Page table structure

Abstract

A page table structure for address translation is disclosed, which can include a relative type page table entry for which a relative offset value can be used to specify an address pointer to a next level page table entry or a translated address, the relative offset value indicating an offset of the address pointer relative to a reference point base address.

Description

[0001] The present technology relates to the field of data processing. More specifically, the present technology relates to page table structures for address translation.

[0002] A data processing system can have a memory management unit for performing address translation. The MMU can translate a virtual address specified by program code into a physical address identifying a storage location in memory. The translation can be based on address mapping information specified in a page table structure.

[0003] At least some examples provide an apparatus comprising: memory management circuitry to translate a storage address based on a page table entry defined in a page table structure, the page table structure comprising a plurality of page table levels stored in a memory system; and page table walk circuitry to obtain a page table entry from the page table structure for use by the memory management circuitry, each page table entry identifying an address pointer, the address pointer to identify one of: a translated address and an address of a sub-page table at a next level of the page table structure; wherein: when a given page table entry is a relative type page table entry specifying a relative offset value, the relative offset value indicating an offset of the address pointer relative to a reference point base address determined for the given page table entry, the page table walk circuitry is configured to determine the address pointer from the reference point base address and the relative offset value.

[0004] At least some examples provide a method comprising: performing a page table walk to obtain a page table entry from a page table structure for translating a storage address, the page table structure comprising a plurality of page table levels stored in a memory system, each page table entry identifying an address pointer, the address pointer to identify one of: a translated address and an address of a sub-page table at a next level of the page table structure; wherein: when a given page table entry is a relative type page table entry specifying a relative offset value, the relative offset value indicating an offset of the address pointer relative to a reference point base address determined for the given page table entry, the address pointer is determined from the reference point base address and the relative offset value.

[0005] At least some examples provide a computer program comprising: page table walk program logic to obtain a page table entry from a page table structure, the page table structure comprising a plurality of page table levels, each page table entry identifying an address pointer, the address pointer to identify one of: a translated address and an address of a sub-page table at a next level of the page table structure; wherein: when a given page table entry is a relative type page table entry specifying a relative offset value, the relative offset value indicating an offset of the address pointer relative to a reference point base address determined for the given page table entry, the page table walk program logic is configured to determine the address pointer from the reference point base address and the relative offset value.

[0006] At least some examples provide an apparatus comprising: memory management circuitry to translate a storage address based on a page table entry defined in a page table structure, the page table structure comprising a plurality of page table levels stored in a memory system; and page table walk circuitry to obtain a page table entry from the page table structure for use by the memory management circuitry, each page table entry identifying an address pointer to identify one of: a translated address and an address of a child page table at a next level of the page table structure; wherein: when a given page table entry specifies a descendant entry restricted indicator, the page table walk circuitry is configured to signal a fault when a descendant page table entry of the given page table entry identifies an address pointer that lies outside a boundary address region identified by the given page table entry.

[0007] At least some examples provide a method comprising: performing a page table walk to obtain a page table entry from a page table structure for translating a storage address, the page table structure comprising a plurality of page table levels stored in a memory system, each page table entry identifying an address pointer to identify one of: a translated address and an address of a child page table at a next level of the page table structure; in response to detecting that a given page table entry specifies a descendant entry restricted indicator and a descendant page table entry of the given page table entry identifies an address pointer that lies outside a boundary address region identified by the given page table entry, signalling a fault.

[0008] At least some examples provide a computer program comprising: page table walk program logic to obtain a page table entry from a page table structure, the page table structure comprising a plurality of page table levels, each page table entry identifying an address pointer to identify one of: a translated address and an address of a child page table at a next level of the page table structure; wherein: when a given page table entry specifies a descendant entry restricted indicator, the page table walk program logic is configured to signal a fault when a descendant page table entry of the given page table entry identifies an address pointer that lies outside a boundary address region identified by the given page table entry.

[0009] The above computer program can be stored on a computer readable storage medium, which can be a non-transitory storage medium or a transitory storage medium.

[0010] Further aspects, features, and advantages of the present technology will be apparent from the following description of examples, as read in conjunction with the accompanying drawings, in which:

[0011] Figure 1 An example of a data processing system comprising at least one memory management unit for processing address translations is schematically illustrated;

[0012] Figure 2An example of a page table walk to obtain a page table entry from a page table structure is shown schematically;

[0013] Figure 3 An example format of a page table entry of a page table structure supporting relative page table pointers is shown;

[0014] Figure 4 An example of calculating an address pointer based on a relative type page table entry is shown;

[0015] Figure 5 A flow diagram showing a method of performing a page table walk is shown;

[0016] Figure 6 A second example of using a block table to indicate a base address and a size of a boundary address region is shown;

[0017] Figure 7 An example of a page table entry including a descendant entry restricted indicator is shown; and

[0018] Figure 8 An example of a simulation program for controlling a host data processing apparatus to provide an instruction execution environment for executing instructions is shown.

[0019] An apparatus can have memory management circuitry to translate a store address based on a page table entry (PTE) defined in a page table structure stored in a memory system. The page table structure can include two or more page table levels. Page table walk circuitry can be provided to obtain PTEs from the page table structure for use by the memory management circuitry. Each PTE can identify an address pointer to identify a translated address or an address of a child page table at a next level of the page table structure. An entry that specifies a translated address can be referred to as a block entry or a leaf entry. The translated address can be an intermediate physical address or a physical address. A PTE that has an address pointer to a child page table at a next level of the page table structure can be referred to as a table entry or a branch entry. A PTE that points to a given child page table can be referred to as a parent PTE of that child page table, and can also be referred to as a parent PTE of all child PTEs within the child page table. A child PTE of a given PTE, and any grandchild PTEs or further descendant PTEs in subsequent levels of the page table accessed via address pointers in the child PTEs, can be referred to as descendant PTEs of the given PTE.

[0020] When performing a page table walk, a portion of a target address to be translated can be used to select one PTE from the PTEs of the page table at each level of the page table structure. A first portion of the target address is used to select a PTE from the level 0 page table. The selected level 0 PTE provides an address pointer to the level 1 page table, and a second portion of the target address is used to select a particular PTE from the level 1 page table, and so on for each subsequent level until a block entry is reached, which provides an address pointer used to determine the translated address corresponding to the target address. The use of a multi-level page table structure can be used to improve memory efficiency, as (unlike a single linearly indexed table structure) a single contiguous block of memory need not be allocated for the storage of the page table structure, the size of which is proportional to the overall size of the address space being mapped.

[0021] In a typical page table structure, the address pointer used to identify a translated address or address of a sub-page table is specified as an absolute address. Thus, a given PTE can specify an address value that directly identifies the address pointer.

[0022] In contrast, with the approach discussed below, the page table walk circuitry supports a page table structure comprising relative type PTEs. A relative type PTE specifies a relative offset value that identifies an offset of an address pointer relative to a reference point base address determined for that given PTE. Thus, when a given PTE is defined as a relative type PTE, the page table walk circuitry can determine the address pointer for that entry from the reference point base address and the relative offset value defined in the given PTE.

[0023] By using address pointers that are specified as relative offsets relative to a base address, this can reduce the overhead of remapping an address space. A supervisory process (e.g. an operating system or hypervisor) can be responsible for managing address translation by defining a page table structure. When a portion of the page table structure is defined to use relative type PTEs, then by simply changing the reference point base address of a given PTE, subsequent address pointers calculated relative to that reference point base address can be automatically repositioned to a different region of memory, avoiding the supervisory process having to separately update absolute pointers in many PTEs.

[0024] This can be particularly useful for systems that use non-volatile memory, in which it can be desirable to store persistent page table fragments within the non-volatile memory. For example, executable program code stored in non-volatile memory can contain one or more relative page tables comprising relative type PTEs. This means that, in order to map the executable program code into memory, the operating system can simply set the PTEs pointing to the relative page tables in the non-volatile memory, and then the relative type PTEs within that page table can automatically map all parts of the executable program code into memory without the operating system having to specify each descendant entry individually using absolute pointers. If it is later required to map the non-volatile memory to a new region of address space, the operating system does not have to update all the PTEs in the corresponding part of the page table structure, as simply updating the base address from which those relative pointers are derived is sufficient to re-map the entire relative part of the page table.

[0025] In addition to relative type PTEs, the page table walk circuitry can also support absolute type PTEs. When a given PTE is an absolute type PTE specifying an absolute address value that directly specifies an address pointer, the page table walk circuitry can determine the address pointer from the absolute address value. In this case, there is no need to determine a reference point base address.

[0026] Regardless of whether the PTE is a relative type or an absolute type, for a table PTE, the address pointer can identify a base address of a child page table at a next level of the page structure, and an address of a particular child PTE to be accessed within the child page table at the next level can correspond to a sum of the address pointer and a next level index portion of a target address to be translated. Thus, the address pointer can be aligned with a page size boundary size, such that a least significant bit portion of the address pointer is always 0, and thus need not be explicitly specified in the PTE (the number of bits in the “always 0” portion can depend on the system configuration). On the other hand, for a block PTE, the address pointer can specify a most significant bit portion of the translated address, and a least significant bit portion of the translated address can be mapped directly from a corresponding bit of the target address being translated. For an absolute type PTE, the most significant portion of the child PTE address or the most significant portion of the translated address is specified as an absolute value directly specified in the absolute type PTE. For a relative type PTE, the most significant portion of the child PTE address or the most significant portion of the translated address is specified using a relative offset value specified in the relative type PTE, which is added to or appended to a reference point base address determined for the relative type PTE. The reference point base address associated with the relative type PTE can be the same as or different from a base address of the page table comprising the relative type PTE.

[0027] The type of a given PTE can be determined based on a type indicator specified in a parent PTE at a previous level of the page table structure. Thus, the type of a PTE is not specified in the PTE itself, but in the parent entry of the PTE. This can improve security, as it means that a supervisory process responsible for a given level of the page table structure can control whether or not a subsequent level is allowed to use relative address pointers, which can be useful in situations where it is desirable to delegate responsibility for a subsequent level to another process or party whilst still maintaining security. For example, a supervisory process can wish to force a subsequent level to have to use relative pointers to avoid a delegated process (to which management of a subsequent level of the page table structure is delegated) being able to specify arbitrary absolute pointers that can extend beyond the region of address space allocated for that delegated process.

[0028] When a given PTE is of the relative type, the page table walk circuitry can signal a fault in response to detecting that a child PTE of the given PTE is of the absolute type. Thus, once a certain level of the page table structure specifies that the next level is of the relative type, then any descendants of the relative type PTE will also need to be of the relative type. This ensures that the supervisory process can be confident that when it remaps the reference point base address associated with the relative type PTE of the earliest level, then this also remaps the address pointers of all subsequent descendant entries. Were any of the subsequent address pointers to be of the absolute type, then these would result in a fault and thus could not give rise to a valid memory access.

[0029] In some implementations, the top level PTE of the page table structure can be restricted to be an absolute type PTE. Thus, the first level, which can be a relative type PTE, can be the second level of the table structure.

[0030] Alternatively, in other examples, the top level PTE can also be allowed to be a relative type PTE. For example, the translation table base register providing the address of the top level PTE can specify an indication of whether the top level PTE is of the absolute type or the relative type.

[0031] Relative type PTEs can be used for both table PTEs (branch PTEs) and block PTEs (leaf PTEs). Thus, even for leaf PTEs that identify a translated address, such PTEs are allowed to be relative type PTEs.

[0032] For a given PTE of the relative type, the reference point base address can be determined in different ways. For a relative type PTE, the reference point base address can be non-zero. In one approach, the page table walk circuitry can determine as the reference point base address for a given entry a size-aligned address corresponding to the result of aligning the address of the page table that includes the given PTE to an address size boundary selected based on a size parameter specified by a parent PTE of the given PTE. Thus, with this approach, there is no need to explicitly identify the reference point base address in the PTE, but rather the reference point base address can be determined implicitly based on the size specified by the parent PTE and the address of the page table that includes the given PTE. The size specified by the parent PTE can match the size of the page table that includes the given PTE, and in this case the reference point base address can be the same as the base address of the page table that includes the given PTE. Alternatively, the size specified by the parent PTE can be larger than the size of the page table that includes the given PTE, and in this case the reference point base address can be different from the base address of the page table that includes the given PTE. The size alignment of the base address can correspond to clearing a particular number of least significant bits of the base address to zero, where the number of bits cleared to zero depends on the specified size.

[0033] By using a size-aligned address as the reference point base address, this means that there is no need for an adder for calculating a relative address pointer from the reference point base address and a relative offset value, as the relative offset value can simply be appended to the right of the least significant non-zero bits of the size-aligned reference point base address. Eliminating the need for an adder can improve performance, as ripple-carry adders can be relatively slow in propagating carry from the least significant end to the most significant end of the calculated sum.

[0034] Another advantage of implicitly determining the reference point base address from size-aligning the address of the page table that includes the given page table entry is that this can simplify control to constrain the region of address space accessible via descendant PTEs of a given relative PTE to lie within the region defined by the reference point base address and size of the given PTE. This can also be useful for security, as it means that a supervising process can be confident that a delegate process cannot define an address pointer outside the defined region of address space when specifying control of a subsequent level of the page table structure to another process that uses relative type PTEs.

[0035] Alternatively, another way of determining the reference point base address can be for a given PTE to specify a block table entry identifier that points to a selected entry of a block table that is a separate table structure independent of the page table structure. The selected entry of the block table can specify the reference point base address. Thus, in this example, the page table walk circuit obtains the reference point base address for a given PTE from the selected entry of the block table that is identified by the block table entry identifier specified in the parent PTE of the given PTE. While this approach can require slightly more overhead for remapping the address space, it can provide greater flexibility for the supervisory process to qualify the address region mapped for the relative page table. Whether the reference point base address is determined implicitly by size-aligning the base address or in the explicit approach using a block table, the parent PTE can control the region that allows the relative specified address pointer of the child PTE that specifies this parent PTE, which can be useful for security when delegating the responsibility of managing the subsequent level page table to another process or another party.

[0036] To simplify the calculation of the relative address pointer, the reference point base address can be constrained to be a size-aligned address (for which the least significant number of bits is zero - note that these zero bits can not need to be explicitly identified in any storage representation of the reference point base address, the bits known to be zero can be omitted and implicitly reserved to reduce storage overhead). The size alignment constraint can be implemented by construction (e.g. in the case of calculating the reference point base address by size-aligning the base address of the corresponding page table as described above), or can be enforced by signaling a fault in the case where the base address specified in the relevant block table entry is already specified to be a non-size-aligned address.

[0037] The address pointer specified by a relative type PTE can be bounded to lie within a certain boundary address region, which can be specified by a reference point base address and a size parameter associated with the relative type PTE. As described above, the reference point base address and size can be specified within a selected entry of a block table identified by the parent PTE of the given PTE, or alternatively, the size parameter of the given PTE can be specified by the parent PTE of the given PTE, and a size-aligned address of the page table that includes the given PTE can implicitly reference the reference point base address.

[0038] When the given PTE is a relative type PTE, the page table walk circuit can signal a fault when an address pointer specified by a descendant PTE of the given PTE is outside the boundary address region identified for the given PTE. This can improve security because it allows the supervisory process to be confident that any descendant PTE of a relative type PTE cannot specify an address pointer that extends outside the defined boundary address region. This is useful because one benefit of using relative type PTEs can be that it can allow the supervisory process to delegate management of a relative portion of the page table to others, for example, to delegate responsibility to a developer of executable program code to be stored in non-volatile memory in the relative segment of the page table specified. However, in some cases, the operating system or other supervisory process can not be able to trust that a certain non-volatile memory device or software process will behave correctly. By signalling a fault when an address pointer extending outside the boundary address region specified by the supervisory process is derived in a descendant PTE of a relative PTE, this improves security by constraining the relative segment of the page table structure to limit address pointers to a restricted region, such that the delegated process cannot access incorrect storage addresses located in other regions of the address space.

[0039] In the example described above in which the reference point base address is determined to be a size-aligned address obtained by aligning the address of the page table including the given page table entry, such a check of the boundary address region can be implemented by comparing the size parameter specified by the parent PTE with the size parameter specified by its child PTE. If the given child PTE specifies a larger size parameter than its parent PTE, a fault can be triggered. Given that each direct descendant of a relative type PTE specifies the same size or a smaller size than its parent, then it can be sufficient to calculate the reference point base address by aligning the page table address with the specified size boundary size to ensure that any subsequent address pointers in the descendant PTEs are confined within the boundary address region identified for the given PTE. This avoids the need to record tracking data for tracking the boundary address region identified for earlier ancestral PTEs to check whether address pointers are allowed to descend several levels down the table structure, because instead the boundary address region enforcement can simply be implemented by comparing the two size parameters (the size parameter of the parent PTE and the size parameter of the child PTE) at each step down the table. If at a given level the child PTE is verified to pass the size check (the size specified by the child PTE is not greater than the size specified by the parent PTE), then the indication of the parent PTE size can be discarded because there is no longer a need to perform a size check at subsequent levels of the page table structure.

[0040] On the other hand, if it is permissible to define reference point base addresses more arbitrarily, e.g. based on a block table as described above, then it is possible to check whether the address pointers specified by descendant page table entries of a given page table entry are outside the boundary address region identified for the given page table entry based on tracking information recorded based on earlier ancestor PTEs traversed in the page table walk. For example, upon encountering a given PTE, the boundary address region defined for that PTE can be indicated in the tracking information, and then subsequent address pointers of descendant PTEs encountered in the page table walk can be compared with the tracking information to determine whether a fault is triggered. This approach can require more overhead in terms of storing tracking information and providing an address comparator, but can provide greater flexibility in defining address mappings for subsequent entries of a table than the size alignment approach discussed above.

[0041] In one way of using relative type PTEs with size-aligned base addresses and comparing the sizes specified by parent / child PTEs, descendant PTEs cannot effectively specify address pointers outside the boundary address region defined for an ancestor PTE.

[0042] However, when using absolute type PTEs, it can also be useful to be able to apply such restrictions to the boundaries within which descendant address pointers can be specified. Thus, more generally, a given PTE can specify a descendant entry limited indicator, and the page table walk circuitry can signal a fault when a descendant entry PTE of the given PTE identifies an address pointer that lies outside the boundary address region identified by the given PTE. In some examples, the descendant entry limited indicator can simply be a type indicator that specifies whether the given PTE is of the absolute type or the relative type, such that by definition, relative type PTEs can be considered to be descendant entry limited, whereas absolute type PTEs can not be.

[0043] However, in other examples, the descendant entry limited indicator can be a separate indicator that is independent of whether the descendant entry is of the absolute type or the relative type. Thus, a parent PTE that specifies entries in its child page table to be of the absolute type can specify a descendant entry limited indicator to indicate that the absolute child PTEs are constrained to define their address pointers within certain boundaries, and a fault can be signalled if those child PTEs specify address pointers that are outside those boundaries.

[0044] Additionally, in some cases, systems that do not support relative type PTEs at all can still use the descendant entry restriction indicator to indicate whether all subsequent address pointers in descendant PTEs must lie within a certain boundary address region. Even if relative type entries are not supported, the restriction on descendant entries can be used to provide assurance that once a given PTE specifies a given boundary region of address space, then all subsequent entries from that entry will also need to specify address pointers that lie within that boundary address region, which can be useful for allowing delegation of management of certain parts of a table structure to other processes that can potentially be untrustworthy.

[0045] Likewise, the boundary address region can be specified in different ways. In one example, the boundary address region is a region of a specified size starting from a reference point base address, and the given PTE can specify a size parameter that indicates the specified size. In this case, the reference point base address of the boundary address region can be determined as a size-aligned address that corresponds to the result of aligning the address of the page table that will include the child PTE with an address size that is based on the size parameter specified by the given PTE. Thus, with this approach, the determination of the boundary address region can be similar to the approach discussed above for computing the reference point base address of a relative type PTE.

[0046] Alternatively, the base address and the size of the boundary address region can be specified within an entry of a block table, the entry being identified by a block table entry identifier specified in the given PTE.

[0047] The above-described techniques can be implemented in apparatus having specific circuitry provided in hardware to define memory management circuitry and page table walk circuitry.

[0048] However, it is also possible to emulate the functionality of the page table walk circuitry in software, within a computer program for controlling a host data processing apparatus to provide an instruction execution environment for executing instructions. The computer program can include page table walk program logic that operates in a manner corresponding to the page table walk circuitry discussed above, supporting relative type PTEs and / or PTEs that specify descendant entry restriction indicators as described above. Such a program can be used to allow program code that writes itself to be executed by a host data processing apparatus that does not have native hardware support for the type of page table structure described above to be used with processor architectures that do support these features.

[0049] Figure 1An example of a data processing system 2 comprising a plurality of processor cores 4 is shown schematically. Each core comprises a processing pipeline 6 for fetching instructions from memory, decoding the instructions, and performing data processing operations in response to the decoded instructions. Registers 8 are provided for storing operands of the data processing operations. Results of the processing operations are written back to the registers 8. The core 4 can comprise at least one cache 10 for caching data from the memory system for faster access by the core.

[0050] The core 4 also has a memory management unit 12 for managing address translation between virtual addresses specified by instructions processed by the pipeline 6 and physical addresses used to identify locations within the memory system. Address translation is controlled based on at least one page table structure stored in the memory system. In some examples, a two-stage translation can be used in which a virtual address is translated in a first stage address translation to an intermediate physical address, and then the intermediate physical address is translated in a second stage address translation to a physical address that directly identifies the corresponding memory location. This can be used to support virtualization in which a virtualization operating system, assuming it is the only operating system present, can define an address mapping associated with the first stage address translation, and consider the intermediate physical address generated in the first stage translation to be the actual physical address, but a hypervisor managing respective operating system virtualizations on the same physical platform can define the second stage address translation to map intermediate physical addresses defined by different operating systems onto different parts of the physical address space. Thus, the first stage translation can be controlled based on a first stage page table structure comprising page table entries of two or more levels, and the second stage translation can be controlled based on a second stage page table structure comprising page table entries of two or more levels.

[0051] The MMU 12 can comprise a translation lookaside buffer (TLB) 14 which is a cache of some of the page table entries of the page table structure. The MMU can also comprise a page table walk circuit 16 for performing a page table walk operation to obtain PTEs from the page table structure stored in memory for address translation. The PTEs obtained in the page table walk, or information derived from the PTEs, can be allocated to the TLB 14 so that when the same memory addresses are accessed in the future, the translation can be performed more quickly.

[0052] The processor cores 4 can communicate via an interconnect 20 which can manage the linking between the respective caches 10 and TLBs 14 of the respective processor cores. Via the interconnect 20, the cores can request access to an underlying memory system which can comprise various peripheral devices 22, one or more modules of volatile memory 24 such as dynamic random access memory (DRAM), and one or more modules of non-volatile memory 26 such as flash memory.

[0053] The system 2 can also include one or more master devices 30 that can request access to the memory, but unlike the processor core 4, the master devices can not have an internal memory management unit (MMU) 12 themselves. Examples of such devices 30 can include display controllers, network interface controllers, graphics processing units (GPUs), etc. A system MMU 32 can be provided between the master devices 30 and the interconnect 20 to provide the master devices 30 with address translation functionality similar to that provided by the MMU 12 within the core 4. Like the MMU 12, the system MMU 32 can include a TLB 34 and page table walk circuitry 36.

[0054] As shown in Figure 2 The MMUs 12, 32 can control address translation based on a page table structure stored in the memory system, which includes multiple page table levels 40, each page table 40 including multiple page table entries (PTEs). Each page table 40 is stored in a given page of the address space that is mapped using the page table structure. Each page table 40 is associated with a given level of the page table structure, and a PTE 42 at one level can include an address pointer 48 to a page table 40 at the next level of the page table structure. A PTE 42 that points to a subsequent page table is referred to as a table entry or branch entry. The final level page table of a given branch of the page table structure can include a block entry or leaf entry that specifies an address pointer that identifies a translated storage address corresponding to a target address for which translation is requested. In the example shown, the PTEs 42-0, 42-1, 42-2 indicated at levels 0, 1, and 2 are table entries, and the level 3 PTE 42-3 is a block entry. Figure 2

[0055] When a processing pipeline 6 of the processor core 4 or a given master device 30 issues a memory access request to request read or write access to a storage location associated with a certain target address 46, the corresponding MMU 12, 32 performs address translation to translate the target address 46 to a translated address 52. If the relevant address mapping is already cached within the TLB 14, 34, the translated storage address can be returned relatively quickly, otherwise at least a portion of a page table walk can be performed.

[0056] Figure 2 A full page table walk operation is shown for traversing a page table structure associated with a single stage address translation:

[0057] • The translation table base address is stored in a translation table base register (TTBR) of the MMU 12, 32 and points to the base address of the level 0 page table 40-0 of the page table structure.

[0058] ​• The 0-level index portion 44-0 of the target address 46 is used to index into a selected PTE 42-0 of the 0-level page table 40-0.

[0059] • The selected 0-level PTE 40-0 includes an address pointer 48 that identifies a base address of a particular 1-level page table 40-1 of the page table structure.

[0060] • The 1-level index portion 44-1 of the target address 46 is used to select a 1-level PTE 42-1 from the 1-level page table 40-1.

[0061] • The selected 1-level PTE 42-1 specifies an address pointer that identifies a base address of a 2-level page table 40-2.

[0062] • Based on the 2-level index portion 44-2 of the target address 46, a 2-level PTE 42-2 is selected from the 2-level page table 40-2.

[0063] • The 2-level PTE 44-2 includes an address pointer that identifies a base address of a 3-level page table 40-3.

[0064] • Based on the 3-level index portion 44-3 of the target address 46, a 3-level PTE 42-3 is selected from the 3-level page table 40-3.

[0065] • The 3-level PTE 42-3 is a block PTE whose address pointer provides the most significant portion 50 of the translated address 52. The most significant portion 50 of the translated address 52 replaces the bits of the target address 46 corresponding to the index portions 44-0 through 44-3. The remaining bits 54 of the target address 54 are mapped directly into corresponding bits 54 of the translated address 52 without change.

[0066] Figure 2 A single stage address translation is shown, but in an MMU that implements a two stage address translation, the first stage address translation can translate a virtual address into an intermediate physical address, and the second stage address translation can translate the intermediate physical address into a physical address. However, each of the address pointers 48 in the address pointers provided by the PTEs within the first stage address translation can itself be designated as an intermediate physical address (IPA), and thus can need to be translated into a physical address (PA) in the second stage address translation before the next level of the 1st stage page table structure can be accessed. In addition, the translation table base address in the TTBR can be designated as an IPA, so it can also need to be translated in the 2nd stage before the 1st stage 0-level page table can be accessed. Thus, in practice, each successive step through the 1-level page table structure can be separated by a walk through the 2-level page table structure. That is, when a 2-stage address translation requires a full page table walk operation, the sequence can be as follows:

[0067] • Stage 2,0; Stage 2,1 ; Stage 2,2; Stage 2,3 (to translate the Stage 1,0 base address from IPA to PA);

[0068] • Stage 1,0 (to obtain the Stage 1,1 base address designated as IPA);

[0069] • Stage 2,0; Stage 2,1 ; Stage 2,2; Stage 2,3 (to translate the Stage 1,1 base address from IPA to PA)

[0070] • Stage 1,1 (to obtain the Stage 1,2 base address designated as IPA);

[0071] • Stage 2,0; Stage 2,1 ; Stage 2,2; Stage 2,3 (to translate the Stage 1,2 base address from IPA to PA)

[0072] • Stage 1,2 (to obtain the Stage 1,3 base address designated as IPA);

[0073] • Stage 2,0; Stage 2,1 ; Stage 2,2; Stage 2,3 (to translate the Stage 1,3 base address from IPA to PA)

[0074] • Stage 1,3 (to obtain the translated address designated as IPA);

[0075] • Stage 2,0; Stage 2,1 ; Stage 2,2; Stage 2,3 (to translate the translated address from IPA to PA).

[0076] In practice, not all of these page table lookups are required each time a page table walk is performed, as the TLB can cache PTEs from any level, so some steps can be skipped if the corresponding PTE is already available in the TLB.

[0077] Whilst Figure 2 An example is shown of a block entry in a 3-level page table 40-3, but if a single contiguous address mapping is to be used for a large portion of the address space, it is also possible to define block entries at higher levels of the page table structure. For example, a 1 -level or 2-level PTE can be a block entry, and in this case the page table walk of the page table structure can terminate after a 1 -level or 2-level lookup and can not need to walk through all levels.

[0078] As Figure 2Different addresses with different values for the level 0 index portion 44-0 can be mapped to different level 0 PTEs 42-0 in the level 0 page table 40-0 with different address pointers 48, as indicated by the dashed lines labeled 58, such that they point to different level 1 page tables 40-1, and thus, different addresses 46 can need to traverse different branches of the page table structure separately to reach the final block entry of the implied translated address. Some branches can re-converge if some entries in different page tables contain pointers to the same entry at a subsequent level.

[0079] In general, page tables use absolute physical addresses or intermediate physical addresses to describe where the table resides in memory. However, for non-volatile memory (NVM) 26, it can be useful to store persistent page table segments in non-volatile memory. For example, executable program code stored in NVM 26 can contain relative page table segments. To map the executable program code into memory, the OS can set up page table entries, e.g., L0 entries, that point to the relative page tables in NVM. This operation can automatically map all parts of the executable program code into memory. Unlike traditional page tables with absolute addresses, the OS does not need to relocate the page tables if the NVM is mapped at a new base address, e.g., by moving it to a different system.

[0080] Figure 3 An exemplary structure of a PTE 42 that can be used to implement such relative address pointers is shown. The format of a table PTE (branch entry) is shown in the upper portion of Figure 3 and the format of a block PTE (leaf entry) is shown in the lower portion of Figure 3 Both types of PTEs include a valid bit 60 that specifies whether the information in the PTE is valid. Thus, the operating system does not have to map all PTEs within a given page table 40. If an access is made to a target address that corresponds to an invalid PTE, this can trigger an address translation fault, which can trigger an exception, which can cause a supervisory process (e.g., an operating system or hypervisor) to re-map the address space to provide a mapping to the accessed address region.

[0081] The PTE 42 can also include a table / block flag 62 that indicates whether the PTE is a table PTE or a block PTE. In the example of Figure 3 if the table / block flag 62 is 1, the PTE is a table PTE, and if the table / block flag 62 is 0, the PTE is a block PTE.

[0082] Both types of PTEs can specify memory attributes 64 associated with the region of address space corresponding to the PTE. For a 0-level PTE, the corresponding portion of address space is the region consisting of all addresses that share the 0-level index portion 44-0 having a given value. For a 1-level PTE, the corresponding address region is the region formed by all those addresses that share a set of given values for the 0-level index portion 44-0 and the 1-level index portion 44-1. For a 2-level PTE, the corresponding address region is the region formed by those addresses that have a set of given values for each of the 0-level index portion 44-0, the 1-level index portion 44-1, and the 2-level index portion 44-2. For a 3-level PTE, the address region is formed by those addresses that have a set of given values for all of the 0-level to 3-level index portions 44-0, 44-1, 44-2, 44-3. The attributes 64 defined for the corresponding address region can specify, for example, whether the region is read-only, or can be read and written. These attributes can also specify whether the region is a device-type memory region that does not allow reordering of memory accesses compared to their issue order. In addition, the memory attributes 64 can specify which privilege levels of the processor core 4 are allowed to access the corresponding address region, or other information for controlling how the corresponding region of memory is allowed to be accessed. In Figure 3 In the example described below, the block PTEs can specify a greater amount of attribute information than the table PTEs, although this is not required.

[0083] As shown in Figure 3 , the table PTEs can include a next-level PTE type indicator 66 (R n+1 ) that indicates whether the PTEs within the page table 40 at the next level of the page table structure are of the absolute type or the relative type. In this example, if the type indicator 66 is 0, this indicates that the next-level PTEs are of the absolute type, and if the type indicator 66 is 1, this indicates that the PTEs at the next level are of the relative type. This mapping using the type indicator 66 can be used for compatibility with legacy software written for architectures that do not support relative-type PTEs, as the reserved bit that is normally expected to be 0 can be repurposed to indicate the type indicator 66. The block PTEs do not specify a next-level PTE type indicator 66, as there is no next level for the block PTEs, as the block PTEs are the final level of this branch of the page table structure. In the block PTEs, the bit in the same bit position as the type indicator 66 of the table PTEs can be reserved for future use, fixed to zero, or used for other information.

[0084] In the notation R n and R n+1 described below, for a given table PTE at level n of the page table structure, R n is the type indicator 66 specified in the parent PTE of this table PTE that defines whether the n-level PTE is of the absolute type (R n=0) or relative type (R) n =1), while R n+1 The type indicator 66 is specified in the PTE at level n, which defines that the PTE at level (n+1) below the page structure is an absolute type (R). n+1 =0) or relative type (R) n+1 =1).

[0085] Both the table and block PTEs specify address pointers 68 and 72. If the parent PTE at a previous level of the page table structure specifies R... n =0, then the address pointer is an absolute value. For a table PTE, address pointer 68 is used to determine the base address of page table 40 at the next level of the page table structure. If the n-level PTE at the current level is of absolute type, then the address pointer is an absolute value that directly specifies the base address of the next level page table. To make the address pointer field 68 shorter, it is not necessary to explicitly specify that the lower part of the bits in the address pointer field 68 is all equal to 0, as these can be implied from the level of the PTE. For a block PTE identified as an absolute type PTE, the absolute address pointer value 72 identifies the most significant bit of the translated address, where the least significant bit 54 of the translated address 52 is directly mapped from the corresponding bit 54 of the destination address 46, such as... Figure 2 As shown.

[0086] Specify that the next level PTE belongs to the relative type (R) n+1 =1) Table PTE also specifies the size parameter 70 (BS) n+1 This size parameter defines the area size applicable to the next level of relative type PTE. Area size BS n+1 The reference point base address B, which can be used to calculate the reference point base address that will be used as the reference for the relative address offset specified by the next-level relative type PTE. n+1 .

[0087] The region size can be defined as a power of 2, using the stored parameter BS, which does not explicitly indicate the size but can be used to calculate the size as follows. The symbol BS is described below. n and BS n+1 In the context of page table structure, for a given table PTE at level n, BS n This refers to the dimension parameter 70 specified in the parent PTE of the PTE table, and BS n+1 This refers to the dimension parameter 70 specified in the PTE at level n, which defines the dimensions of the PTE at level (n+1). According to the relation... The stored size parameters BS can be n Mapped to the corresponding address region size S n Where “bias” is an arbitrary bias constant, which is an integer of 0 or greater. This is achieved by applying (S) to... n-1) the calculated bit mask is inverted to clear the least significant bits, so that the given base address B n Size alignment. For example, if the offset is 0, some examples of different region sizes and corresponding bit masks are as follows:

[0088] BS n ]]> [SA n ]]> S n -1 (binary)] Bitmask 1 2 …00000001 …11111110 2 4 …00000011 …11111100 3 8 …00000111 …11111000 4 16 …00001111 …11110000

[0089] In practice, the minimum region size that needs to be supported can be larger than 2 bytes, so by using an offset it is possible to compress the size indicator to fewer bits by avoiding the need to provide encoding space for encoding region sizes smaller than the minimum size. For example, if the required minimum region size is 1 kB (1024 bytes), the required S n The minimum value would be 10, so the offset can be set to 10, so that the minimum region size can be defined using BS n = 0:

[0090] BS n ]] [SA n ]] S n -1 (binary)] Bitmask 0 1024 …0 0011 1111 1111 …1 1100 0000 0000 1 2048 …0 0111 1111 1111 …1 1000 0000 0000 2 4096 …0 1111 1111 1111 …1 0000 0000 0000 …

[0091] This approach allows the use of fewer bits to encode region sizes between the required minimum size and the maximum size.

[0092] As Figure 4 shown for a relative type PTE, the reference point base address B n for a given n-level relative type PTE can be calculated by combining the bit mask (determined based on the size parameter) in a bitwise AND operation with the base address TA n of the page table comprising the n-level PTE, clearing the least significant bits of TA n , where the number of cleared bits depends on the specified size. This generates a size-aligned reference point base address B n that is aligned with the size boundary corresponding to the size specified in the parameter BS n at the (n-1) level of the table structure.

[0093] For an n-level relative type table PTE, the base address TA n+1 of the child page table at the n+1 level of the page table structure is obtained, which is equal to the sum of the reference point base address B n and the relative offset value rTA n+1 specified in the address pointer field 68 of the n-level PTE. This can be calculated using an adder, but it can be more efficient to simply append the relative offset value rTA n+1 to the least significant end of the non-cleared part of the reference point base address B n , or to OR B n with rTA n+1 , which achieves the same result as adding B n when size-aligned.

[0094] Before combining the offset with the reference point base address, the relative offset value can be obtained by combining it with the value corresponding to (S). n The high-order bits of the mask representing the binary representation of –1) are masked by performing an AND operation (this mask is used to generate the reference point base address B). n (Inverting the bitmask) to ensure the reference point base address B n The sum of the offsets cannot extend beyond the marked area S. n Address B of the end size n +S n Additionally, a certain number of least significant bits of the offset can be cleared by applying a mask, where the number of cleared bits depends on the granularity (the size of a page table) and / or the hierarchy of page tables within the table structure, to ensure that the end of the accessed page table does not extend beyond the end B of the region. n +S n This is discussed in more detail than step 114. In some implementations, a fault can be triggered if any bit in the mask (at the top or bottom of the offset) is not zero, as this indicates an invalid PTE definition.

[0095] Similarly, the n-level relative type block PTE specifies a relative offset value in the address pointer field 72, from which the upper part of the translated address can be calculated. This translated address is equal to the base address B. n The sum of the relative offset value rPA specified in the address pointer field 72 of the block PTE (again, using the offset mask as described above). Again, this doesn't necessarily require addition, but can be done using shifters and / or OR logic.

[0096] In this example, since any table PTE (including level 0 PTEs) can specify that the next level provides a relative address by setting the absolute / relative type flag 66 in the current PTE to 1, this means that the first level that can contain any relative address pointer is a level 1 page table, and level 0 page tables can be absolute PTEs by default. However, in other examples, the TTBR can specify a type indicator that indicates whether a level 0 page table is absolute or relative, allowing relative type PTEs to be provided in level 0 page tables as well.

[0097] Once a PTE at a certain level specifies that the next level is relative, any subsequent level must also be of a relative type, and descendant PTEs of relative PTEs are not allowed to be absolute PTEs. Therefore, as... Figure 4 As shown, the address pointer TA1 specified in the level 0 table entry will always be an absolute pointer and point to a level 1 page table 40-1 in the page table structure.

[0098] exist Figure 4In the example of FIG. 4, assume that the level-0 PTE specifies that the level-1 page table should be of the relative type, and specifies a size parameter 70 corresponding to a certain region size S1, as shown. Figure 4 The reference point base address B1 is formed by aligning the table address TA1 of the level-1 page table 40-1 with the size boundary size associated with size S1. Note that in Figure 4 the shaded portion of 40-1 corresponds to the level-1 page table itself, while the unshaded region 80 of size S1 starting at reference point base address B1 is the boundary address region within which address pointers specified by the level-1 PTE and any descendant entries of those PTEs are permitted to be defined. Based on the level-1 index portion 44-1 of the target address, a PTE is selected from the level-1 page table 40-1. The sum of the base address B1 and the relative offset rTA2 specified in the index entry of the level-1 page table provides the table address TA2 of the level-2 page table 40-2 at the next level of the page table structure. The level-1 PTE specifies a size parameter BS2 that identifies the size S2 of the boundary region of its child PTEs at level 2. Again, aligning TA2 with the size boundary size of size S2 yields a base address B2 that is the reference point for the relative address pointer 72 specified in the level-2 page table 40-2. In this example, the level-2 PTE is a block PTE, and thus the address pointer specified using the relative offset rPA gives the translated address PA, and thus no further traversal of the page table structure is required.

[0099] Thus, in summary, a page table walk begins with an absolute pointer in the TTBR and the L0 page table. Any table (including L0) can specify that the next level provides a relative address by setting the relative next bit in the current page table. Once a level specifies that the next level is relative, any subsequent levels must likewise be relative.

[0100] When a level specifies that the next level provides a relative address, the current level also specifies the size S of the permitted storage region addressable by the next level. Based on the pointer TA n+1 to the next level and the size Sn +1 of the level, the boundary storage region for the level is defined. The boundary storage region is naturally aligned, and has a base address B n+1 and a size S n+1 . The base address is computed by aligning the table address: B n = TA n & ~ (S n - 1). The relative pointer is resolved relative to the base address of the region in which the current table exists. For example: TA n+1 = B n | rTA n+1 . Relative block entries are resolved in the same manner as relative table pointers.

[0101] The MMU can implement security checks that allow segments of page table structures defined using relative address pointers to be stored in non-volatile memory 26, enabling them to be embedded within executable code written by potentially untrusted software developers rather than the developers of the operating system or hypervisor that restricts the page table structure to a higher level. These checks may include:

[0102] • The boundary memory region 80 at level n should be a subset of level n-1. Otherwise, the CPU should fail. This applies to both table entries and block entries. The start and end of a block at level n should both fall within the region at level n-1.

[0103] If level n-1 is marked as relative, then the table entry at level n should be marked as relative. Otherwise, the CPU should fail.

[0104] The combination of these checks ensures that once a given PTE marks the next level of the page table structure as relative, all subsequent descendants of that PTE will also be relative. This allows the operating system to easily remap the entire portion of the address space pointed to by that branch of the page table structure by changing the absolute address pointer at the last level, which includes the absolute PTE. Additionally, this means that any relative address pointer defined at subsequent levels of a PTE can be guaranteed not to point to any address outside the boundary address region 80 specified at the highest-level PTE that is defined as a relative type PTE.

[0105] use Figure 4 The method shown ensures that, as long as the size parameter 70 of a child entry is not greater than the size parameter of its parent entry, the address regions of the child PTE and any descendant PTEs will always be within the boundary address region entries defined by the top-level PTE relative type PTE. This means that even if the device containing the relative fragment of the page table structure is untrusted, or the developer of the software associated with that fragment of the page table is untrusted, higher-privilege processes such as the operating system or hypervisor remain trustworthy: once a given region 80 of the address space has been mapped to be suitable for the use of relative page tables, all mappings provided by the other party in subsequent levels of the page table structure will not extend beyond region 80, and therefore addresses in other regions of the total address space are safely protected from incorrect access. This can be achieved through... Figure 4 As can be seen, the pointer to region B2 is a level 2 bounded pointer to B2+S2. As a result of size alignment, the base address used to calculate the relative offset is restricted to region 80, which is defined as a level 1 boundary region.

[0106] Figure 5 This is a flowchart illustrating a method for performing page table walks to locate entries for use by MMU 12. Figure 5The steps performed when a given level (n-level) of the page table structure is reached are shown. It will be appreciated that the method can then be repeated for each level reached by traversing the address pointers from the parent PTE to the child PTE. In Figure 2 In the example of Figure 2 , n can be between 0 and 3, i.e. the maximum number of levels of the page table hierarchy is 4, but other examples can support a maximum number of levels less than or greater than 4.

[0107] In addition, it will be appreciated that not every memory access can require a page table walk. If the full translation mapping between the target address and the translated address is already cached in the TLB, then no page table walk is required.

[0108] In addition, where a page table walk is required, it is not always necessary to traverse all levels of PTEs. Some TLBs can cache partial translations (e.g. from a VA to an address of a PTE at some level of the tree structure, e.g. from a VA to a 2-level). In this case, it is not necessary to walk the page table structure at 0-level and 1-level, as the cached information in the TLB can be used to obtain the relevant PTE from the 2-level, and then proceed to identify the next level PTE to be accessed at 3-level.

[0109] Thus, Figure 5 The steps performed when a given level (n-level) of the page table structure is reached are shown. It will be appreciated that the method can then be repeated for each level reached by traversing the address pointers from the parent PTE to the child PTE. In

[0110] Thus, at step 100, the PTE corresponding to the n-level index portion 44-n of the target address 46 is obtained from the TLB 14, 34 or from the memory system. At step 102, the page table walk circuitry 16, 36 identifies what type of PTE the parent PTE at the previous n-1 level of the page table structure indicates. For example, see Figure 2 For a PTE 42-2 at level 2, the parent PTE would be the PTE 42-1 at level 1 which contains an address pointer to the level 2 page table 40-2 which contains the level 2 PTE 42-2. If the type indicator 66 in the parent PTE indicates that the PTE at level n is of the absolute type, then at step 104 the address pointer for the PTE at level n is determined from the absolute address 68, 72 specified directly in that PTE. If the PTE at level n is a block PTE, then this terminates the traversal of the page table structure (although a 2nd phase further traversal of the page table structure can still be required if the translated address is an IPA). If the PTE at level n is a table PTE, then the address pointer 68 identifies the address of the page table at the subsequent level which can then be obtained in further walks by the method of Figure 5

[0111] If at step 102 the parent PTE at level n-1 indicates that the PTE at level n is of the relative type (R n = 1), then at step 106 the page table walk circuitry 16, 36 determines whether the type indicator 66 specified by the PTE at level n indicates that its child PTE at level n+1 is of the absolute type (R n+1 = 0). If so, then a fault is signalled at step 108. Thus, a relative PTE can only specify a further relative PTE as a child. This ensures that a relative segment of the address table can be freely remapped by simply updating the last absolute pointer defined in one of its ancestors in the page table structure without needing to individually re-map the address pointer in each subsequent PTE in the relative portion of the page table.

[0112] At step 110, a second security check can be performed to determine whether the size parameter 70 (BS n+1 ) specified by the PTE at level n indicates a larger size than the size parameter 70 (BS n ) specified by its parent PTE at level n-1. If the size specified by the n-1 level parent PTE is greater than the size specified by the n level child PTE, then again a fault is signalled at step 108. Since the base address of the relative offset at level n is a size-aligned version of the table address of the n level page table, preventing an increase in size from parent to child provides the following guarantee: any subsequent offset within the relative portion of the page table will lie within the boundary region defined by the earliest relative PTE encountered on the current branch through the page table structure.

[0113] ​The checks at steps 106 and 110 can be performed in either order, or can be performed in parallel with each other.

[0114] If neither step 106, 110 triggers a fault, i.e. the sub-PTE at level n specifies that level n+1 is relative and its specified size is less than or equal to the size specified in its parent PTE, then the method proceeds to step 112. At step 112, the reference point base address Bn n determined at step 112 is determined to be a size-aligned address corresponding to the table address TA n (from which the n-level PTE being read) is aligned with a natural address boundary corresponding to the size parameter BS n identified size S n The natural address boundary is a boundary corresponding to an integer multiple of the size (e.g. for a 4kB size, the address boundary will be at 4kB, 8kB, 12kB, etc.). The base address Bn n and the size S n together define a boundary address region within which the relative specified address pointers for the current PTE at level n and subsequent descendant PTEs are permitted to be defined.

[0115] At step 114, a mask is applied to the relative address offset specified in the address pointer field 68, 72 of the PTE at level n. In the mask, some higher bits of the offset are cleared by the mask based on the mask (S n -1) and some lower bits are cleared by the mask. For table entries, the lower bits are cleared based on the mask ~ (G - 1), where G is the granularity of the page table structure. For block entries, the lower bits to be cleared are those corresponding to fields 54 and 44 - X, where all X are greater than the level containing the block entry (i.e. the offset does not affect bits directly mapped from the block entry at that level of the page table structure). These mask operations ensure that both the start and end of the page table or granule accessed using the address pointer will be within the region of size S n starting from the base address Bn n In some examples, a fault can be triggered if any of the mask bits are non-zero in the original (unmasked) relative address offset. At step 114, the address pointer is determined from the reference point base address Bn

[0116] If the n-level PTE is a block PTE, then no further steps through the page table structure are required (although, as mentioned above, a second-stage address translation may be necessary if the returned address is an IPA). If the n-level PTE is a table PTE, then n is incremented by 1, and then the process is repeated for the next level of the page table structure. Figure 5 The method.

[0117] In the example shown above, the size parameter BS n+1 The size of the boundary address region of the child PTE at the next level of the page table structure is explicitly specified within the parent PTE. Alternatively, in the example above, the base address B is implicitly determined by aligning the address of the page table at level n with the size boundary dimension. n The dimension boundary is based on the dimension parameter BS specified by its parent PTE. n To determine this, a relative address pointer is calculated using a relative address offset based on the base address.

[0118] However, as Figure 6 As shown, another approach is to specify a block identifier 90 instead of the size parameter 70 in the PTE table. The block identifier 90 identifies a specific block entry 92 within a block table 94, which is a separate table structure independent of the page table structure. Each block entry 92 specifies a base address 96 and a size parameter 98, which can then be used as the base address B. n+1 and dimensional parameters BS n+1 This is used to determine the address pointer of the sub-PTE at the next level (n+1) of the page table structure. Address pointer 68 can still specify a relative offset as previously described, and all other fields 60, 62, 66, and 64 can be... Figure 3 The fields in the example are the same.

[0119] Therefore, as Figure 6 As shown, it is not necessary to explicitly indicate the base address or size parameters in the PTE itself.

[0120] If using Figure 6 The method shown provides a mechanism to allow child PTEs to "inherit" block specifications from their parent. This can be achieved by preserving a predetermined block identifier (e.g., block ID 0) to indicate "keeping the block defined by the parent," or by having the convention that subsequent relative type indicators 66 (or below) are not set for child entries unless the child entry updates the block specification. Figure 7Inheritance is achieved (in the example of the above discussion) by the relative type PTE being marked with a child entry restricted flag (child entries in this case will only inherit attributes from the parent). Providing such an inheritance mechanism is useful as it means that the child entries themselves do not need to specify information on the block table, which improves security as the block table can be managed by the OS / hypervisor and the page table fragments can exist on removable (non-volatile) media, such that it would not be desirable to encode information from the block table on the removable media.

[0121] In the example discussed above, once a PTE is marked as a relative type, this also means that the descendant PTEs of the relative type PTE are constrained to have their specified address pointers within a certain boundary address region 80 defined for the first level relative PTE. Thus, the relative / absolute type indicator 66 can also be considered a child entry restricted indicator, which indicates whether the child entries of the PTE are restricted to have the defined address pointers within a certain boundary address region. However, in other approaches, it can also be desirable to apply such a boundary to address pointers to absolute type PTEs at subsequent levels in the page table structure.

[0122] Thus, in some implementations, a PTE format as shown in Figure 7 may be used. The fields 64, 66, 68, 70 or 90, 62 and 60 of the PTE can be the same as in Figure 3 or Figure 6 However, in Figure 7 the PTE can also include a child entry restricted flag 120, which indicates whether any child entries are restricted to only specify pointers within a defined boundary address region 80 (D n+1 = 1) or are allowed to specify pointers outside the boundary region 80 (D n+1 = 0). The boundary address region can be defined by a base address and size in the block table as shown in Figure 6 (thereby allowing the boundary region to be defined relative to any arbitrary), or by aligning the base address size of the current level page table based on the size specified by the parent PTE of the page table as shown in Figure 4 .

[0123] For branches of the table structure which include relative PTEs, using the relative offset to calculate the address pointer from the size aligned base address and applying the mask to the relative address offset, it can be guaranteed (provided that it is not possible to increase the size from parent to child as discussed with respect to step 110) that the descendant PTEs cannot define address pointers outside the boundary region defined for the earlier PTE.

[0124] However, for the absolute part of the page table, or for relative PTEs in which a boundary region is defined using an arbitrary base address and size in the block table, it is envisaged that the address pointer 68 at a given level n is defined to point outside the boundary address region defined for an earlier region in the same branch of the page table structure. For example, in Figure 7 the PTE in the level 0 page table 40-0 defines D n+1 = 1 to define its descendants as "descendant entry restricted". The level 0 PTE defines a boundary address region 80 for its child PTEs at level 1. In this example, the boundary region starts at base address B1 and has size S1. Although the address pointer specified in the level 1 PTE is within this region, in this example the child PTE at level 2 specifies an absolute address pointer 68 which points to a location outside the boundary address region 80 defined for level 1, and so this would trigger the page table walk circuitry 16, 36 to signal a fault. By contrast, if the descendant entry restricted flag 120 is 0 in both the L0 and L1 PTEs, then even if the address pointer in the L2 PTE extends outside the boundary region 80 of the earlier L0 PTE, no fault is generated (at least for absolute type PTEs).

[0125] In some embodiments, in order to track the boundary address region defined for a given level PTE, the page table walk circuitry 16, 36 can record some tracking information, for example the base address and size defining the boundary address region, or the start and end addresses of the boundary address region. On encountering a descendant PTE at a subsequent level, the page table walk circuitry 16, 36 can compare the address pointer of this PTE with the boundary address region defined by its ancestor PTE to determine whether to signal a fault. Multiple sets of tracking information can be maintained for PTEs at different levels of the page table structure.

[0126] Alternatively, in the case where the boundary address region is defined as a size-aligned version of the page table address as described above, it is not necessary to store this tracking information, since in this case a simple comparison of the size parameters of the parent and child entries is sufficient to enable the boundary check of the subsequent address pointer. This can be more efficient, since it means that the page table walk circuitry 16, 36 can have less hardware for comparing addresses and storing tracking information about the boundary address regions defined by earlier PTEs in the page table walk.

[0127] By allowing address pointers to be bounded by absolute PTEs as well as certain region boundaries of relative PTEs, this can allow an operating system or hypervisor to delegate management of certain sub-portions of the page table structure to other software processes or to the software developer of certain persistent segments of acceptable code to be stored in non-volatile memory 26, in the confidence that any subsequent mappings resulting from descendant entries will also be within that region, making it impossible for a malicious party to modify descendant PTEs to point to incorrect addresses.

[0128] In some examples, D n+1 = 0 can be overridden by the indication of a later PTE of relative type, i.e. relative type PTEs can be considered by default to be "descendant entry restricted", but absolute type PTEs can be either (D n+1 = 1) "descendant entry restricted" or not (D n+1 = 0).

[0129] Other examples can also allow relative type PTEs to be distinguished as either (D n+1 = 1) "descendant entry restricted" or not (D n+1 = 0). This can allow a supervisory process controlling a higher level of the page table structure to determine whether a device defining a subsequent level of the page table structure is trusted, and to set the descendant entry restricted flag 120 accordingly (D n+1 = 1 if not trusted, and D n+1 = 0 if trusted).

[0130] Although Figure 7 PTE format is shown which combines both the absolute / relative type indicator 66 and the indicator of whether descendant entries are restricted 120, it is also possible to provide the descendant entry restricted indicator 120 in a PTE format which does not support relative type PTEs at all, and in this case the absolute / relative type indicator 66 can be omitted.

[0131] Figure 8Embodiments of simulators that can be used are shown. While the previously described embodiments implement the application in terms of apparatus and methods for operating specific processing hardware that support the technology involved, it is also possible to provide an instruction execution environment in accordance with the embodiments described herein that is implemented through the use of a computer program. Such computer programs are often referred to as simulators, in part because such computer programs provide a software-based implementation of a hardware architecture. Categories of simulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators. In general, a simulator implementation can run on a host processor 230 that supports the simulator program 210, which optionally runs a host operating system 220. In some arrangements, there can be multiple simulation layers between the hardware and the provided instruction execution environment and / or multiple different instruction execution environments provided on the same host processor. Historically, powerful processors have been required to provide a simulator implementation that executes at a reasonable speed, but such an approach can be reasonable in certain situations, such as when it is desirable to run code native to another processor for compatibility or re-use reasons. For example, a simulator implementation can provide an instruction execution environment with additional functionality that is not supported by the host processor hardware, or provide an instruction execution environment that is normally associated with a different hardware architecture. An overview of simulation is given in "Some Efficient Architecture Simulation Techniques", Robert Bedichek, Winter 1990 USENIX Conference, pp. 53-63.

[0132] To the extent that the previously described embodiments have been described with reference to specific hardware configurations or features, in a simulated embodiment, equivalent functionality can be provided by suitable software configurations or features. For example, a particular circuit can be implemented as computer program logic in a simulated embodiment. Similarly, memory hardware such as registers or cache memory can be implemented as software data structures in a simulated embodiment. To the extent that one or more of the hardware elements referenced in the previously described embodiments exist in an arrangement on host hardware (e.g., host processor 230), some simulated embodiments can make use of the host hardware, where appropriate.

[0133] The emulator program 210 can be stored on a computer readable storage medium (which can be a non-transitory medium) and provides a program interface (instruction execution environment) to the target code 200 (which can comprise an application program, operating system and hypervisor) which is the same as the application program interface of the hardware architecture which the emulator program 210 is modelling. Thus, program instructions of the target code 200 (including instructions defining a page table structure having the properties as described above) can be executed from within the instruction execution environment using the emulator program 210 so that a host computer 230 which does not actually have the hardware features of the apparatus 2 described above can emulate these features.

[0134] The emulator program 210 can comprise instruction decoding program logic 212 which maps instructions specified by the target code 200 to corresponding functionality defined using native instructions supported by the host hardware 230. The emulator program 210 also comprises memory management program logic 214 defined using native instructions supported by the host hardware 230 and page table walker program logic 216 which emulates the functionality of the MMU 12, 32 and page table walker circuitry 16, 36 of the apparatus 2 described above. The memory management program logic 214 can allow the emulator program 210 to emulate the presence of the emulated address space 218. From the perspective of the target code 200, data and instructions are stored in memory addressed based on the emulated address space 218, but the memory management program logic 214 can control emulated address translations from emulated virtual addresses to emulated physical addresses under the control of the page table structure 219 described above, followed by further mapping of the emulated physical addresses to addresses used by the host hardware (which further mapping can comprise native address translations by the MMU of the host hardware 230 to obtain physical addresses which actually store the relevant data in memory of the host hardware 230). Thus, when performing emulated address translations, the page table structure 219 can be walked by the page table walker program logic 216 using absolute address pointers or relative address pointers in the same way as described above. This allows software designed for an apparatus to support the features described above to be executed on a host platform which does not support these features, because the missing features can be emulated in the software by the emulator program 210.

[0135] Figure 8 The emulator program 210 shown controls a host data processing apparatus to provide an instruction execution environment for executing instructions of a target program, which is one example of a computer program which can provide software support for page table walking based on a page table structure of the type described above.

[0136] However, other examples of software can be provided which can have page table walker program logic 216 but need not provide instruction decoding program logic 212, memory management program logic 214 or emulation of an emulated address space 218.

[0137] For example, in a second example of software-controlled page table walks, the host device can have its own TLB hardware and memory management hardware, however the population of the TLB can be at least partially managed by software such as an operating system. Thus, in this case, the page table structure is stored in the host device's host address space, rather than in the emulated address space. The host device can have hardware for triggering a page table walk when an address translation request fails in the TLB, but in addition, the TLB can be software managed, such that the operating system can include page table walk program logic 216 for requesting certain PTEs from the page table structure based on a specified target address, and then loading information based on the fetched PTEs into the TLB. Such page table walk program logic 216 can support the use of relative page tables or page tables with restrictions on pointers in the above-described descendant entries.

[0138] In a third example, the host device can have hardware support for only absolute page tables or page tables that do not allow restrictions on regions where descendant entries define pointers, but it can be desirable to allow the host device to execute software written for systems that do provide hardware support for relative page tables or descendant entry restricted PTEs. In this case, software executing on the host device (e.g., an operating system) can perform a page table walk of a relative page table under software control, and map the identified address translation mappings and page table entries to corresponding absolute type PTEs defined in a shadow page table structure stored in a different portion of the address space. The TTBR of the host hardware can then point to the shadow (absolute) page table structure, rather than the actual (relative) page table structure used by the target software being executed. Thus, this can likewise be an example of a computer program including page table walk program logic 216 to obtain page table entries from a page table structure based on using the above-described relative address pointers and / or descendant entry restricted indicators.

[0139] In this application, the word "configured" is used to mean that an element of a device has a configuration capable of performing the defined operations. In this context, a "configuration" means an arrangement or manner of interconnection of hardware or software. For example, a device can have dedicated hardware which provides the defined

[0140] While exemplary embodiments of the present application have been described in detail hereinabove, it is to be understood that the application is not limited to the precise embodiments, and as such, various changes and modifications can be affected therein by one skilled in the art without departing from the scope and spirit of the application as defined by the appended claims.

Claims

1. Apparatus for data processing, comprising: memory management circuitry to translate memory addresses based on page table entries defined in a page table structure, the page table structure comprising a plurality of page table levels stored in a memory system; and page table walk circuitry to obtain the page table entries from the page table structure for use by the memory management circuitry, each page table entry identifying an address pointer to identify one of: a translated address and an address of a child page table at a next level of the page table structure; wherein: when a given page table entry is a relative type page table entry specifying a relative offset value, the relative offset value indicating an offset of the address pointer relative to a reference point base address determined for the given page table entry, the page table walk circuitry is configured to determine the address pointer from the reference point base address and the relative offset value; when the given page table entry is an absolute type page table entry specifying an absolute address value, the absolute address value directly specifying the address pointer, the page table walk circuitry is configured to determine the address pointer from the absolute address value; and the page table walk circuitry is configured to determine whether the given page table entry is the relative type or the absolute type based on a type indicator specified in a parent page table entry at a previous level of the page table structure.

2. The apparatus of claim 1, wherein the page table walk circuitry is configured to signal a fault when the given page table entry is the relative type in response to detecting that a child page table entry of the given page table entry is the absolute type.

3. The apparatus of claim 1 or 2, wherein top level page table entries of the page table structure are restricted to the absolute type page table entries.

4. The apparatus of claim 1 or 2, wherein leaf page table entries are permitted to be the relative type page table entries, for which the address pointer identifies the translated address.

5. The apparatus of claim 1 or 2, wherein the page table walk circuitry is configured to determine a size-aligned address as the reference point base address for the given page table entry, the size-aligned address corresponding to a result of aligning an address of a page table comprising the given page table entry with an address size boundary selected based on a size parameter specified for the given page table entry by a parent page table entry of the given page table entry.

6. The apparatus of claim 1 or 2, wherein the page table walk circuitry is configured to obtain the reference point base address for the given page table entry from a selected entry of a block table, the selected entry of the block table selected based on a block table entry identifier specified in a parent page table entry of the given page table entry.

7. The apparatus of claim 1 or 2, wherein the relative type page table entry is associated with a size parameter, the reference point base address and the size parameter together identifying a boundary address region of the address pointer specified by the relative type page table entry.

8. The apparatus of claim 7, wherein when the given page table entry is the relative type page table entry, the page table walk circuitry is configured to signal a fault when the address pointer specified by a descendant page table entry of the given page table entry is outside the boundary address region identified for the given page table entry.

9. The apparatus of claim 7, wherein the size parameter is specified directly in a parent page table entry of the relative type page table entry.

10. The apparatus of claim 7, wherein the size parameter is specified in a selected entry of a block table, the selected entry of the block table being selected based on a block table entry identifier specified in a parent page table entry of the relative type page table entry.

11. The apparatus of claim 7, wherein when the given page table entry is the relative type page table entry, the page table walk circuitry is configured to signal a fault when the size parameter identified for a child page table entry of the given page table entry indicates a size that is greater than the size parameter associated with the given page table entry.

12. A method for data processing, comprising: performing a page table walk to obtain page table entries from a page table structure for translating memory addresses, the page table structure comprising a plurality of page table levels stored in a memory system, each page table entry identifying an address pointer, the address pointer being for identifying one of: a translated address and an address of a child page table at a next level of the page table structure; wherein: when a given page table entry is a relative type page table entry specifying a relative offset value, the relative offset value indicating an offset of the address pointer relative to a reference point base address determined for the given page table entry, the address pointer is determined from the reference point base address and the relative offset value; when the given page table entry is an absolute type page table entry specifying an absolute address value, the absolute address value directly specifying the address pointer, the address pointer is determined from the absolute address value; and whether the given page table entry is the relative type or the absolute type is determined based on a type indicator specified in a parent page table entry at a previous level of the page table structure.

13. A computer program product comprising a computer program, the computer program comprising: page table walk program logic for obtaining page table entries from a page table structure, the page table structure comprising a plurality of page table levels, each page table entry identifying an address pointer, the address pointer being for identifying one of: a translated address and an address of a child page table at a next level of the page table structure; wherein: when a given page table entry is a relative type page table entry specifying a relative offset value, the relative offset value indicating an offset of the address pointer relative to a reference point base address determined for the given page table entry, the page table walk program logic is configured to determine the address pointer from the reference point base address and the relative offset value; when the given page table entry is an absolute type page table entry specifying an absolute address value, the absolute address value directly specifying the address pointer, the page table walk program logic is configured to determine the address pointer from the absolute address value; and whether the given page table entry is the relative type or the absolute type is determined based on a type indicator specified in a parent page table entry at a previous level of the page table structure. when the given page table entry is an absolute type page table entry specifying an absolute address value, the absolute address value directly specifying the address pointer, the page table walker logic is configured to determine the address pointer from the absolute address value; and the page table walker logic is configured to determine whether the given page table entry is the relative type or the absolute type based on a type indicator specified in a parent page table entry at a previous level of the page table structure.

14. A storage medium storing a computer program according to claim 13.

15. An apparatus for data processing, comprising: memory management circuitry to translate memory addresses based on page table entries defined in a page table structure, the page table structure comprising a plurality of page table levels stored in a memory system; and page table walk circuitry to obtain the page table entries from the page table structure for use by the memory management circuitry, each page table entry identifying an address pointer, the address pointer to identify one of: a translated address and an address of a child page table at a next level of the page table structure; wherein: when a given page table entry specifies a descendant entry restricted indicator, the page table walk circuitry is configured to signal a fault when a descendant page table entry of the given page table entry identifies an address pointer that lies outside a boundary address region identified by the given page table entry.

16. The apparatus according to claim 15, wherein the boundary address region comprises a region of a specified size starting from a reference point base address; the given page table entry specifies a size parameter, the size parameter indicating the specified size.

17. The apparatus according to claim 16, wherein the reference point base address comprises a size-aligned address, the size-aligned address corresponding to a result of aligning an address of a page table comprising child page table entries of the given page table entry to an address size boundary selected based on the size parameter.

18. The apparatus according to claim 15, wherein the given page table entry specifies a block table entry identifier, the block table entry identifier identifying an entry of a block table, the entry specifying a reference point base address and a size of the boundary address region.

19. A method for data processing, comprising: performing a page table walk to obtain page table entries from a page table structure for translating memory addresses, the page table structure comprising a plurality of page table levels stored in a memory system, each page table entry identifying an address pointer, the address pointer to identify one of: a translated address and an address of a child page table at a next level of the page table structure; in response to detecting that a given page table entry specifies a descendant entry restricted indicator and a descendant page table entry of the given page table entry identifies an address pointer that lies outside a boundary address region identified by the given page table entry, signalling a fault.

20. A computer program product comprising a computer program comprising: page table walker logic to obtain page table entries from a page table structure, the page table structure comprising a plurality of page table levels, each page table entry identifying an address pointer, the address pointer to identify one of: a translated address and an address of a child page table at a next level of the page table structure; wherein: when a given page table entry specifies a descendant entry restricted indicator, the page table walker logic is configured to signal a fault when a descendant page table entry of the given page table entry identifies an address pointer that lies outside a boundary address region identified by the given page table entry.

21. A storage medium storing a computer program according to claim 20.

Images