Apparatus and method

Abstract

An apparatus is provided comprising: a translation circuit that performs a translation operation to generate a translated second memory address in a second memory address space as a translation of a first memory address in a first memory address space, the translation circuit being configured to generate the translated second memory address in response to translation information stored in one or more translation information addresses; an authorization circuit that performs, for a given second memory address, an operation of detecting permission information to indicate whether memory access is permitted for the given second memory address; and an access circuit that permits access to data stored at the given second memory address if the permission information indicates that memory access to the given second memory address is permitted, wherein the access circuit is configured to selectively permit access by the translation circuit to the translation information address without the authorization circuit completing the operation of detecting permission information to indicate whether memory access is permitted for the translation information address.

Description

[Technical Field]

[0001] The present disclosure relates to an apparatus and a method. [Background technology]

[0002] The data processing system may include address translation circuitry for translating a virtual address of a memory access request into a physical address corresponding to the location to be accessed within the memory system.

[0003] The process of generating such an address translation may itself require multiple memory accesses. Summary of the Invention

[0004] In an exemplary configuration, an apparatus comprising: a translation circuit that performs a translation operation to generate a translated second memory address in a second memory address space as a translation of a first memory address in the first memory address space, the translation circuit being configured to generate the translated second memory address in response to translation information stored in one or more translation information addresses; a permission circuit that performs, for a given second memory address, operations to detect permission information to indicate whether memory access is permitted for the given second memory address; an access circuit that permits access to data stored at the given second memory address if the permission information indicates that memory access to the given second memory address is permitted; An apparatus is provided in which the access circuitry is configured to selectively permit access by the translation circuit to a translation information address without the permit circuit completing an operation of detecting permit information for indicating whether memory access is permitted for the translation information address.

[0005] In another exemplary configuration, a method includes: performing a translation operation to generate a translated second memory address in a second memory address space as a translation of the first memory address in the first memory address space, the translation operation including generating the translated second memory address in accordance with translation information stored in one or more translation information addresses; performing, for a given second memory address, an operation of detecting permission information to indicate whether memory access is permitted for the given second memory address; accessing data stored at the given second memory address if the permission information indicates that memory access to the given second memory address is permitted; selectively accessing the translation information address without the permission circuit completing operations of detecting permission information for indicating whether memory access is permitted for the translation information address; A method is provided, comprising:

[0006] In another exemplary configuration, there is provided a computer program for controlling a host data processing apparatus that provides an instruction execution environment for executing target code, the computer program comprising: translation logic that performs a translation operation to generate a translated second memory address in a second memory address space as a translation of a first memory address in the first memory address space, the translation logic being configured to generate the translated second memory address according to translation information stored in one or more translation information addresses; authorization logic that performs, for a given second memory address, operations of detecting authorization information to indicate whether memory access is authorized for the given second memory address; access logic that permits access to data stored at the given second memory address if the permission information indicates that memory access to the given second memory address is permitted; A computer program is provided in which the access logic is configured to selectively permit access by the translation logic to the translation information address without the permission logic completing an operation of detecting permission information to indicate whether memory access is permitted for the translation information address.

[0007] Further respective aspects and features are defined by the appended claims. [Brief explanation of the drawings]

[0008] The present technology will now be further described, by way of example only, with reference to embodiments thereof illustrated in the accompanying drawings, in which: [Figure 1] 1 illustrates a schematic example of a data processing device; [Figure 2] 1 illustrates some areas in which the processing circuitry can operate. [Figure 3] 1 illustrates an example processing system that supports granular protection lookup. [Figure 4] 1 illustrates schematically the aliasing of several physical address spaces onto a system physical address space that identifies locations within a memory system. [Figure 5] An example is given of partitioning the effective hardware physical address space so that different architectural physical address spaces have access to respective portions of the system physical address space. [Figure 6] 1 illustrates a schematic diagram of data encryption and decryption. [Figure 7] 1 illustrates a schematic diagram of data encryption and decryption. [Figure 8] 1 illustrates a schematic diagram of one aspect of an exemplary memory management unit (MMU) operation. [Figure 9] 1 shows a schematic of a single stage MMU. [Figure 10] 1 shows a schematic of a two-stage MMU. [Figure 11] 10A and 10B (respectively) illustrate the operation of a two-stage MMU with granular protection operation and a single-stage MMU. [Figure 12] 10A and 10B (respectively) illustrate the operation of a two-stage MMU with granular protection operation and a single-stage MMU. [Figure 13] 1 illustrates a schematic of a single stage MMU with at least partial elimination of granule protection operations. [Figure 14] 1 illustrates a schematic diagram of a two-stage MMU with at least partial elimination of granule protection operations. [Figure 15] 10 illustrates a schematic of MMU operation with deferred granule protection operation. [Figure 16] 10 illustrates a schematic of MMU operation with deferred granule protection operation. [Figure 17] 1 is a schematic flow chart illustrating a method. [Figure 18] Examples of simulators that may be used are given below. DETAILED DESCRIPTION OF THE INVENTION

[0009] Before discussing the embodiments with reference to the accompanying drawings, the following embodiments will be described.

[0010] An exemplary embodiment is an apparatus comprising: a translation circuit that performs a translation operation to generate a translated second memory address in a second memory address space as a translation of a first memory address in the first memory address space, the translation circuit being configured to generate the translated second memory address in response to translation information stored in one or more translation information addresses; a permission circuit that performs, for a given second memory address, operations to detect permission information to indicate whether memory access is permitted for the given second memory address; an access circuit for accessing data stored at the given second memory address when the permission information indicates that memory access to the given second memory address is permitted; The apparatus provides an access circuit configured to selectively access a translation information address without the permission circuit completing an operation of detecting permission information for indicating whether memory access is permitted for the translation information address.

[0011] This disclosure recognizes that an operation, such as that performed by a translation circuit, e.g., a memory management unit or MMU, may itself involve many memory accesses. If permission information needs to be obtained before each of those accesses, obtaining the permission information can introduce significant overhead into generating the translation, especially if the permission information is also maintained in memory. This can be particularly problematic in the context of multi-stage MMUs.

[0012] In an exemplary configuration, in the absence of a process to obtain completed authorization information, access to at least some translation information, which is information used by the translation circuit to generate the translation (such as a so-called page table entry), is granted.

[0013] Such a configuration can help reduce the latency associated with obtaining memory address translations.

[0014] While these configurations are applicable to read and write operations by the translation circuit, in exemplary embodiments, it is noted that (a) the majority of the latency associated with obtaining the translation is generally associated with the read operation by the translation circuit, and (b) the preceding absence of a completed process for obtaining authorization information potentially poses a lower security risk if the configuration is limited to read operations by the translation circuit. Thus, in exemplary embodiments, the access circuit is configured to access the translation information address without the authorization circuit completing operations to detect authorization information if the access to that translation information address is associated with a read access, and the access circuit is configured to access the translation information address only if the authorization information indicates that memory access to the translation information address is authorized if the access to that translation information address is associated with a write access.

[0015] In some examples, the permission circuit is configured to perform a further operation to detect a storage type applicable to a given second memory address, the storage type being at least whether the first storage type or a second, different storage type is applicable to the given second memory address. For example, the access circuit may be configured to access a translation information address only if the storage type applicable to the translation information address is the first storage type, without the permission circuit completing an operation to detect permission information indicating whether memory access is permitted for that translation information address. This is particularly relevant when the first storage type is a storage type in which data stored at the given address is not altered by a read operation from the given address. For example, another storage type may be a storage type in which data stored at the given address is potentially altered by a read operation from the given address, e.g., a storage type associated with input / output circuitry, such as an address mapping to a register, such as a first-in, first-out (FIFO) register, in which a read operation alters the nature of the data read by a subsequent read operation.

[0016] In an exemplary configuration, the operation of detecting authorization information may be postponed, but in other examples may be omitted or eliminated. As an example of the case of at least partial elimination, the authorization circuitry is configured to not perform the operation of detecting authorization information for at least a portion of the translation information address. As a further measure to avoid security risks arising from proceeding without obtaining authorization information, the translation circuitry may be configured to not provide as output to circuitry external to the translation circuitry (or indeed to software executing on a processor accessing the translation circuitry) the translation information obtained from the translation information address for which the operation of detecting authorization information has not been completed.

[0017] The present disclosure is particularly applicable to translation circuitry that includes a hierarchy of translation information entries (e.g., so-called page table entries or PTEs) in which translation information applicable to the translation of a given first memory address is indicated by a preceding translation information entry with data representing the translation information address of the next translation information entry. In such a configuration, the data representing the translation information address of the next translation information entry can indicate at least a portion of the first memory address applicable to the next translation information entry, and the translation circuitry is configured to perform a translation operation to generate the respective translation information addresses.

[0018] Such a configuration may be useful in the context of postponing the acquisition of authorization information, for example in a configuration in which the authorization circuit is configured to postpone the initiation of operations for detecting authorization information for a next translation information entry until after the initiation of access to that next translation information entry.

[0019] The translation circuit may be operable with respect to memory access transactions, each memory access transaction being associated with a first memory address for translation, the translation circuit associating a translated second memory address with each memory access transaction, the permission circuit configured to perform operations to detect permission information related to the translated second memory address for each memory access transaction, and the access circuit configured to provide a result of accessing the translated second memory address for the memory access transaction only if access to the translated second memory address is permitted by the permission data.

[0020] In an exemplary configuration for operation of the translation circuit, the first memory address may include one of a virtual memory address and an intermediate physical address, and the second memory address may include a physical memory address.

[0021] The techniques are particularly suited for use with a memory having multiple memory partitions, each data memory partition associated with a partition identifier and having a respective range of physical addresses within a physical address space, wherein the authorization circuit may be configured to detect a zone identifier associated with the second memory address, the zone identifier selected from a plurality of zone identifiers, each zone identifier operative to indicate access authorization to a respective set of memory partitions, for at least one of the zone identifiers, the respective set of memory partitions including one or more subsets, but not all, of the memory partitions, and compare the detected zone identifier with the partition identifier associated with the second memory address.

[0022] As a further layer of security to prevent memory access from erroneous zone identifiers, the device can include encryption and decryption circuitry for encrypting data for storage by the memory and decrypting data retrieved from the memory, the encryption and decryption circuitry configured to apply a respective encryption and corresponding decryption of a set of encryptions and corresponding decryptions to each memory partition, the set of encryptions and corresponding decryptions being such that data encrypted to a given memory partition by the respective encryption of that memory partition cannot be decrypted by applying the decryption of another memory partition.

[0023] In an exemplary arrangement, the authorization circuitry is configured to associate with the translated second memory address data indicative of a district identifier associated with the translated second memory address.

[0024] The encryption and decryption operations may be configured such that the encryption and decryption circuitry applies decryption by applying a decryption selected according to data indicating a region identifier associated with the transformed second memory address to decrypt data retrieved from the memory at the transformed second memory address.

[0025] As a further measure to mitigate security risks arising from the use of memory accesses when operations to detect authorization information have not been completed, in the context of an apparatus comprising one or more cache memories for holding data retrieved from memory and / or data for storage in memory, the cache memories may be configured to associate a respective area identifier with each data item held by the cache memory, and the cache memories may be configured to prohibit access to the data item associated with a given area identifier in response to a memory access associated with data indicating a different area identifier.

[0026] As a further measure to mitigate security risks arising from the use of memory accesses when operations to detect authorization information have not been completed, the translation circuitry is configured to detect a translation failure for a given translation operation when use of the translation information by the translation circuitry does not provide a valid address translation, and in response to detecting the translation failure, the translation circuitry is configured to control the authorization circuitry to perform operations to detect authorization information for any translation information addresses accessed as part of the given translation operation.

[0027] In an exemplary embodiment, an apparatus comprises a processor that executes program instructions at a general exception level selected from a hierarchy of exception levels, each exception level being associated with a security privilege such that instructions executing at a higher exception level can access resources that are inaccessible to instructions executing at lower exception levels. The processor must execute instructions at the highest level of the exception level in order for the authorization circuitry to set data at which authorization information is detected.

[0028] Another exemplary embodiment is a method comprising: performing a translation operation to generate a translated second memory address in a second memory address space as a translation of the first memory address in the first memory address space, the translation operation including generating the translated second memory address in accordance with translation information stored in one or more translation information addresses; performing, for a given second memory address, an operation of detecting permission information to indicate whether memory access is permitted for the given second memory address; accessing data stored at the given second memory address if the permission information indicates that memory access to the given second memory address is permitted; and accessing the translation information address without the permission circuit completing an operation of detecting permission information for indicating whether memory access is permitted for the translation information address.

[0029] Another exemplary embodiment is a computer program for controlling a host data processing apparatus to provide an instruction execution environment for execution of target code, the computer program comprising: translation logic that performs a translation operation to generate a translated second memory address in a second memory address space as a translation of a first memory address in the first memory address space, the translation logic being configured to generate the translated second memory address according to translation information stored in one or more translation information addresses; authorization logic that performs, for a given second memory address, operations of detecting authorization information to indicate whether memory access is authorized for the given second memory address; access logic that permits access to data stored at the given second memory address if the permission information indicates that memory access to the given second memory address is permitted; A computer program is provided in which the access logic is configured to selectively permit access by the translation logic to the translation information address without the permission logic completing an operation of detecting permission information to indicate whether memory access is permitted for the translation information address.

[0030] Introduction - Controlling Access to Physical Address Space A data processing system may support the use of virtual memory, and address translation circuitry is provided to translate a virtual address specified by a memory access request into a physical address associated with a location in the memory system being accessed. The mapping between the virtual address and the physical address may be defined in one or more page table structures. Page table entries in the page table structures may also define certain access permission information that may control whether a given software process executing on the processing circuitry can access a particular virtual address.

[0031] In some processing systems, all virtual addresses may be mapped by address translation circuitry onto a single physical address space that is used by the memory system to identify locations in memory to be accessed. In such systems, control over whether a particular software process can access a particular address is provided solely based on a page table structure used to provide the virtual-to-physical address translation mapping. However, such page table structures may typically be defined by the operating system and / or hypervisor. Compromise of the operating system or hypervisor could result in a security breach that could allow an attacker to access sensitive information.

[0032] Thus, in some systems where certain processes need to be executed securely in isolation from other processes, the system may support operation in several regions, and several separate physical address spaces may be supported, and for at least some components of the memory system, memory access requests where a virtual address is translated to a physical address in a different physical address space are treated as if they were accessing an entirely different address in memory, even if the physical addresses in each physical address space actually correspond to the same location in memory. Isolating accesses to the separate physical address spaces from different operating regions of the processing circuitry, as is the case for some memory system components, can provide stronger security guarantees that are not dependent on page table permission information set by an operating system or hypervisor.

[0033] The processing circuitry may support processing within the root region involved in managing switching between other regions in which the processing circuitry may operate. Providing a dedicated root region for controlling switching may help maintain security by limiting the extent to which code executing in one region can trigger a switch to another region. For example, the root region may perform various security checks when a region switch is requested.

[0034] Thus, the processing circuitry may support processing being performed in one of at least three regions: a root region and at least two other regions. The address translation circuitry may translate a virtual address of a memory access performed from the current region to a physical address in one of a plurality of physical address spaces selected based on at least the current region.

[0035] The root physical address space may be exclusively accessible from the root region. Thus, when the processing circuitry is operating in one of the other regions, the processing circuitry may not be able to access the root physical address space. This improves security by ensuring that code running in one of the other regions cannot tamper with data or program code on which the root region relies to manage switching between regions or to control the rights the processing circuitry has in one of the other regions. Meanwhile, in an example, all of multiple physical address spaces may be accessible from the root region. Because code running in the root region must be trusted by any party that provides code operating in one of the other regions, and the code in the root region is responsible for switching to the particular region in which that party's code is running, the root region may essentially be trusted for access to any physical address space. Having all of the physical address space accessible from the root region allows functions such as transitioning memory areas into and out of regions, copying code and data into regions, and providing services to regions, for example, during boot.

[0036] Description of the Examples FIG. 1 schematically illustrates an example data processing system 2 having at least one requester device 4 and at least one completer device 6. An interconnect 8 provides communication between the requester device 4 and the completer device 6. A requester device can issue memory access requests requesting memory access to specific addressable memory system locations. The completer device 6 is a device responsible for processing memory access requests directed to it. Although not shown in FIG. 1, some devices may be capable of functioning as both a requester device and a completer device. The requester device 4 may include processing elements such as a central processing unit (CPU) or a graphics processing unit (GPU) or other master devices such as bus master devices, network interface controllers, display controllers, etc. The completer device may include a memory controller responsible for controlling access to corresponding memory storage units, a peripheral controller for controlling access to peripheral devices, etc. While FIG. 1 illustrates one example configuration of the requester device 4 in more detail, it should be understood that other requester devices 4 may have similar configurations. Alternatively, other requestor devices may have a different configuration than requestor device 4 shown on the left side of FIG.

[0037] Requester device 4 has processing circuitry 10 for performing data processing responsive to instructions by referencing data stored in registers 12. Registers 12 may include general-purpose registers for storing operands and results of processed instructions, as well as control registers for storing control data for configuring how processing is performed by the processing circuitry. For example, the control data may include a current domain indication 14 used to select which operating domain is the current domain, and a current exception level indication 15 indicating which exception level is the current exception level at which processing circuit 10 is operating.

[0038] Processing circuit 10 may be capable of issuing memory access requests specifying a virtual address (VA) that identifies an addressable location to be accessed and a region identifier (region ID or “security state”) that identifies the current region. Address translation circuit 16 (e.g., a memory management unit (MMU)) translates the virtual address into a physical address (PA) through one of many stages of address translation based on page table data defined in page table structures stored in the memory system. Translation lookaside buffer (TLB) 18 functions as a lookup cache to cache a portion of the page table information for faster access than if the page table information had to be fetched from memory each time an address translation was needed. In this example, in addition to generating a physical address, address translation circuit 16 also selects one of several physical address spaces associated with the physical address and outputs a physical address space (PAS) identifier that identifies the selected physical address space. PAS selection is discussed in more detail below.

[0039] Based on the translated physical address and the PAS identifier, the PAS filter 20 functions as a requester filtering circuit to determine whether the physical address is permitted to be accessed within the specified physical address space identified by the PAS identifier. This lookup is based on granule protection information stored in a granule protection table (GPT) structure stored within the memory system. The granule protection information may be cached within the granule protection information cache 22, similar to the caching of page table data within the TLB 18. The granule protection information restricts the physical address space within which a given physical address may be accessed, and based on this lookup, defines information that the PAS filter 20 uses to determine whether to allow a memory access request to proceed being issued to one or more caches 24 and / or the interconnect 8. If the specified PAS for a memory access request is not permitted to access the specified physical address, the PAS filter 20 may block the transaction and signal a fault.

[0040] The PAS filter may operate (in part) in response to a control signal (shown diagrammatically as signal 21) from the address translation circuitry, indicating that at least some checks or other actions by the PAS filter may or should be eliminated or postponed, as will be described in more detail below.

[0041] While Figure 1 shows an example of a system having multiple requestor devices 4, the features shown for the single requestor device on the left side of Figure 1 may also be included in systems where there is only one requestor device, such as a single-core processor.

[0042] While FIG. 1 shows an example in which the selection of a PAS for a given request is performed by the address translation circuit 16, in other examples, information for determining which PAS to select along with the PA can be output by the address translation circuit 16 to the PAS filter 20, which can select a PAS and verify whether the PA can be accessed within the selected PAS.

[0043] The provision of PAS filter 20 helps support a system that can operate in several operating domains, each associated with its own isolated physical address space, where, for at least a portion of the memory system (e.g., for some caches or coherency enforcement mechanisms such as snoop filters), separate physical address spaces are treated as if they refer to separate sets of addresses that identify entirely separate memory system locations, even if the addresses within those address spaces actually refer to the same physical location within the memory system. This can be useful for security purposes.

[0044] FIG. 2 shows examples of different operating states and domains in which processing circuitry 10 can operate, as well as examples of the types of software that may run at different exception levels and domains (it will, of course, be understood that the particular software installed on a system is selected by the party managing that system and is therefore not an essential feature of the hardware architecture).

[0045] The processing circuit 10 is capable of operating at several different exception levels 80, in this example four exception levels labeled EL0, EL1, EL2, and EL3, where EL3 refers to the most privileged exception level and EL0 refers to the least privileged exception level. It will be appreciated that other architectures may choose the reverse numbering, with the exception level with the highest number being considered to be the least privileged. In this example, the least privileged exception level EL0 is for application-level code, the next most privileged exception level EL1 is used for operating system-level code, the next most privileged exception level EL2 is used for hypervisor-level code that manages switching between several virtual operating systems, and the most privileged exception level EL3 is used for monitor code that manages switching between the respective domains and allocating physical addresses into the physical address space.

[0046] Thus, the processing circuit 10 is configured to execute program instructions at a general exception level selected from a hierarchy of exception levels, each exception level being associated with a security privilege such that instructions executed at a higher exception level can access resources that are inaccessible to instructions executed at a lower exception level. As explained below, the processing circuit must execute instructions at the highest level of the exception level (e.g., EL3) in order for the permission circuit or PAS filter 20 to set data for detecting permission information.

[0047] When an exception occurs at a particular exception level while processing software, for some types of exceptions, the exception is accepted to a higher (more privileged) exception level, and the particular exception level at which the exception is accepted is selected based on attributes of the particular exception that occurred. However, in some circumstances, other types of exceptions may be accepted at the same exception level as the exception level associated with the code that was being processed when the exception was accepted. When an exception is accepted, information characterizing the state of the processor at the time the exception was accepted can be saved, including, for example, the current exception level at the time the exception was accepted. Thus, once an exception handler is processed to address the exception, processing can return to the previous processing, and the saved information can be used to identify the exception level to which processing should return.

[0048] In addition to different exception levels, the processing circuit also supports several operating regions, including a root region 82, a secure (S) region 84, a less-secure region 86, and a realm region 88. For ease of reference, the less-secure region is described below as a “non-secure” (NS) region, although it will be understood that this is not intended to imply a particular level (or lack thereof) of security. Instead, “non-secure” simply indicates that the non-secure region is intended for code that is less secure than code operating in the secure region. The root region 82 is selected when the processing circuit 10 is at the highest exception level, EL3. When the processing circuit is at one of the other exception levels, EL0-EL2, the current region is selected based on a current region indicator 14, which indicates which of the other regions 84, 86, 88 is active. For each of the other regions 84, 86, 88, the processing circuit can be at either exception level, EL0, EL1, or EL2.

[0049] At power-up, some boot code (e.g., BL1, BL2, OEM boot) may execute within, for example, the more privileged exception levels EL3 or EL2. Boot code BL1, BL2 may be associated with, for example, the root region, and OM boot code may operate in the secure region. However, once the system is booted, during execution, processing circuitry 10 may be considered to operate in one of regions 82, 84, 86, and 88 at a time. Each of regions 82-88 is associated with its own associated physical address space (PAS). This allows for isolation of data from different regions within at least a portion of the memory system, as will be described in more detail below.

[0050] Non-secure region 86 may be used for normal application level processing and operating system and hypervisor activity for managing such applications. Thus, within non-secure region 86 there may be application code 30 running at EL0, operating system (OS) code 32 running at EL1, and hypervisor code 34 running at EL2.

[0051] The secure region 84 allows certain system-on-chip security, media, or system services to be isolated in a physical address space separate from the physical address space used for non-secure processing. The secure and non-secure regions are not equivalent in the sense that non-secure region code cannot access resources associated with the secure region 84. The secure region, on the other hand, can access both secure and non-secure resources. An example of a system that supports such a division of secure and non-secure regions 84, 86 is a system based on the TrustZone® architecture offered by Arm® Limited. The secure region can run trusted applications 36 at EL0, trusted operating systems 38 at EL1, and, optionally, a secure partition manager 40 at EL2. EL2, when secure partitioning is supported, can use two page tables to support isolation between different trusted operating systems 38 running within the secure region 84, in a manner similar to how the hypervisor 34 can manage isolation between virtual machines or guest operating systems 32 running within the non-secure region 86.

[0052] Extending systems to support secure domains 84 has become common in recent years because it allows a single hardware processor to support isolated secure processing and avoids the need for processing to occur on a separate hardware processor. However, as the use of secure domains has grown in popularity, many practical systems with such secure domains now support a relatively high degree of heterogeneity of services within the secure domain provided by a wide range of different software providers. For example, the code running within secure domain 84 may include different software providers, including (among other providers) silicon providers that fabricate integrated circuits, original equipment manufacturers (OEMs) that assemble integrated circuits provided by the silicon providers into electronic devices such as mobile phones, operating system vendors (OSVs) that provide operating systems 32 for devices, and / or cloud platform providers that manage cloud servers that support services for many different customers via the cloud.

[0053] However, there is a growing demand for providers of user-level code (which might typically be expected to run as applications 30 in non-secure world 86) to be provided with a secure computing environment that can be trusted not to leak information to other parties running code on the same physical platform. It may be desirable for such a secure computing environment to be dynamically allocable during runtime and to be guaranteed and provable, allowing users to verify whether sufficient security guarantees are provided on the physical platform before entrusting the device with processing potentially sensitive code or data. Users of such software may not want to trust providers of feature-rich operating systems 32 or hypervisors 34 that might typically run in non-secure world 86 (or, even if those providers themselves are trustworthy, users may want to protect themselves from unauthorized access to the operating systems 32 or hypervisors 34 by attackers). While secure world 84 can be used for such user-provided applications requiring secure processing, in practice this creates problems for both users who provide code requiring a secure computing environment and providers of existing code running in secure world 84. For providers of existing code running in secure area 84, the attack surface for potential attacks against their code increases with the addition of arbitrary user-provided code within the secure area. This may be undesirable, and users may therefore be strongly discouraged from allowing code to be added to secure area 84. On the other hand, users who provide code that requires a secure computing environment may be reluctant to trust access to their data or code to all of the different code providers running in secure area 84, as it may be difficult to audit and certify all of the separate code provided by different software providers running in secure area 84 if assurances and certifications of the code running in a particular area are required as a prerequisite for the user-provided code to perform operations.This may limit opportunities for third parties to offer more secure services.

[0054] Thus, as shown in FIG. 2, an additional realm 88, called a realm realm, is provided and can be used by such user-introduced code to provide a secure computing environment orthogonal to any secure computing environment associated with components operating in the secure realm 24. In the realm realm, the executing software can include several realms, each of which can be isolated from other realms by a realm management module (RMM) 46 operating at exception level EL2. The RMM 46 can control the isolation between the respective realms 42, 44 executing in the realm realm 88 by defining access permissions and address mappings within page table structures, for example, similar to how the hypervisor 34 manages the isolation between different components operating in the non-secure realm 86. In this example, the realms include an application-level realm 42 running at EL0 and an encapsulated application / operating system realm 44 running across exception levels EL0 and EL1. It will be appreciated that supporting both EL0 and EL0 / EL1 type realms is not required, and multiple realms of the same type can be established by the RMM 46.

[0055] The realm region 88 has its own physical address space assigned to it, just like the secure region 84. However, the realm region is orthogonal to the secure region 84 in the sense that while the realm region and the secure region 88, 84 each have access to the non-secure PAS associated with the non-secure region 86, the realm region 88 and the secure region 84 do not have access to each other's physical address space. This means that code running in the realm region 88 and the secure region 84 have no dependencies on each other. Code within the realm region only needs to trust the hardware, the RMM 46, and the code running in the root region 82, which manages switching between regions, meaning that attestation and certification are more feasible. Attestation allows given software to request verification that code installed on a device matches certain expected characteristics. This can be done by checking whether a hash of program code installed on the device matches an expected value signed by a trusted party using a cryptographic protocol. The RMM 46 and monitor code 29 may be attested by, for example, checking whether a hash of this software matches an expected value signed by a trusted party, such as the silicon provider that manufactured the integrated circuit that includes the processing system 2, or the architecture provider that designed the processor architecture that supports region-based memory access control. This allows the user-provided code 42, 44 to verify that the integrity of the region-based architecture can be trusted before performing any secure or sensitive functions.

[0056] Thus, as shown by the dotted lines indicating gaps in the non-secure realm where these processes would previously have executed, it can be seen that code associated with realms 42, 44 that would previously have executed in the non-secure realm 86 can now be moved to the realm realm where they may have stronger security guarantees because their data and code cannot be accessed by other code running in the non-secure realm 86. However, due to the fact that the realm realm 88 and the secure realm 84 are orthogonal and therefore cannot see each other's physical address space, this means that providers of code in the realm realm do not need to trust providers of code in the secure realm, and vice versa. Code in the realm realm can simply trust the firmware that provides the root realm 82 and the monitor code 29 of the RMM 46, which may be provided by the silicon provider or the provider of the instruction set architecture supported by the processor. These providers may need to be inherently trusted from the start when code is running on their device, so that no additional trust relationships with other operating system vendors, OEMs, or cloud hosts are required by users in order for them to be provided with a secure computing environment.

[0057] This is useful for a variety of purpose applications and use cases, including, for example, mobile wallet and payment applications, fraud and piracy prevention mechanisms in games, operating system platform security extensions, secure virtual machine hosting, confidential computing, networking, or gatewaying for the Internet of Things. Users will appreciate that they may find many other applications in which Realm support is useful.

[0058] To support the security assurances provided to a Realm, a processing system may support attestation reporting capabilities, whereby firmware images and configurations, e.g., monitor code images and configurations, or RMM code images and configurations, are measured at boot time or runtime. At runtime, the contents and configurations of a Realm are measured, allowing a Realm Owner to trace back relevant attestation reports to known implementations and assurances and make trust decisions about whether to run on that system.

[0059] As shown in FIG. 2, a separate root region 82 is provided to manage region switching, with the root region having its own isolated root physical address space. Creating a root region and isolating resources from the secure region allows for a more robust implementation, even in systems with only non-secure and secure regions 86 and 84 and no realm region 88, but it can also be used in implementations that support the realm region 88. The root region 82 can be implemented using monitor software 29 provided (or certified) by the silicon provider or architecture designer and can be used to provide secure boot functionality, trusted boot measurements, system-on-chip configuration, debug control, and firmware update management for firmware components provided by other parties, such as the OEM. Code in the root region can be developed, certified, and deployed by the silicon provider or architecture designer without dependency on the final device. In contrast, the secure region 84 can be managed by the OEM to implement specific platform and security services. Management of the non-secure realm 86 may be controlled by the operating system 32, which provides operating system services, while the realm realm 88 is mutually isolated from existing secure software environments in the secure realm 84 while allowing the development of new forms of trusted execution environments that may be dedicated to user or third-party applications.

[0060] FIG. 3 schematically illustrates another example of a processing system 2 for supporting these techniques. Elements that are the same as in FIG. 1 are designated by the same reference numerals. FIG. 3 illustrates address translation circuitry 16 in greater detail, including a stage 1 memory management unit 50 and a stage 2 memory management unit 52. Stage 1 MMU 50 can be involved in translating either virtual addresses to physical addresses (if the translation is triggered by EL2 or EL3 code) or to intermediate addresses (if the translation is triggered by EL0 or EL1 code, with further stage 2 translation by Stage 2 MMU 52 being necessary). Stage 2 MMU can translate the intermediate addresses to physical addresses. Stage 1 MMU can be based on page tables controlled by the operating system for translations starting from EL0 or EL1, page tables controlled by the hypervisor for translations from EL2, or page tables controlled by monitor code 29 for translations from EL3. Stage 2 MMU 52, on the other hand, can be based on page table structures defined by the hypervisor 34, RMM 46, or secure partition manager 14, depending on which region is being used. Separating the translation into two stages in this manner allows operating systems to manage address translation for themselves and for applications, assuming they are the only operating systems running on the system, while RMM 46, hypervisor 34, or SPM 40 can manage isolation between different operating systems running within the same realm.

[0061] 3, the address translation process using address translation circuitry 16 can return security attributes 54 that, in combination with the current exception level 15 and the current region 14 (or security state), allow a particular section of physical address space (identified by a PAS identifier or "PAS TAG") to be accessed in response to a given memory access request. This provides an example of permission circuitry 20 configured to associate, with a translated second memory address, data (PAS TAG) that indicates a region identifier associated with the translated second memory address.

[0062] The physical address and PAS identifier can be looked up in a granular protection table 56, which provides the granular protection information described above. In this example, the PAS filter 20 is shown as a granular memory protection unit (GMPU) that verifies whether the selected PAS can access the requested physical address, and if so, allows the transaction to be passed to any cache 24 or interconnect 8 that is part of the system fabric of the memory system.

[0063] The GMPU 20 allows memory to be allocated to separate address spaces while at the same time providing strong hardware-based isolation guarantees, providing spatial and temporal flexibility in how physical memory is allocated to these address spaces, as well as an efficient sharing scheme. As previously mentioned, the execution units in the system are logically divided into virtual execution states (regions or "worlds"), with one execution state (root world) located at the highest exception level (EL3), called the "root world," and the root world manages the allocation of physical memory to these worlds.

[0064] A single system physical address space is virtualized into multiple "logical" or "architectural" physical address spaces (PAS), where each such PAS is an orthogonal address space with independent coherency properties. A system physical address is mapped into a single "logical" physical address space by extending it with a PAS tag.

[0065] A given world is allowed access to a subset of the logical-physical address space. This is enforced by a hardware filter 20 that can be attached to the output of the memory management unit 16.

[0066] The world defines the security attributes (PAS tags) of the access using fields in the translation table descriptor of the page table used for address translation. The hardware filter 20 has access to a table (Granule Protection Table 56, or GPT) that defines granule protection information (GPI) for each page in the system physical address space, which indicates the PASTAG with which it is associated, and (optionally) other granule protection attributes.

[0067] In some examples, so-called Level 0 (L0) GPT checks and Level 1 (L1) GPT checks are provided. The L0 information indicates the memory type associated with the PA and, at a minimum, whether so-called side effects can potentially occur on a read access. For example, in the case of a PA assigned to an I / O device (which may provide data for a read from a first-in-first-out (FIFO) or other register), an operation reading data from that PA can modify the data provided in response to a subsequent read by retrieving a data item from the FIFO register, such that the retrieved data is no longer present for access by the subsequent read operation. On the other hand, a read of data from DRAM generally does not suffer from such side effects and does not modify the data read by a subsequent operation on the same PA.

[0068] Therefore, the L0GPT check can be used (as a useful added benefit) to detect whether such side effects are potentially experienced. If the answer is "no," then the initiation of a read operation at a particular PA poses no direct risk to the integrity of the data at that PA.

[0069] Because the L0GPT information underlying the check can be relatively coarse-grained, e.g., having a 1 GB granularity, the size of the L0GPT data referenced as part of the L0GPT check can be relatively small (potentially one data item per GB of physical address space), which allows the L0GPT data to be cached relatively easily and allows the L0GPT check to be performed with relatively little impact on the latency of the processes described below.

[0070] Generally speaking, performing the L0GPT check is one example of the permission circuit (e.g., GMPU) performing further operations to detect a storage type applicable to a given second (e.g., physical) memory address, where the storage type is at least whether the first storage type or a second, different storage type is applicable to the given second memory address. For example, the first storage type may be a storage type in which data stored at the given address is not modified by a read operation from the given address (i.e., a storage type that is not subject to "side effects" as described above).

[0071] The L1 GPT check can provide, for example, permission information and PAS tags.

[0072] The hardware filter 20 checks the world ID and security attributes for the GPI of the granule to determine whether access can be granted, thus forming a Granular Memory Protection Unit (GMPU).

[0073] GPT56 can reside, for example, in on-chip SRAM or off-chip DRAM. If stored off-chip, GPT56 can be integrity protected by an on-chip memory protection engine, which can use encryption, integrity, and freshness mechanisms to maintain the security of GPT56.

[0074] Locating GMPU 20 on the requester side of the system (e.g., on the MMU output) rather than on the completer side allows Interconnect 8 to assign access permissions at page granularity while allowing continuous hashing / striping of pages across multiple DRAM ports.

[0075] The transaction remains tagged with the PAS TAG as it propagates throughout the system fabric 24, 8 until it reaches a location defined as the physical aliasing point 60. This allows filtering to be placed on the master side (requester side) without weakening security guarantees compared to slave-side (completer-side) filtering. As the transaction propagates throughout the system, the PAS TAG can be used as a security mechanism in-depth for address isolation. For example, a cache can add the PAS TAG to an address tag in the cache to prevent accesses made with an incorrect PAS TAG to the same PA from hitting the cache, thereby improving side-channel resistance. The PAS TAG can also be used as a context selector for a protection engine attached to a memory controller that encrypts data before it is written to external DRAM. An example of such a protection engine is described below.

[0076] The Point of Physical Aliasing (PoPA) is the location in the system where the PAS TAG is stripped and addresses change from logical physical addresses back to system physical addresses. The PoPA can be located below the cache on the completer side of the system, where accesses to physical DRAM are made (using the cryptographic context resolved via the PAS TAG). Alternatively, it may be located above the cache to simplify system implementation at the expense of weakened security.

[0077] At any point, a world can request that a page be transitioned from one PAS to another. The request is made at EL3 to monitor code 29, which examines the current state of the GPI. EL3 may allow only a specific set of transitions to occur (e.g., non-secure PAS to secure PAS, but not realm PAS to secure PAS). To provide a clean transition, a new instruction, "Delete Data and Invalidate to Physical Aliasing Point," is supported by the system and can be submitted by EL3 before transitioning the page to the new PAS. This ensures that any residual state associated with the previous PAS is flushed from any caches upstream of PoPA 60 (closer to the requester).

[0078] Another property that can be achieved by attaching the GMPU 20 to the master side is efficient sharing of memory between worlds. It may be desirable to allow a subset of N worlds shared access to a physical granule while preventing other worlds from accessing it. This can be achieved by adding a "limited sharing" semantic to the granule protection information and enforcing it to use a specific PAS TAG. As an example, a GPI can indicate that a physical granule can only be accessed by the "realm world" 88 and the "secure world" 84 while tagged with the PAS TAG of the secure PAS 84.

[0079] The example properties above result in rapid changes in the visibility characteristics of a particular physical granule. Consider the case where each world is assigned a private PAS accessible only to that world. For a particular granule, a world can request that it become visible to the non-secure world at any time, without changing its PAS association, by changing its GPI from "exclusive" to "limitedly shared with non-secure world." In this way, the visibility of that granule can be increased without requiring costly cache maintenance or data copy operations.

[0080] The apparatus of FIG. 1 or FIG. 3 may be implemented as a so-called system on a chip (SoC), a so-called network on a chip (NoC), or as individual components in various respective examples.

[0081] 4 illustrates the concept of aliasing the respective physical address spaces on the physical memory provided in the hardware. As previously mentioned, each of the regions 82, 84, 86, 88 has its own respective physical address space 61.

[0082] At the time a physical address is generated by address translation circuitry 16, the physical address has a value within a particular numeric range 62 supported by the system, which is the same regardless of which physical address space is selected. However, in addition to generating the physical address, address translation circuitry 16 may also select a particular physical address space (PAS) based on information in the current region 14 and / or the page table entry used to derive the physical address. Alternatively, instead of address translation circuitry 16 performing the PAS selection, the address translation circuitry (e.g., an MMU) can output a physical address and information derived from a page table entry (PTE) that is used to select the PAS, and this information can then be used by the PAS filter or GMPU 20 to select the PAS.

[0083] The selection of a PAS for a given memory access request may be limited depending on the current domain in which processing circuit 10 operates when issuing the memory access request, according to the rules defined in the table below.

[0084] [Table 1]

[0085] For regions where there are multiple physical address spaces available to choose from, information from the accessed page table entry used to provide the physical address is used to select between the available PAS options.

[0086] Thus, by the time the PAS filter 20 outputs a memory access request to the system fabric 24, 8 (assuming it passes any filtering checks), the memory access request is associated with a physical address (PA) and a selected physical address space (PAS).

[0087] From the perspective of memory system components (caches, interconnects, snoop filters, etc.) operating before the physical aliasing (PoPA) point 60, each physical address space 61 is seen as an entirely separate address range corresponding to a different system location in memory. This means that from the perspective of the pre-PoPA memory system components, the address range identified by a memory access request is actually four times the size of the range 62 that may be output in the address translation. This is because the PAS identifier is effectively treated as additional address bits alongside the physical address itself, so that the same physical address PAx may be mapped to several aliased physical addresses 63 within the separate physical address spaces 61, depending on the PAS selected. These aliased physical addresses 63 all actually correspond to the same memory system location implemented in physical hardware, but the pre-PoPA memory system components treat the aliased addresses 63 as separate addresses. Therefore, if there is a pre-PoPA cache or snoop filter that allocates entries to such addresses, the aliased addresses 63 will be mapped to different entries with separate cache hit / miss determinations and separate coherency management. This reduces the likelihood or effectiveness of an attacker using cache or coherency side channels as a mechanism to probe the behavior of other domains.

[0088] The system may include two or more PoPAs 60 (eg, as shown in FIG. 14, discussed below).

[0089] In each PoPA 60, the aliased physical addresses are folded into a single unaliased address 65 within the system physical address space 64. The unaliased address 65 is provided to any post-PoPA components downstream, so that the system physical address space 64 that actually identifies a memory system location is again the same size as the range of physical addresses that can be output in the address translation performed on the requester side. For example, in PoPA 60, the PAS identifier can be stripped from the address, and for downstream components, the address can be identified simply using the physical address value without specifying a PAS. Alternatively, if some completer-side filtering of memory access requests is desired, the PAS identifier can still be provided downstream of PoPA 60, but it may not be interpreted as part of the address. As a result, the same physical address appearing in different physical address spaces 60 will be interpreted downstream of the PoPA to point to the same memory system location. However, the provided PAS identifier can still be used to perform completer-side security checks.

[0090] 5 illustrates how system physical address space 64 can be divided into chunks allocated for access within a particular architectural physical address space 61 using a granule protection table 56. Granule protection table (GPT) 56 defines which portions of system physical address space 65 are accessible from each architectural physical address space 61. For example, GPT 56 may contain several entries, each corresponding to a particular size granule of physical addresses (e.g., 4K pages), and may define the granule's assigned PAS, which may be selected from among non-secure, secure, realm, and root regions. By design, if a particular granule or set of granules is assigned to a PAS associated with one of the regions, it can only be accessed within the PAS associated with that region and cannot be accessed within the PASs of other regions. However, note that even though granules allocated to (for example) the secure PAS are not accessible from within the root PAS, root region 82 can still access that granule of physical addresses by specifying PAS selection information in its page table to ensure that virtual addresses associated with pages mapped to that area of ​​physically addressed memory are translated to physical addresses in the secure PAS instead of the root PAS. Thus, data sharing between regions (to the extent permitted by the accessibility rules defined in the table above) can be controlled at the time of selecting a PAS for a given memory access request.

[0091] However, in some implementations, in addition to enabling access to granules of physical addresses within the assigned PAS defined by the GPT, the GPT can use other GPT attributes to mark a region of address space (e.g., an address space associated with a region of lower or orthogonal privilege that would not normally be permitted to select the assigned PAS for access requests for that region) as shared with another address space. This can facilitate temporary sharing of data without having to change the assigned PAS for a given granule. For example, in FIG. 5 , realm PAS region 70 is defined in the GPT to be assigned to the realm region and is normally inaccessible from non-secure region 86 because non-secure region 86 cannot select the realm PAS for its access requests. Because non-secure region 26 does not have access to the realm PAS, non-secure code would not normally be able to see data in region 70. However, if a realm wishes to temporarily share some of its data in an allocated region of memory with a non-secure region, it can request that monitor code 29 running in root region 82 update GPT 56 to indicate that region 70 is shared with non-secure region 86, thereby making region 70 accessible to the non-secure PAS shown on the left side of Figure 5 without having to change which regions are allocated to region 70. This may improve performance because the operations to assign a different region to a particular memory region may be more performance intensive and involve a higher degree of cache / TLB invalidation and / or data zeroing in memory or copying data between memory regions. This may not be justifiable if the sharing is expected to be only temporary.

[0092] Thus, the configuration of Figure 5 provides one example of a memory having multiple memory partitions, each data memory partition associated with a partition identifier and having a respective range of physical addresses within the physical address space.

[0093] The GMPU, which is an example of a permission circuit, performs the following operations to detect permission information: detecting a zone identifier (e.g., a PAS TAG) associated with the second memory address, the zone identifier selected from a plurality of zone identifiers, each zone identifier operative to indicate access permissions to a respective set of memory partitions, and for at least one of the zone identifiers, the respective set of memory partitions including one or more subsets, but not all, of the memory partitions; The detected area identifier is configured to compare with a partition identifier (eg, a PAS identified by the translation circuit) associated with the second memory address.

[0094] Protection Engine 6 and 7 provide a schematic example of a so-called protection engine that may be associated with physical memory 600.

[0095] The protection engine provides encryption and decryption circuitry for encrypting data for storage by memory 600 and for decrypting data retrieved from memory 600. The encryption and decryption circuitry is configured to apply each encryption and corresponding decryption of a set of encryptions and corresponding decryptions to PASs in different realms, such that data encrypted in a given realm or memory partition by that realm's respective encryption cannot be decrypted by applying a decryption of another realm.

[0096] The protection engine may utilize the PAS tag to apply encryption to encrypt data stored in memory and decryption to decrypt data retrieved from memory at the translated second (physical) memory address by applying encryption and decryption selected according to the PAS tag (data indicating an area identifier) ​​associated with that physical memory address.

[0097] Referring to FIG. 6, a respective encryption / decryption circuit 610, 612, 614, 616 is provided for each realm, and a control / selection circuit 620 selects the appropriate one of the encryption / decryption circuits in response to the PAS tag associated with a particular memory access transaction.

[0098] In FIG. 7, a single encryption / decryption circuit 700 is provided, where a control circuit 710 sets parameters such as encryption / decryption keys and / or encryption / decryption algorithms or algorithm characteristics according to the PAS tag.

[0099] The effect of using a protection engine is to add an additional layer of security to the other measures provided herein.

[0100] TLB operation overview As mentioned above, memory management unit 16 may be associated with a translation lookaside buffer (TLB) 18. The operation of this arrangement is illustrated by the simplified flowchart of Figure 8, where, in step 800, MMU 16 receives a translation request. In step 810, MMU 16 detects whether the required translation is present in TLB 18. If not, in step 820, MMU 16 obtains the required translation using techniques described below and stores it in the TLB.

[0101] Either after step 820 or after a "yes" result from step 810, in step 830 the translation request is serviced from data stored by the TLB.

[0102] MMU operation overview Address translation is performed between a first memory address (e.g., a virtual address, VA) and a second memory address (e.g., a physical address, PA, or an intermediate physical address, IPA), and can utilize a process called a page table walk (PTW). The process involves referencing so-called page tables that store translation information. Page tables are provided as a hierarchy of page tables, so that an accessed entry in a first page table provides a pointer to the associated next translation information entry in the next page table.

[0103] Thus, in an example, a first (input) memory address to the translation process may include one of a virtual memory address and an intermediate physical address, and a second (output) memory address from the process includes either the intermediate physical address or the physical memory address.

[0104] More specifically, the PTW process involves traversing a hierarchical set of so-called page tables to arrive at the translation for a particular VA. For single-stage memory translations, the output may be a PA. For multi-stage memory address translations, the process can be significantly more complex. Because the PA is required to access the page table itself, each access of the next table in the hierarchy may require a translation stage itself to obtain the PA of the next required table.

[0105] An example of a so-called single-stage memory address translation is shown schematically in Figure 9, where a first memory address is a virtual address (VA) 900 and a second memory address is a so-called physical memory address (PA). The effective TLB entry 910 generated by the process of Figure 9 represents a mapping between at least the VA 900 and the translated PA. The mapping may be represented on a page or other memory area basis, such that a single mapping stored in the TLB as TLB entry 910 maps a set of contiguous virtual addresses to a corresponding set of contiguous physical addresses, for example, mapping a page (e.g., a 4k memory address) to a corresponding page of physical addresses.

[0106] The address of the first page table in the hierarchy is provided by a register "Translation Table Base Register" (TTBR). The location of a first translation information entry 930 is provided by at least a portion of the memory address defined by the TTBR and at least a portion of the VA 900 to be translated. These two components constitute the address 920 of the first translation information entry L0[VA] 930. Retrieving this first translation information entry 930 provides address information that can be combined with further bits of VA 900 to generate an address 935 for accessing the next translation information entry 940. Again, the data stored in that translation information entry concatenated with the further bits of VA 900 provides an address 945 of entry 950. The translation information stored in entry 950 concatenated with the further bits of VA 900 provides an address 955 of a final translation information entry 960, and the data stored in entry 960 is concatenated with the final bits of VA 900 to form the valid TLB entry 910.

[0107] As an example, the VA that needs to be converted is formed as a 48-bit value, with different parts of the VA being used at different stages of the PTW process.

[0108] To obtain the first entry in the page table hierarchy, the base address stored in the TTBR is obtained. The first part of the VA, e.g., the 9 most significant bits, is added to the base address as an offset to provide the address of the entry in the L0 table. This lookup provides the base address of the L1 table.

[0109] In the second iteration, a further portion of the VA, for example the next 9 bits [38:30] of the VA, forms an offset from the base address of the L1 table to provide the address of an entry in the L1 table.

[0110] This process is repeated, for example, using the next offset portion bits [29:21] and bits [20:12] for L2 and L3 table accesses. Finally, the page table entry in the L3 table provides the page address and potentially some access permissions related to the physical memory page. The remaining portion of the VA, for example, the least significant 12 bits [11:0], provides the page offset within the memory page defined by that last page table entry, while in an exemplary system that stores information as contiguous 4-byte (e.g., 32-bit) portions, portion [11:2] may provide the offset needed to address the appropriate 32-bit word.

[0111] A page table entry may also provide an indication of whether the page has been written (a so-called "dirty bit"), an indication of when the page was last used (an "access bit") to allow cache eviction etc., and optionally other parameters.

[0112] Using a page table in this manner provides an example where translation information applicable to the translation of a given first memory address includes a hierarchy of translation information entries, where data representing a translation information address of a next translation information entry is indicated by a preceding translation information entry. For example, data representing a translation information address of a next translation information entry can indicate a first memory address applicable to the next translation information entry, and the translation circuitry can be configured to perform a translation operation to generate the respective translation information addresses.

[0113] Two-stage MMU overview In so-called two-stage MMUs, the VA is still translated to a PA, but this is via a two-stage process where the VA is translated to a so-called intermediate physical address (IPA), which is then translated to the required PA. The TTBR_E1 lookup and stage 1 MMU page table lookup provide the IPA, not the PA, and each of these IPAs must undergo stage 2 translation even to find the next page table entry.

[0114] Two-stage MMUs are used for a variety of reasons, including to provide further isolation between a processing element and / or processes running on that processing element and the physical memory provided by the system as a whole. For example, the translation from VA to IPA may follow a page table (translation information entry) established by and controlled by the operating system at a first security level, such as so-called Exception Level 1 (EL1). The translation from IPA to PA can be handled more securely and under the control of a so-called hypervisor at a higher security or exception level, such as EL2 in the hierarchy of exception levels, such that operations at EL1 cannot access system resources associated with EL2.

[0115] One advantage of this configuration is that each individual stage, as shown in FIG. 9, requires a further translation from IPA to PA, represented by the translation table base register TTBR_EL1, to access the next translation information entry in physical memory.

[0116] Thus, referring to Figure 10, upon receiving a VA 1000 for a translation, a stage 1 TTBR entry 1010 is accessed at EL1. This yields the IPA of the first translation information entry 1020. However, this IPA 1010 must be translated to a PA 1015 by the stage 2 MMU in order to access the entry 1020 in physical memory. The translation to PA involves looking up the stage 2 TTBR at EL2 and performing a multi-stage page table walk to generate information 1015 that, when combined with the bits of VA 1000, provides the complete physical address of the next translation table entry 1020. A similar process is required for each level in the hierarchy of page table accesses to generate a valid TLB entry 1030.

[0117] Two-stage MMU with GPT checks Referring now to FIG. 11, a sequence of operations is shown such that permission information is included in the two-stage MMU obtained by the GMPU in two-stage GMPU operations L0GPT and L1GPT for each physical address access.

[0118] Given that each operation shown in FIG. 11 requires a memory access, namely the table lookup for the VA conversion, the table lookup for the IPA conversion, and the permission lookup by the GMPU, the number of accesses involved in the process of FIG. 11 can be significant.

[0119] Note that in Figure 11 and in some further examples described below, the checking GMP is referred to as a "Stage 3 GMPU," a term that indicates that it follows the final stage of MMU translation, even in the case of a single-stage MMU.

[0120] Single-stage MMU with GPT checks In a similar configuration, but with a single stage MMU, shown schematically in Figure 12, each of the TTBR access and four page table accesses potentially requires two additional memory accesses to the L0GPT and L1GPT.

[0121] Memory Access Cost Assuming a "cold" (initially empty) TLB, estimates of the number of memory accesses required can be derived for various configurations. In the examples below, a working assumption is made that the page table has four levels, but it should be noted that the present embodiment is applicable to a variety of different depths or number of levels of page table structures (costs are still total costs for the exemplary embodiments of the present disclosure, but may vary upwards for more levels or downwards for fewer levels). A relevant diagram for a four-level page table structure is as follows:

[0122] [Table 2]

[0123] Complete or partial removal and / or postponement of GMPU checks for MMU access In an exemplary embodiment, for certain operations by the MMU, at least some of the GMPU checks may be omitted or "eliminated." In other examples, at least some of the GMPU checks may be postponed. In either case, the results of the operation may be used before the corresponding GMPU check is completed, either because its initiation was postponed or because it was not initiated.

[0124] For example, as described in the embodiments described below, elimination and / or deferral may be performed for some but not all accesses (i.e., may be performed selectively). This may be requested or indicated by the MMU, for example, using control signals 21, or may be controlled by the GMPU according to what type of memory access is being initiated by the MMU (which may also, optionally, make control information available via connection 21). Thus, in such an example, the access circuitry may selectively allow access even if the GMPU check (full or partial) has not been completed.

[0125] In an example of deferring, the authorization circuitry may be configured to postpone initiation of operations to detect authorization information for a next translation information entry until after initiation of access to the next translation information entry.

[0126] In at least some examples, these operations relate to a translation information read operation by an MMU, or at least a portion of such a read operation, which provides examples of access circuitry configured to access the translation information address without the permission circuit completing operations to detect permission information if the access to the translation information address is associated with a read access, and the access circuitry configured to access the translation information address if the access to the translation information address is associated with a write access only if the permission information indicates that memory access to the translation information address is permitted.

[0127] As background to the description of these exemplary embodiments, it should be noted that the MMU does not actually need the information provided by the GMPU from the GPT to form the correct page table accesses. Techniques relating to this aspect are described below.

[0128] The MMU hardware itself can be trusted to ensure that stored contents read by the MMU are not visible to the host or other software, i.e., individual instances of translation information are used only within the MMU and are not provided as output to external hardware or indeed software. In the case of (at least partial) removal of GPT checks, this can provide an example where the authorization circuit is configured to not perform operations to detect authorization information for at least some of the translation information addresses, and the translation circuit is configured to not provide as output to circuitry external to the translation circuit translation information obtained from translation information addresses for which operations to detect authorization information have not been completed.

[0129] Note that the primary performance impact caused by the number of memory accesses in the arrangements shown in Figures 11 and 12 relates to read operations by the MMU. While write operations by the MMU are somewhat common (e.g., writing to the accessed or dirty bits of a page descriptor in a page table), at least principled evictions of the type described herein can be applied to write operations as well as read operations, but the evictions are restricted to read operations. This has the potential advantage that the security risk in allowing a particular MMU read operation to proceed without completing GMPU checks is perceived to be somewhat lower than the security risk associated with allowing the MMU to write data without completing appropriate GMPU checks. Thus, in at least the exemplary embodiment, all writes to memory, whether initiated by the MMU or any other aspect of the overall system, are constrained to be allowed only if verified by a complete GMPU checking configuration.

[0130] Security Features To avoid or at least mitigate security risks by enabling removal and / or postponement of GMPU checks of MMU read accesses of translation information, the following security features may be provided by the hardware design. (a) External hardware and software cannot directly access data read by the MMU. In other words, any data value read into the MMU is guaranteed to remain private within the MMU (in an exemplary embodiment). Other exemplary measures that may optionally be applied (individually or collectively) are: (b) translation faults and the like are fully addressed, and any granule protection faults that occur with respect to page table (translation information) accesses are reported to processes executing in EL3. This provides an example in which the translation circuitry is configured to detect a translation fault with respect to a given translation operation when use of the translation information by the translation circuitry does not provide a valid address translation, and in response to detecting the translation fault, the translation circuitry is configured to control the permission circuitry to perform operations to detect permission information with respect to any translation information addresses accessed as part of the given translation operation. (c) Memory encryption and decryption may be in place, e.g., with separate keys and / or algorithms per world or realm, e.g., by the techniques of Figure 6 or Figure 7. This can mitigate so-called side-channel analysis of the transformation behavior. (d) The page table walk process is prohibited from read access to the I / O address space. This can be achieved by removing only some of the GMPU checks but retaining some of the GMPU checks related to the memory type associated with each address, for example, by providing the L0GPT check but removing or postponing the L1GPT check, so that MMU accesses are only permitted to memory areas that are free of the "side effects" described above. An example of this technique is described below. (e) Restrict deletion and / or postponement to MMU read accesses (i.e., provide full GMPU checking for write accesses by the MMU).

[0131] Cache and Memory Access With respect to cache storage in the example cache 24 above, for example, an attempt to access a secure cache line using a non-secure PAS tag will not even observe the PA in the cache.

[0132] If data is written to the cache using an "incorrect" PAS, it is benign and cannot subsequently be accessed or written back to main memory. Instead, it simply remains in the cache until it is overwritten by periodic cache management and eviction policies operated by the cache itself.

[0133] An additional level of security is provided by the encryption arrangement mentioned earlier and in point (c) above, which uses memory encryption associated with each PAS such that if the "wrong" PAS tag is associated with a PA, an attempt may be made to decrypt the memory contents at a particular address, but the attempt will fail.

[0134] These arrangements provide examples of a cache memory associating a respective area identifier with each data item held by the cache memory, the cache memory being configured to prohibit access to a data item associated with a given area identifier in response to a memory access associated with data indicating a different area identifier.

[0135] Example - Single stage, removing L1GPT check In Figure 13, for each proposed access to a PA, a Level 0 GPT check (L0GPT) is performed to detect the memory area type, as described above, and in particular whether the memory area is associated with an I / O device or memory that can be read without any "side effects" on the read operation itself that would change the data stored at that address.

[0136] As mentioned above, the GPT data required for this particular check may be relatively compact, e.g., one data item per GB, and so in an exemplary configuration is cached either in a custom cache maintained by the MMU or in a system cache so that the performance penalty in retrieving the L0GPT data for a particular memory access is relatively low.

[0137] However, in the example of FIG. 13, the L1GPT check is omitted or removed for all memory accesses involved in a single-stage MMU operation, except for the final stage leading to the fetching of a TLB entry.

[0138] This configuration therefore enables speculative loads of data that are not subject to L1 GPT checks. To do this, for example, the GMPU can assume a PAS tag value for the data access by associating a default PAS tag with the access. In other examples, the PAS tag for a page table walk can be derived directly from the "security state" with which the page table is associated, optionally combined with an (optional) bit in the Stage 1 or Stage 2 page table (the bit is called "NS" to indicate whether the state is "non-secure"). Thus, in such examples, the GPT is not required to send the correct page table access (e.g., initiated by the present technology). The GMPU in such examples simply needs to verify that the PAS tag is "allowed" for the security state according to the table above.

[0139] A final check is provided to verify the final address that is brought into the TLB entry.

[0140] The potential savings in comparing Figure 13 with Figure 12 is on the order of four memory accesses in generating the 14 address translations required in the configuration of Figure 12. In an exemplary configuration, five of the remaining memory accesses may be for cached L0GPT data.

[0141] This use of the L0GPT check provides an example in which the access circuitry is configured to selectively permit access to a translation information address by the translation circuitry only if the storage type applicable to the translation information address is a first storage type (e.g., not if it is a second storage type, such as one that may potentially suffer from a "side effect"), without the permission circuitry completing operations to detect permission information to indicate whether memory access is permitted for that translation information address.

[0142] Example - Step 2, removing L1GPT check Figure 14 shows a similar arrangement to that of Figure 11, but again, the L1GPT checks have been removed except for the last one, which results in a TLB entry being fetched. This reduces the 74 accesses mentioned above by 24, with 25 of the remaining accesses being to cached L0GPT data.

[0143] Disable Deletion Optionally, the EL3 code may disable eviction in case of a fault or a specific type of fault, such as a general protection fault resulting from a page table access.

[0144] Optionally, the EL3 code may require that a full GPT check be re-run on MMU translations if a translation or other failure occurs.

[0145] Further example - single-stage, deferred L1GPT check Figures 15 and 16 provide for deferred checking, and both configurations allow the MMU to load unchecked data with an assumed PAS tag. Note that while both Figures 15 and 16 relate to single-stage MMU operation (for purposes of example illustration), corresponding techniques can be used for two-stage MMU operation. Note that the L0GPT checks associated with Figures 15 and 16 are not shown, but are assumed to occur before the associated address is used in a memory access.

[0146] In Figure 15, an L0 page table access 1500 is performed before the completion of an L1 GPT check 1505 of the page table base address provided by TTBR_EL1. In the example shown, both accesses begin at approximately the same time, but use of this technique simply requires that the check 1505 is not completed by the time the relevant information in 1500 is actually used to access the first level of the page table.

[0147] 15 imposes a requirement that, in some instances, the PAS assumed to be associated with a read access be validated before the resulting data can be used or cached. This is represented by the dashed vertical line 1510, which represents the GPT checkpoint. In other words, the data read from the L0 page table access 1500 cannot be used further until the address from which that data was obtained, i.e., the page table base address in TTBR_EL1, is itself validated.

[0148] Similarly, an L1 page table entry access 1520 can begin before its address (the output of access 1500) is validated by step 1525, but in the example of Figure 15, the next level address information read by access 1520 cannot itself be used (for a subsequent access 1530 until the L1GPT check 1525 itself related to the address at which access 1520 was performed has completed).

[0149] The configuration of FIG. 15 can, in some examples, be implemented by dual or parallel issuance of a GPT L1 check and the next page table entry read operation, such as parallel or dual issuance of accesses 1505 and 1500. This means that the page table entry read operation is performed at the expected PAS without its address being fully checked. However, by providing a GPT checkpoint, such as checkpoint 1510, upon read completion, memory access faults or translation faults resulting from reading so-called "bad" data are handled synchronously in that they occur with or in response to the associated MMU operation. Secondary speculative page table entry reads are not issued from unchecked data, which can help avoid cache side-channel attacks or other issues.

[0150] At the GPT checkpoint of Figure 15, access / dirty bit updates are performed (note that, as mentioned above, in an exemplary embodiment, any write operation by the MMU requires a full L1 GPT check before being implemented), and the TLB and walk cache may be populated.

[0151] 16, unchecked data loads or reads with assumed PAS values ​​are still permitted, and the loaded data value itself can be used as input to a subsequent load operation. However, the assumed PAS value is verified by completing the respective L1GPT check before the final data can be committed or cached.

[0152] 16, the page table base address provided by TTBR_EL1 is used in a first read operation 1600, the results of which may be used in a second read operation 1610, and so on through a fourth read operation 1620 associated with a fourth page table walk operation. Separately, a chain of L1GPT checks is initiated such that the base address provided by TTBR_EL1 is subjected to L1GPT check 1605, and assuming this check passes at checkpoint 1607, a detection is made as to whether a second L1GPT check 1615 of the output of read operation 1600 passes 1617, and so on. The chain of L1GPT checks continues through L1GPT check 1625 of the address or address portion read from operation 1620, and passing check 1625 1627 is a condition for (a) fetching TLB entry 1630 and prefetching data 1640 at the translated address.

[0153] As noted above, at the GPT checkpoint of Figure 16, access / dirty bit updates are performed (note that, as noted above, in an exemplary embodiment, any write operation by the MMU requires a full L1 GPT check before implementation), and the TLB and walk cache may be populated.

[0154] Two-stage MMU example In a two-stage MMU, any of the techniques described herein may be applied individually to one stage but not the other stage (in any case), or may be applied to both stages.

[0155] Further examples Further examples of selectively allowing access are as follows.

[0156] The authorization circuitry may select a separate configuration for each PTE access (or for a subgroup of PTE accesses), in other words, to postpone, remove or retain (or not postpone or remove) the corresponding full or partial authorization check, or may be controlled by the conversion circuitry.

[0157] As an example, if both stage 1 and stage 2 are enabled, the enabling circuit (either by itself or under the control of the translation circuit) For each stage 1 MMU read operation, performing a corresponding permission check before the stage 1 read or deferring it to completion by the time the result is used to drive a subsequent stage 2 read; For the final stage 2 read operation (which obtains data defining the output address of the requested memory address translation), performing a permission check before the stage 2 read or postponing it to completion until a point before the output address is committed or otherwise used; For all other stage 2 read operations, the enable circuit check is removed.

[0158] Such an implementation can prevent an attacker from using an attacker-controlled stage 2 table as a Spectre-like revelation attack that can disclose the contents of removed stage 1 checks.

[0159] More generally, different patterns of dropping and / or deferring can be used, for example random or pseudo-random patterns.

[0160] Overview of Exemplary Technologies As noted above, the various exemplary configurations contemplate at least the following options and variations, all of which are within the scope of the present disclosure as defined by the appended claims: a) Removal of all or part of the omission of at least some permission information (e.g., GPT) checks (e.g., Figures 13 and 14) b) Proceed with translation information (e.g., PTE) access and initiate a GPT check at the same time, or at least such that the GPT check is not completed by the time the PTE access is initiated. c) As in (b), the result of the GPT check for a PTE access is required before that PTE access can be used for the next MMU operation (e.g., before the next PTE access is initiated using the information obtained from that PTE access) (e.g., Figure 15). d) Although shown as (b), the result of the GPT check for a PTE access is required before the result is committed, e.g., before any resulting writes to TLB entries or fetches of translated addresses are initiated (e.g., Figure 16); e) As in any of (b) through (d), some GPT checks, such as L0GPT, are performed before the relevant PTE access, but the remaining GPT checks, in our example L1GPT, are deferred.

[0161] An example of (c) is the so-called "lockstep" variant, where the GPT check is initiated in parallel with the memory access of the page table walk, but the GMPU check itself is deferred until a point before the result of that memory access is used (e.g., to drive the next walk).

[0162] Method overview FIG. 17 is a schematic flow chart illustrating a method including: performing 1700 a translation operation to generate a translated second memory address in a second memory address space as a translation of a first memory address in a first memory address space, the translation operation including generating the translated second memory address in accordance with translation information stored in one or more translation information addresses; performing, for a given second memory address, an operation of detecting permission information to indicate whether memory access is permitted for the given second memory address (step 1710); accessing the data stored at the given second memory address if the permission information indicates that memory access to the given second memory address is permitted (step 1720); and accessing the translation information address without the permission circuit completing operations of detecting permission information to indicate whether memory access is permitted for the translation information address (step 1730).

[0163] Overview of device functions The arrangements of Figures 1 and 3 operating in accordance with the techniques described above provide an example of an apparatus that includes: a translation circuit 16 (50, 52) that performs a translation operation to generate a translated second memory address in a second memory address space as a translation of a first memory address in a first memory address space, the translation circuit being configured to generate the translated second memory address in response to translation information stored in one or more translation information addresses; a permission circuit (20, 22) that performs, for a given second memory address, an operation of detecting permission information to indicate whether memory access is permitted for the given second memory address; an access circuit (20) for accessing data stored at the given second memory address if the permission information indicates that memory access to the given second memory address is permitted; The apparatus provides an access circuit configured to selectively access a translation information address without the permission circuit completing an operation of detecting permission information for indicating whether memory access is permitted for the translation information address.

[0164] In an exemplary configuration, the translation circuit 16 is operable with respect to memory access transactions, each memory access transaction being associated with a first memory address for translation, and the translation circuit associating a translated second memory address with each memory access transaction; The permission circuit 20 is configured to perform operations to detect permission information regarding the translated second memory address for each memory access transaction (e.g., L1GPT checks 1300, 1400, 1532, 1625), and the access circuit is configured to provide a result of accessing the translated second memory address for the memory access transaction only if access to the translated second memory address is permitted by the permission data.

[0165] Simulator implementation FIG. 18 illustrates a simulator implementation that may be used. While the above embodiments implement the present invention in terms of apparatus and methods for operating specific processing hardware supporting the technology, it is also possible to provide an instruction execution environment according to the embodiments described herein implemented using a computer program. Such computer programs are often referred to as simulators, insofar as they provide a software-based implementation of a hardware architecture. Various simulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators. Typically, simulator implementations may run on a host processor 1430, optionally running a host operating system 1420 that supports the simulator program 1410. In some configurations, there may be multiple layers of simulation between the hardware and the provided instruction execution environment, and / or there may be multiple different instruction execution environments provided on the same host processor. Historically, powerful processors have been required to provide simulator implementations that run at reasonable speeds, but such an approach may be justified in certain situations, such as when it is desirable to execute code native to another processor for compatibility or reuse reasons. For example, a simulator implementation may provide an instruction execution environment with additional features not supported by the host processor hardware, or may provide an instruction execution environment typically associated with a different hardware architecture. An overview of simulation is given in "Some Efficient Architecture Simulation Techniques," Robert Bedichek, Winter 1990 USENIX Conference, pp. 53-63.

[0166] While embodiments have been described above with reference to particular hardware configurations or features, equivalent functionality may be provided in the simulated embodiments through appropriate software configurations or features. For example, particular circuits may be implemented as computer program logic in the simulated embodiments. Similarly, memory hardware such as registers or caches may be implemented as software data structures in the simulated embodiments. In configurations where one or more of the hardware elements referenced in the foregoing embodiments reside in host hardware (e.g., host processor 1430), some simulated embodiments may use the host hardware where appropriate.

[0167] Simulator program 1410 may be stored on a computer-readable storage medium (which may be a non-transitory medium) and provides a program interface (an instruction execution environment) for target code 1400 (which may include applications, an operating system, and a hypervisor), which is the same as the interface of the hardware architecture modeled by simulator program 1410. Thus, program instructions of target code 1400 may be executed from within the instruction execution environment using simulator program 1410, so that a host computer 1430 that does not actually have the hardware features of device 2 described above can emulate these features. This may be useful, for example, to enable testing of target code 1400 being developed for a new version of a processor architecture before hardware devices that actually support that architecture are available, since the target code can be tested by running it within a simulator that runs on a host device that does not support the new version of the processor architecture.

[0168] The simulator code emulates the behavior of processing circuit 1400, including, for example, instruction decode program logic that decodes instructions in target code 1400, maps the instructions to a sequence of corresponding instructions in a native instruction set supported by host hardware 1430, and includes processor program logic 1412 that performs functions equivalent to the decoded instructions. Processor program logic 1412 also simulates the processing of code at different exception levels and domains, as described above. Register emulation program logic 1413 maintains data structures in the host address space of the host processor that emulate architectural register state defined according to the target instruction set architecture associated with target code 1400. Thus, such architectural state is not stored in hardware registers 12 as in the example of FIG. 1 , but instead is stored in the memory of host processor 1430, and register emulation program logic 1413 maps register references in instructions in target code 1400 to corresponding addresses for retrieving simulated architectural state data from host memory. This architectural state may include the current region indication 14 and the current exception level indication 15 mentioned above.

[0169] The simulation code includes address translation program logic 1414 and filtering program logic 1416 that emulate the functions of the address translation circuit 16 and PAS filter 20, respectively, referencing the same page table structure and GPT 56 as described above. Thus, the address translation program logic 1414 translates virtual addresses specified by the target code 1400 into simulated physical addresses (pointing to physical locations in memory from the target code's perspective) in one of the PASs, but these simulated physical addresses are actually mapped onto the host processor's (virtual) address space by address space mapping program logic 1415. Similar to the PAS filter described above, the filtering program logic 1416 performs a lookup of granule protection information to determine whether a memory access triggered by the target code is allowed to proceed.

[0170] The arrangement of Figure 18 provides an example of a computer program for controlling a host data processing apparatus to provide an instruction execution environment for executing target code, the computer program comprising: translation logic that performs a translation operation to generate a translated second memory address in a second memory address space as a translation of a first memory address in the first memory address space, the translation logic being configured to generate the translated second memory address according to translation information stored in one or more translation information addresses; authorization logic that performs, for a given second memory address, operations of detecting authorization information to indicate whether memory access is authorized for the given second memory address; access logic that permits access to data stored at the given second memory address if the permission information indicates that memory access to the given second memory address is permitted; A computer program is provided in which the access logic is configured to selectively permit access by the translation logic to the translation information address without the permission logic completing an operation of detecting permission information to indicate whether memory access is permitted for the translation information address.

[0171] In this application, the term "configured to..." is used to mean that elements of an apparatus have a configuration that is capable of performing a defined operation. In this context, "configuration" refers to a way of arranging or interconnecting hardware or software. For example, an apparatus may have dedicated hardware that provides the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured to" does not imply that the apparatus elements need to be modified in any way to provide the defined operation.

[0172] Although exemplary embodiments of the present invention are described in detail herein with reference to the accompanying drawings, it will be understood that the invention is not limited to these precise embodiments, and that various changes and modifications can be made to the embodiments by those skilled in the art without departing from the scope of the invention as defined by the appended claims.

Claims

1. 1. An apparatus comprising: a translation circuit that performs a translation operation to generate a translated second memory address in a second memory address space as a translation of a first memory address in a first memory address space, the translation circuit being configured to generate the translated second memory address in response to translation information stored in one or more translation information addresses; a permission circuit that performs, for a given second memory address, operations of detecting permission information to indicate whether memory access is permitted for said given second memory address; an access circuit that permits access to data stored at the given second memory address if the permission information indicates that memory access to the given second memory address is permitted; the access circuitry is configured to selectively permit access by the translation circuit to the translation information address without the permission circuit completing the operation of detecting permission information to indicate whether memory access is permitted for the translation information address.

2. the access circuitry is configured to selectively permit access to the translation information address by the translation circuitry when the access to the translation information address is related to a read access without the permitting circuitry completing the operation to detect permitting information; the access circuitry is configured to permit access to a translation information address only if the permission information indicates that memory access to the translation information address is permitted, when the access to the translation information address is related to a write access.

10. The apparatus of claim 1.

3. 3. The apparatus of claim 1, wherein the permission circuitry is configured to perform a further operation to detect a storage type applicable to a given second memory address, the storage type being at least whether a first storage type or a second, different storage type is applicable to the given second memory address.

4. 4. The apparatus of claim 3, wherein the access circuitry is configured to selectively permit access to the translation information address by the translation circuitry only if the storage type applicable to the translation information address is the first storage type, without the permission circuitry completing the operation of detecting permission information to indicate whether memory access is permitted for that translation information address.

5. 5. The apparatus of claim 4, wherein the first storage type is a storage type in which the data stored at a given address is not modified by a read operation from the given address.

6. the authorization circuitry is configured to not perform the operation of detecting authorization information for at least a portion of the translation information address; the translation circuit is configured to not provide the translation information obtained from the translation information address as an output to a circuit external to the translation circuit if the operation of detecting permission information has not been completed.

6. An apparatus according to any one of claims 1 to 5.

7. 6. The apparatus of claim 1, wherein the translation information applicable to the translation of a given first memory address comprises a hierarchy of translation information entries in which data representing a translation information address of a next translation information entry is pointed to by a preceding translation information entry.

8. the data indicating a translation information address of a next translation information entry indicates a first memory address applicable to the next translation information entry; the translation circuitry is configured to perform the translation operation to generate a respective translation information address; 8. The apparatus of claim 7.

9. 9. The apparatus of claim 7, wherein the authorization circuit is configured to postpone initiation of the operation for detecting authorization information for a next translation information entry until after initiation of access to that next translation information entry.

10. the translation circuitry is operable with respect to memory access transactions, each memory access transaction being associated with a first memory address for translation, and the translation circuitry associates a translated second memory address with each memory access transaction; the permission circuitry is configured to perform the operation of detecting permission information related to the translated second memory address for each memory access transaction, and the access circuitry is configured to provide a result of accessing the translated second memory address for the memory access transaction only if access to the translated second memory address is permitted by the permission information.

10. An apparatus according to any one of claims 1 to 9.

11. the first memory address comprises one of a virtual memory address and an intermediate physical address; the second memory address comprises an intermediate physical address or a physical memory address; 11. An apparatus according to any one of claims 1 to 10.

12. 12. The apparatus of claim 11, comprising a memory having a plurality of memory partitions, each data memory partition associated with a partition identifier and having a respective range of physical addresses within a physical address space.

13. encryption and decryption circuitry for encrypting data for storage by said memory and for decrypting data retrieved from said memory; the encryption and decryption circuitry is configured to apply a respective encryption and corresponding decryption of a set of encryptions and corresponding decryptions to each memory partition, the set of encryptions and corresponding decryptions being such that data encrypted to a given memory partition by the respective encryption of that memory partition cannot be decrypted by applying the decryption of another memory partition; 13. The apparatus of claim 12.

14. When configured, the operation of detecting authorization information includes: detecting a region identifier associated with the second memory address, the region identifier selected from a plurality of region identifiers, each region identifier operative to indicate access permission to a respective set of the memory partitions, and for at least one of the region identifiers, the respective set of memory partitions including one or more subsets, but not all, of the memory partitions; The apparatus of claim 13 , further comprising: comparing the detected area identifier with a partition identifier associated with the second memory address.

15. 15. The apparatus of claim 14, wherein the authorization circuitry is configured to associate with the translated second memory address data indicative of the area identifier associated with the translated second memory address.

16. 16. The apparatus of claim 15, wherein the encryption and decryption circuitry is configured to apply decryption to decrypt data retrieved from the memory at a transformed second memory address by applying decryption selected according to the data indicative of the area identifier associated with the transformed second memory address.

17. one or more cache memories for holding data retrieved from and / or for storage into said memory; the cache memory associates the respective area identifier with each data item held by the cache memory; 17. The apparatus of claim 15 or 16, wherein the cache memory is configured to inhibit access to a data item associated with a given area identifier in response to a memory access associated with data indicating a different area identifier.

18. the translation circuitry is configured to detect a translation failure for a given translation operation if use of the translation information by the translation circuitry does not provide a valid address translation; and in response to detecting a translation failure, the translation circuitry is configured to control the authorization circuitry to perform the operation of detecting authorization information for any translation information addresses accessed as part of the given translation operation.

18. Apparatus according to any one of claims 1 to 17.

19. a processor for executing program instructions at a general exception level selected from a hierarchy of exception levels, each exception level being associated with a security privilege such that instructions executing at a higher exception level have access to resources that are inaccessible to instructions executing at a lower exception level; the processor must execute an instruction at the highest level of the exception level in order to set data in which the permission circuit detects permission information; 19. Apparatus according to any one of claims 1 to 18.

20. 1. A method comprising: performing a translation operation to generate a translated second memory address in a second memory address space as a translation of a first memory address in a first memory address space, the translation operation including generating the translated second memory address in response to translation information stored in one or more translation information addresses; performing, for a given second memory address, an operation of detecting permission information to indicate whether memory access is permitted for said given second memory address; accessing data stored at the given second memory address if the permission information indicates that memory access to the given second memory address is permitted; and selectively accessing the translation information address without completing the operation of detecting permission information for indicating whether memory access is permitted for the translation information address; A method comprising:

Images