping used to derive the physical address PAj of a given walked stage 1 translation table entry.

[0149] In the particular example of Figure 6, the associated stage 2 translation table entry for the L1 stage 1 entry used to derive the PA of the accessed page is the stage 2 L3 entry shown as "D_Page" in Figure 6. For the other walked stage 1 entries shown in Figure 6, there is similarly an associated stage 2 L3 entry (or stage 2 L1 or L2 entry, if a stage 2 block descriptor is found corresponding to IPAy) that must be marked with PRO or read-only permission in order for the anti-aliasing condition to be met (these are the last entries of the various stage 2 translation walks shown to obtain the physical address of each walked stage 1 translation table).

[0150] 16, if MMU 28 determines that any one or more of the walked stage 1 translation table entries do not satisfy an anti-aliasing condition, then the memory access is denied, at step 808. A failure may be signaled, which may trigger an exception handler (e.g., executing in EL2) to perform error handling actions.

[0151] If all walked stage 1 translation table entries satisfy the anti-aliasing condition, step 808 is omitted. In this case, in step 810, MMU 28 also checks whether any other checks are satisfied (such as any checks based on PRO permissions set for access to the memory region, protection entry checks whether the memory access request was issued in response to an RCW instruction, or any other specific checks to protect against other improper accesses, such as checks based on secure / non-secure state in implementations that support this). If any of the other checks are not satisfied, then again in step 808, the memory access is denied (the type of failure generated may depend on the cause of the access check failure). If so, in step 812, the memory access request is allowed to proceed.

[0152] Thus, as shown in Figure 6, the anti-aliasing property can be set on the stage 2 translation table entry that provides the physical address mapping for the memory region being accessed (this can be either a page descriptor or a block descriptor). If the anti-aliasing property is set for a valid access to the corresponding memory location, this requires that all walked stage 1 translation table entries on the path to the entry that provides the intermediate address mapping for that memory region are either (a) marked as protected and marked for the stage 2 entry that provides the physical address mapping for the region that stores those walked stage 1 translation table entries to specify PRO permission, or (b) stored in a PA with read-only permission specified by the stage 2 entry that provides the PA mapping for that PA. This means that an attacker cannot easily set up new aliasing stage 1 address mappings to circumvent the protections applied to the trusted address mappings expected to be used to access the corresponding region of memory. An attacker able to affect the behavior of operating system code at EL1 does not have control over the stage 2 entries used to control memory accesses, since this is based on the base address in the VTTBR_EL2 register, which cannot be updated by code executing at EL1 (and therefore cannot cause PRO or read-only permissions to be set for the area that stores the attacker's newly created aliased stage 1 address mapping). Also, the mechanism for code executing at EL1 to update the stage 1 translation table entries may be to execute a protection entry check type RCW instruction as described above (no other instructions are prohibited from writing to the PRO area of ​​memory), which cannot change the protection state of any translation table entry, so the attacker cannot cause the stage 1 entries to become protected. Also, the read-only area cannot be written to by any write instruction.Therefore, any new entries that an attacker can create should fail at least one of the anti-aliasing checks whether the stage 1 entries used to obtain the VA-IPA mapping are protected and whether those entries are stored in a PRO or read-only area of ​​memory.

[0153] Protection against improper updates to the Stage 1 Top-Level Base Address Another attack that may be attempted by an attacker capable of affecting the behavior of operating system code executing at EL1 may be to modify the stage 1 top level base address (which identifies the location in memory of the L0 stage 1 page tables) indicated by the base address register TTBR_EL1. For example, the attacker may substitute the addresses of a new set of attacker-defined stage 1 tables to replace the addresses of authorized page table structures that are correctly formed and behave correctly as verified by the hypervisor. The attacker may also attempt to cause the MMU 28 to use an existing authorized stage 1 page table in an unexpected way, for example by substituting the base address of one of the L1, 2, or 3 page tables to replace the correct L0 base address, such that the next level table pointer or address mapping for a different memory region may be incorrectly used for the memory region being accessed due to the accessed table being used at the wrong level in the tree from the predicted level, and different bits of the virtual address being used to select the relevant entry from the table.

[0154] FIG. 17 illustrates a stage 1 top level base address check that may be performed to protect against these types of attacks. In step 1000, a page table walk is required for a memory access request that specifies a target virtual address (for memory access requests that do not require a page table walk because the necessary address mappings are already available from the TLB, no separate check needs to be performed because the necessary stage 1 top level base address checks have already been performed when these address mappings were allocated to the cache following a previous page table walk). In step 1002, a stage 1 top level base address is determined based on the value in the stage 1 translation table base address register TTBR_EL1. The base address is specified as the intermediate address IPA_base. In step 1004, MMU 28 retrieves information specified by the associated stage 2 translation table entry that provides the mapping from IPA_base to PA_base. For example, this information may be retrieved from TLB 29 if already cached in the TLB, or may be retrieved by performing a stage 2 translation table walk using the stage 2 base address specified in the stage 2 translation table base address register VTTBR_EL2.

[0155] In step 1006, MMU 28 determines whether stage 1 top-level table partial read-only checking is enabled. For example, this may be determined based on a stage 1 top-level table partial read-only checking enable control value stored in a control register (e.g., stage 2 translation control register VTCR_EL2, where updates are restricted to code executing at exception level EL2 or above). Alternatively, other implementations may consider stage 1 top-level table partial read-only checking to be permanently enabled. If stage 1 top-level table partial read-only checking is enabled, in step 1008, MMU 28 checks whether the associated stage 2 translation table entry specifies PRO permission, and if not, in step 1010, the memory access is denied and a failure is signaled. This means that if an attacker attempts to modify the stage 1 translation table base address register TTBR_EL1 to point to a new L0 page table created by the attacker, accesses based on the modified base address will fail since the attacker cannot modify the PRO region of memory and would therefore have written to a non-PRO region, and therefore the stage 1 top level table PRO check will fail.

[0156] If the stage 1 top level table PRO check is disabled at step 1006 or is enabled but passes at step 1008, then at step 1012 MMU 28 determines whether a stage 1 top level table existence check is enabled. Again, this may be determined based on a stage 1 top level table existence check enable control value stored in a control register (e.g., stage 2 translation control register VTCR_EL2). The enable control value used to determine whether the check is enabled at step 1012 may be the same as the enable control value described above for step 1006 (e.g., in some implementations, the checks at steps 1008 and 1014 may be considered as two steps of a single check that is either collectively enabled or collectively disabled). If the stage 1 top level table existence check is enabled, then at step 1014 MMU 28 determines whether the associated stage 2 translation table entry specifies a stage 1 top level entry existence permission 80. As discussed above with respect to Figure 8, the stage 1 top-level entry presence permission may be coded as an alternative variant of the PRO permission (such that memory regions with stage 1 top-level entry presence permission are assumed to also have PRO permission), or may be coded as an independent attribute separate from the indication of whether PRO permission is provided. If the associated stage 2 translation table entry does not specify stage 1 top-level entry presence permission, then again in step 1010, the memory access is denied and a failure is signaled. This may be used to protect a valid and genuine L1, L2, or L3 table from being replaced with an L0 table by modifying the stage 1 top-level base address to point to the address of the L1, L2, or L3 table, since the stage 2 entry corresponding to the memory region used to hold the L1, L2, or L3 table may be defined as not having a stage 1 top-level entry presence permission.To restrict which addresses can be used as stage 1 L0 base addresses for valid memory accesses, only memory regions used to hold any valid and genuine stage 1 L0 tables can be marked as having stage 1 top level entry presence permission in the corresponding stage 2 entry.

[0157] If the stage 1 top level table existence check is disabled in step 1012, or is enabled but passes in step 1014, then in step 1016 the MMU performs any other checks required to access the memory region identified by PA_base, and if these fail, again denies the memory access in step 1010. If any other checks pass, then in step 1018 the page table walk may be performed, effectively using the stage 1 top level base address IPA_base. Thus, the address of the stage 1 top level translation table entry is obtained by applying an index offset to the determined PA_base, where the index offset is determined based on a subset of the bits of the target VA to be translated. The page table walk then continues as previously described.

[0158] Thus, as shown in FIG. 6, in an expected use defined by software (and therefore not enforced as a requirement by hardware), among the stage 1 entries accessed on a page table walk to obtain a PA mapping 64 of a memory region for which additional protection is desired, the stage 2 page / block descriptor providing the PA mapping 64 identifying a storage location of a stage 1 L0 page table specifies both PRO and stage 1 top-level presence permissions, and the stage 2 page / block descriptor providing the PA mapping 64 identifies a storage location of a stage 1 L1, L2, or L3 page table and specifies PRO permission but not stage 1 top-level presence permission. This protects against the base address substitution attack described above. An alternative to avoid the need to implement a base address check could be to trap any access to the stage 1 base address register TTBR_EL1 to a hypervisor executing at EL2, which could then check whether an update requested by operating system code executing at EL1 is valid and deny the update if necessary. However, in practice, an operating system may need to frequently switch the address in the base address register TTBR_EL1 upon context switching, and therefore trapping every update may be costly in terms of performance. By implementing the stage 1 top-level base address check shown in Figure 17, this can avoid the need for such traps on base address register updates to TTBR_EL1, improving performance.

[0159] In some examples, a single variant of stage 1 top-level presence permission may be supported, in which case the check in step 1014 of FIG. 17 may simply be a check whether that stage 1 top-level presence permission is specified.

[0160] Other examples may support two or more variants of the stage 1 top level presence permission to allow finer control over which addresses within a memory region a particular stage 1 translation table base address register can specify. For example, some implementations may support two stage 1 base address registers: TTBR0_EL1, selected for stage 1 translation at EL0 or EL1 when the most significant bits of a configurable number (number, N) of virtual addresses to be translated are all set to 0 (N may be defined in a control value specified in a control register); and TTBR1_EL1, which is selected for stage 1 translation at EL0 or EL1 when any of the N most significant bits of the virtual address to be translated are non-zero.

[0161] Next, several variants of stage 1 top-level existence permissions can be defined, including the following: ●Toplevel0 indicates a memory area that is permitted for use in the top-level translation table accessed via TTBR0_EL1, but is not permitted for use in the top-level translation table accessed via TTBR1_EL1. ●Toplevel1 indicates a memory area that is permitted for use in the top-level translation table accessed via TTBR1_EL1, but is not permitted for use in the top-level translation table accessed via TTBR0_EL1. - Toplevel01, which indicates the memory area permitted for use for the top-level translation table accessed via either TTBR0_EL1 or TTBR1_EL1.

[0162] In this case, one implementation of the check in step 1014 may be such that a failure is signaled in step 1010 of FIG. 17 if any of the following conditions are met: TTBR0_EL1 is used to provide a base address for which the corresponding memory region does not have either Toplevel0 or Toplevel01 permissions, or ●TTBR1_EL1 is used to provide a base address for which the corresponding memory region does not have either Toplevel1 or Toplevel01 permissions.

[0163] In some implementations, further controls set in a control register controlled by software in EL2 can control whether TTBR0_EL1 is prohibited from granting access to the Toplevel1 page, and whether TTBR1_EL1 is prohibited from granting access to the Toplevel0 page. In this case, the check in step 1014 can cause a failure to be signaled in step 1010 if any of the following conditions are met: TTBR0_EL1 is used to provide a base address whose corresponding memory region does not have Toplevel01 permissions or has Toplevel1 permissions when the TTBR0 / Toplevel1 failure enable control is set to allow a failure to be triggered when TTBR0_EL1 is used to access a Toplevel1 page, or ●TTBR1_EL1 is used to provide a base address where the corresponding memory region does not have Toplevel0 permissions or has Toplevel0 permissions when the TTBR1 / Toplevel0 failure enable control is set to allow a failure to be triggered when TTBR1_EL1 is used to access a Toplevel01 page.

[0164] These features allow finer control over which memory address ranges can be used to provide the top-level stage 1 translation table, while the enable control allows these finer checks to be disabled if deemed acceptable for any top-level page used to provide the base addresses of both TTBR0 and TTBR1.

[0165] In some implementations, the encodings of the various top-level existence permissions Toplevel0, Toplevel1, Toplevel01 can be combined with the encoding of PRO permissions such that they are treated as Toplevel0 PRO permission, Toplevel1 PRO permission, and Toplevel01 PRO permission. In such implementations, it is not possible to define a Toplevel0, Toplevel1, or Toplevel01 memory region as having no PRO permission. Nevertheless, it is possible to define a PRO region as having none of the Toplevel0, Toplevel1, or Toplevel01 permissions, since there are separate PRO permission encodings that are not treated as having any of the stage 1 top-level table existence permissions.

[0166] Simulator example FIG. 18 illustrates a simulator implementation that may be used. While the above embodiments implement the invention in terms of apparatus and methods for operating specific processing hardware that supports the techniques, it is also possible to provide an instruction execution environment according to the embodiments described herein that is implemented by the use of a computer program. Such computer programs are often referred to as simulators insofar as they provide a software-based implementation of a hardware architecture. Various simulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators. Typically, a simulator implementation may run on a host processor 1230, which optionally runs a host operating system 1220 and supports a simulator program 1210. In some arrangements, there may be multiple layers of simulation between the hardware and the instruction execution environment provided, and / or there may be multiple different instruction execution environments provided on the same host processor. Historically, powerful processors have been required to provide simulator implementations that run at reasonable speeds, but such an approach may be justified in certain situations, such as when it is desirable to run code native to another processor for compatibility or reuse reasons. For example, a simulator implementation may provide an instruction execution environment that has additional functionality not supported by the host processor hardware, or that is typically associated with a different hardware architecture. An overview of simulation is given in "Some Efficient Architecture Simulation Techniques", Robert Bedichek, Winter 1990 USENIX Conference, pp. 53-63.

[0167] Although embodiments have been described above with reference to particular hardware constructs or features, in the simulated embodiments, equivalent functionality may be provided by suitable software constructs or features. For example, particular circuits may be implemented as computer program logic in the simulated embodiments. Similarly, memory hardware such as registers or caches may be implemented as software data structures in the simulated embodiments. In arrangements in which one or more of the hardware elements referenced in the foregoing embodiments reside in host hardware (e.g., host processor 1230), some simulated embodiments may use the host hardware where suitable.

[0168] The simulator program 1210 may be stored in a computer-readable storage medium (which may be a non-transitory medium) and provides a program interface (instruction execution environment) to the target code 1200 (which may include applications, operating systems, and hypervisors) that is the same as the interface of the hardware architecture being modeled by the simulator program 1210. Thus, program instructions of the target code 1200, including the protection entry check RCW instruction described above, may be executed from within an instruction execution environment using the simulator program 1210, thereby allowing a host computer 1230, which does not actually have the hardware capabilities of the device 2 described above, to emulate these capabilities. Similarly, the various memory management check functions described above, including support for the PRO region type, may be emulated using the memory management program logic 1218 of the simulator program 1210.

[0169] Thus, simulator program 1210 may have processing program logic 1212 that simulates states of processing circuitry 4 described above. For example, processing program logic 1212 may control transitions between execution states EL0-EL3 in response to events occurring during simulated execution of target code 1200. Instruction decode program logic 1214 decodes instructions of target code 1200 and maps them to corresponding instructions in the native instruction set of host device 1230. Register emulation program logic 1216 maps register accesses requested by the target code to accesses to corresponding data structures maintained on the host hardware of host device 1230, such as by accessing registers of host device 1230 or data in memory 1232. The memory manager logic 1218 implements address translation, page table walks, and access control checks in a manner corresponding to the MMU 28 described in the hardware implementation embodiment above, but with the additional functionality of mapping simulated physical addresses obtained by stage 2 mapping in the address translation based on the page tables defined for the target code 1200 to host virtual addresses used to access the host memory 1232. These host virtual addresses can themselves be translated to host physical addresses using standard address translation mechanisms supported by the host (the translation of host virtual addresses to host physical addresses is outside the scope of what is controlled by the simulator program 1210).

[0170] In this application, the term "configured to..." is used to mean that elements of an apparatus have a configuration that is capable of performing a defined operation. In this context, "configuration" refers to a manner of arrangement or interconnection of hardware or software. For example, an apparatus may have dedicated hardware that provides the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured to" does not imply that the apparatus elements need to be modified in any way to provide the defined operation.

[0171] Although exemplary embodiments of the present invention are described in detail herein with reference to the accompanying drawings, it will be understood that the invention is not limited to these precise embodiments, and that various changes and modifications can be made to the embodiments by those skilled in the art without departing from the scope of the present invention as defined by the appended claims.

Claims

1. An apparatus comprising: a processing circuit for processing instructions in one of a plurality of execution states associated with different privilege levels; a memory management circuit for translating, in response to a memory access request, a target virtual address specified by the memory access request into a target physical address indicating a memory system location to be accessed; the memory management circuit is configured to support two-stage address translation based on a stage 1 translation table structure including stage 1 translation table entries and a stage 2 translation table structure including stage 2 translation table entries, wherein the mapping from the target virtual address to the target physical address depends on a stage 1 address mapping and a stage 2 address mapping, the stage 1 address mapping including a mapping from the target virtual address to a target intermediate address specified by a corresponding stage 1 translation table entry corresponding to the target virtual address, and the stage 2 address mapping including a mapping from the target intermediate address to the target physical address specified by a corresponding stage 2 translation table entry corresponding to the target intermediate address; the memory management circuitry is configured to perform a permission check on the memory access request based at least on stage 2 access permission information specified by the corresponding stage 2 translation table entry, the stage 2 access permission information having an encoding specifying whether the memory region corresponding to the target intermediate address has partial read-only permission indicating that write requests to the memory region corresponding to the target intermediate address issued when the processing circuitry is in a predetermined execution state of the plurality of execution states are permitted for a restricted subset of write request types but prohibited for write request types outside of the restricted subset, the restricted subset of write request types including metadata update write requests generated by the memory management circuitry to update access tracking metadata in a translation table entry; the memory management circuitry is configured to reject the memory access request in response to determining that the memory access request is a write request issued in the given execution state, the stage 2 access permission information specifies that the memory region corresponding to the target intermediate address has the partial read-only permission, and the memory access request is a write request type other than the restricted subset of write request types.

2. 2. The apparatus of claim 1, wherein said restricted subset of write request types also includes write requests issued in response to at least one predetermined type of translation table entry update instruction executed by said processing circuitry in said predetermined execution state.

3. 3. The apparatus of claim 1, wherein the restricted subset of write request types excludes write requests issued in response to at least one type of store instruction executed by the processing circuitry in the given execution state.

4. 3. The apparatus of claim 1, wherein each stage 1 translation table entry has a coding that specifies whether the stage 1 translation table entry is a protected entry that is restricted from updates compared to stage 1 translation table entries that are not coded as protected entries.

5. 5. The apparatus of claim 4, further comprising a protection entry check circuit for checking whether to restrict updates to access permissions or address mappings specified by a given stage 1 translation table entry based on whether the given stage 1 translation table entry is marked as a protection entry.

6. in response to the processing circuit executing a protection entry check type read check write instruction to request an update to a given memory system location, Reading data from said given memory system location; checking whether the data read from the given memory system location has a value that matches a stage 1 translation table entry designated as a protected entry; 5. The apparatus of claim 4, further comprising: a protection entry check circuit for preventing a subset of update-restricted bits of a stage 1 translation table entry from being updated in response to the read check write instruction in response to determining that the data read from the given memory system location has a value that matches a stage 1 translation table entry designated as a protection entry.

7. 7. The apparatus of claim 6, wherein when the update to the given memory system location is performed in response to a read-check-write instruction of the protection entry check type, the protection entry check circuitry is configured to control the reading of the data from the given memory system location, the checking whether the data has a value that matches a stage 1 translation table entry designated as a protection entry, and the update of the given memory system location to be performed as an atomic operation.

8. 7. The apparatus of claim 6, wherein when the update to the given memory system location is executed in response to a read-check-write instruction of the protection entry check type executed when the processing circuit is in the predetermined execution state, the protection entry check circuitry is configured to prohibit the update to the given memory system location from changing whether a stage 1 translation table entry stored at the given memory system location is designated as a protection entry.

9. 7. The apparatus of claim 6, wherein write requests issued in response to a read check write instruction of said protection entry check type are one of a restricted subset of said write request types.

10. The subset of update restricted bits is all bits of the stage 1 translation table entry; a suitable subset of bits of the stage 1 translation table entry, the suitable subset including one or more bits used to encode whether the stage 1 translation table entry is designated as a protected entry, and selecting which bits are in the suitable subset of bits includes Non-programmable, and 7. The apparatus of claim 6, wherein the appropriate subset of bits is one of: a. programmable depending on a software programmable selection value stored in a control register.

11. each valid stage 1 translation table entry has said encoding specifying whether the stage 1 translation table entry is a protection entry; 7. The apparatus of claim 6, wherein in response to determining that the data read from the given memory system location has a value that matches an invalid stage 1 translation table entry, the protection entry check circuit is configured to allow updates of the invalid stage 1 translation table entry other than updates that cause the data at the given memory system location to become a valid stage 1 translation table entry designated as a protection entry.

12. both the valid stage 1 translation table entry and the invalid stage 1 translation table entry have an encoding that specifies whether the stage 1 translation table entry is a protection entry; in response to determining that the data read from a given memory system location has a value that matches an invalid stage 1 translation table entry designated as a protection entry, the protection entry checking circuitry is configured to prevent a subset of invalid entry update restricted bits of the given memory system location from being updated in response to the read check write instruction; 7. The apparatus of claim 6, wherein in response to determining that the data read from the given memory system location has a value that matches a valid stage 1 translation table entry designated as a protection entry, the protection entry check circuitry is configured to prevent a subset of valid entry update restricted bits of the given memory system location from being updated in response to the read check write instruction.

13. the valid stage 1 translation table entry includes a first bit field indicating whether the valid stage 1 translation table entry is a protection entry; the invalid stage 1 translation table entry includes a second bit field indicating whether the invalid stage 1 translation table entry is a protection entry; 13. The apparatus of claim 12, wherein the first bit field and the second bit field are in different bit positions within a stage 1 translation table entry encoding.

14. The protection entry check circuit, rejecting the update of the given memory system location when the requested update would cause an update to at least one of a subset of the update-restricted bits; 7. The apparatus of claim 6, further comprising: a read / check / write instruction for reading and writing data from a first bit of the given memory system location and for reading and writing data from a second bit of the given memory system location; and a read / check / write instruction for reading and writing data from a first bit of the given memory system location and for writing data from a second ...

15. 7. The apparatus of claim 6, wherein in response to the protection entry check type read check write instruction, the processing circuitry is configured to set at least one condition status value indicating whether at least a portion of the update requested by the protection entry check type read check write instruction is inhibited based on the check whether the data read from the given memory system is a stage 1 translation table entry designated as a protection entry.

16. The protection entry check type read check write instruction is a swap variant of the protection entry check type read check write instruction, wherein in response to the swap variant, the processing circuitry is configured to write the data read from the given memory system location to a destination register for use as an operand by a subsequent instruction; a storage variant of the protection entry check type read check write instruction, for which the processing circuitry is configured to process the storage variant without writing the data read from the given memory system location to a destination register; a compare and swap variant of the protection entry check type read check write instruction specifying a comparison operand, wherein for the compare and swap variant, the protection entry check circuitry is configured to determine whether a comparison of the data read from the given memory system location with the comparison operand satisfies a comparison condition, inhibit the update to the given memory system location when the comparison condition is not satisfied, and write the data read from the given memory system location to a destination register for use as an operand by a subsequent instruction; and a bit set / clear instruction, for which the updating of the given memory system location includes setting or clearing at least one selected bit of the data at the given memory system location.

17. a given stage 2 access translation table entry corresponding to a given intermediate address has an encoding that specifies whether the memory region corresponding to the given intermediate address has anti-aliasing properties that indicate a requirement that each of one or more walked stage 1 translation table entries accessed in a translation table walk of the stage 1 translation structure to find the corresponding stage 1 translation table entry that specifies the stage 1 address mapping from a given virtual address to the given intermediate address must satisfy an anti-aliasing condition in order for access to the memory region corresponding to the given intermediate address to be permitted; The anti-aliasing condition for a given walked stage 1 translation table entry is: the given walked stage 1 translation table entry is designated as a protected entry and the partial read-only permission is specified by the stage 2 access permission information for an associated stage 2 translation table entry that provides the stage 2 address mapping used to derive a physical address of the memory system location that stores the given walked stage 1 translation table entry; or read-only permission is satisfied when either:

6. The apparatus of claim 5, wherein the memory management circuitry is configured to deny the memory access request in response to determining that the corresponding stage 2 translation table entry specifies that the memory region corresponding to the target intermediate address has the anti-aliasing property and any of the one or more walked stage 1 translation table entries fails to satisfy the anti-aliasing condition.

18. 3. The apparatus of claim 1, wherein the memory management circuitry is configured to determine a stage 1 top level base address of a stage 1 top level translation table of the stage 1 translation table structure based on a value in a stage 1 translation table base address register.

19. 20. The apparatus of claim 18, wherein when a stage 1 top level table partial read-only check is enabled, the memory management circuitry is configured to signal a failure in response to determining that the stage 1 top level base address corresponds to an intermediate address whose associated stage 2 translation table entry does not specify the partial read-only permission.

20. 20. The apparatus of claim 19, wherein the memory management circuitry is configured to determine whether the stage 1 top level table partial read-only check is enabled based on a stage 1 top level partial read-only check enable control value stored in a control register.

21. 20. The apparatus of claim 18, wherein when a stage 1 top level table existence permission check is enabled, the memory management circuit is configured to determine whether a given memory region corresponding to the stage 1 top level base address is associated with a stage 1 top level table existence permission indicating that the given memory region is permitted to be allocated for storing the stage 1 top level table of the stage 1 translation table structure, and to trigger a failure when the given memory region corresponding to the stage 1 top level base address does not have the stage 1 top level table existence permission.

22. 22. The apparatus of claim 21, wherein the memory management circuitry is configured to determine whether the given memory region is associated with the stage 1 top level table presence permission based on an encoding of an associated stage 2 translation table entry that corresponds to the stage 1 top level base address.

23. 22. The apparatus of claim 21, wherein the memory management circuitry is configured to determine whether the stage 1 top level table existence permission check is enabled based on a stage 1 top level table existence permission check enable control value stored in a control register.

24. 1. A method comprising: Processing the instruction in one of a plurality of execution states associated with different privilege levels; performing, in response to a memory access request, a two-stage address translation of a target virtual address specified by the memory access request to a target physical address indicative of a memory system location to be accessed, the two-stage address translation being based on a stage 1 translation table structure including stage 1 translation table entries and a stage 2 translation table structure including stage 2 translation table entries, a mapping of the target virtual address to the target physical address being dependent on a stage 1 address mapping and a stage 2 address mapping, the stage 1 address mapping including a mapping from the target virtual address to a target intermediate address specified by a corresponding stage 1 translation table entry corresponding to the target virtual address, and the stage 2 address mapping including a mapping from the target intermediate address to the target physical address specified by a corresponding stage 2 translation table entry corresponding to the target intermediate address; performing a permission check on the memory access request based at least on stage 2 access permission information specified by the corresponding stage 2 translation table entry, the stage 2 access permission information having an encoding specifying whether the memory region corresponding to the target intermediate address has partial read-only permission indicating that write requests to the memory region corresponding to the target intermediate address issued when the processing circuitry is in a predetermined execution state of the plurality of execution states are permitted for a restricted subset of write request types but prohibited for write request types outside of the restricted subset, the restricted subset of write request types including metadata update write requests generated by a memory management circuit to update access tracking metadata in a translation table entry; and in response to determining that the memory access request is a write request issued in the given execution state, rejecting the memory access request, where the stage 2 access permission information specifies that the memory region corresponding to the target intermediate address has the partial read-only permission and the memory access request is a write request type other than the restricted subset of write request types.

25. 1. A computer program comprising instructions for controlling a host data processing apparatus to provide an instruction execution environment for executing target code, said computer program comprising: processing program logic for simulating processing of instructions of the target code in one of a plurality of execution states associated with different privilege levels; memory management program logic for translating, in response to a simulated memory access request triggered by the target code, a target virtual address specified by the memory access request into a target physical address indicating a simulated memory system location being accessed; the memory management program logic is configured to support two stage address translation based on a stage 1 translation table structure including stage 1 translation table entries and a stage 2 translation table structure including stage 2 translation table entries, the mapping from the target virtual address to the target physical address being dependent on a stage 1 address mapping and a stage 2 address mapping, the stage 1 address mapping including a mapping from the target virtual address to a target intermediate address specified by a corresponding stage 1 translation table entry corresponding to the target virtual address, and the stage 2 address mapping including a mapping from the target intermediate address to the target physical address specified by a corresponding stage 2 translation table entry corresponding to the target intermediate address; the memory manager logic is configured to perform a permission check on the simulated memory access request based at least on stage 2 access permission information specified by the corresponding stage 2 translation table entry, the stage 2 access permission information having an encoding specifying whether the memory region corresponding to the target intermediate address has partial read-only permission indicating that write requests to the memory region corresponding to the target intermediate address issued when the processing program logic is in a predetermined execution state of the plurality of execution states are permitted for a restricted subset of write request types but prohibited for write request types outside of the restricted subset, the restricted subset of write request types including metadata update write requests generated by the memory manager logic to update access tracking metadata in a translation table entry; the memory management program logic is configured to reject the simulated memory access request in response to determining that the simulated memory access request is a write request issued in the given execution state, the stage 2 access permission information specifies that the memory region corresponding to the target intermediate address has the partial read-only permission, and the simulated memory access request is a write request type other than the restricted subset of write request types.

Images