Patent Description:
A data processing system may comprise memory access control circuitry to perform a translation of a virtual address of a memory access to a physical address associated with a memory location to be accessed. <CIT>discloses a method for detecting and correcting mapping table errors.

The present techniques will be described further, by way of example only, with reference to embodiments thereof as illustrated in the accompanying drawings, to be read in conjunction with the following description, in which:.

Data processing systems may support the use of virtual memory, whereby address translation capability is provided to translate a virtual address specified by a memory access request into a physical address associated with a memory location to be accessed. The mappings between virtual addresses and physical addresses may be defined in one or more page table structures. The page table entries within the page table structures could also define some access permission information which may control whether a given software process executing in the data processing system is allowed to access a particular address.

In some examples herein there is an apparatus comprising: memory access control circuitry to perform a translation of a virtual address of a memory access to a physical address associated with a memory location to be accessed, wherein the memory access control circuitry is arranged to access a page table when performing the translation, wherein the page table comprises a descriptor comprising translation parameters for the translation, and wherein the descriptor further comprises an integrity check value, wherein the integrity check value is dependent on the translation parameters.

The page tables and the descriptors which they comprise are stored in memory and therefore require memory accesses in order for them to be retrieved, so that the address translations and access permissions which they define can be implemented. The memory access control circuitry which performs the translation of a virtual address to a physical address may be provided with its own local storage capability such that page table entries retrieved from memory can be quickly reused, i.e. without incurring the latency associated with a memory access. Such local storage capability may for example be in the form of a cache structure, of which a translation lookaside buffer (TLB) is just one example. Nevertheless the definitive copy of a given page table entry is stored in memory and this must be retrieved at least once initially by means of a memory access. The present techniques recognise that in this context such page table entries could be vulnerable to memory corruption, whether this is due to a random event such as radiation strike causing one or more bits in memory to flip or whether it is due to an intentional attack, such as error injection, i.e. carried out by a malicious agent. The provision of an integrity check value within the descriptor itself provides a defence against such corruption and furthermore, and where the integrity check value is dependent on the translation parameters of the descriptor, this defence specifically protects those translation parameters. In consequence the address translations and memory access permissions which the descriptor defines are also so protected.

The integrity check value and its relationship to the translation parameters of the descriptor may be used in a variety of ways in order to provide an integrity confirmation. On the one hand this information may be used by software executing in a data processing system of which the apparatus forms part, whether when writing to a page table in order to define the parameters of the descriptor or when reading from the page table in order to make use of the parameters given by the descriptor. On the other hand this information may be used by hardware, for example the apparatus itself, when reading from the page table in order to make use of the parameters given by the descriptor, e.g. as part of a hardware implemented address translation process.

In some examples the memory access control circuitry is responsive to the memory access to perform a descriptor integrity check comprising: reading the descriptor; calculating an integrity verification value dependent on the translation parameters of the descriptor; and when the integrity verification value matches the integrity check value, allowing the memory access to proceed, and when the integrity verification value does not match the integrity check value, blocking the memory access. Accordingly when handling memory access requests the descriptor integrity check may be an integral part of that handling. Furthermore although the descriptor integrity check can be carried out with respect to a descriptor which has just been retrieved from memory, the descriptor integrity check is not limited to only being carried out at that juncture and any time the descriptor is used its integrity can be so verified.

The apparatus may be arranged to respond in a variety of ways when a descriptor integrity check fails, i.e. the integrity of the descriptor is not confirmed. In some examples the descriptor integrity check further comprises, when the integrity verification value does not match the integrity check value, signalling an error to privileged software. The privileged software can then take one or more further steps in response to this signalled error and these further step(s) may take a variety of forms. To give just some examples the privileged software may take action to repair the descriptor and its integrity check value, the privileged software may take action with respect to a perceived source of the error that has occurred, for example where the possibility exists that the error has occurred because of a software based attack, and the privileged software may prevent one or more instances of currently executing less privileged software from continuing.

The integrity check value is dependent on the translation parameters of the descriptor and as described above this provides specific protection for the address translations which can then be performed when using this descriptor. Nevertheless various configurations are proposed for the extent to which the integrity check value is dependent on the content of the descriptor. In some examples the integrity check value is dependent on all of the descriptor other than the integrity check value. In some examples the integrity check value is dependent on less than all of the descriptor other than the integrity check value. When the integrity check value is dependent on less than all of the descriptor (other than the integrity check value itself) this therefore means that the descriptor may have content which is not protected by the integrity check value. This provides the opportunity for the descriptor to hold certain data, which is related to memory access to the region of memory to which the descriptor applies, but which may be allowed to be modified (i.e. without this causing the descriptor integrity check to fail). For example such data could be bits indicating recent access to or modification of the region of memory, where these bits are used by a memory page management system to determine what data to hold locally and what to put out to memory. Thus a useful balance is achieved in which the integrity of the descriptor with regards to the translations and permissions it defines can be verified, yet still allowing less privileged software to carry out other aspects of memory management (such that these do not also have to be performed by more privileged software).

In some examples the memory access control circuitry is arranged to access the page table via multiple levels of a multi-level page table when performing the translation, and wherein more than one level of the multiple levels of the multi-level page table comprises an entry comprising a level-specific integrity check value, wherein the level-specific integrity check value is dependent on the entry. The address translations may be defined by means of a multi-level page table (i.e. a page table hierarchy). A higher level of such a page table arrangement may point to a next-lower level, and may also provide translation parameters for the translation. Due to the hierarchical structure, more generally applied definitions can be provided by higher levels of the hierarchy, whilst memory region specific definitions may be provided by the lowest levels of the hierarchy. Providing a level-specific integrity check value for more than one level of the multiple levels of the multi-level page table provides a broader integrity check for the page table process which is used to derive the required translation parameters.

In some examples the memory access control circuitry is arranged to access the page table via multiple levels of a multi-level page table when performing the translation, and wherein a control descriptor of a control level of the multiple levels comprises a control bit, wherein a value of the control bit defines whether subsequent levels of the multi-level page table must be integrity authenticated by privileged software. This provides flexibility in the management of memory regions, wherein for example more privileged software can validate a larger region of the memory address space, while sub-regions can be left to be directly managed by less privileged software. This control bit may be set at any level of a multi-level page table arrangement, and the value of this control bit is then propagated through the further levels of the page tables.

Flexibility may be provided in terms of configuring the elements of the descriptor on which the integrity check value depends. In some examples the apparatus further comprises configuration storage holding a mask value, wherein the mask value defines which elements of the descriptor the integrity check value is dependent upon. In examples with level-specific integrity check values for a multi-level page table the apparatus may further comprise configuration storage holding more than one mask value, wherein for each of the more than one level of the multi-level page table a respective mask value defines which elements of the entry the level-specific integrity check value is dependent upon. Such configuration storage may take a variety of forms. In some examples this storage is one or more configuration registers.

Whilst it is necessary for a trusted entity to originally define the descriptor and to calculate its integrity check value, this trusted entity may be provided in a variety of ways and may itself be invoked by a range of other system entities. The memory access circuitry comprises integrity verification value calculation circuitry to generate the integrity check value, wherein the integrity verification value calculation circuitry comprises authenticated integrity check value generation circuitry to generate the integrity check value in dependence on a private key. The use of a private key (such as in the in the generation of a MAC (message authentication code) as the integrity check value), provides a mechanism for ensuring that the integrity check value can be trusted. In some examples the authenticated integrity check value generation circuitry may be invoked by even less trusted system entities (e.g. less privileged software). However according to the invention, authenticated integrity check value generation circuitry is arranged to generate the integrity check value in response to more-privileged software and is arranged not to generate the integrity check value in response to less-privileged software. A further mechanism for protecting the integrity check value would be to restrict actions which are allowed to take place with respect to a stored descriptor. Access to the descriptor and its integrity check value can then be provided to a range of entities, as long as reliable demarcation is implemented for what actions that range of entities is allowed to take with respect to the descriptor and its integrity check value. However it may be preferred to allow wider access rights (including modification) to the descriptor stored in memory, for example to allow flexibility in terms of the range of entities that can carry out memory management actions with respect to the memory region in which the descriptor is stored. In examples in which the authenticated integrity check value generation circuitry is arranged to generate the integrity check value in response to more-privileged software and is arranged not to generate the integrity check value in response to less-privileged software this therefore means that only a trusted entity (e.g. more-privileged software) can cause the generation of the integrity check value. Thus, whilst a non-trusted entity (e.g. less-privileged software) may be allowed to fully access (i.e. even modify) the descriptor (including its integrity check value) in memory, an integrity check value which has not been generated in dependence on the private key would then fail a subsequent integrity check verification.

In some examples herein there is a data processing method comprising: performing a translation of a virtual address of a memory access to a physical address associated with a memory location to be accessed, wherein performing the translation comprises accessing a page table, wherein the page table comprises a descriptor comprising translation parameters for the translation, and wherein the descriptor further comprises an integrity check value, wherein the integrity check value is dependent on the translation parameters.

In some examples the method further comprises performing a descriptor integrity check, wherein the descriptor integrity check comprises: reading the descriptor; calculating an integrity verification value dependent on the translation parameters of the descriptor; and when the integrity verification value matches the integrity check value, allowing the memory access to proceed, and when the integrity verification value does not match the integrity check value, blocking the memory access.

In some examples the descriptor integrity check further comprises, when the integrity verification value does not match the integrity check value, signalling an error to privileged software. In some examples the integrity check value is dependent on all of the descriptor other than the integrity check value. In some examples the integrity check value is dependent on less than all of the descriptor other than the integrity check value.

In some examples performing the translation comprises accessing the page table via multiple levels of a multi-level page table when performing the translation, and wherein more than one level of the multiple levels of the multi-level page table comprises an entry comprising a level-specific integrity check value, wherein the level-specific integrity check value is dependent on the entry.

In some examples the method further comprises storing a mask value, and wherein the mask value defines which elements of the descriptor the integrity check value is dependent upon. In some examples the method further comprises storing more than one mask value, wherein for each of the more than one level of the multi-level page table a respective mask value defines which elements of the entry the level-specific integrity check value is dependent upon.

In some examples the method further comprises an integrity value generation step of: generating the integrity check value in dependence on a private key.

In some examples the integrity value generation step comprises: generating the integrity check value for storage as part of the descriptor, wherein the integrity value generation step is performed in response to more-privileged software and is not performed in response to less-privileged software.

In some examples there is a computer program for controlling a host data processing apparatus to provide an instruction execution environment for execution of target code, the computer program comprising: memory access control logic to perform a translation of a virtual address of a memory access to a physical address associated with a memory location to be accessed, wherein the memory access control logic is arranged to access a page table when performing the translation, wherein the page table comprises a descriptor comprising translation parameters for the translation, and wherein the descriptor further comprises an integrity check value, wherein the integrity check value is dependent on the translation parameters.

In some examples there is a computer-readable storage medium storing the computer program mentioned above.

Some particular embodiments are now described with reference to the figures.

<FIG> schematically illustrates an example of a data processing system <NUM> having a processor <NUM> connected via an interconnect <NUM> to a memory <NUM>. The processor <NUM> is shown to comprise processing circuitry <NUM>, memory access control <NUM>, and a set of configuration registers <NUM>. As part of the data processing operations which it carries out, the processing circuitry <NUM> generates memory access requests, where the memory location to which access is sought is specified as a virtual address. Memory access control circuitry <NUM> (e.g. a memory management unit (MMU) translates the virtual address into a physical address through one or more stages of address translation based on page table data defined in page table structures <NUM> stored in the memory <NUM>. The memory <NUM> also stores data <NUM> at locations specified by physical addresses. The memory access control <NUM> comprises integrity verification circuitry <NUM> and address translation storage <NUM>. The address translation storage <NUM> is provided to hold copies of parts of the page table data which had previously been retrieved from memory. Accordingly when a virtual address is encountered by the memory access control <NUM> (as part of a memory access request) for which the required page table data for performing the address translation is not currently present in the address translation storage <NUM>, an address translation request is generated by the memory access control <NUM> to retrieve this page table data from the page table <NUM>. The page table data returned from memory <NUM> is then stored in the address translation storage <NUM>. The address translation storage <NUM> may have a cache structure (e.g. a translation lookaside buffer (TLB)). With the required page table data then locally present, the memory access control <NUM> can then not only determine the physical address corresponding to the virtual address, but also determine whether this memory access should be allowed to proceed based on permissions information forming part of the page table data. Additionally the memory access control <NUM> uses its integrity verification circuitry <NUM> to verify the integrity of page table data, and in particular the integrity of descriptors in the page table data providing the translation parameters. This integrity checking process and the circuitry components of the integrity verification circuitry to support it are described in more detail with respect to the figures which follow. The integrity checking may be performed solely on the basis of the descriptor itself (and the integrity check value which it comprises), but may also be performed taking into account further configuration data and <FIG> shows a configuration registers <NUM> within the processor <NUM> providing such further configuration data to the integrity verification circuitry <NUM>.

<FIG> schematically illustrates a descriptor <NUM> comprising various page table descriptor values <NUM> and an integrity check value <NUM>. In order to carry out a descriptor integrity check with respect to the descriptor <NUM>, an integrity check calculation is performed on the page table descriptor values <NUM> by the integrity check calculation circuitry <NUM>. Any technically feasible integrity check calculation may be used for the verification of the integrity of the descriptors, for example MAC (message authentication code), CRC (cyclic redundancy check), and so on. However the security of the system is further improved when (as in the case of a MAC, though not a CRC) a private key forms part of the integrity check calculation, because this protects against an intentional malicious modification of the translation parameters of the descriptor and its integrity check value. Non-authenticated integrity check values can nevertheless be used and still protect against non-malicious modification of the translation parameters (such as due to a radiation strike causing a bit flip). However in the example of <FIG> the integrity check calculation is authenticated with reference to a securely held private key <NUM>. The value generated by the integrity check calculation is then compared by comparison circuitry <NUM> to the integrity check value <NUM> which forms part of the descriptor <NUM>. It will therefore be understood that the same integrity check calculation was previously performed when descriptor <NUM> was defined and stored. When the comparison circuitry <NUM> determines that the two values are the same then the integrity of the descriptor <NUM> is verified. Conversely when the comparison circuitry <NUM> determines that the two values are not the same then either the page table descriptor values <NUM> or the integrity check value <NUM> (or both) have been modified since the descriptor <NUM> was defined and stored. Whilst the process shown in <FIG> has been described in terms of hardware which carries out the descriptor integrity check (e.g. within the integrity verification circuitry <NUM> of the memory access control circuitry <NUM> in the example of <FIG>), the same descriptor integrity check can also be carried out by software components of the data processing system. In this latter case the integrity check calculation <NUM> and the comparison <NUM> are provided by routines of the relevant software component.

<FIG> schematically illustrates a descriptor <NUM> in a variant on the example of <FIG>. Here the descriptor <NUM> is shown to comprise a set of translation parameters <NUM>, other information <NUM>, and an integrity check value <NUM>. The integrity check value <NUM> is shown being created in dependence on the translation parameters <NUM> by the integrity check calculation <NUM>. As in the case of <FIG> the integrity check calculation is authenticated with reference to a securely held private key (not explicitly shown in <FIG>). Accordingly, the process shown in <FIG> can represent part of an initialisation process for the data processing system during which a trusted system entity (e.g. more privileged software) defines the descriptor <NUM> (including calculating its integrity check value <NUM>) and causes storage of the descriptor <NUM> in the page tables <NUM> of the memory <NUM>. Thus in that scenario the integrity check calculation <NUM> is performed by software, but in other examples the generation of the integrity check value <NUM> can be performed by hardware configured to operate in a trusted manner. Hence it may be the integrity verification circuitry <NUM> of the memory access control <NUM> which performs the integrity check calculation (possibly as a task delegated to it by trusted software) to generate the integrity check value <NUM> before the descriptor <NUM> is stored to memory. Note also that the descriptor <NUM> is shown to comprise other information <NUM> in addition to the translation parameters <NUM> and that the integrity check calculation <NUM> is performed taking the translation parameters <NUM> as an input without inclusion of the other information <NUM>. Accordingly whilst all the translation parameters <NUM> are included in the integrity check calculation, such that their integrity can be protected by the use of the integrity check value <NUM>, it is not necessary for the entirety of the descriptor <NUM> to be included in the integrity check calculation <NUM>.

<FIG> schematically illustrates a descriptor <NUM> in a variant on the examples of <FIG>. As in the case of the descriptor <NUM> in <FIG>, the descriptor <NUM> is shown to comprise a set of translation parameters <NUM>, other information <NUM>, and an integrity check value <NUM>. Here the integrity check calculation <NUM> is shown to receive the translation parameters <NUM>, the other information <NUM>, and a mask value <NUM> as inputs. As in the case of <FIG> the integrity check calculation is authenticated with reference to a securely held private key (not explicitly shown in <FIG>). The mask value is provided by the content of a configuration register (e.g. from configuration registers <NUM> in <FIG>). The mask value <NUM> controls the extent to which the other information <NUM> is used in the integrity check calculation <NUM>. Thus in one maximal configuration the mask value may cause the integrity check calculation <NUM> to use all of the other information <NUM> (in addition to the translation parameters <NUM>) and the integrity check value is than calculated in the same manner as the example of <FIG>. Conversely in another minimal configuration the mask value may cause the integrity check calculation <NUM> to use none of the other information <NUM> (i.e. only to use the translation parameters <NUM>) and the integrity check value is than calculated in the same manner as the example of <FIG>. The mask value may be freely defined between these two extremes, to use some but not all of the other information <NUM>. The other information <NUM> may be used for a range of purposes related to the function of the descriptor. For example it may hold various meta-state data relating to the usage of the descriptor and the memory region it relates to. Where (part of) the other information is required to be robust and to be protected against corruption, it is included in the integrity check calculation. Where (part of) the other information does not have this requirement, it can be excluded from the integrity check calculation. One usage of at least part of this other information may be to provide software with usable bits in the descriptor to record and read information related to the memory region to which the descriptor relates. For example a memory management process can use such bits to hold "access" and "dirty" bits, indicating access to and modification of the memory region. The present techniques are not restricted to any particular size of descriptor, but in one configuration the descriptors <NUM>, <NUM>, and <NUM> are <NUM>-bit page table entry. Hence as one example subdivision, the page table entry comprises <NUM> bits of permission fields for the translation, <NUM> bits of meta-state (other) data, and an <NUM>-bit integrity check value.

<FIG> schematically illustrates the use of a multi-level page table in one example. A virtual memory address <NUM> is shown to be subdivided into three portions. A first portion <NUM> of the address is used when accessing a higher level <NUM> of the page table hierarchy to select an entry <NUM>. The entry <NUM> comprises parameters <NUM> related to the address translation as well as an integrity check value <NUM>. The parameters <NUM> indicate the base address of a lower level <NUM> of the page table hierarchy, which is then accessed using a second portion <NUM> of the address to select an entry <NUM>. This entry <NUM> also comprises parameters <NUM> related to the address translation as well as an integrity check value <NUM>. The parameters <NUM> indicate the base address of a 4kB memory page and the third portion <NUM> of the address indicates the physical address <NUM> to which access is sought. A multilevel page table in which integrity check values are used at more than one level may comprise more than two levels, but the illustration of <FIG> only illustrates two merely for brevity and clarity.

<FIG> schematically illustrates circuitry for performing integrity verification of entries of a multilevel page table such as that shown in <FIG>. Such circuitry may for example be provided as part of the integrity verification circuitry <NUM> in the example of <FIG>. Accordingly from an entry <NUM> from a first level of the multilevel page table the translation parameters <NUM> are provided as an input to the integrity check calculation circuitry <NUM>. A further input to the integrity check calculation circuitry <NUM> is a mask value <NUM> which defines what part of the translation parameters <NUM> should be included in the calculation. The result of the integrity check calculation is passed to the comparison circuitry <NUM> for comparison with the integrity check value <NUM> from the entry <NUM>. Similarly from an entry <NUM> from a second level of the multilevel page table the translation parameters <NUM> are provided as an input to the integrity check calculation circuitry <NUM>. Although integrity check calculation circuitry <NUM> is illustrated separately from the integrity check calculation circuitry <NUM>, these may be provided as one and the same circuitry which performs the integrity check calculation for each level sequentially, as each level is accessed in sequence. The same applies to the comparison circuitry <NUM> and <NUM>. In one example the result of the comparison <NUM> determines whether the calculation <NUM> and the comparison <NUM> are performed at all, in that if the comparison <NUM> produces a negative outcome an error is reported immediately and the page table lookup process is halted at that point. A further input to the integrity check calculation circuitry <NUM> is a mask value <NUM> which defines what part of the translation parameters <NUM> should be included in the calculation. This may be the same mask value as mask value <NUM> or may be specific to this level. The result of the integrity check calculation is passed to the comparison circuitry <NUM> for comparison with the integrity check value <NUM> from the entry <NUM>. As in the case of <FIG> the integrity check calculations are authenticated with reference to a securely held private key (not explicitly shown in <FIG>). The confirmed integrity of both entries <NUM> and <NUM> confirms the overall integrity of the address translation being performed. In the above mentioned example where the calculation <NUM> and the comparison <NUM> are only performed at all, if the outcome of comparison <NUM> is positive, then a positive outcome of the comparison <NUM> also necessarily confirms the overall integrity. Schematically in <FIG> this is represented by the results of the two comparisons (<NUM> and <NUM>) being brought together (as schematically illustrated by the AND gate <NUM>) to give an overall integrity confirmation.

<FIG> schematically illustrates the use of a control bit at a higher level of a multi-level page table to delegate authentication of descriptors at subsequent levels from more privileged software to less privileged software. A descriptor <NUM> at a higher level of a multi-level page table (for example at the level <NUM> in the example of <FIG>) comprises translation parameters <NUM>, an integrity check value <NUM>, and a control bit <NUM>. The integrity check value <NUM> is authenticated by a calculation <NUM>, which is under the control of privileged software. If the integrity check value <NUM> is not verified, then an error is reported to the privileged software and the process stops at this point. However when the integrity check value <NUM> is verified, the control bit <NUM> then determines whether authentication of subsequent levels of the multi-level page table (e.g. level <NUM> in the example of <FIG>) is to continue to be handled by privileged software or is to be delegated to non-privileged software. Accordingly from this determination <NUM>, when the control is delegated, a descriptor <NUM> at the next level is then authenticated by non-privileged software. The descriptor <NUM> comprises translation parameters <NUM> and an integrity check value <NUM>. Under the control of the non-privileged software the integrity check value <NUM> is authenticated by a calculation <NUM>. If the integrity check value <NUM> is not verified, then an error is reported to the non-privileged software and the process stops at this point, but otherwise it proceeds. When the determination <NUM> does not delegate the control, the descriptor <NUM> is again authenticated <NUM> by the privileged software. Control may be delegated <NUM> at any level of the multi-level page table which has at least one subsequent level. Hence, when the descriptor <NUM> is authenticated by the privileged software, its own control bit <NUM> is examined to determine whether to delegate control. Control bit <NUM> is not used by the non-privileged software when authenticating the descriptor <NUM>. It will be appreciated that this mechanism for optionally delegating authentication control from more privileged software to less privileged software may therefore be implemented across any number of levels of a multi-level page table. Accordingly more privileged software can validate a larger region of the address space, while leaving smaller sub-regions (within that larger region) to be directly managed by less privileged software. The control bit set within a given validated page table entry is fed down into the further levels of the page tables, for example so that control is held by more privileged software until it is delegated, and conversely once control is delegated to less privileged software it remains delegated to the less privileged software.

<FIG> schematically illustrates an example of a data processing system in which a data processor <NUM> accesses a memory <NUM>. More specifically, processing circuitry <NUM> issues memory access requests, which are processed and checked by memory access control <NUM>. Memory access checking circuitry <NUM> checks that a given memory access is in accordance with the permissions defined for the memory region to which access is sought. Those memory access requests which are permitted are allowed to proceed to the memory <NUM>. Software executing in the processing circuitry <NUM> may operate at different levels of privilege, as illustrated by the less privileged software <NUM> and the more privileged software <NUM>. Access to page tables in memory <NUM>, in particular to a descriptor <NUM>, is permitted for both the less privileged software <NUM> and the more privileged software <NUM>. As described elsewhere herein, when the descriptor <NUM> is retrieved from memory <NUM>, its integrity is verified by the integrity verification circuitry <NUM> of the memory access control circuitry <NUM> by performing the integrity check calculation based on the translation parameters <NUM> and determining if the resulting value is the same as the integrity check value <NUM> forming part of the descriptor <NUM> retrieved. In some examples, either the less privileged software <NUM> or the more privileged software <NUM> is permitted to invoke the integrity check calculation (authenticated with reference to a securely held private key), a process which includes calculating the integrity check value <NUM> on the basis of the translation parameters <NUM>. However in the example shown in <FIG> only the more privileged software <NUM> is permitted to invoke the integrity check calculation (authenticated with reference to a securely held private key), a process which includes calculating the integrity check value <NUM> on the basis of the translation parameters <NUM>. Either the less-privileged software <NUM> or the more privileged software <NUM> can be allowed to modify the integrity check value <NUM> of a descriptor <NUM> which is already stored in memory (and equally to modifying the translation parameters <NUM>). Thus the memory access checking circuitry <NUM> can allow the less privileged software <NUM> to access the descriptor <NUM> in memory <NUM>, and in some examples can allow the less privileged software <NUM> to authenticate a page table, but in the example shown in <FIG> only the more privileged software <NUM> can authenticate a page table. The less privileged software <NUM> can therefore handle various aspects of memory management which involve the use of the descriptor <NUM>, but in instances where authentication of a descriptor is required, for example in a setup phase before normal use, the less privileged software <NUM> must send an authentication request to the more privileged software <NUM> to carry out such authentication. The integrity verification circuitry <NUM> is further arranged to report integrity errors, which in the example of <FIG> are sent to the more privileged software <NUM> (although when less privileged software <NUM> is permitted to authenticate a page table it can correspondingly be the recipient of integrity error reports.

<FIG> is a flow diagram showing a sequence of steps which are taken according to an example method. At step <NUM> a memory access request is received. Then at step <NUM> a page table is accessed dependent on the virtual address received as part of the memory access request. A descriptor in the page table is read at step <NUM> and at step <NUM> an integrity check value is calculated using translation parameters of the descriptor (and may include values from configuration registers, such as a mask value and a key). It is then determined at step <NUM> if calculated integrity check value matches the integrity check value read as part of the descriptor. If it does match, then the integrity of the descriptor has been verified and the flow proceeds to step <NUM>, where the virtual to physical address translation required is performed and the memory access is permitted to proceed. Conversely, if it is determined that it does not match, then the integrity of the descriptor has been compromised and the flow proceeds to step <NUM>, where the memory access is prevented and an error is reported.

<FIG> illustrates a simulator implementation that may be used. Whilst the earlier described embodiments implement the present invention in terms of apparatus and methods for operating specific processing hardware supporting the techniques concerned, it is also possible to provide an instruction execution environment in accordance with the embodiments described herein which is implemented through the use of a computer program. Such computer programs are often referred to as simulators, insofar as they provide a software based implementation of a hardware architecture. Varieties of simulator computer programs include emulators, virtual machines, models, and binary translators, including dynamic binary translators. Typically, a simulator implementation may run on a host processor <NUM>, optionally running a host operating system <NUM>, supporting the simulator program <NUM>. In some arrangements, there may be multiple layers of simulation between the hardware and the provided instruction execution environment, and/or multiple distinct instruction execution environments provided on the same host processor. Historically, powerful processors have been required to provide simulator implementations which execute at a reasonable speed, but such an approach may be justified in certain circumstances, such as when there is a desire to run code native to another processor for compatibility or re-use reasons. For example, the simulator implementation may provide an instruction execution environment with additional functionality which is not supported by the host processor hardware, or provide an instruction execution environment typically associated with a different hardware architecture. An overview of simulation is given in "<NPL>.

To the extent that embodiments have previously been described with reference to particular hardware constructs or features, in a simulated embodiment, equivalent functionality may be provided by suitable software constructs or features. For example, particular circuitry may be implemented in a simulated embodiment as computer program logic. Similarly, memory hardware, such as a register or cache, may be implemented in a simulated embodiment as a software data structure. In arrangements where one or more of the hardware elements referenced in the previously described embodiments are present on the host hardware (for example, host processor <NUM>), some simulated embodiments may make use of the host hardware, where suitable.

The simulator program <NUM> may be stored on a computer-readable storage medium (which may be a non-transitory medium), and provides a program interface (instruction execution environment) to the target code <NUM> (which may include applications, operating systems and a hypervisor) which is the same as the interface of the hardware architecture being modelled by the simulator program <NUM>. Thus, the program instructions of the target code <NUM>, including those that result in the generation of memory access requests for which the integrity of the required translations is verified as described above, may be executed from within the instruction execution environment using the simulator program <NUM>, so that a host computer <NUM> which does not actually have the hardware features of the apparatuses (e.g. the memory access control circuitry) discussed above can emulate these features.

In brief overall summary apparatuses, methods, and programs for performing a translation of a virtual address of a memory access to a physical address associated with a memory location to be accessed are disclosed. A page table descriptor is accessed when performing the translation, which comprises translation parameters for the translation. The descriptor further comprises an integrity check value, wherein the integrity check value is dependent on the translation parameters.

Claim 1:
Apparatus (<NUM>) comprising:
memory access control circuitry (<NUM>) to perform a translation of a virtual address of a memory access to a physical address associated with a memory location to be accessed,
wherein the memory access control circuitry is arranged to access a page table (<NUM>) when performing the translation,
wherein the page table comprises a descriptor (<NUM>) comprising translation parameters (<NUM>) for the translation,
and wherein the descriptor further comprises an integrity check value (<NUM>), wherein the integrity check value is dependent on the translation parameters,
wherein the memory access circuitry comprises integrity verification value calculation circuitry (<NUM>) to generate the integrity check value, wherein the integrity verification value calculation circuitry comprises authenticated integrity check value generation circuitry to generate the integrity check value in dependence on a private key (<NUM>), and
wherein the authenticated integrity check value generation circuitry is arranged to generate the integrity check value in response to privileged software and is arranged not to generate the integrity check value in response to software having less privilege than the privileged software.