Verifying the integrity of address translation

Abstract

An apparatus, method, and program are disclosed for performing a translation from a virtual address of a memory access to a physical address associated with the accessed memory location. When performing the translation, a page table descriptor is accessed that includes translation parameters for the translation. The descriptor further includes an integrity check value, the integrity check value being dependent on the translation parameters.

Description

[Technical Field]

[0001] The present technology relates to data processing systems.

[0002] The data processing system may include memory access control circuitry that performs the translation from the virtual address of a memory access to a physical address associated with the accessed memory location.

[0003] At least some examples provide an apparatus including a memory access control circuit that performs a translation from a virtual address of a memory access to a physical address associated with an accessed memory location, the memory access control circuit configured to access a page table when performing the translation, the page table including a descriptor including translation parameters for the translation, the descriptor further including an integrity check value, the integrity check value being dependent on the translation parameters.

[0004] At least some examples provide a data processing method that includes performing a translation from a virtual address of a memory access to a physical address associated with the accessed memory location, where performing the translation includes accessing a page table, where the page table includes a descriptor that includes translation parameters for the translation, where the descriptor further includes an integrity check value, where the integrity check value is dependent on the translation parameters.

[0005] At least some examples provide a computer program for controlling a host data processing apparatus to provide an instruction execution environment for execution of target code, the computer program including memory access control logic that performs a translation from a virtual address of a memory access to a physical address associated with an accessed memory location, the memory access control logic configured to access a page table when performing the translation, the page table including a descriptor that includes translation parameters for the translation, the descriptor further including an integrity check value, the integrity check value being dependent on the translation parameters.

[0006] At least some examples provide a computer-readable storage medium that stores the above-described computer program.

[0007] The present technology will now be further described, by way of example only, with reference to embodiments thereof as illustrated in the accompanying drawings, to be read in conjunction with the following description. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a diagram illustrating an example of a data processing system in which page table descriptor integrity checking is performed; [Figure 2A] FIG. 10 illustrates a schematic example of an integrity check performed on a page table descriptor; [Figure 2B] FIG. 10 illustrates a schematic example of an integrity check performed on a page table descriptor; [Figure 2C] FIG. 10 illustrates a schematic example of an integrity check performed on a page table descriptor; [Figure 3A] FIG. 10 is a diagram illustrating an example of a multi-level page table in which integrity check values ​​are provided at two or more levels. [Figure 3B] FIG. 10 is a diagram illustrating an example of integrity checking performed using two or more levels of integrity check values ​​in a multi-level page table. [Figure 3C]FIG. 10 illustrates schematically the use of control bits at higher levels of a multi-level page table to delegate descriptor validation from more privileged software to less privileged software at subsequent levels. [Figure 4] 1 is a diagram illustrating an example of an apparatus in which page table descriptor integrity checking is performed; [Figure 5] FIG. 10 is a flow diagram illustrating a method for executing a page table descriptor. [Figure 6] FIG. 1 illustrates an example of a simulator that may be used.

[0009] A data processing system may support the use of virtual memory, which provides an address translation capability for translating a virtual address specified by a memory access request into a physical address associated with the accessed memory location. The mapping between the virtual address and the physical address may be defined in one or more page table structures. The page table entries in the page table structures may also define some access permission information, which may control whether a given software process executing in the data processing system is allowed to access a particular address.

[0010] In some examples herein, there is an apparatus comprising: memory access control circuitry that performs a translation from a virtual address of a memory access to a physical address associated with an accessed memory location, wherein the memory access control circuitry is configured to access a page table when performing the translation, the page table including a descriptor that includes translation parameters for the translation, the descriptor further including an integrity check value, and the integrity check value is dependent on the translation parameters.

[0011] Page tables and the descriptors they contain are stored in memory and therefore require memory accesses to retrieve them, thereby enabling address translation and the access permissions they define. The memory access control circuitry that performs virtual-to-physical address translation may have its own local storage capacity so that it can reuse page table entries retrieved from memory quickly, i.e., without incurring the latency associated with memory accesses. Such local storage capacity may be in the form of a cache structure, an example of which is a translation lookaside buffer (TLB). Nevertheless, a definitive copy of a given page table entry is stored in memory and must be initially retrieved at least once by a memory access. The present technology recognizes that, in this context, such page table entries may be vulnerable to memory corruption, whether the memory corruption is due to a random event, such as a radiation hit that causes one or more bits in memory to flip, or due to a deliberate attack, such as error injection, i.e., performed by a malicious entity. A defense against such corruption is provided by providing an integrity check value within the descriptor itself, and furthermore, if the integrity check value depends on the translation parameters of the descriptor, this defense specifically protects those translation parameters. As a result, the address translation and memory access permissions defined by the descriptor are also so protected.

[0012] The integrity check value and its relationship to the translation parameters of the descriptor may be used in various ways to provide integrity assurance. On the one hand, this information may be used by software running in a data processing system of which the device forms part when writing to a page table to define the parameters of the descriptor, or when reading from a page table to use the parameters provided by the descriptor. On the other hand, this information may be used by hardware, e.g., the device itself, when reading from a page table to make use of the parameters provided by the descriptor, e.g., as part of a hardware-implemented address translation process.

[0013] In some examples, the memory access control circuitry performs a descriptor integrity check in response to a memory access, including reading a descriptor, calculating an integrity check value that depends on a transformation parameter of the descriptor, and allowing the memory access to proceed if the integrity check value matches the integrity check value and blocking the memory access if the integrity check value does not match the integrity check value. Thus, when processing a memory access request, the descriptor integrity check may be an integral part of that processing. Furthermore, while the descriptor integrity check may be performed on a descriptor that has just been retrieved from memory, the descriptor integrity check is not limited to being performed only at that time; the integrity of the descriptor may be verified any time the descriptor is used.

[0014] The device may be configured to respond in various ways when a descriptor integrity check fails, i.e., when the integrity of the descriptor is not verified. In some examples, the descriptor integrity check further includes signaling an error to the privileged software if the integrity verification value does not match the integrity check value. The privileged software can then take one or more further steps in response to this signaled error, and these further steps may take various forms. As just some examples, the privileged software may take action to repair the descriptor and its integrity check value; the privileged software may take action regarding the identified source of the error, e.g., if there is a possibility that the error was caused by a software-based attack; and the privileged software may prevent one or more currently executing instances of less privileged software from continuing.

[0015] The integrity check value depends on the translation parameters of the descriptor, which, as noted above, provides protection specific to address translations that may then be performed when using this descriptor. That said, various configurations have been proposed for the extent to which the integrity check value depends on the contents of the descriptor. In some examples, the integrity check value depends on all descriptors other than the integrity check value. In some examples, the integrity check value depends on fewer descriptors than all descriptors other than the integrity check value. When the integrity check value depends on fewer descriptors (other than the integrity check value itself), this therefore means that the descriptor may have content that is not protected by the integrity check value. This provides an opportunity for a descriptor to hold certain data that is related to memory accesses to the region of memory to which the descriptor applies, but that can be tolerated to be modified (i.e., without causing a descriptor integrity check failure). For example, such data could be bits indicating recent accesses or modifications to that region of memory, which are used by the memory page management system to determine what data to keep locally and what to commit to memory. Thus, a useful balance is achieved in that it is possible to check the integrity of the descriptor with respect to the transformations and permissions defined by the descriptor, while still allowing less privileged software to perform other aspects of memory management (without them having to be performed by more privileged software).

[0016] In some examples, the memory access control circuitry is configured to access the page table through multiple levels of a multi-level page table when performing a translation, where two or more of the multiple levels of the multi-level page table include an entry that includes a level-specific integrity check value, and the level-specific integrity check value depends on the entry. Address translations may be defined by the multi-level page table (i.e., a page table hierarchy). Higher levels of such a page table configuration may point to the next lower level and may also provide translation parameters for the translation. With a hierarchical structure, broadly applicable definitions may be provided by higher levels of the hierarchy, while memory region-specific definitions may be provided by the lowest level of the hierarchy. Providing level-specific integrity check values ​​for two or more of the multiple levels of the multi-level page table provides a more extensive integrity check for the page table process used to derive the necessary translation parameters.

[0017] In some examples, the memory access control circuitry is configured to access the page table through multiple levels of the multi-level page table when performing translations, and the control descriptor of a control level of the multiple levels includes a control bit, the value of the control bit defining whether subsequent levels of the multi-level page table need to be integrity authenticated by privileged software, thereby providing flexibility in managing memory regions, such as allowing highly privileged software to verify large regions of the memory address space while leaving smaller regions to be managed directly by less privileged software.

[0018] This control bit may be set at any level in a multi-level page table configuration, and the value of this control bit is then propagated through further levels of the page table.

[0019] Flexibility may be provided with respect to configuring elements of the descriptor on which the integrity check value depends. In some examples, the device further comprises a configuration store holding a mask value, the mask value defining which elements of the descriptor the integrity check value depends on. In examples with level-specific integrity check values ​​for a multi-level page table, the device may further comprise a configuration store holding two or more mask values, for each of two or more levels of the multi-level page table, a respective mask value defining which elements of the entry the level-specific integrity check value depends on. Such a configuration store may take various forms. In some examples, the store is one or more configuration registers.

[0020] While a trusted entity is primarily required to define the descriptors and compute the integrity check values ​​of the descriptors, this trusted entity may be provided in a variety of ways and may itself be invoked by a range of other system entities. In some examples, the memory access circuitry includes an integrity check value calculation circuitry to generate the integrity check values, and the integrity check value calculation circuitry includes an authenticated integrity check value generation circuitry to generate the integrity check values ​​in dependence on a secret key. The use of the secret key (such as in generating a MAC (Message Authentication Code) as the integrity check value) provides a mechanism for ensuring that the integrity check values ​​can be trusted. In some examples, the authenticated integrity check value generation circuitry may be invoked by less trusted system entities (e.g., less privileged software). However, in other examples, the authenticated integrity check value generation circuitry is configured to generate integrity check values ​​in response to more privileged software and not in response to less privileged software. A further mechanism for protecting the integrity check values ​​would be to limit the actions that are allowed to be taken with respect to the stored descriptors. Access to the descriptor and its integrity check value can then be provided to a range of entities, as long as there is a firm demarcation of what actions the entities are allowed to take with respect to the descriptor and its integrity check value. However, it may be preferable to allow broader access rights (including modification) to descriptors stored in memory, for example to allow flexibility with respect to the range of entities that can perform memory management actions with respect to the memory region in which the descriptor is stored. Thus, in an example where the authenticated integrity check value generation circuit is configured to generate an integrity check value in response to high-privilege software and not to generate an integrity check value in response to low-privilege software, this means that only trusted entities (e.g., high-privilege software) can cause the generation of an integrity check value.Thus, an untrusted entity (e.g., low-privilege software) may be allowed to fully access (i.e., even modify) the in-memory descriptor (including the descriptor integrity check value), but any integrity check value not generated in reliance on the private key will fail subsequent integrity check verification.

[0021] In some examples herein, there is a data processing method that includes performing a translation from a virtual address of a memory access to a physical address associated with the accessed memory location, where performing the translation includes accessing a page table, where the page table includes a descriptor that includes translation parameters for the translation, where the descriptor further includes an integrity check value, where the integrity check value is dependent on the translation parameters.

[0022] In some examples, the method further includes performing a descriptor integrity check, the descriptor integrity check including reading the descriptor, calculating an integrity check value that depends on a transformation parameter of the descriptor, allowing the memory access to proceed if the integrity check value matches the integrity check value, and blocking the memory access if the integrity check value does not match the integrity check value.

[0023] In some examples, the descriptor integrity check further includes signaling an error to privileged software if the integrity verification value does not match the integrity check value. In some examples, the integrity check value depends on all descriptors other than the integrity check value. In some examples, the integrity check value depends on fewer descriptors than all descriptors other than the integrity check value.

[0024] In some examples, performing the translation includes accessing the page table through multiple levels of the multi-level page table when performing the translation, and two or more of the multiple levels of the multi-level page table include an entry that includes a level-specific integrity check value, and the level-specific integrity check value is dependent on the entry.

[0025] In some examples, the method further includes storing a mask value, the mask value defining which elements of the descriptor the integrity check value depends on. In some examples, the method further includes storing a plurality of mask values, for each of two or more levels of the multi-level page table, a respective mask value defining which elements of the entry the level-specific integrity check value depends on.

[0026] In some examples, the method further comprises an integrity value generation step of generating the integrity check value in dependence on the private key.

[0027] In some examples, the integrity value generating step includes generating an integrity check value for storage as part of the descriptor, the integrity value generating step being performed in response to high-privilege software and not in response to low-privilege software.

[0028] In some examples, there is a computer program for controlling a host data processing apparatus to provide an instruction execution environment for execution of target code, the computer program including memory access control logic that performs a translation from a virtual address of a memory access to a physical address associated with an accessed memory location, the memory access control logic configured to access a page table when performing the translation, the page table including a descriptor that includes translation parameters for the translation, the descriptor further including an integrity check value, the integrity check value being dependent on the translation parameters.

[0029] In some examples, there is a computer readable storage medium that stores the above-described computer program.

[0030] Some specific embodiments will now be described with reference to the figures.

[0031] FIG. 1 schematically illustrates an example data processing system 10 having a processor 12 connected to a memory 16 via an interconnect 14. The processor 12 is shown to include processing circuitry 20, memory access control 22, and a set of configuration registers 24. The processing circuitry 20 generates memory access requests as part of data processing operations performed by the processing circuitry 20, and the memory locations being accessed are specified as virtual addresses. The memory access control circuitry 22 (e.g., a memory management unit (MMU)) translates the virtual addresses into physical addresses through one or more stages of address translation based on page table data defined in a page table structure 26 stored in the memory 16. The memory 16 also stores data 28 at locations specified by the physical addresses. The memory access control circuitry 22 includes an integrity verification circuitry 30 and an address translation storage unit 32. The address translation storage unit 32 is provided to maintain copies of portions of page table data previously retrieved from memory. Thus, when memory access control 22 encounters (as part of a memory access request) a virtual address for which page table data required to perform an address translation is not currently present in address translation storage device 32, an address translation request is generated by memory access control 22 to retrieve this page table data from page table 26. The page table data returned from memory 16 is then stored in address translation storage device 32, which may include a cache structure (e.g., a translation lookaside buffer (TLB)). Now that the required page table data is present locally, memory access control 22 can then not only determine the physical address corresponding to the virtual address, but also determine whether to allow the memory access to proceed based on permission information that forms part of the page table data. Furthermore, memory access control 22 uses its integrity verification circuitry 30 to verify the integrity of the page table data, specifically, the integrity of the descriptors within the page table data that provide the translation parameters.This integrity checking process and the circuit components of the integrity verification circuitry are described in more detail with respect to the following figures. The integrity check may be performed solely on the basis of the descriptor itself (and the integrity check value it contains), but may also take into account configuration data; Figure 1 shows configuration registers 24 within processor 12 that provide such further configuration data to integrity verification circuitry 30.

[0032] FIG. 2A schematically illustrates a descriptor 50 including various page table descriptor values ​​52 and integrity check values ​​54. To perform a descriptor integrity check on the descriptor 50, an integrity check calculation is performed on the page table descriptor values ​​52 by an integrity check calculation circuit 56. Any technically feasible integrity check calculation may be used to verify the integrity of the descriptor, such as a MAC (Message Authentication Code) or a CRC (Cyclic Redundancy Check). However, if a secret key forms part of the integrity check calculation (as is the case for a MAC, but not for a CRC), this further enhances system security by protecting against intentional and malicious modification of the descriptor's transformation parameters and descriptor integrity check value. Nevertheless, unauthenticated integrity check values ​​can be used, and protection against unintentional modification of the transformation parameters (e.g., a radiation hit causing a bit flip) is also possible. However, in the example of FIG. 2A, the integrity check calculation is authenticated with reference to a securely held secret key 59. The value produced by the integrity check calculation is then compared by comparison circuitry 58 to integrity check value 54, which forms part of descriptor 50. It is therefore understood that the same integrity check calculation was performed when descriptor 50 was previously defined and stored. If comparison circuitry 58 determines that the two values ​​are the same, the integrity of descriptor 50 is confirmed. Conversely, if comparison circuitry 58 determines that the two values ​​are not the same, either page table descriptor value 52 or integrity check value 54 (or both) have been modified since descriptor 50 was defined and stored. While the process shown in FIG. 2A has been described with respect to hardware performing the descriptor integrity check (e.g., within integrity verification circuitry 30 of memory access control circuitry 22 in the example of FIG. 1), the same descriptor integrity check could also be performed by a software component of a data processing system. In the latter case, integrity check calculation 56 and comparison 58 would be provided by routines in the associated software component.

[0033] FIG. 2B schematically illustrates a descriptor 60 in a variation of the example of FIG. 2A. Here, descriptor 60 is shown to include a set of transformation parameters 62, other information 63, and an integrity check value 64. The integrity check value 64 is shown to be generated in dependence on the transformation parameters 62 by an integrity check calculation 66. As in FIG. 2A, the integrity check calculation is authenticated with reference to a securely held private key (not explicitly shown in FIG. 2B). Thus, the process illustrated in FIG. 2B may represent part of an initialization process for a data processing system in which a trusted system entity (e.g., highly privileged software) defines descriptor 60 (including calculating integrity check value 64) and stores descriptor 60 within page table 26 of memory 16. Thus, although in that scenario, integrity check calculation 66 is performed by software, in other examples, generation of integrity check value 64 may be performed by hardware configured to operate in a trusted manner. Thus, it may be the integrity verification circuitry 60 of memory access control 22 that performs the integrity check calculation to generate the integrity check value 64 (perhaps as a task delegated by trusted software) before the descriptor 60 is stored in memory. Note also that the descriptor 60 is shown as including other information 63 in addition to the transformation parameters 62, and that the integrity check calculation 66 is performed with the transformation parameters 62 as input, but without the other information 63. Thus, it is not necessary for the entire descriptor 60 to be included in the integrity check calculation 66, although all of the transformation parameters 62 are included in the integrity check calculation, so that their integrity may be protected by the use of the integrity check value 64.

[0034] FIG. 2C schematically illustrates a descriptor 70 in a variation of the examples of FIGS. 2A and 2B. As with descriptor 60 of FIG. 2B, descriptor 70 is shown to include a set of transformation parameters 72, other information 73, and an integrity check value 74. Here, integrity check calculation 76 is shown to receive transformation parameters 72, other information 73, and a mask value 77 as inputs. As with FIG. 2A, the integrity check calculation is authenticated with reference to a securely held private key (not explicitly shown in FIG. 2C). The mask value is provided by the contents of a configuration register (e.g., from configuration register 24 of FIG. 1). The mask value 77 controls the extent to which other information 73 is used in integrity check calculation 76. Thus, in one maximum setting, the mask value may cause integrity check calculation 76 to use all of other information 73 (in addition to transformation parameters 72), and the integrity check value is then calculated in the same manner as in the example of FIG. 2A. Conversely, in another minimal configuration, the mask value may not require the integrity check calculation 76 to use any of the other information 73 (i.e., only use the transformation parameters 72), and thus the integrity check value is calculated in the same manner as in the example of FIG. 2B. Between these two extremes, the mask value may be freely defined to use some, but not all, of the other information 73. The other information 73 may be used for a range of purposes related to the function of the descriptor. For example, it may hold various metastate data regarding the use of the descriptor and the memory region to which it is associated. If (some of) the other information needs to be robust and protected against corruption, it is included in the integrity check calculation. If (some of) the other information does not have this requirement, it can be excluded from the integrity check calculation. One use of at least some of this other information may be to provide useful bits within the descriptor for software to record and retrieve information about the memory region to which the descriptor is associated. For example, a memory management process may use such bits to maintain “accessed” and “dirty” bits to indicate accesses and modifications to the memory region. Although the present technology is not limited to descriptors of any particular size, in one configuration, descriptors 50, 60, and 70 are 64-bit page table entries.Thus, as an example of granularity, a page table entry contains a 48-bit translation permission field, 8 bits of metastate data (other data), and an 8-bit integrity check value.

[0035] FIG. 3A illustrates the use of multi-level page tables in one example. A virtual memory address 80 is shown subdivided into three portions. A first portion 81 of the address is used to access a higher level 85 of the page table hierarchy to select an entry 86. Entry 86 includes parameters 87 for address translation as well as an integrity check value 88. The parameters 87 indicate the base address of a lower level 90 of the page table hierarchy, which is then accessed using a second portion 82 of the address to select entry 91. This entry 91 also includes parameters 92 for address translation as well as an integrity check value 93. The parameters 92 indicate the base address of a 4 kB memory page, and the third portion 83 of the address indicates the physical address 96 to be accessed. While a multi-level page table in which integrity check values ​​are used at more than one level may include more than two levels, the illustration of FIG. 3A shows only two for the sake of brevity and clarity.

[0036] FIG. 3B schematically illustrates a circuit for performing integrity checks on entries of a multi-level page table, such as that shown in FIG. 3A. Such a circuit may be provided, for example, as part of the integrity check circuit 30 of the example of FIG. 1. Thus, a translation parameter 87 is provided from an entry 86 in a first level of the multi-level page table as an input to an integrity check calculation circuit 95. A further input to the integrity check calculation circuit 95 is a mask value 96 that defines which portions of the translation parameter 87 should be included in the calculation. The result of the integrity check calculation is passed to a comparison circuit 97 for comparison with an integrity check value 88 from the entry 86. Similarly, a translation parameter 92 is provided from an entry 91 in a second level of the multi-level page table as an input to an integrity check calculation circuit 98. Although the integrity check calculation circuit 98 is shown separate from the integrity check calculation circuit 95, they may be provided as one and the same circuit that sequentially performs the integrity check calculations for each level as each level is sequentially accessed. The same applies to the comparison circuits 97 and 100. In one example, the result of comparison 97 determines whether calculation 98 and comparison 100 are performed at all; if comparison 97 produces a negative result, an error is reported immediately, at which point the page table lookup process stops. A further input to integrity check calculation circuit 98 is mask value 99, which defines which portions of translation parameters 92 should be included in the calculation. This may be the same mask value as mask value 96 or may be specific to this level. The result of the integrity check calculation is passed to comparison circuit 100 for comparison with integrity check value 93 from entry 91. As in FIG. 2A, the integrity check calculation is authenticated with reference to a securely held private key (not explicitly shown in FIG. 3B). The verified integrity of both entries 86 and 91 verify the overall integrity of the address translation performed. In the example above, where only calculation 98 and comparison 100 are performed at all, if comparison 97 results in a positive result, then a positive result of comparison 100 also necessarily verify overall integrity.This is represented in FIG. 3B by two comparisons (97 and 100) taken together (as shown diagrammatically by AND gate 101) to provide an overall assurance of completeness.

[0037] 3C schematically illustrates the use of control bits at higher levels of a multilevel page table to delegate validation of descriptors at subsequent levels from more privileged software to less privileged software. A descriptor 110 at a higher level of a multilevel page table (e.g., level 85 in the example of FIG. 3A ) includes translation parameters 111, an integrity check value 112, and control bits 113. The integrity check value 112 is validated by a calculation 114 under the control of the privileged software. If the integrity check value 112 is not verified, an error is reported to the privileged software, and the process stops at this point. However, if the integrity check value 112 is verified, the control bits 113 determine whether validation of subsequent levels of the multilevel page table (e.g., level 90 in the example of FIG. 3A ) should continue to be handled by the privileged software or should be delegated to unprivileged software. Following this determination 114, if control is delegated, the next level's descriptor 116 is validated by the unprivileged software. Descriptor 116 includes translation parameters 117 and an integrity check value 118. Under the control of unprivileged software, calculation 119 authenticates integrity check value 118. If integrity check value 118 does not verify, an error is reported to the unprivileged software and the process stops at this point; otherwise, the process proceeds. If control is not delegated by decision 114, descriptor 117 is also authenticated by privileged software at 120. Control may be delegated at 121 at any level of a multilevel page table, having at least one subsequent level. Thus, if descriptor 117 is authenticated by privileged software, control bits 122 of the descriptor itself are examined to determine whether to delegate control. Control bits 122 are not used when unprivileged software authenticates descriptor 116. It will be appreciated that this mechanism of optionally delegating authentication control from more privileged software to less privileged software may thus be implemented across any number of levels of a multilevel page table.Thus, highly privileged software can validate large regions of the address space, but leave smaller regions to be managed directly by less privileged software. The control bit set in a given validated page table entry is fed to a lower level of the page table, e.g., held by the highly privileged software until control is delegated to it, and conversely, remains delegated to the less privileged software after control has been delegated to it.

[0038] 4 illustrates an example of a data processing system in which data processor 150 accesses memory 152. More specifically, processing circuitry 154 issues memory access requests, which are processed and checked by memory access control 156. Memory access check circuitry 168 checks that a given memory access complies with the permissions defined for the memory region being accessed. Those memory access requests that are permitted are allowed to proceed to memory 152. Software executing within processing circuitry 154 may operate with different levels of privilege, as illustrated by low-privileged software 157 and high-privileged software 158. Access to page tables in memory 152, and specifically descriptor 160, is permitted to both low-privileged software 157 and high-privileged software 158. As described elsewhere herein, when a descriptor 160 is retrieved from memory 152, the integrity of that descriptor is verified by integrity verification circuitry 162 of memory access control circuitry 156 by performing an integrity check calculation based on transformation parameters 164 and determining whether the resulting value is the same as an integrity check value 165 that forms part of the retrieved descriptor 160. In some examples, either low-privileged software 157 or high-privileged software 158 is permitted to invoke the integrity check calculation (authenticated with reference to a securely held private key), a process that involves calculating the integrity check value 165 based on transformation parameters 164. However, in the example shown in FIG. 4, only high-privileged software 158 is permitted to invoke the integrity check calculation (authenticated with reference to a securely held private key), a process that involves calculating the integrity check value 165 based on transformation parameters 164. Either low-privilege software 157 or high-privilege software 158 may be allowed to change the integrity check value 165 (and similarly change the transformation parameters 164) of a descriptor 160 already stored in memory.Thus, memory access check circuit 168 may allow less privileged software 157 to access descriptors 160 in memory 152, and in some examples may also allow less privileged software 157 to authenticate page tables, although in the example shown in Figure 4 only more privileged software 158 may authenticate the page tables. Thus, less privileged software 157 may handle various aspects of memory management including the use of descriptors 160, but when authentication of a descriptor is required, e.g., during a setup phase before normal use, less privileged software 157 must send an authentication request to more privileged software 158 to perform such authentication. Integrity verification circuit 162 is further configured to report an integrity error, which in the example of Figure 4 is sent to more privileged software 158 (although if less privileged software 157 is allowed to authenticate page tables it may correspondingly be the recipient of the integrity error report).

[0039] 5 is a flow diagram illustrating a series of steps performed according to an exemplary method. In step 200, a memory access request is received. Then, in step 202, a page table is accessed depending on the virtual address received as part of the memory access request. In step 204, a descriptor in the page table is read, and in step 206, an integrity check value (which may include values ​​from configuration registers such as a mask value and a key) is calculated using the descriptor's translation parameters. Then, in step 208, it is determined whether the calculated integrity check value matches the integrity check value read as part of the descriptor. If there is a match, the integrity of the descriptor is confirmed, and flow proceeds to step 210, where the necessary virtual-to-physical address translation is performed and the memory access is allowed to proceed. Conversely, if a match is determined, the integrity of the descriptor has been compromised, and flow proceeds to step 212, where the memory access is prevented and an error is reported.

[0040] FIG. 6 illustrates a simulator implementation that may be used. While the above embodiments implement the present invention in terms of apparatus and methods for operating specific processing hardware supporting the technology, it is also possible to provide an instruction execution environment according to the embodiments described herein implemented using a computer program. Such computer programs are often referred to as simulators, insofar as they provide a software-based implementation of a hardware architecture. Various simulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators. Typically, a simulator implementation may run on a host processor 330, optionally running a host operating system 320 that supports the simulator program 310. In some configurations, there may be multiple layers of simulation between the hardware and the provided instruction execution environment, and / or there may be multiple different instruction execution environments provided on the same host processor. Historically, powerful processors have been required to provide simulator implementations that run at reasonable speeds, but such an approach may be justified in certain situations, such as when it is desirable to execute code native to another processor for compatibility or reuse reasons. For example, a simulator implementation may provide an instruction execution environment with additional features not supported by the host processor hardware, or may provide an instruction execution environment typically associated with a different hardware architecture. An overview of simulation is given in "Some Efficient Architecture Simulation Techniques," Robert Bedichek, Winter 1990 USENIX Conference, pp. 53-63.

[0041] While embodiments have been described above with reference to particular hardware configurations or features, equivalent functionality may be provided in simulated embodiments through appropriate software configurations or features. For example, particular circuits may be implemented as computer program logic in simulated embodiments. Similarly, memory hardware such as registers or caches may be implemented as software data structures in simulated embodiments. In configurations where one or more of the hardware elements referenced in the foregoing embodiments reside in host hardware (e.g., host processor 330), some simulated embodiments may use the host hardware where applicable.

[0042] Simulator program 310 may be stored on a computer-readable storage medium (which may be a non-transitory medium) and provides a virtual program interface (instruction execution environment) to target code 300 (which may include applications, an operating system, and a hypervisor), which interface is the same as the interface of the hardware architecture modeled by simulator program 310. Thus, program instructions of target code 300, including instructions that result in memory access requests for which the completeness of the necessary translations is to be verified as described above, may be executed using simulator program 310 from within the instruction execution environment, thereby allowing host computer 330, which does not actually have the hardware features of the device (e.g., the memory access control circuitry described above), to emulate such features.

[0043] In general, briefly summarized, an apparatus, method, and program are disclosed for performing a translation from a virtual address of a memory access to a physical address associated with the accessed memory location. When performing the translation, a page table descriptor is accessed that includes translation parameters for the translation. The descriptor further includes an integrity check value, the integrity check value being dependent on the translation parameters.

[0044] In this application, the term "configured to..." is used to mean that an element of a device has a configuration that is capable of performing a defined operation. In this context, "configuration" refers to a method of configuration or interconnection of hardware or software. For example, a device may have dedicated hardware that provides the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured to..." does not imply that the device element needs to be modified in any way to provide the defined operation.

[0045] Although illustrative embodiments have been described in detail herein with reference to the accompanying drawings, it will be understood that the invention is not limited to exact embodiments thereof, and that various changes, additions, and modifications may be made by those skilled in the art without departing from the scope and spirit of the invention as defined by the appended claims. For example, various combinations of the features of the independent claims may be made with the features of the dependent claims without departing from the scope of the invention.

Claims

1. memory access control circuitry that performs translation from the virtual address of a memory access to a physical address associated with the accessed memory location; An apparatus comprising: the memory access control circuitry is configured to access a page table when performing the translation; the page table includes a descriptor containing transformation parameters for the transformation; the descriptor further comprises an integrity check value, the integrity check value being dependent on the transformation parameters; the memory access control circuit includes an integrity check value calculation circuit for generating the integrity check value, the integrity check value calculation circuit including an authenticated integrity check value generation circuit for generating the integrity check value in dependence on a private key; the authenticated integrity check value generation circuitry is configured to generate the integrity check value in response to high-privilege software and to not generate the integrity check value in response to low-privilege software. Device.

2. The memory access control circuit responds to the memory access by: reading the descriptor; calculating an integrity check value of said descriptor that depends on said transformation parameters; allowing the memory access to proceed if the integrity verification value matches the integrity check value; blocking the memory access if the integrity verification value does not match the integrity check value; Perform a descriptor integrity check, including 10. The apparatus of claim 1.

3. 3. The apparatus of claim 2, wherein the descriptor integrity check further comprises signaling an error to privileged software if the integrity verification value does not match the integrity check value.

4. Apparatus according to any one of claims 1 to 3, wherein the integrity check value depends on all the descriptors other than the integrity check value.

5. Apparatus according to any one of claims 1 to 3, wherein the integrity check value depends on fewer of the descriptors than on anything other than the integrity check value.

6. the memory access control circuitry is configured to access the page table through multiple levels of a multi-level page table when performing the translation; two or more levels of the plurality of levels of the multi-level page table include entries that include level-specific integrity check values, the level-specific integrity check values ​​being dependent on the entries; An apparatus according to any one of claims 1 to 5.

7. the memory access control circuitry is configured to access the page table through multiple levels of a multi-level page table when performing the translation; a control descriptor of a control level of the plurality of levels including a control bit, the value of the control bit defining whether subsequent levels of the multi-level page table need to be integrity authenticated by privileged software; An apparatus according to any one of claims 1 to 6.

8. The device according to any one of claims 1 to 7, further comprising a configuration store for holding a mask value, said mask value defining on which elements of said descriptor said integrity check value depends.

9. 7. The apparatus of claim 6, further comprising: a configuration store for holding two or more mask values, for each of two or more levels of the multi-level page table, a respective mask value defining on which elements of the entry the level-specific integrity check value depends.

10. 10. Apparatus according to claim 8 or claim 9, wherein the configuration storage device is a configuration register.

11. A data processing method executed by a processor, comprising: performing a translation from a virtual address of a memory access to a physical address associated with the accessed memory location; performing the translation includes accessing a page table; the page table includes a descriptor containing transformation parameters for the transformation; the descriptor further comprises an integrity check value, the integrity check value being dependent on the transformation parameters; the method further comprising an integrity value generation step of generating the integrity check value in dependence on a private key; the integrity value generating step includes generating the integrity check value for storage as part of the descriptor; the integrity value generating step is performed in response to high-privilege software and not in response to low-privilege software; Data processing methods.

12. performing a descriptor integrity check, the descriptor integrity check including reading the descriptor; calculating an integrity check value of said descriptor that depends on said transformation parameters; allowing the memory access to proceed if the integrity verification value matches the integrity check value; and blocking the memory access if the integrity verification value does not match the integrity check value. The method of claim 11.

13. 13. The method of claim 12, wherein the descriptor integrity check further comprises signaling an error to privileged software if the integrity verification value does not match the integrity check value.

14. A method according to any one of claims 11 to 13, wherein the integrity check value depends on all the descriptors other than the integrity check value.

15. A method according to any one of claims 11 to 13, wherein the integrity check value depends on fewer of the descriptors than on anything other than the integrity check value.

16. performing the translation includes accessing the page table through multiple levels of a multi-level page table when performing the translation; two or more levels of the plurality of levels of the multi-level page table include entries that include level-specific integrity check values, the level-specific integrity check values ​​being dependent on the entries; The method according to any one of claims 11 to 15.

17. performing the translation includes accessing the page table through multiple levels of a multi-level page table when performing the translation; 17. The method of claim 11, wherein a control descriptor of one control level of the plurality of levels includes a control bit, the value of which defines whether subsequent levels of the multi-level page table need to be integrity authenticated by privileged software.

18. The method of any one of claims 11 to 17, further comprising storing a mask value, said mask value defining on which elements of said descriptor said integrity check value depends.

19. 17. The method of claim 16, further comprising storing two or more mask values, for each of the two or more levels of the multi-level page table, a respective mask value defining which elements of the entry depend on the level-specific integrity check value.

20. 1. A computer program for controlling a host data processing apparatus to provide an instruction execution environment for execution of target code, comprising: memory access control logic that performs a translation from a virtual address of a memory access to a physical address associated with the accessed memory location; the memory access control logic is configured to access a page table when performing the translation; the page table includes a descriptor containing transformation parameters for the transformation; the descriptor further comprises an integrity check value, the integrity check value being dependent on the transformation parameters; the memory access control logic includes integrity check value calculation logic for generating the integrity check value, the integrity check value calculation logic including authenticated integrity check value generation control logic for generating the integrity check value in dependence on a private key; the authenticated integrity check value generation control logic is configured to generate the integrity check value in response to high-privilege software and to not generate the integrity check value in response to low-privilege software. Computer program.

21. 21. A computer-readable storage medium storing the computer program of claim 20.

Images