A predetermined less secure memory characteristic

Abstract

The target virtual address of a memory access request is translated to the target physical address (PA). The memory access request is associated with one of several regions, which include at least a less secure region associated with a less secure physical address space (PAS) and a more secure region associated with a more secure PAS. PAS selection circuits 16 and 20 select a PAS for the memory access request. A more secure PAS is prohibited from being selected for a memory access request associated with a less secure region. The check circuit 20 determines whether to reject the memory access request based on the protection information corresponding to the target PA. In at least one mode, if the protection information indicates a predetermined less secure memory characteristic, a less secure PAS (not a more secure PAS) is permitted to provide access to the target PA, and a memory access request associated with a more secure region is prohibited from accessing the target PA, even if the selected PAS is a less secure PAS.

Description

Technical Field

[0001] This technique relates to the field of data processing.

Background Art

[0002] A data processing system can have an address conversion circuit for converting a virtual address of a memory access request into a physical address corresponding to a position to be accessed within the memory system.

Summary of the Invention

[0003] At least some embodiments include an address translation circuit for translating a target virtual address of a memory access request to a target physical address, wherein the memory access request is associated with one of a plurality of processing regions, the plurality of regions including at least a less secure region associated with a less secure physical address space and a more secure region associated with a more secure physical address space; a physical address space selection circuit for selecting a physical address space selected for a memory access request from a plurality of physical address spaces including at least a less secure physical address space and a more secure physical address space, wherein the more secure physical address space is prohibited from being selected for a memory access request associated with a less secure region; and protection information corresponding to the target physical address. The present invention provides a device comprising: a check circuit for determining whether to reject a memory access request, wherein the protection information specifies which of a plurality of physical address spaces is permitted to provide access to the target physical address, wherein in at least one operating mode, in response to the determination that the protection information corresponding to the target physical address indicates a predetermined less secure memory characteristic, the check circuit is configured to determine that the less secure physical address space is permitted to provide access to the target physical address, the more secure physical address space is prohibited from providing access to the target physical address, and even when the selected physical address space is a less secure physical address space, a memory access request associated with the more secure region is prohibited from accessing the target physical address.

[0004] At least some embodiments translate the target virtual address of a memory access request to a target physical address, wherein the memory access request is associated with one of a plurality of processing regions, the plurality of regions including at least a less secure region associated with a less secure physical address space and a more secure region associated with a more secure physical address space; and select a physical address space selected for the memory access request from among a plurality of physical address spaces including at least a less secure physical address space and a more secure physical address space, wherein the more secure physical address space is prohibited from being selected for a memory access request associated with a less secure region; and based on protection information corresponding to the target physical address, the memory A method is provided that includes determining whether to reject an access request, wherein the protection information specifies which of a plurality of physical address spaces is permitted to provide access to the target physical address, wherein in at least one operating mode, in response to the determination that the protection information corresponding to the target physical address exhibits a predetermined less secure memory characteristic, the less secure physical address space is permitted to provide access to the target physical address, the more secure physical address space is prohibited from providing access to the target physical address, and even when the selected physical address space is a less secure physical address space, memory access requests associated with the more secure region are prohibited from accessing the target physical address.

[0005] At least some embodiments provide a computer-readable medium for storing computer-readable codes for the manufacture of the above-described apparatus.

[0006] At least some embodiments provide a computer program that, when executed by a host data processing device, includes instructions that control the host data processing device to provide an instruction execution environment for executing target program code, the computer program includes address translation program logic for translating the target virtual address of a memory access request to the simulated physical address of a target, wherein the memory access request is associated with one of a plurality of processing regions, the plurality of regions including at least a less secure region associated with a less secure simulated physical address space and a more secure region associated with a more secure simulated physical address space, and physical address space selection for selecting a simulated physical address space selected for a memory access request from a plurality of simulated physical address spaces including at least a less secure simulated physical address space and a more secure simulated physical address space. A selection program logic comprising: a physical address space selection program logic, wherein a more secure simulated physical address space is prohibited from being selected for a memory access request associated with a less secure region; and a check program logic for determining whether to reject a memory access request based on protection information corresponding to a target simulated physical address, wherein the protection information specifies which of a plurality of simulated physical address spaces is permitted to provide access to the target simulated physical address, wherein in at least one operating mode, the check program logic determines that the protection information corresponding to the target simulated physical address exhibits a predetermined less secure memory characteristic, and the less secure simulated physical address space is permitted to provide access to the target simulated physical address, and the more secure simulated physical address space is permitted.It is configured to determine that providing access to the target's simulated physical address is prohibited, and that even when the selected simulated physical address space is a less secure simulated physical address space, memory access requests associated with a more secure region are prohibited from accessing the target's simulated physical address.

[0007] The storage medium may store the aforementioned computer program. The storage medium may also be a non-temporary storage medium. [Brief explanation of the drawing]

[0008] Further aspects, features, and advantages of the technique will become apparent from the following example description, which should be read in conjunction with the attached drawings. [Figure 1] An example of a data processing device will be explained. [Figure 2] This section illustrates several regions in which a processing circuit can operate. [Figure 3] An example of a processing system that supports granule-protected lookup is illustrated. [Figure 4] This section provides a schematic example of aliases in the system physical address space that identify the locations of multiple physical address spaces within the memory system. [Figure 5] This example illustrates how to partition the effective hardware physical address space, thereby allowing different architectural physical address spaces to access their respective parts of the system physical address space. [Figure 6] This flowchart illustrates a method for determining the current operating range of a processing circuit. [Figure 7] This shows an example of the page table entry format for a page table entry used to translate a virtual address to a physical address. [Figure 8] This flowchart illustrates how to select the physical address space to be accessed by a given memory access request. [Figure 9] This document illustrates several stages of address translation and granule protection information filtering. [Figure 10] This example illustrates how to perform a granular protection check based on granular protection information. [Figure 11] This illustrates the steps performed for a granule protection check when the granule protection information corresponding to the target address of a memory access request has encoding that indicates a predetermined less secure memory characteristic. [Figure 12] An example of a data processing system with a system memory management unit will be illustrated. [Figure 13] Let's illustrate this with a simulation example. [Modes for carrying out the invention]

[0009] A data processing system can support the use of virtual memory, and an address translation circuit is provided to translate the virtual address specified by a memory access request to the physical address associated with the location in the memory system being accessed. The mapping between virtual addresses and physical addresses can be defined by one or more page table structures. Page table entries within a page table structure can also define several access permission information that can control whether a given software process running on the processing circuit can access a particular virtual address.

[0010] In some processing systems, virtual addresses may be mapped by address translation circuits onto a single physical address space used by the memory system to identify the location in memory being accessed. In such systems, control over whether a particular software process can access a particular address may be provided solely on a page table structure used to provide virtual-to-physical address translation mappings. However, such page table structures are typically defined by the operating system and / or hypervisor. Unauthorized access to the operating system or hypervisor can lead to confidentiality leaks, potentially allowing attackers to access sensitive information.

[0011] Therefore, in some systems where a particular process needs to run securely and isolated from other processes, the system can support operation in multiple regions, and multiple separate physical address spaces may be supported. These regions may include at least a less secure region and a more secure region (corresponding to a less secure physical address space and a more secure physical address space, respectively), and the more secure physical address space may be prohibited from being selected for memory access requests associated with the less secure region. By isolating access to separate physical address spaces, this can provide stronger security assurances that do not rely on page table authorization information set by the operating system or hypervisor.

[0012] In a system where the virtual address of a memory access request can be mapped to a physical address in one of two or more separate physical address spaces, granular protection information can be used to restrict which physical addresses are accessible within a particular physical address space. This can be useful to ensure that access to a specific location of physical memory implemented in hardware, either on-chip or off-chip, can be restricted to a specific physical address space, or, if desired, a specific subset of the physical address space.

[0013] Therefore, the device may include an address translation circuit, a physical address space (PAS) selection circuit, and a check circuit. The address translation circuit translates the target virtual address (VA) of a memory access request to the target physical address (PA). A memory access request is associated with one of two or more processing regions, which include at least a less secure region associated with a less secure PAS and a more secure region associated with a more secure PAS. The PAS selection circuit selects a preferred PAS for a memory access request from two or more PAS, including at least a less secure PAS and a more secure PAS, and the more secure PAS is prohibited from being selected for a memory access request associated with a less secure region. The check circuit determines whether to reject the memory access request based on protection information corresponding to the target PA. The protection information specifies which PAS is permitted to provide access to the target physical address.

[0014] In the embodiments described below, in at least one operating mode, in response to determining that the protection information corresponding to the target PA exhibits a predetermined less secure memory characteristic, the check circuit determines that (i) the less secure PAS is permitted to provide access to the target physical address, (ii) the more secure PAS is prohibited from providing access to the target physical address, and (iii) a memory access request associated with a more secure region is prohibited from accessing the target PA, even if the selected physical address space is a less secure physical address space.

[0015] This approach is unusual because, typically, the region associated with a memory access request may be a factor in selecting the PAS chosen for that memory access request, and checks based on the protection information corresponding to the target PA may be independent of the region associated with the memory access request. Therefore, it may have been assumed that any request from a region permitted to select a given PAS can access any PA indicated in the protection information as being permitted to provide access to that PA by that given PAS.

[0016] Furthermore, this approach can be considered counterintuitive because it typically assumes that requests associated with a more secure region are more trustworthy than requests associated with a less secure region, and therefore assumes there is no problem in allowing memory access requests associated with a more secure region to access addresses allocated for access within a less secure PAS.

[0017] Instead, in the following embodiments, when the protection information indicates a predetermined less secure memory characteristic of the target PA, a memory access request associated with a more secure region is not permitted to access the target PA even if the selected PAS is a less secure PAS. This applies even when a memory access request associated with a more secure region may be permitted to have a less secure PAS selected as the PAS selected by the PAS selection circuit, and may be permitted to access other physical addresses of the less secure PAS where a predetermined less secure memory characteristic is not defined by the protection information.

[0018] The inventors have recognized that it may be useful to provide support for encoding a predetermined less secure characteristic within the protection information and for the check circuit to implement corresponding checks based on the predetermined less secure characteristic (in at least one operating mode). This can improve resilience against a form of confused proxy attack that exploits greater privileges of more secure software. For example, an attacker may be able to trick software running in a more secure region into performing a memory access that damages a resource associated with a less secure region. By using a predetermined less secure characteristic, the region of less secure PASs can be isolated from access by more secure software operating in a more secure region. This is because the predetermined less secure characteristic forces the check circuit to ensure that a memory access request associated with a more secure region cannot access a physical address assigned a predetermined less secure memory characteristic by the protection information even when it specifies a less secure PAS associated with a less secure region. This helps establish an additional layer of protection that can be useful in a "defense in depth" approach to protecting resources used by less secure software against confused proxy attacks.

[0019] In at least one operating mode, in response to determining that the protection information corresponding to the target physical address indicates a less secure memory characteristic than a predetermined one, the check circuit may reject a memory access request associated with a less secure region of a physical address space that is a more secure physical address space. For example, to reject a memory access request, the check circuit may cause a malfunction to be signaled.

[0020] In some embodiments, the less secure region and the more secure region may be the only supported processing regions. However, other embodiments may have three or more regions (and thus three or more physical address spaces).

[0021] Generally, the less secure region and the more secure region can be any two processing regions, and the more secure region can be such that a less secure PAS is selected for at least some of its memory access requests, but the less secure region cannot be such that a more secure PAS is selected for its memory access request. In some cases, the less secure region may be associated with the lowest level of security. For example, requests associated with the less secure region cannot be such that a PAS of another region is selected as the less secure PAS.

[0022] In some embodiments, the region may also include an additional more secure region associated with an additional more secure PAS. The additional more secure PAS may be prohibited from being selected for memory access requests associated with a less secure region. A predetermined less secure memory characteristic may also be used to deny access to a physical address associated with a less secure PAS when access is requested by a memory access request associated with an additional more secure region. Thus, a predetermined less secure memory characteristic may be used to protect less secure memory from access from two or more secure regions. In at least one operating mode, in response to determining that the protection information corresponding to the target physical address indicates a predetermined less secure memory characteristic, the check circuit may determine that the additional more secure PAS is prohibited from providing access to the target PA, and that memory access requests associated with the additional more secure region are prohibited from accessing the target PA even when the selected physical address space is a less secure PAS.

[0023] An additional, more secure PAS may be prohibited from being selected for memory access requests associated with a more secure region, and a more secure PAS may be prohibited from being selected for memory access requests associated with an additional, more secure region. By providing each of the two more secure regions with a corresponding more secure PAS that is inaccessible from the other more secure region (whereas memory access requests associated with less secure regions cannot access either of those more secure PAS), this allows software provided by two untrustworthy software developers to coexist on the same hardware without needing to trust each other, even when both providers require assurance of isolation from less secure software components. For example, a more secure region and an additional more secure region may correspond to the secure and realm regions mentioned below (and vice versa).

[0024] In some embodiments, certain less secure memory characteristics may prevent memory access requests associated with any more secure region than the less secure region accessing the corresponding PA via the less secure PAS, even when the less secure PAS is permitted to be selected by the PAS selection circuit for memory access requests associated with those more secure regions.

[0025] However, in other embodiments, there may be a most secure region where access to a PA with less secure memory characteristics is still permitted using a less secure PAS, in contrast to one or more other regions that are considered more secure than less secure regions.

[0026] For example, a region may include a root region for managing switching between other regions among several regions. The root region is associated with a root PAS that is prohibited from being selected for memory access requests associated with regions other than the root region. In at least one operating mode, a check circuit may permit a memory access request associated with a root region where the selected physical address space is a less secure physical address space, in response to determining that the protection information corresponding to the target physical address indicates a predetermined less secure memory characteristic. A confused proxy attack based on the root region is far less likely than one against a more secure region because the root region software is typically provided by a single trusted provider and is smaller code (rather than a complex suite of software containing parts provided by many different suppliers), and therefore the root region software presents a much smaller attack surface than software running in a more secure region. By allowing memory access requests associated with the root region to access a less secure PAS, even for PAs assigned a predetermined less secure memory characteristic, this simplifies the design of the root region software and ensures that the root region software can perform its management functions with respect to software running in other regions.

[0027] In some embodiments, the check circuit can operate according to at least one operating mode in which a check based on a predetermined less secure memory characteristic is always performed for memory access requests associated with a more secure region (and, if supported, additional more secure regions). However, in other embodiments, there may be another mode in which the use of a predetermined less secure memory characteristic is disabled, so the check circuit does not always need to perform a check based on a predetermined less secure memory characteristic. This may be useful for backward compatibility with software written for systems that do not support a predetermined less secure memory characteristic.

[0028] Therefore, in some embodiments, a check circuit can determine whether to operate according to at least one operating mode based on configuration information indicating whether the use of a predetermined less secure memory characteristic is enabled. This configuration information may be programmable by software running on the device. In some cases, the right to program the configuration information may be limited to software running in a particular subset of the region (e.g., software running in the root region) or a particular subset of the privilege level (e.g., software with at least a given level of privilege).

[0029] In some embodiments, in further operating modes, the check circuit may treat encodings that indicate a predetermined less secure memory characteristic as reserved encodings that are not used to indicate a valid characteristic for the target physical address. In this case, the use of the predetermined less secure memory characteristic is disabled.

[0030] For example, in response to determining that the protection information corresponding to a target physical address has a reserved coding scheme, a check circuit may trigger an error handling response. While spare coding schemes may be reserved for possible future expansions of available options for selection using the protection information, setting the protection information to a reserved coding scheme (which should not be selected for a properly configured region of memory) can be a hint that an error has occurred (such as a malicious attempt to corrupt system operation by changing the state of the protection information, or an accidental error such as a bit flip from 0 to 1 or vice versa due to a particle collision or other randomly occurring physical event). Therefore, it may be useful to implement a technique that triggers a fault in the case of the protection information corresponding to a target physical address. Thus, signaling a fault when the protection information of a target PA indicates a reserved coding scheme (including a reserved coding scheme used to indicate a predetermined less secure memory characteristic in at least one mode, if it is currently in a further operating mode) can help reduce vulnerability to errors. In some embodiments, a malfunction can be triggered not only when the protection information corresponding to the target PA itself has reserved coding, but also when the protection information entry with reserved coding is not the protection information entry corresponding to the target PA itself, but when any one of the group of protection information entries for the block of memory containing the target PA has reserved coding.

[0031] In response to determining that the protection information corresponding to the target PA indicates a second less secure memory characteristic and does not indicate a predetermined less secure memory characteristic, the check circuit may determine that the less secure PAS is permitted to provide access to the target PA, the more secure PAS is prohibited from providing access to the target PA, and when the selected PAS is a less secure PAS, memory access requests associated with a more secure area are permitted to access the target PA. Thus, the second less secure memory characteristic can be used for areas of memory where it is desired to share data between less secure software in a less secure area and more secure software in a more secure area, thereby allowing the more secure software to access a portion of the less secure PAS that provides the shared data. However, for other less secure data that the less secure software does not want to expose to a more secure area, a predetermined less secure memory characteristic can be used.

[0032] In some embodiments, the techniques described above may be implemented within a processor such as a central processing unit (CPU), a graphics processing unit (GPU), or other processing unit capable of executing program instructions according to an instruction set architecture.

[0033] For example, the address translation circuit may include a memory management unit associated with the processing circuit, and the processing circuit may include at least one system register that specifies current region identification information that identifies the current region designated as one of several processing regions for a memory access request issued by the processing circuit. When the above technique is implemented within a processor, the check circuit can access the system register state to identify the current region associated with the memory access request, and thus use the contents of at least one system register to identify whether the request is associated with a more secure region and whether the request is permitted to use a less secure PAS to obtain access to a memory region assigned a predetermined less secure characteristic.

[0034] However, the techniques described above can also be implemented for other system components that can access memory but may not be able to execute instructions according to the instruction set architecture, and therefore may not have direct access to the system registers that specify the current processing area.

[0035] For example, an address translation circuit may include a system memory management unit (SMMU) for translating addresses on behalf of one or more devices in a data processing system. For example, a device may include a peripheral device, an input / output device, or a hardware accelerator. If the SMMU is performing address translation in a system that supports the separate PAS described above, the SMMU may also be associated with corresponding PAS selection and checking circuits as described above to select the PAS to be accessed for a given memory access request issued by one of the devices, and to perform a check, based on protection information, whether the selected PAS is permitted to provide access to the target PA. However, in order to perform the check based on a predetermined less secure memory characteristic, some information is needed about which processing area a given memory access request is associated with. The system memory management unit may identify one of several processing areas associated with a memory access request based on a region identifier provided to the system memory management unit by the device that issued the memory access request.

[0036] A device may have configuration information that specifies which region identifier to specify for a given request (for example, this may be provided by software or configured based on previous information stored in memory, depending on a particular software use case). For example, if software running on a processor in a particular region configures the device to perform a function on its behalf, that software may set the corresponding configuration information in the device to specify a particular region such that a memory access request associated with that function specifies a particular region within the region identifier provided by the SMMU. In this case as well, the specific mechanism for setting the configuration information to control the device's selection of region identifiers may be a software-specific mechanism depending on the particular task performed by the device, and therefore does not need to be a feature of the hardware device. Also, since the device may be an external device, the device itself is not necessarily part of a device that includes an SMMU. However, it is generally useful for the SMMU to be provided with region identifiers associated with memory access requests received from the device so that a check circuit associated with the SMMU can check whether the memory access request satisfies conditions associated with a predetermined less secure memory characteristic.

[0037] Regardless of whether the address translation circuit is a memory management unit within a processing element or a system memory management unit associated with an I / O device, peripheral device, or hardware accelerator device, the PAS selection circuit may select a PAS based on address space selection information, directly or indirectly specified by an address translation entry that provides the address mapping used when translating a target virtual address to a target physical address, for memory access requests associated with one of several processing regions associated with a memory access request, and at least a region other than a less secure region. The address space selection information can be specified directly within the encoding of the address translation entry itself, or indirectly within a register referenced by part of the address translation entry. In either case, specifying address space selection information in the address translation entry makes it possible to assign a different PAS to different addresses accessed within the same processing region than the selected PAS. This can be useful, where appropriate, to support inter-region sharing of data. However, since address translation entries that provide address space selection information can be configured under the control of the operating system or hypervisor, which may be potentially compromised, it may be useful to define the protection information independently of the address space selection information and allow for further checks on whether the selected PAS is permitted to provide access to a given physical address, in order to implement the security model.

[0038] For at least some components of a memory system, a memory access request in which a virtual address is translated to a physical address in a different physical address space is treated as if it were accessing a completely different address in memory, even if the physical addresses in each physical address space actually correspond to the same location in memory.

[0039] For example, a memory system may include a point of physical aliasing (PoPA), which is the point at which aliased physical addresses from different physical address spaces corresponding to the same memory system resource are mapped (de-aliased) to a single physical address that uniquely identifies that memory system resource. The memory system may also include at least one pre-PoPA memory system component provided upstream of the PoPA, which treats the aliased physical addresses as if they corresponded to different memory system resources.

[0040] For example, at least one pre-PoPA memory system component may include a cache or translation lookaside buffer, which can cache data, program code, or address translation information for alias physical addresses in separate entries. Therefore, when the same memory system resource is requested to be accessed from a different physical address space, the access will allocate a separate cache or TLB entry. Furthermore, the pre-PoPA memory system component may include a coherence control circuit, such as a coherent interconnect, a snoop filter, or other mechanism for maintaining coherence between cached information in the respective master devices. The coherence control circuit can assign separate coherence states to each alias physical address in different physical address spaces. Thus, alias physical addresses are treated as separate addresses for the purpose of maintaining coherence, even if they actually correspond to the same underlying memory system resource. At first glance, it might seem that tracking coherency separately for alias physical addresses could lead to coherency loss issues. However, in practice, this is not a problem because processes operating in different regions can access a particular memory system resource using a less secure physical address space (e.g., the second less secure memory characteristic mentioned earlier) if they are intended to actually share access to that resource. Another example of a pre-PoPA memory system component could be a memory protection engine provided to protect data stored in off-chip memory from loss of confidentiality and / or tampering. Such a memory protection engine could, for example, treat alias physical addresses as if they corresponded to effectively different memory system resources by separately encrypting the data associated with a particular memory system resource using different encryption keys depending on the physical address space from which the resource was accessed (e.g., an encryption scheme that makes encryption address-dependent could be used, and the physical address space identifier could be considered part of the address for this purpose).

[0041] Regardless of the form of the pre-PoPA memory system component, it may be useful for such PoPA memory system components to treat alias physical addresses as if they corresponded to different memory system resources. This is because it provides hardware-implemented isolation between accesses issued to different physical address spaces, and as a result, information associated with one region is not leaked to another region due to features such as cache timing side channels or side channels being triggered by coherency control circuits and accompanied by changes in coherency.

[0042] In some implementations, alias physical addresses in different physical address spaces may be represented using different numerical physical address values ​​for each of those different physical address spaces. This technique may require a mapping table in PoPA to determine which different physical address values ​​correspond to the same memory system resource. However, this overhead of maintaining a mapping table can be considered unnecessary, and in some implementations, it may be simpler if the alias physical address includes physical addresses that are represented using the same numerical physical address value in each of the different physical address spaces. When this technique is adopted, at the point of the physical alias, it may be sufficient to simply discard the physical address space identifier that identifies which physical address space is accessed using memory access, and then provide the remaining physical address bits downstream as the unaliased physical address.

[0043] Therefore, in addition to pre-PoPA memory system components, the memory system may also include a PoPA memory system component configured to dealias multiple aliased physical addresses and obtain the dealiased physical addresses provided to at least one downstream memory system component. The PoPA memory system component may be a device that accesses a mapping table to find the dealiased address corresponding to an aliased address within a particular address space, as described above. However, the PoPA component may simply be a location in the memory system where a physical address tag associated with a given memory access is discarded, and as a result, the physical address provided downstream uniquely identifies the corresponding memory system resource, regardless of which physical address space it is provided from. Alternatively, in some cases, the PoPA memory system component may still provide physical address space tags to at least one downstream memory system component (for example, for the purpose of enabling completer-side filtering, as will be discussed further below). However, the PoPA marks a point in the memory system so that downstream memory system components no longer treat the aliased physical addresses as different resources and map the same memory system resource considering each of the aliased physical addresses. For example, if a memory controller or hardware memory storage device downstream of a PoPA receives a physical address tag and physical address for a given memory access request, and that physical address corresponds to the same physical address as a previously seen transaction, then any hazard checks or performance improvements that would normally be performed on each transaction accessing the same physical address (such as merging accesses to the same address) can be applied, even if each transaction specifies a different physical address space tag.In contrast, for upstream memory system components of PoPA, such hazard checks or performance improvement steps taken for transactions accessing the same physical address do not need to be triggered if those transactions specify the same physical address in different physical address spaces.

[0044] The techniques described above can be implemented in hardware devices having hardware circuit logic for implementing the functions described above. Therefore, the address translation circuit, PAS selection circuit, and check circuit may also have hardware circuit logic.

[0045] However, in other examples, a computer program that controls a host data processing unit to provide an instruction execution environment for executing target code may be provided with processing program logic and address translation program logic that perform functions equivalent to the address translation circuit, PAS selection circuit, and check circuit described above in software. This may be useful, for example, to enable target code written for a particular instruction set architecture to run on a host computer that does not support that instruction set architecture. Functions expected from an instruction set architecture not provided by the host computer can instead be emulated by simulation software providing an equivalent instruction execution environment for the target code, as would be expected if the target code were executed on a hardware device that actually supports the instruction set architecture.

[0046] Therefore, address translation program logic, PAS selection program logic, and check program logic may be provided to emulate the functions of the address translation circuit, PAS selection circuit, and check circuit described above. In the case of the method in which the architecture simulation is provided, each physical address space is a simulated physical address space because, although they do not actually correspond to the physical address spaces identified by the hardware components of the host computer, they are mapped to addresses in the host's virtual address space.

[0047] Providing such simulations can be useful for a variety of purposes, such as making older code written for one instruction set architecture executable on different platforms that support different instruction set architectures, or assisting in the development of new software to run for a new version of an instruction set architecture when hardware devices supporting that version are not yet available (this allows the development of software for a new version of the architecture to begin in parallel with the development of hardware devices that support that version of the architecture).

[0048] Figure 1 schematically illustrates an example of a data processing system 2 having at least one requester device 4 and at least one completer device 6. The interconnect 8 provides communication between the requester device 4 and the completer device 6. The requester device can issue memory access requests requesting memory access to a specific addressable memory system location. The completer device 6 is the device responsible for processing the memory access requests directed to it. Although not shown in Figure 1, some devices may be able to function as both a requester device and a completer device. The requester device 4 may include, for example, a processing element such as a central processing unit (CPU) or a graphics processing unit (gGPU), or other master devices such as a bus master device, a network interface controller, or a display controller. The completer device may include a memory controller responsible for controlling access to the corresponding memory storage device, a peripheral controller for controlling access to peripheral devices, etc. Figure 1 shows one exemplary configuration of a requester device 4 in more detail, but it will be understood that other requester devices 4 may have similar configurations. Alternatively, other requester devices may have a different configuration from requester device 4 shown on the left side of Figure 1 (for example, as shown in Figure 12, which will be described in more detail below, another requester device 4 may be a system memory management unit that has an address translation circuit 16 and a PAS filter 20, but does not have the processing circuit 10 shown in Figure 1).

[0049] The requester device 4 shown in Figure 1 has a processing circuit 10 for performing data processing in response to an instruction by referring to data stored in register 12. Register 12 may include not only general-purpose registers for storing operands and the results of processed instructions, but also control registers for storing control data that configures how the processing is performed by the processing circuit. For example, the control data may include a current region indicator 14 used to select which operating region is the current region, and a current exception level indicator 15 indicating which exception level is the current exception level in which the processing circuit 10 is operating.

[0050] The processing circuit 10 may issue a memory access request specifying a virtual address (VA) that identifies the addressable location to be accessed, and a region identifier (region ID or "security state") that identifies the current region. The address translation circuit 16 (e.g., a memory management unit, MMU) translates the virtual address to a physical address (PA) through one of several stages of address translation, based on page table data defined in a page table structure stored in the memory system. The translation lookaside buffer (TLB) 18 functions as a lookup cache to cache a portion of the page table information for faster access than if the page table information had to be fetched from memory each time address translation was needed. In this example, in addition to generating a physical address, the address translation circuit 16 also selects one of several physical address spaces associated with the physical address and outputs a physical address space (PAS) identifier that identifies the selected physical address space. The selection of the PAS will be discussed in more detail below.

[0051] The PAS filter 20 functions as a circuit check circuit to check, based on the translated physical address and PAS identifier, whether the physical address is permitted to be accessed within the specified physical address space identified by the PAS identifier. This lookup is based on granule protection information stored in a granule protection table structure stored in the memory system. Granule protection information can be cached in a granule protection information cache 22, similar to the cache of page table data in the TLB 18. In the example in Figure 1, the granule protection information cache 22 is shown as a separate structure from the TLB 18, but in other examples, these types of lookup caches can be combined as a single lookup cache structure, and as a result, a single lookup of entries in the combined structure provides both page table information and granule protection information. The granule protection information defines information that restricts the physical address space in which a given physical address can be accessed, and based on this lookup, the PAS filter 20 determines whether it is possible to proceed with issuing a memory access request to one or more caches 24 and / or interconnect 8. If the specified PAS for a memory access request is not permitted to access the specified physical address, the PAS filter 20 may block the transaction and signal the malfunction.

[0052] Figure 1 shows an example of a system having multiple requester devices 4, but the characteristics shown for the single requester device on the left side of Figure 1 can also be found in systems with only one requester device, such as a single-core processor.

[0053] Figure 1 shows an example where the selection of a PAS for a given request is performed by the address translation circuit 16. In other examples, the address translation circuit 16 can output information to the PAS filter 20, along with the PA, to determine which PAS to select. The PAS filter 20 can then select a PAS and verify whether the PA can be accessed within the selected PAS. Therefore, the PAS selection circuit can be provided by either the address translation circuit 16 or the PAS filter 20, or both, working together.

[0054] The provision of PAS filters 20 helps support systems that can operate in multiple operating regions, each associated with its own isolated physical address space. Here, for at least a portion of the memory system (for example, for some cache or coherence enforcement mechanisms such as snoop filters), separate physical address spaces are treated as if they pointed to a separate set of addresses that identify entirely separate memory system locations, even though the addresses within those address spaces actually point to the same physical locations within the memory system. This can be useful for security purposes.

[0055] Figure 2 shows examples of different operating states and domains in which the processing circuit 10 can operate, as well as examples of types of software that can run at different exception levels and domains (it should be understood that, naturally, the specific software installed on the system is selected by the party managing the system and is therefore not an essential feature of the hardware architecture).

[0056] The processing circuit 10 can operate with several different exception levels 80, four exception levels labeled EL0, EL1, EL2, and EL3 in this embodiment, where EL3 refers to the highest privileged exception level and EL0 refers to the lowest privileged exception level. In other architectures, it will be understood that the reverse numbering system may be chosen, with the exception level having the highest number being considered to have the lowest privileges. In this embodiment, the lowest privileged exception level EL0 is for application-level code, the next highest privileged exception level EL1 is used for operating system-level code, the next highest privileged exception level EL2 is used for hypervisor-level code that manages switching between several virtual operating systems, and the highest privileged exception level EL3 is used for monitor code that manages switching between each region and the allocation of physical addresses to the physical address space, as will be described later.

[0057] When an exception occurs at a specific exception level while processing software, for some types of exceptions, the exception is accepted at a higher (more privileged) exception level, and the specific exception level to which the exception is accepted is selected based on the attributes of the specific exception that occurred. However, in some situations, other types of exceptions may be accepted at the same exception level associated with the code that was being processed when the exception was accepted. When an exception is accepted, information characterizing the state of the processor at the time the exception was accepted can be stored, for example, the current exception level at the time the exception was accepted. Therefore, once an exception handler is processed to address the exception, processing can return to the previous processing, and the stored information can be used to identify the exception level to which processing should return.

[0058] In addition to different exception levels, the processing circuit also supports several operating regions (also known as “security states”), including the root region 82, the secure (S) region 84, the less secure region 86, and the realm region 88. For ease of reference, the less secure region will be described below as the “non-secure” (NS) region, but it should be understood that this is not intended to imply a particular level (or lack thereof) of security. Instead, “non-secure” simply indicates that the non-secure region is intended for code that is less secure than the code operating in the secure region. The root region 82 is selected when the processing circuit 10 is at the highest exception level, EL3. When the processing circuit is at one of the other exception levels, EL0 through EL2, the current region is selected based on the current region indicator 14, which indicates which of the other regions 84, 86, and 88 is active. For each of the other regions 84, 86, and 88, the processing circuit can be at any of the exception levels EL0, EL1, or EL2.

[0059] During boot time, several boot codes (e.g., BL1, BL2, OEM boot) may be executed, for example, within a higher privileged exception level, such as EL3 or EL2. Boot codes BL1 and BL2 may be associated with the root area, for example, while the OEM boot code may operate in the secure area. However, once the system is booted, during execution, the processing circuit 10 can be considered to operate in one of areas 82, 84, 86, and 88 at a time. Each of areas 82-88 is associated with its own associated physical address space (PAS). This allows for isolation of data from different areas within at least a portion of the memory system. This will be explained in more detail below.

[0060] The non-secure area 86 can be used for normal application-level processing and for operating system and hypervisor activities to manage such applications. Therefore, application code 30 running in EL0, operating system (OS) code 32 running in EL1, and hypervisor code 34 running in EL2 may reside within the non-secure area 86.

[0061] The secure region 84 allows certain system-on-chip security, media, or system services to be isolated in a physical address space separate from the physical address space used for non-secure processing. The secure and non-secure regions are not equivalent in that non-secure region code cannot access resources associated with the secure region 84, while the secure region can access both secure and non-secure resources (at least with respect to regions of memory where certain less secure memory characteristics, further described below, are defined). An example of a system that supports such partitioning of secure and non-secure regions 84, 86 is a system based on the TrustZone® architecture provided by Arm® Limited. The secure region can run trusted applications 36 in EL0, trusted operating systems 38 in EL1, and optionally a secure partition manager 40 in EL2. If secure partitioning is supported, EL2 can use a two-page table to support isolation between different trusted operating systems 38 running within the secure region 84 in a similar manner to how a hypervisor 34 can manage isolation between virtual machines or guest operating systems 32 running within the non-secure region 86.

[0062] Extending systems to support secure regions 84 has become common in recent years because it allows a single hardware processor to support isolated secure processing and avoids the need for processing to be performed on separate hardware processors. However, as the use of secure regions has become more popular, many practical systems with such secure regions now support a relatively high degree of mixed environments of services provided by a wide range of different software providers within the secure region. For example, the code running within the secure region 84 may contain different software, and its providers may include (among others) silicon providers that manufacture integrated circuits, original equipment manufacturers (OEMs) that assemble integrated circuits provided by silicon providers into electronic devices such as mobile phones, operating system vendors (OSVs) that provide operating systems 32 for devices, and / or cloud platform providers that manage cloud servers that support services for several different customers via the cloud.

[0063] However, there is a growing demand for a secure computing environment that provides reliable assurance that providers of user-level code (which would typically be expected to run as applications 30 in the non-secure area 86) will not leak information to other parties running their code on the same physical platform. Such a secure computing environment may be desirable to be dynamically scalable during execution and guaranteed and verifiable so that users can verify whether sufficient security assurances are provided on the physical platform before entrusting the processing of potentially sensitive code or data to the device. Users of such software may not want to trust providers of feature-rich operating systems 32 or hypervisors 34 that would typically run in the non-secure area 86 (or, even if the providers themselves are trustworthy, users may want to protect themselves from unauthorized access to the operating system 32 or hypervisor 34 by attackers). Furthermore, while a secure area 84 is available for such user-provided applications requiring secure processing, in practice this creates problems for both users providing code that requires a secure computing environment and providers of existing code running within the secure area 84. For providers of existing code operating within Secure Area 84, the addition of arbitrary user-provided code within the Secure Area increases the attack surface for potential attacks against that code. This may be undesirable, and therefore, users may be strongly advised not to allow the addition of code to Secure Area 84. On the other hand, users providing code that requires a secure computing environment may be reluctant to entrust access to their data or code to all different code providers operating within Secure Area 84, as assurance and proof of the code operating in a particular area may be required as a prerequisite for the user-provided code to perform processing.This could limit the opportunity for third parties to provide more secure services.

[0064] Therefore, as shown in Figure 2, an additional, more secure region 88 called a realm region is provided, which can be used by user-introduced code to provide a secure computing environment orthogonal to any secure computing environment associated with components operating in the secure region 24. In the realm region, the software being executed can contain several realms, each realm can be isolated from other realms by a realm management module (RMM) 46 operating at exception level EL2. The RMM 46 can control the isolation between each realm 42, 44 running in the realm region 88 by defining access permissions and address mappings in a page table structure, for example, in the same way that a hypervisor 34 manages the isolation between different components operating in an unsecure region 86. In this example, the realms include an application-level realm 42 running at EL0 and an encapsulated application / operating system realm 44 running across exception levels EL0 and EL1. It will be understood that it is not mandatory to support both EL0 and EL0 / EL1 type realms, and multiple realms of the same type can be established by the RMM 46.

[0065] Realm region 88, like secure region 84, has its own allocated physical address space, but while realm region and secure regions 88, 84 can each access the non-secure PAS associated with non-secure region 86, they are orthogonal to secure region 84 in the sense that realm region and secure regions 88, 84 cannot access each other's physical address spaces. This means that the code running in realm region 88 and secure region 84 have no dependencies on each other. Code in realm region only needs to trust the hardware, RMM46, and the code running in root region 82 which manages switching between regions, which means that proof and assurance are more feasible. Proof allows given software to require verification that the code installed on a device matches certain expected characteristics. This can be done by checking whether the hash of the program code installed on the device matches an expected value signed by a trusted party using a cryptographic protocol. RMM46 and monitor code 29 can be verified, for example, by checking whether the hash of this software matches an expected value signed by a trusted party, such as the silicon provider that manufactured the integrated circuit including processing system 2, or the architecture provider that designed the processor architecture that supports region-based memory access control. This allows user-provided codes 42 and 44 to verify whether the integrity of the region-based architecture is trustworthy before executing any secure or confidential functions.

[0066] Therefore, as indicated by the dotted lines showing the gaps in the non-secure region where these processes would have previously been executed, the code associated with realms 42 and 44, which would have previously been running in the non-secure region 86, can now be moved to a realm region where they can have stronger security guarantees, since their data and code are no longer accessible by other code running in the non-secure region 86. However, the fact that realm region 88 and secure region 84 are orthogonal and therefore cannot see each other's physical address spaces means that providers of code in the realm region do not need to trust providers of code in the secure region, and vice versa. Code in the realm region can simply trust the firmware that provides the monitor code 29 for root region 82 and RMM46, which may be provided by the silicon provider or the provider of the instruction set architecture supported by the processor. These providers may need to be inherently trusted from the outset when the code is running on their device, and as a result, no further trust relationships with other operating system vendors, OEMs, or cloud hosts are required by the user in order for the user to be able to provide a secure computing environment.

[0067] This is useful for a variety of applications and use cases, including, for example, mobile wallet and payment applications, anti-fraud and anti-copyright infringement mechanisms in games, operating system platform security extensions, secure virtual machine hosting, confidential computing, networking, or gateway processing for the Internet of Things. Users will understand that they may find many other applications where Realm Support is useful.

[0068] To support the security assurances provided to the Realm, the processing system can support a certification reporting function, which measures the image and configuration of the firmware, such as the image and configuration of the monitor code or the image and configuration of the RMM code, during boot or execution. During execution, the content and configuration of the Realm are measured, so that the Realm owner can trace back relevant certification reports against known implementations and assurances and make a confidence decision about whether it will work on that system.

[0069] As shown in Figure 2, a separate root region 82 is provided to manage region switching, and this root region has its own isolated root physical address space. Creating a root region and isolating resources from the secure region allows for a more robust implementation, even in systems that have only non-secure and secure regions 86, 84 and no realm region 88, although it can also be used in implementations that support the realm region 88. The root region 82 can be implemented using monitor software 29 provided (or guaranteed) by the silicon provider or architecture designer and can be used to provide secure boot functionality, trusted boot measurement, system-on-chip configuration, debug control, and firmware update management for firmware components provided by other parties such as the OEM. The code for the root region can be developed, guaranteed, and deployed by the silicon provider or architecture designer without any dependency on the final device. In contrast, the secure region 84 can be managed by the OEM to implement certain platform and security services. The management of the non-secure area 86 can be controlled by the operating system 32 that provides operating system services, while the realm area 88 is isolated from the existing secure software environment in the secure area 84, and at the same time, it enables the development of new forms of trusted execution environments that can be dedicated to the user or third-party applications.

[0070] Figure 3 schematically illustrates another example of processing system 2 to support these techniques. Elements that are the same as those in Figure 1 are illustrated with the same reference numbers. Figure 3 shows more detail of the address translation circuit 16, including the Stage 1 memory management unit 50 and the Stage 2 memory management unit 52. The Stage 1 MMU 50 may be involved in translations from virtual addresses to physical addresses (when the translation is triggered by an EL2 or EL3 code) or to intermediate addresses (when the translation is triggered by an EL0 or EL1 code in an operating state where further Stage 2 translation by the Stage 2 MMU 52 is required). The Stage 2 MMU can translate intermediate addresses to physical addresses. The Stage 1 MMU may rely on a page table controlled by the operating system for translations initiated from EL0 or EL1, a page table controlled by the hypervisor for translations from EL2, or a page table controlled by monitor code 29 for translations from EL3. On the other hand, the Stage 2 MMU 52 can be based on a page table structure defined by the hypervisor 34, RMM 46, or secure partition manager 14, depending on which region is being used. By separating the translation into these two stages, operating systems can manage address translation for themselves and for applications, under the assumption that they are the only operating systems running on the system, while the RMM 46, hypervisor 34, or SPM 40 can manage isolation between different operating systems running within the same region.

[0071] As shown in Figure 3, the address translation process using the address translation circuit 16 can, in combination with the current exception level 15 and the current region 14 (or security state), return a security attribute 54 that allows a section of a particular physical address space (identified by a PAS identifier or "PAS TAG") to be accessed in response to a given memory access request. The physical address and PAS identifier can be looked up in the granular protection table 56 that provides the aforementioned granular protection information. In this example, the PAS filter 20 is shown as a granular memory protection unit (GMPU) that verifies whether the selected PAS is authorized to access the requested physical address, and if so, allows the transaction to be passed to any cache 24 or interconnect 8 that is part of the system fabric of the memory system.

[0072] GMPU20 enables the allocation of memory to separate address spaces while simultaneously providing strong hardware-based isolation guarantees, offering not only spatial and temporal flexibility in how physical memory is allocated to these address spaces, but also an efficient sharing scheme. As mentioned earlier, execution units in the system are logically divided into virtual execution states (regions or "worlds") where one execution state (root world) located at the highest exception level (EL3) is located, and the root world manages the allocation of physical memory to these worlds.

[0073] A single system physical address space is virtualized into multiple “logical” or “architectural” physical address spaces (PAS), each such PAS being an orthogonal address space with independent coherence attributes. System physical addresses are mapped to a single “logical” physical address space by extending it with PAS tags.

[0074] A given world is granted access to a subset of the logical-physical address space. This is accomplished by a hardware filter 20, which can be attached to the output of the memory management unit 16.

[0075] The world defines access security attributes (PAS tags) using fields in the translation table descriptor of the page table used for address translation. The hardware filter 20 has access to a table (granule protection table 56, or GPT) that defines granule protection information (GPI) for each page in the system physical address space, where the granule protection information indicates the PAS TAG to which it is associated, and (optionally) other granule protection attributes.

[0076] The hardware filter 20 checks the world ID and security attributes of the granule's GPI to determine whether access may be permitted, and in this way forms a granular memory protection unit (GMPU).

[0077] GPT56 can reside, for example, in on-chip SRAM or off-chip DRAM. When stored off-chip, GPT56 can be protected for integrity by an on-chip memory protection engine that can use encryption, integrity, and freshness mechanisms to maintain the security of GPT56.

[0078] By locating GMPU20 on the system's requester side (e.g., on the MMU output) rather than the completer side, interconnect 8 can assign access permissions at page granularity while allowing continuous page hashing / striping across multiple DRAM ports.

[0079] The PAS TAG remains tagged because the transaction propagates throughout the entire system fabric 24,8 until it reaches a location defined as point 60 of the physical alias. This allows the filter to be placed on the master side without weakening security guarantees compared to slave-side filtering. As the transaction propagates throughout the system, the PAS TAG can be used as a detailed security mechanism for address isolation. For example, a cache can add the PAS TAG to address tags in the cache to prevent access made using the wrong PAS TAG for the same PA from hitting the cache, thereby improving side-channel resistance. The PAS TAG can also be used as a context selector for a protection engine attached to a memory controller that encrypts data before it is written to external DRAM.

[0080] A Point of Physical Alias ​​(PoPA) is a location within the system where the PAS TAG is removed and the address returns from a logical physical address to a system physical address. A PoPA can be located below the cache on the system's completer side, where access to physical DRAM is performed (using the cryptographic context resolved via the PAS TAG). Alternatively, it may be located above the cache to simplify the system implementation at the expense of reduced security.

[0081] At any given time, the world can request to transfer a page from one PAS to another. The request is made by EL3 to monitor code 29, which checks the current state of the GPI. EL3 may only allow a specific set of transitions to occur (e.g., it allows transitions from a non-secure PAS to a secure PAS, but not from a realm PAS to a secure PAS—another supported transition could be between a non-secure PAS with a given less secure memory characteristic and a second non-secure PAS with a second less secure memory characteristic). To provide a clean transition, a new instruction "delete data and invalidate up to the point of physical alias" is supported by the system, and EL3 can submit this before transferring the page to the new PAS. This ensures that any residual state associated with the previous PAS is flushed from any cache upstream of PoPA60 (closer to the requester side).

[0082] Another characteristic that can be achieved by installing GMPU20 on the master side is the efficient sharing of memory between worlds. It may be desirable to allow a subset of N worlds shared access to a physical granule while preventing other worlds from accessing it. This can be achieved by adding the semantic "limited sharing" to the granule protection information and enforcing the use of a specific PAS TAG. As an example, GPI can indicate that a physical granule can only be accessed by "realm world" 88 and "secure world" 84 while it is tagged with the PAS TAG of secure PAS 84.

[0083] The above example of characteristics leads to a rapid change in the visibility characteristics of a particular physical granule. Consider a case where each world is assigned a private PAS that is accessible only to that world. For a particular granule, a world can request to be visible to non-secure worlds at any time without changing the PAS association by changing its GPI from "exclusive" to "limitedly shared with non-secure worlds". In this way, the visibility of that granule can be increased without requiring costly cache maintenance or data copy operations.

[0084] Figure 4 illustrates the concept of aliasing each physical address space on the physical memory provided to the hardware. As mentioned above, each of regions 82, 84, 86, and 88 has its own physical address space 61.

[0085] At the point when the physical address is generated by the address translation circuit 16, the physical address has a value within a specific numerical range 62 supported by the system, which is the same regardless of which physical address space is selected. However, in addition to generating the physical address, the address translation circuit 16 may also select a specific physical address space (PAS) based on the current region 14 and / or information in the page table entries used to derive the physical address. Alternatively, instead of the address translation circuit 16 performing the PAS selection, an address translation circuit (e.g., an MMU) may output the physical address and information derived from the page table entries (PTEs) used for PAS selection, which can then be used by a PAS filter or GMPU 20 to select a PAS.

[0086] The selection of PAS for a given memory access request may be limited according to the rules defined in the table below, depending on the current region in which the processing circuit 10 is operating when it issues the memory access request.

[0087] [Table 1] For regions where multiple physical address spaces are available for selection, the selection is made from among the available PAS options using information from the accessed page table entries used to provide the physical address. Regarding access to non-secure PAS: * For entries in the marked table, whether the secure and realm regions can access the non-secure PAS also depends on whether a previously defined, less secure memory characteristic is specified in the Granule Protection Information (GPI) for the accessed PA (it is possible to provide a mode in which the use of this characteristic is disabled for backward compatibility reasons, at least in some operating modes).

[0088] Therefore, by the time the PAS filter 20 outputs a memory access request to the system fabric 24, 8 (assuming it has passed any filtering checks), the memory access request is associated with a physical address (PA) and a selected physical address space (PAS).

[0089] From the perspective of memory system components (caches, interconnects, snoop filters, etc.) operating before the Point of Physical Alias ​​(PoPA) 60, each physical address space 61 is considered a completely separate address range corresponding to a different system location in memory. This means that, from the perspective of pre-PoPA memory system components, the address range identified by a memory access request is actually four times the size of the range 62 that can be output in address translation. This is because, in effect, the PAS identifier is treated as an additional address bit alongside the physical address itself, and therefore, depending on the selected PAS, the same physical address PAx can be mapped to a number of alias physical addresses 63 in separate physical address spaces 61. Although all of these alias physical addresses 63 actually correspond to the same memory system location implemented in the physical hardware, pre-PoPA memory system components treat alias addresses 63 as different addresses. Therefore, if there is a pre-PoPA cache or snoop filter allocating entries to such addresses, the alias addresses 63 will be mapped to different entries with different cache hit / miss decisions and different coherency management. This reduces the likelihood or effectiveness of attackers using caches or coherent seaside channels as a mechanism to explore the behavior of other domains.

[0090] A system may contain two or more PoPAs (for example, memory access requests specifying different physical addresses may be routed through different paths in the memory system and handled by different PoPAs). In each PoPA, the aliased physical address is folded into a single unaliased address 65 in the system physical address space 64. The unaliased address 65 is provided downstream of any post-PoPA component, and as a result, the system physical address space 64 that actually identifies the memory system location is again the same size as the range of physical addresses that can be output in the address translation performed on the requester side. For example, in a PoPA, the PAS identifier may be detached from the address, and for downstream components, the address can be identified simply using the physical address value without specifying the PAS. Alternatively, if some completer-side filtering of the memory access request is desired, the PAS identifier may still be provided downstream of the PoPA, but may not be interpreted as part of the address. As a result, the same physical address appearing in different physical address spaces 60 will be interpreted downstream of PoPA as pointing to the same memory system location. However, the supplied PAS identifier may still be used to perform completer-side security checks.

[0091] Figure 5 illustrates how the system physical address space 64 can be divided into chunks allocated for access within the physical address space 61 on a particular architecture using a granule protection table 56. The granule protection table (GPT) 56 defines which parts of the system physical address space 65 are accessible from the physical address space 61 on each architecture. For example, the GPT 56 contains several entries, each defining granule protection information (GPI) corresponding to a granule of physical address of a certain size (e.g., 4K pages). The GPI can indicate that a specific PAS can be assigned to that granule, or that the granule can be accessed using two or more PAS. As further illustrated with respect to Figure 11, for setting up GPIs corresponding to a given less secure memory characteristic, the GPI can also impose further requirements regarding which regions are associated with memory access requests. If a particular granule or set of granules in the physical memory address space is defined in GPT as being accessible only from one PAS, then it can only be accessed within that PAS and not within the PAS of other regions. However, it should be noted that even though a granule allocated to a secure PAS (for example) is inaccessible from within the root PAS, the root region 82 can still access that granule at its physical address by specifying PAS selection information in its page table to ensure that the virtual addresses associated with pages mapped to that region of physically addressed memory are translated to physical addresses in the secure PAS instead of the root PAS. Thus, data sharing between regions (to the extent permitted by the accessibility rules defined in the table above) can be controlled at the time of selecting the PAS for a given memory access request.

[0092] However, in some implementations, in addition to allowing granules of physical addresses to be accessed within a single PAS assigned by GPT, GPT can use other GPT attributes to mark certain regions of the address space (e.g., address spaces associated with lower or orthogonal privilege regions that are not normally permitted to select the PAS assigned for access requests to that region) as shared with another address space. This can facilitate the temporary sharing of data without the need to change the PAS assigned to a given granule. For example, in Figure 5, region 70 of the realm PAS is defined in GPT to be assigned to a realm region, and is normally inaccessible from the non-secure region 86 because the non-secure region 86 cannot select the realm PAS for its access requests. Because the non-secure region 26 cannot access the realm PAS, non-secure code would normally not be able to see the data in region 70. However, if a realm initially desires to share some of its data within an allocated memory region with an insecure region, it can request monitor code 29, operating in the root region 82, to update GPT 56 to indicate that region 70 is shared with the insecure region 86. This makes region 70 accessible from the insecure PAS shown on the left side of Figure 5 without needing to change which region is allocated to region 70. When a realm region points to a region of its address space as being shared with an insecure region, a memory access request issued from the insecure region targeting that region may initially specify an insecure PAS, but the PAS filter 20 can remap the request's PAS identifier to specify the realm PAS instead. This allows downstream memory system components to treat the request as if it had been issued from the realm region from the beginning.This sharing can improve performance because the operation of allocating different regions to a specific memory area may be more performance-intensive, involving a higher degree of cache / TLB invalidation and / or data zeroing in memory or data copying between memory areas. This may not be justifiable if the sharing is expected to be only temporary.

[0093] Other implementations may not support such sharing options, and therefore GPT may restrict each physical address to being accessible only through one PAS.

[0094] Figure 6 is a flowchart showing how the current operating region is determined, which may be performed by the processing circuit 10, or by the address translation circuit 16 or the PAS filter 20. In step 100, it is determined whether the current exception level 15 is EL3, and if so, then in step 102, it is determined that the current region is the root region 82. If the current exception level is not EL3, then in step 104, it is determined that the current region is one of the non-secure, secure, and realm regions 86, 84, or 88, as indicated by at least two region indicator bits 14 in the processor's EL3 control register (since the root region is indicated by the current exception level being EL3, it is not necessary to have a code for the region indicator bit 14 corresponding to the root region, and therefore the code for at least one region indicator bit can be reserved for other purposes). The EL3 control register is writable when operating at EL3 and cannot be written from other exception levels EL2 to EL0.

[0095] Figure 7 shows an example of a page table entry (PTE) that can be used by the address translation circuit 16 for page table entries in a page table structure used for mapping from virtual addresses to physical addresses, from virtual addresses to intermediate addresses, or from intermediate addresses to physical addresses (depending on whether the translation is performed in an operating state where a Stage 2 translation is required in the first place, and if a Stage 2 translation is required, whether the translation is Stage 1 or Stage 2). Generally, a given page table structure may be defined as a multilevel table structure in which the first level of the page table is implemented as a page table tree identified based on a base address stored in the processor's translation table base address register, and the index for selecting a particular level 1 page table entry in the page table is derived from a subset of bits of the input address from which the translation lookup is performed (the input address may be a virtual address for Stage 1 translation, or an intermediate address for Stage 2 translation). A level 1 page table entry may be a “table descriptor” 110 that provides a pointer 112 to the next level of the page table from which further page table entries may be selected based on a further subset of bits of the input address. Finally, after one or more lookups into successive levels of page tables, it is possible to identify blocks or page descriptors PTEs 114, 116, 118 that provide the output address 120 corresponding to the input address. The output address may be an intermediate address (for stage 1 translations performed in an operating state where further stage 2 translations are also performed) or a physical address (for stage 2 translations, or stage 1 translations when stage 2 is not required).

[0096] To support the separate physical address spaces described above, the page table entry format may specify several additional states for use in physical address space selection, in addition to the next level page table pointer 112 or output address 120 and any attributes 122 for controlling access to the corresponding block in memory.

[0097] For table descriptor 110, the PTE used by any realm other than the non-secure realm 86 includes a non-secure table indicator 124 that indicates whether the next level of page tables should be accessed from the non-secure physical address space or the physical address space of the current realm. This helps facilitate more efficient management of page tables. Often, the page table structure used by the root, realm, or secure realm 24 may only need to define special page table entries for a portion of the virtual address space, and the same page table entries used by the non-secure realm 26 may be available for the other portion. Thus, by providing the non-secure table indicator 124, a realm / secure-only table descriptor can be provided at a higher level of the page table structure, while at some point in the page table tree, the root realm or secure realm can switch to using page table entries from the non-secure realm for portions of the address space where higher security is not required. Other page table descriptors in other parts of the page table tree can still be fetched from the associated physical address space associated with the root, realm, or secure realm.

[0098] On the other hand, block / page descriptors 114, 116, and 118 may contain physical address space selection information 126, depending on which region they are associated with. A non-secure block / page descriptor 118 used within a non-secure region 86 does not contain any PAS selection information, since the non-secure region can only access non-secure PAS. However, for other regions, block / page descriptors 114 and 116 contain PAS selection information 126 used to select the PAS that translates the input address. For the root region 22, the EL3 page table entry may have PAS selection information 126 containing at least two bits to indicate the PAS associated with one of the four regions 82, 84, 86, and 88 as the selected PAS to which the corresponding physical address is translated. In contrast, for realm and secure regions, the corresponding block / page descriptor 116 must contain only one bit of PAS selection information 126, thereby selecting between the realm and a non-secure PAS for the realm region, and between a secure PAS and a non-secure PAS for the secure region. To improve the efficiency of circuit implementation and avoid increasing the size of page table entries, for realm and secure regions, the block / page descriptor 116 can code the PAS selection information 126 at the same location in the PTE regardless of whether the current region is a realm or secure, thus allowing the PAS selection bits 126 to be shared.

[0099] Therefore, Figure 8 is a flowchart showing how to select a PAS based on the current region and information 124, 126 from the block / page PTE used to generate a physical address for a given memory access request. PAS selection can be performed by the address translation circuit 16, or by a combination of the address translation circuit 16 and the PAS filter 20, if the address translation circuit sends the PAS selection information 126 to the PAS filter 20.

[0100] In step 130 of Figure 8, the processing circuit 10 issues a memory access request specifying a given virtual address (VA) as the target VA. In step 132, the address translation circuit 16 looks up any page table entry (or cache information derived from such a page table entry) in its TLB 18. If any of the required page table information is unavailable, the address translation circuit 16 initiates a page table walk to memory to fetch the required PTE (potentially requiring a series of memory accesses to step through each level of the page table structure and / or multiple stages of address translation to obtain mappings from VA to intermediate addresses (IPAs) and from IPAs to PAs). Any memory access request issued by the address translation circuit 16 in the page table walk operation may itself be subject to address translation and PAS filtering. Therefore, it should be noted that the request received in step 130 may be a memory access request issued to request a page table entry from memory. Once the relevant page table information is identified, the virtual address is translated to a physical address (possibly in two stages via IPAs). In step 134, the address translation circuit 16 or the PAS filter 20 determines which region is the current region using the method shown in Figure 6.

[0101] If the current area is an insecure area, then in step 136, the output PAS selected for this memory access request is an insecure PAS.

[0102] If the current region is a secure region, in step 138 an output PAS is selected based on the PAS selection information 126 contained in the block / page descriptor PTE that provided the physical address, and the output PAS is selected as either a secure PAS or a non-secure PAS.

[0103] If the current region is a realm region, in step 140 an output PAS is selected based on the PAS selection information 126 contained in the block / page descriptor PTE from which the physical address was derived, in which case the output PAS is selected as either a realm PAS or a non-secure PAS.

[0104] If step 134 determines that the current region is the root region, step 142 selects an output PAS based on the PAS selection information 126 in the root block / page descriptor PTE 114 from which the physical address was derived. In this case, the output PAS is selected as one of the physical address spaces associated with the root, realm, secure, and non-secure regions.

[0105] Figure 9 summarizes the operation of the address translation circuit 16 and the PAS filter 20. The PAS filtering 20 can be considered an additional Stage 3 check performed after the Stage 1 (and optionally Stage 2) address translation performed by the address translation circuit. It should also be noted that the EL3 translation is based on page table entries that provide selection information based on a 2-bit address (labeled NS and NSE in the embodiment of Figure 12), while the single-bit selection information "NS" is used to select a PAS of other states. The security state shown in Figure 9 as input to the granule protection check refers to the region ID that identifies the current region of processing element 4.

[0106] Figure 10 is a flowchart illustrating how the PAS filter 20 (check circuit) performs a protection check in Stage 3 shown in Figure 9. In step 200, the PAS filter 20 obtains protection information GPT[PA] corresponding to the target physical address (PA) obtained for the memory access request by the address translation circuit 16. For example, the PAS filter 20 looks up the target PA in the granular protection information cache 22, and if it hits the target PA, it determines the protection information associated with the target PA based on the cache information specified in the hit entry of the granular protection information cache 22. If the target PA misses in the granular protection information cache 22, at least one memory access request is sent to the memory system to request that the granular protection entry corresponding to the target PA be returned from memory.

[0107] For example, the PAS filter 20 may have a register that stores the base address of the granule protection table used to define granule protection information, and may generate the address of a memory access request issued to request the associated granule protection entry as a function of the base address and the target PA. The right to update the register that stores the GPT base address may be restricted to software running in the root area (at exception level EL3).

[0108] Some implementations can use a linear table structure that allows access to the required granule protection entries in a single access, while others can use a hierarchical table structure similar to the multilevel page table used by the address translation circuit 16 to access the address translation mapping, which may require issuing two or more memory access requests to step through multiple levels of granule protection tables, each level of which is indexed based on the respective parts of the target PA, and a pointer provided to an entry in one level of granule protection table provides a base address that can be used to derive the address to which the next level of granule protection table is accessed. When the associated granule protection entry corresponding to the target PA of the original memory access is returned from memory, the information derived from this granule protection entry can be cached in a granule protection information cache (the cached information does not need to be encoded in exactly the same way as the granule protection entry stored in memory—for example, a compression scheme may be used to reduce the amount of cached data compared to the encoding stored in memory).

[0109] Therefore, in step 200, information is identified by the PAS filter 20 that allows the PAS filter 20 to determine the encoding of granule protection information corresponding to the target PA. This can be identified based on information cached in the cache 22 or based on information stored in memory.

[0110] In step 202, the PAS filter 20 determines whether the memory access request is permitted based on information identifying the granule protection information corresponding to the target PA. If the memory access request is not permitted, in step 204, the memory access request is rejected and a fault is signaled. If it is determined that the memory access request is permitted, in step 206, the memory access request is allowed to proceed.

[0111] Granule protection information can be specified at a granularity of memory blocks of a specific size (e.g., a 4KB page, or a larger or smaller block) such that all physical addresses within the same block share the same granule protection information entry.

[0112] Generally, a granular protection information entry corresponding to a given PA provides information identifying which physical address spaces are permitted to provide access to that PA. For example, granular protection information can support various encodings that provide different configurations of which PAS are permitted to provide access. For example, supported encodings for granular protection information (GPI) may be as follows:

[0113] [Table 2] The specific mapping of GPI values ​​to memory characteristics shown here is merely an example, and it should be understood that the same configuration may be implemented with different mappings of GPI values ​​(for example, some meanings of the GPI value coding may be interchangeable). It should also be understood that other examples may provide additional options, or one of these options may be omitted (for example, the "all access allowed" option may be removed).

[0114] The above setting 0b1101 is an example of the predetermined less secure memory characteristic described above. It will be understood that this characteristic can also be represented by other types of encoding (e.g., bit flags that select whether the characteristic is satisfied, or range information that specifies the start / end addresses of the memory range for the predetermined less secure characteristic). Therefore, the claimed method is not particularly limited in terms of how this characteristic is encoded. Any information can be used that enables the PAS circuit to determine that the predetermined less secure characteristic is defined for a given physical address.

[0115] The setting 0b1001 shown above is an example of the second, less secure memory characteristic described above, which can be used for memory regions where it is desirable to allow requests issued in a realm or secure security state to access the memory region via a non-secure PAS.

[0116] Figure 11 is a flowchart illustrating the steps performed by the PAS filter 20 to check whether memory access is permitted based on the granular protection information GPT[PA] corresponding to the target PA. In step 220, the PAS filter 20 checks whether the granular protection information corresponding to the target PA indicates a predetermined less secure memory characteristic. If not, in step 222, the processing of the memory access request is controlled according to any other characteristics indicated by the granular protection information corresponding to the target physical address. For example, if GPT[PA] represents one of the settings represented by GPI values ​​0b1000, 0b1001, 0b1010, and 0b1101 in the example shown above (note that similar settings may be encoded differently in other examples), step 222 may include checking whether the PAS selected for the current memory access request is an authorized PAS that is permitted for access in each GPI state (i.e., an authorized PAS is a secure PAS in the case of 0b1000, an insecure PAS in the case of 0b1001, a root PAS in the case of 0b1010, and a realm PAS in the case of 0b1011). Also, if GPT[PA] represents a setting represented using the GPI value 0b1111 shown above (this, too, may be encoded differently in another example), the memory access request may be determined to be permitted regardless of which PAS is selected for the memory access request. Furthermore, if GPT[PA] indicates a setting represented using the above GPI value 0b0000, the memory access request may be deemed ineligible, regardless of which PAS is selected. If GPT[PA] has another encoding that is reserved, a malfunction may be signaled.

[0117] If, in step 220, it is determined that the granular protection information GPT[PA] corresponding to the target PA exhibits a predetermined less secure memory characteristic, then in step 224, the PAS filter 20 determines whether the current operating mode is a mode in which the use of the predetermined less secure memory characteristic is enabled. For example, the PAS filter 20 may determine whether the current mode supports the use of the predetermined less secure memory characteristic based on configuration information specified in register 12 (e.g., a system register). The right to update the configuration information used to determine whether the predetermined less secure memory characteristic is enabled or disabled may be limited to a specific execution state (e.g., only software running in a given exception level or security state—for example, root area software running in EL3 in some cases—may be permitted to set this configuration information, and attempts to update the configuration information by software in a low-privilege exception level may be denied). By supporting a mode in which the use of the predetermined less secure memory characteristic is disabled, this may be useful for backward compatibility with software designed for systems that did not support the predetermined less secure memory characteristic. If the current operating mode does not support the use of a predetermined less secure memory characteristic, in step 226, the instruction for the predetermined less secure memory characteristic is treated as a reserved encoding that should not have been specified by the software, and a fault is signaled. In some cases, a fault may also be signaled if another granule protection entry of a PA in a memory block close to the target PA of a memory access (for example, a granule protection entry accessed on the same cache line as the granule protection entry corresponding to the target PA when the PAS filter 20 requests a block of granule protection entries in memory following a miss in the granule protection information cache 22) has a reserved encoding.By signaling a fault in response to the detection of reserved encoding within GPT[PA] or another granule protection entry within the same block, the system can be made more robust against errors caused by GPT corruption.

[0118] If the granular protection information GPT[PA] corresponding to the target PA indicates a predetermined less secure memory characteristic, and it is determined that the current operating mode is a mode in which the use of the predetermined less secure memory characteristic is enabled, in step 228, the PAS filter 20 determines whether the selected PAS is a non-secure PAS, and if not, in step 230, it is determined that the memory access request is not permitted. Therefore, if the PAS selected for the memory access request is one of the realm PAS, secure PAS, and root PAS, the request is not permitted.

[0119] In step 232, the PAS filter 20 determines whether the area associated with the memory access request is a non-secure area or a root area. For example, the area associated with the memory access request may be determined based on register states 14 and 15, as described above with respect to Figure 6. If the area associated with the memory access request is a secure area or a realm area, the memory access request is not permitted in step 234.

[0120] In steps 228 and 232, if the PAS filter 20 determines that the memory access request is issued from an insecure area or root area and that the selected PAS is an insecure PAS, then in step 236, it is determined that the memory access request is permitted.

[0121] It will be understood that the steps shown in Figure 11 can be rearranged or performed at least partially in parallel to achieve the same function (for example, steps 228 and 232 can be performed in reverse order or in parallel with each other).

[0122] Therefore, less secure software may require the root area software (or other software responsible for setting granule protection information) to set granule protection information for certain regions of memory to a setting corresponding to a given less secure memory characteristic. This means that those memory regions are prevented from being accessed by software running within the realm or secure area, even if the software within that area has set PAS selection information 126 in its page table, and as a result, an insecure PAS is selected for a memory access request to those memory regions. This provides better protection against a confused proxy attack in which nominally more privileged / secure software within the realm or secure area is tricked by an attacker into creating a set of memory accesses that would compromise information maintained by less secure software in memory accessible within an insecure PAS.

[0123] On the other hand, root area software is trusted to access memory regions within non-secure PAS where predetermined less secure characteristics are defined. Root area software is relatively small (in terms of the number of instructions) compared to the numerous instructions defined for operating system / hypervisor / application software within the secure and realm areas. Since root area software is expected to be provided by a single trusted provider (such as a hardware manufacturer, system firmware provider, designer of the instruction set architecture supporting the security model shown in Figure 2, or other trusted party) with a provable root of trust associated with the software, while software operating within the secure and realm areas can be a complex web of software components provided by many different entities, root area software presents a much smaller attack surface than software running within the secure and realm areas. Therefore, it is considered acceptable for root area software to access regions of non-secure PAS assigned with predetermined less secure memory characteristics (e.g., the aforementioned encoding 0b1101).

[0124] The example in Figure 1 above shows an address translation circuit 16 and a PAS filter 20 (check circuit) and a PAS selection circuit represented by one or both of the address translation circuit 16 and the PAS filter 20 within a requester device 4, which may be a processor such as a CPU, GPU, or other processing unit capable of executing program instructions from an instruction set architecture.

[0125] However, as shown in Figure 12, the memory system accessed by such a requester device 4 (for example, the CPU in the example in Figure 12) may also be shared so as to be accessible to one or more other devices 252 that can access the memory via a system memory management unit (SMMU, also known as an input / output memory management unit or IOMMU) 250. The SMMU 250 may be an example of another requester device 4 shown in Figure 1.

[0126] Device 252 may include, for example, peripheral or I / O devices that provide an interface between CPU 4 and the outside world (for example, the device may include a display controller, a network controller, a user interface controller, a memory controller for accessing external off-ship storage, etc.). Device 252 may also include hardware accelerators provided to accelerate custom processing tasks using dedicated hardware that can perform this task more efficiently than the general-purpose processor hardware provided by CPU 4. For example, hardware accelerators can be provided to accelerate functions such as cryptographic operations and machine learning tasks such as neural network processing. The use of hardware accelerators can also help to offload certain memory-intensive tasks that are performed in the background of processing ongoing on CPU 4.

[0127] Since devices 252 may not have their own address translation circuitry capable of translating virtual addresses to physical addresses based on rich memory mappings defined by page tables used by CPU 4, SMMU 250 may be provided as a system component to receive requests from device 252 specifying virtual addresses and perform the necessary address translation on behalf of the device.

[0128] Therefore, in a system supporting the security model shown in Figure 2, the SMMU250 may be provided with an address translation circuit 16 and a PAS filter 20 similar to those shown in Figure 1, the PAS filter 20 functioning as a check circuit for checking permissions defined by granular protection information, and one or both of the address translation circuit 16 and the PAS filter 20 of the SMMU250 provide the aforementioned PAS selection circuit. Thus, the SMMU250 can also support access to multiple physical address spaces and a third stage of checking based on granular protection information, as shown in Figure 9. Thus, the address translation circuit 16 and the PAS filter 20 can operate in the same manner as described above. The SMMU250 may have a TLB 18 and / or GPI cache 22 similar to the corresponding cache structure in the requester 4 shown in Figure 1.

[0129] However, in order for the SMMU250 to support the aforementioned less secure memory characteristics, the SMMU250's PAS filter 20 requires information about which region (security state) the memory access request received from device 252 is associated with. The SMMU250 does not access the CPU's system registers 12 that define the register states 14 that define the current operating region, and in any case, a request sent by a given device 252 may relate to processing in regions other than the current region that is active in the CPU 4. Therefore, in the method shown in Figure 12, a memory access request sent by device 252 to the SMMU250 may specify a region identifier that identifies the region associated with the memory access request. For example, each device 252 may maintain a data structure that identifies the corresponding region identifier for each workload assigned to the device (for example, it may be set based on the current region 14 associated with the software that caused the device to be assigned work when assigning work to the device). This data structure may be used by device 252 to select which region to specify in the region identifier provided to the SMMU250 when a memory access request is issued to the SMMU250. The specific mechanism by which a memory access request from a device is associated with a particular region identifier value may depend on the specific purpose of the device and the mechanism chosen by the software developer to assign the workload to device 252, and therefore may not be a required feature of the system hardware. However, generally speaking, hardware support for providing a signal path that allows region identifiers to be provided to SMMU 250 by device 252 along with memory access requests means that the PAS filter 20 within SMMU 250 can perform protection checks using the aforementioned less secure memory characteristics (which depend on the region associated with the memory access request, as well as the PAS selected with respect to other settings of granular protection information).Therefore, even when the SMMU is in use, certain less secure memory characteristics may be used to prevent device memory access requests associated with processing in a secure or realm region from being used to access an insecure PAS.

[0130] As shown in the example in Figure 12, interconnection 8 may include a system cache 300, which could be an example of a pre-PoPA memory system component that treats alias physical addresses from different PAS as if they corresponded to different memory system resources.

[0131] The concepts described herein may be embodied in computer-readable code for the fabrication of devices that embody the described concepts. For example, computer-readable code may be used in one or more stages of a semiconductor design and fabrication process, including an electronic design automation (EDA) stage, to fabricate an integrated circuit comprising a device that embodies the concepts. The computer-readable code described herein may additionally or alternatively enable the definition, modeling, simulation, verification, and / or testing of devices that embody the concepts described herein.

[0132] For example, computer-readable code for fabricating a device embodying a concept described herein may be embodyed by code that defines a hardware description language (HDL) representation of the concept. For example, the code may define register-transfer-level (RTL) abstractions of one or more logic circuits for defining a device embodying the concept. The code may define HDL representations of one or more logic circuits embodying the device in Verilog, SystemVerilog, Chisel, or an intermediate representation such as Very High-Speed ​​Integrated Circuit Hardware Description Language (VHDL) and FIRRTL. The computer-readable code may provide definitions that embody the concept using system-level modeling languages ​​such as SystemC and SystemVerilog, or other behavioral representations of the concept that can be interpreted by a computer to enable simulation, functional and / or formal verification, and testing of the concept.

[0133] Additionally or alternatively, computer-readable code may define low-level descriptions of integrated circuit components that embody the concepts described herein, such as one or more netlists or integrated circuit layout definitions, including representations such as GDSII. One or more netlists or other computer-readable representations of integrated circuit components may be generated by applying one or more logic synthesis processes to the RTL representations to generate definitions used for fabricating devices that embody the invention. Alternatively or additionally, one or more logic synthesis processes may generate bitstreams from computer-readable code that are loaded into a field-programmable gate array (FPGA) to configure the FPGA to embody the concepts described herein. The FPGA may be deployed for the purpose of verifying and testing the concept before fabrication in an integrated circuit, or the FPGA may be deployed directly into a product.

[0134] Computer-readable code may include a mixture of code representations for the fabrication of a device, for example, a mixture of one or more RTL representations, netlist representations, or other computer-readable definitions used in semiconductor design and fabrication processes for fabricating a device embodying the present invention. Alternatively or additionally, the concept may be defined as a combination of computer-readable definitions used in semiconductor design and fabrication processes for fabricating a device and computer-readable code that defines instructions to be executed by the device once it is fabricated.

[0135] Such computer-readable code may be placed on any known temporary computer-readable medium (such as wired or wireless transmission of code over a network) or on a non-temporary computer-readable medium such as a semiconductor, magnetic disk, or optical disk. An integrated circuit fabricated using computer-readable code may include components such as a central processing unit, a graphics processing unit, a neural processing unit, a digital signal processor, or one or more other components that individually or collectively embody a concept.

[0136] Figure 13 illustrates possible implementations of a simulator. While the above embodiments implement the present invention in terms of devices and methods for operating specific processing hardware that supports the technique, it is also possible to provide an instruction execution environment according to the embodiments described herein, which are implemented using a computer program. Such a computer program is often referred to as a simulator, insofar as it provides a software-based implementation of a hardware architecture. Various simulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators. Typically, a simulator implementation may run on a host processor 430, optionally running a host operating system 420 and supporting the simulator program 410. In some configurations, there may be multiple layers of simulation between the hardware and the provided instruction execution environment, and / or multiple different instruction execution environments may be provided on the same host processor. Historically, powerful processors have been required to provide simulator implementations that run at reasonable speeds, but such techniques may be justified in certain circumstances, such as when it is desirable to run native code on a different processor for reasons of compatibility or reuse. For example, a simulator implementation may provide an instruction execution environment with additional functionality not supported by the host processor hardware, or it may provide an instruction execution environment typically associated with a different hardware architecture. An overview of the simulation is described in "Some Efficient Architecture Simulation Techniques," Robert Bedichek, 1990 Winter USENIX Conference, pp. 53-63.

[0137] While embodiments have been described so far with reference to specific hardware components or features, in simulated embodiments, equivalent functionality may be provided by suitable software components or features. For example, certain circuits may be implemented as computer program logic in simulated embodiments. Similarly, memory hardware such as registers or caches may be implemented as software data structures in simulated embodiments. In arrangements where one or more of the hardware elements referenced in the previously described embodiments reside on host hardware (e.g., host processor 430), some simulated embodiments may, if preferred, utilize the host hardware.

[0138] The simulator program 410 can be stored in a computer-readable storage medium (which may be a non-temporary medium) but provides a program interface (instruction execution environment) to the target code 400 (which may include an application, operating system, and hypervisor) that is the same as the interface of the hardware architecture modeled by the simulator program 410. Thus, program instructions of the target code 400 can be executed from within the instruction execution environment using the simulator program 410, and for this reason, a host computer 430 that does not actually possess the hardware features of the device 2 described above can emulate these features. This can be useful, for example, to enable testing of target code 400 being developed for a new version of a processor architecture before a hardware device that actually supports that architecture becomes available, since the target code can be tested by running it in a simulator that runs on a host device that does not support the new version of the processor architecture.

[0139] The simulator code includes, for example, instruction decoding program logic that decodes the instructions of target code 400, and processing program logic 412 that maps the instructions to a sequence of corresponding instructions in the native instruction set supported by the host hardware 430, thereby executing the function equivalent to the decoded instructions. Processing program logic 412 also simulates the processing of the code in different exception levels and regions, as described above. Register emulation program logic 413 maintains data structures in the host address space of the host processor that emulate the register state on the architecture defined according to the target instruction set architecture associated with target code 400. Thus, instead of such an architectural state being stored in hardware registers 12 as in the embodiment of Figure 1, it is instead stored in the memory of the host processor 430, and register emulation program logic 413 maps the register references of the instructions of target code 400 to the corresponding addresses for retrieving the simulated architectural state data from host memory. This architectural state may include the current region instruction 14 and the current exception level instruction 15 described above.

[0140] The simulation code includes address translation program logic 414 and filtering program logic 416, which emulate the functions of the address translation circuit 16 and PAS filter 20, respectively, referencing the same page table structure and GPT56 as described above. Either or both of the address translation program logic 414 and filtering program logic 416 also function as PAS selection program logic for selecting a selected PAS associated with a given memory access request, based on PAS selection information defined using the current region and page table of the processing program logic 412. Thus, the address translation program logic 414 translates the virtual address specified by the target code 400 to a simulated physical address in one of the PAS (pointing to a physical location in memory from the perspective of the target code), but these simulated physical addresses are actually mapped onto the host processor's (virtual) address space by the address space mapping program logic 415. The filtering program logic 416, like the PAS filter 20 described above, performs a lookup of granule protection information to determine whether to allow the memory access triggered by the target code to proceed.

[0141] In this application, the phrase "configured to..." is used to mean that an element of the device has a configuration that enables it to perform a defined operation. In this context, "configuration" means the arrangement or interconnection of hardware or software. For example, the device may have dedicated hardware to provide the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured to" does not mean that an element of the device must be modified in any way to provide the defined operation.

[0142] In this application, the enumeration of features preceded by the phrase "at least one of" means that any one or more of those features can be provided individually or in combination. For example, "[A], [B] and [C]" includes any of the following options: A alone (without B or C), B alone (without A or C), C alone (without A or B), a combination of A and B (without C), a combination of A and C (without B), a combination of B and C (without A), or a combination of A, B and C.

[0143] While illustrative embodiments of the present invention are described in detail herein with reference to the accompanying drawings, it will be understood that the present invention is not limited to those exact embodiments, and that various changes and modifications can be made to the embodiments without departing from the scope of the present invention as defined by the appended claims.

Claims

1. It is a device, An address translation circuit for translating the target virtual address of a memory access request associated with one of multiple processing regions, each of which includes at least a less secure region associated with a less secure physical address space and a more secure region associated with a more secure physical address space, A physical address space selection circuit for selecting a physical address space selected for a memory access request from among a plurality of physical address spaces, the plurality of which include at least a less secure physical address space and a more secure physical address space that is prohibited from being selected for a memory access request associated with the less secure region; The system includes a check circuit for determining whether to reject the memory access request based on protection information corresponding to the target physical address, wherein the protection information specifies which of the plurality of physical address spaces is permitted to provide access to the target physical address. In at least one operating mode, in response to determining that the protection information corresponding to the target physical address exhibits predetermined less secure memory characteristics, the check circuit: A less secure physical address space is permitted to provide access to the target physical address. The aforementioned more secure physical address space is prohibited from providing access to the target physical address. A device configured to determine that even when the selected physical address space is a less secure physical address space, memory access requests associated with the more secure region are prohibited from accessing the target physical address.

2. The apparatus according to claim 1, wherein in at least one operating mode, the check circuit is configured to reject a memory access request associated with a more secure region where the selected physical address space is the less secure physical address space, in response to determining that the protection information corresponding to the target physical address indicates predetermined less secure memory characteristics.

3. The aforementioned regions also include additional more secure regions associated with additional more secure physical address spaces, the additional more secure physical address spaces being prohibited from being selected for memory access requests associated with the less secure regions. In at least one of the operating modes, in response to determining that the protection information corresponding to the target physical address exhibits predetermined less secure memory characteristics, the check circuit: The aforementioned additional, more secure physical address space is prohibited from providing access to the target physical address. The apparatus according to claim 1 or 2, configured to determine that even when the selected physical address space is a less secure physical address space, memory access requests associated with the additional more secure region are prohibited from accessing the target physical address.

4. The apparatus according to claim 3, wherein the additional more secure physical address space is prohibited from being selected for memory access requests associated with the more secure region, and the additional more secure physical address space is prohibited from being selected for memory access requests associated with the additional more secure region.

5. The aforementioned multiple regions include a root region for managing switching between other regions among the aforementioned multiple regions. The said root region is associated with a root physical address space that is prohibited from being selected for memory access requests associated with regions other than the said root region. The apparatus according to any one of claims 1 to 4, wherein in at least one of the operating modes, the check circuit is configured to permit a memory access request associated with the root region where the selected physical address space is the less secure physical address space, in response to the check circuit determining that the protection information corresponding to the target physical address exhibits predetermined less secure memory characteristics.

6. The apparatus according to any one of claims 1 to 5, wherein the check circuit is configured to determine whether to operate according to the at least one operating mode based on configuration information indicating whether the use of a predetermined less secure memory characteristic is enabled.

7. The apparatus according to any one of claims 1 to 6, wherein in a further operating mode, the check circuit is configured to treat the encoding that indicates the predetermined less secure memory characteristics as a reserved encoding that is not used to indicate valid characteristics for the target physical address.

8. The apparatus according to claim 7, wherein the check circuit is configured to trigger an error handling response in response to the determination that the protection information corresponding to the target physical address has the reserved coding.

9. In response to determining that the protection information corresponding to the target physical address exhibits a second less secure memory characteristic and does not exhibit the predetermined less secure memory characteristic, the check circuit: A less secure physical address space is permitted to provide access to the target physical address. The aforementioned more secure physical address space is prohibited from providing access to the target physical address. The apparatus according to any one of claims 1 to 8, configured to determine that when the selected physical address space is a less secure physical address space, a memory access request associated with the more secure region is permitted to access the target physical address.

10. The apparatus according to any one of claims 1 to 9, wherein the address translation circuit comprises a memory management unit associated with a processing circuit, the processing circuit comprises at least one system register for specifying current region identification information, and the current region identification information identifies the current region to be designated as one of the plurality of processing regions for a memory access request issued by the processing circuit.

11. The address translation circuit includes a system memory management unit for translating addresses on behalf of one or more devices in the data processing system. The apparatus according to any one of claims 1 to 9, wherein the system memory management unit is configured to identify one of the plurality of processing areas associated with the memory access request based on the area identifier provided to the system memory management unit by the device that issued the memory access request.

12. The physical address space selection circuit uses the selected physical address space, One of the plurality of processing areas associated with the memory access request, and The apparatus according to any one of claims 1 to 11, wherein, at least, memory access requests associated with regions other than the less secure region are configured to be selected based on address space selection information directly or indirectly specified by an address translation entry that provides an address mapping used when translating the target virtual address to the target physical address.

13. A physical alias point (PoPA) memory system component configured to dealiase multiple alias physical addresses from different physical address spaces corresponding to the same memory system location, and to map any of the multiple alias physical addresses to a dealiased physical address provided to at least one downstream memory system component, The apparatus according to any one of claims 1 to 12, further comprising: at least one pre-PoPA memory system component provided upstream of the PoPA memory system component, wherein the at least one pre-PoPA memory system component is configured to handle the alias physical address from different physical address spaces such that the alias physical address corresponds to a different memory system location.

14. A computer-readable medium for storing computer-readable codes, for the manufacture of the apparatus according to any one of claims 1 to 13.

15. It is a method, Translating the target virtual address of a memory access request associated with one of multiple processing regions, each of which includes at least a less secure region associated with a less secure physical address space and a more secure region associated with a more secure physical address space, to a target physical address; From among a plurality of physical address spaces, which include at least a less secure physical address space and a more secure physical address space that is prohibited from being selected for memory access requests associated with the less secure region, the physical address space selected for the memory access request is to be selected. The process includes determining whether to reject the memory access request based on protection information corresponding to the target physical address, wherein the protection information specifies which of the plurality of physical address spaces is permitted to provide access to the target physical address. In at least one operating mode, in response to determining that the protection information corresponding to the target physical address exhibits predetermined less secure memory characteristics, A less secure physical address space is permitted to provide access to the target physical address. The aforementioned more secure physical address space is prohibited from providing access to the target physical address. A method for determining that even if the selected physical address space is a less secure physical address space, memory access requests associated with the more secure region are prohibited from accessing the target physical address.

16. A computer program, which, when executed by a host data processing device, includes instructions to control the host data processing device to provide an instruction execution environment for executing target program code, wherein the computer program includes instructions to control the host data processing device to provide an instruction execution environment for executing target program code, Address translation program logic for translating the target virtual address of a memory access request associated with one of the multiple processing regions, each of which includes at least a less secure region associated with a less secure simulated physical address space and a more secure region associated with a more secure simulated physical address space, to the target simulated physical address. A physical address space selection program logic for selecting a simulated physical address space selected for a memory access request from among a plurality of simulated physical address spaces, the plurality of which include at least a less secure simulated physical address space and a more secure simulated physical address space that is prohibited from being selected for a memory access request associated with the less secure region. Includes a check program logic for determining whether to reject the memory access request based on protection information corresponding to the simulated physical address of the target, wherein the protection information specifies which of the plurality of simulated physical address spaces is permitted to provide access to the simulated physical address of the target. In at least one operating mode, in response to determining that the protection information corresponding to the simulated physical address of the target exhibits predetermined less secure memory characteristics, the check program logic: The less secure simulated physical address space described above is permitted to provide access to the simulated physical address of the target, The more secure simulated physical address space described above is prohibited from providing access to the simulated physical address of the target. A computer program configured to determine that even when the selected simulated physical address space is a less secure simulated physical address space, memory access requests associated with the more secure region are prohibited from accessing the target's simulated physical address.

17. A storage medium for storing the computer program described in claim 16.

Images