This disclosure relates to the field of data processing systems. More particularly, this disclosure relates to address translation within a virtualized system.
It is known to provide virtualized data processing systems in which a virtual address generated by a guest operating system is translated to a physical address of a memory system together with the determination of one or more associated memory permissions (and characteristics). Such a translation and permission determination process may be performed in accordance with a first stage of address translation and permission data managed by a guest operating system and a second stage of address translation and permission data managed by a hypervisor. The two stages of address translation and permission data supporting virtualization allow the guest operating system to operate as if it were alone and the hypervisor to manage memory translation and permissions at a higher level in order, for example, to support the presence of multiple guest operating systems, to enforce higher levels of security, or for some other reason. However, the provision of two stages of address translation and permission data has the result that when both stages of this address translation and permission data need to be accessed, such as via a page table walk, relatively long processing delays can result.
At least some embodiments of the present disclosure provide apparatus for processing data comprising:
address translation circuitry to translate a virtual address of a memory access generated by a guest operating system to a physical address of a memory system and to determine one or more associated memory permissions in accordance with a first stage of address translation and permission data managed by said guest operating system and a second stage of address translation and permission data managed by a hypervisor;
mismatch detecting circuitry to detect a mismatch between said first stage of address translation and permission data and said second stage of address translation and permission data; and
speculative mismatch response provision circuitry responsive to detection of said mismatch to trigger a speculative mismatch response provision operation to provide speculative mismatch response for use in handling said mismatch.
At least some embodiments of the present disclosure provide apparatus for processing data comprising:
address translation means for translating a virtual address of a memory access generated by a guest operating system to a physical address of a memory system and for determining one or more associated memory permissions in accordance with a first stage of address translation and permission data managed by said guest operating system and a second stage of address translation and permission data managed by a hypervisor;
mismatch detecting means for detecting a mismatch between said first stage of address translation and permission data and said second stage of address translation and permission data; and
speculative mismatch response provision means responsive to detection of said mismatch for triggering a speculative mismatch response provision operation to provide speculative mismatch response for use in handling said mismatch.
At least some embodiments of the present disclosure provide a method of processing data comprising:
in accordance with a first stage of address translation and permission data managed by a guest operating system and a second stage of address translation and permission data managed by a hypervisor, translating a virtual address of a memory access generated by said guest operating system to a physical address of a memory system and determining one or more associated memory permissions;
detecting a mismatch between said first stage of address translation and permission data and said second stage of address translation and permission data; and
in response to detection of said mismatch, triggering a speculative mismatch response provision operation to provide speculative mismatch response for use in handling said mismatch.
Further aspects, features and advantages of the present technique will be apparent from the following description of examples, which is to be read in conjunction with the accompanying drawings.
The first translation within the first translation (page) table 2 uses the high order bits VA [31:20] of the input virtual address as an index to generate a first intermediate physical address IPA0. Virtualized translation table base register VTTBR stored within a configuration register of the system provides a pointer to the start address of the first translation (page) table 4 within the second stage of address translation and permission data managed by the hypervisor. Successive portions of the first intermediate physical address IPA0 are then used as indexes into this first translation table 4 and subsequent translation tables 6, 8 of the second stage of address translation and permission data in order to generate a first portion of the physical address translation PA0. This first portion of the physical address PA0 provides a pointer to a second translation table 10 within the first stage of address translation and the permission data managed by the guest operating system. A lower significant portion of the input virtual address, namely VA [19:12], is then used as an index into this second page 10 of the first stage of address translation admission data. This generates a second intermediate physical address IPA1. The virtual translation table base register and the second intermediate physical address IPA1 are then used to perform a second Phase of page table walking through page tables 12, 14, 16 of the second stage of address translation and permission data as managed by the hypervisor in order to generate the second portion of the physical address PA1. In this way, a virtual address VA of a memory access generated by the guest operating system is translated via an intermediate physical address IPA to form a physical address PA.
As well as performing the address translation, the first stage of address translation and permission data also yields permissions and other characteristics associated with a memory address as specified and managed by the guest operating system. Similarly, the second stage of address translation and permission data yields permissions and other characteristics for that same memory access as managed by the hypervisor. It will be appreciated that mismatches may arise between the characteristics of a memory access specified within the first stage of address translation and permission data as managed by the guest operating system and those permissions and other characteristics specified for the same memory access within the second stage of address translation and permission data as managed by the hypervisor. When such mismatches arise, an exception handling routine may be triggered to operate under control of the hypervisor in order to resolve the mismatch, such as by updating the second stage of address translation and permission data as specified by the hypervisor, or by triggering an appropriate security response if it appears that a memory access which is being attempted by a guest operating system, and which is permitted by the permissions and other characteristics of that guest operating system, is one which the hypervisor using its own permissions and other characteristics indicate should not be permitted. The hypervisor when responding to such a mismatch may need to examine and modify the contents of the both the first stage of address translation permission data and the second stage of address translation and permission data. In order to access the appropriate portions of this data, the hypervisor may need to determine at least some of the intermediate physical addresses IPAs which were generated during a corresponding address translation in order that the appropriate entries within the tables 2 to 16 can be examined, and if necessary modified. However, the intermediate physical address will typically be a parameter which is dynamically determined within page table walking circuitry of a memory management unit and is not normally available to the hypervisor program. In order to address this, the data processing system may be provided with an intermediate physical address lookup instruction ATS1E1 which when issued to a memory management unit will cause that memory management unit to return address translation and permission data associated with the first stage (S1) of address translation and permission data when executing at exception level E1, but without performing all of the second stage of address translation and permission data generation (e.g. it performs steps 2, 4, 6, 8 and 10, but not steps 12, 14 and 16). Thus, the hypervisor may be returned (e.g. by storing the IPA within a predetermined special purpose register) one or more of the intermediate physical addresses IPAs in order that these may then be used by appropriate mismatch (fault) handling software executed under control of the hypervisor to perform an appropriate response. The memory management unit responds to the intermediate physical address lookup instruction ATS1E1 by returning at least the second-stage intermediate physical address (and any other data required by the architecture to respond to the ATS1E1 instruction).
It will be appreciated that the mismatch between the first stage of address translation and permission data and the second stage of address translation and permission data could take a variety of different forms. However, one particular situation which can arise is where the mismatch concerned relates to a second-stage permission restriction for a second-stage-restricted memory access. This is a memory access that is subject to a virtual address via intermediate physical address to physical address translation and is one in which a second-stage permission restriction arises. Such a second-stage permission restriction may arise when the second-stage restricted memory access is one which is indicated as a non-restricted access (e.g. permitted) by the first stage of address translation and permission data and is indicated as a restricted access (e.g. not permitted) by the second stage of address translation and permission data. As an example, the memory access received may be a write access. The first stage of address translation and permission data may indicate that such a write access is permitted to the address concerned. However, the second stage of address translation and permission data may indicate that only read access is permitted for that memory access (given the level of privilege, or other characteristics associated with that memory access) and accordingly, is more restrictive. Such a situation need not necessarily indicate inappropriate security threatening behavior of the system, and may rather indicate that some corrective action is needed to the hypervisor to modify the second stage of address translation and permission data to take account of the requirements of the memory access received from the guest operating system. In either case, the hypervisor program in such an example may need to determine the intermediate physical addresses IPAs which were used in performing the translation and permission determination for the received memory access in order that the relevant translation table entries may be read and modified, or confirmed, as necessary. As previous mentioned, the hypervisor program can issue an address translation instruction ATS1E1 to a memory management unit to return the intermediate physical address. However, the page table walking operations associated with determining the intermediate physical address in response to such an address translation instruction are relatively slow and can accordingly reduce overall system performance. Thus, it may be desirable if mechanisms may be provided that are able to permit the hypervisor to obtain a response to its address translation instruction (intermediate physical address look up instruction (ATS1E1)) more rapidly.
As part of the page table walk operation performed by the page table walking circuitry 26, the memory access permissions and other characteristics associated with both the first stage of address translation permission data and the second stage of address translation and permission data are supplied to mismatch detecting circuitry 30. This mismatch detecting circuitry 30 also serves as second-stage permission restriction detecting circuitry as in this example embodiment it serves to detect instances where the second stage of address translation and permission data is more restrictive than the first stage of address translation and permission data. If the second-stage permission restriction detecting circuitry 30 determines that the second stage of address translation and permission data is more restrictive than the first stage of address translation and permission data, then it serves to store the available intermediate physical address data IPA and virtual address VA for the page table walk which has just been performed (and accordingly is still available within the page table walking circuitry 26) into a second-stage-restricted cache memory 32. This provides a virtual address to intermediate physical address mapping that can be accessed using the virtual address. The storing of this virtual address to intermediate physical address mapping constitutes a speculative mismatch response provision operation (more specifically a speculative translation provision operation) which can subsequently be utilized to service an intermediate address lookup instruction received by the memory management unit 22. The mismatch detecting circuitry 30 and the cache 32 accordingly serve as speculative mismatch response provision circuitry (speculative translation provision circuitry) and are responsive to detection of a second-stage permission restriction to trigger a speculative translation provision operation which provides speculative second-stage-restricted data mapping a virtual address VA associated with the second-stage-restricted memory access (the one for which the restriction condition has been detected) to a second-stage intermediate physical address(es) IPA associated with that second-stage-restricted memory access.
The cache 32 may be relatively small and yet store a plurality of entries mapping a virtual address to a last intermediate physical address IPA1. This cache 32 may then be accessed when an intermediate physical address lookup instruction is received and accordingly will serve as intermediate physical address lookup circuitry. If a hit occurs within the cache 32 in response to such an intermediate physical address lookup operation, then the desired intermediate physical address may is returned. The virtual address to intermediate physical address mapping stored within the cache 32 serves as speculative second-stage-restricted data which is stored when the memory management unit 22 itself determines that there is a mismatch in the permission data using the mismatch detecting circuitry 30. Such speculative stored mapping data (speculative second-stage-restricted data) is then used to service any intermediate physical address lookup instructions for which the virtual address VA matches the virtual address stored within that speculative second-stage-restricted data within the cache 32.
If when the cache 32 receives an intermediate address lookup instruction (ATS1E1) and there is a miss, then a page table walking operation is triggered to be performed by the page table walking circuitry 26 and the process illustrated in
Finally,
In the case of a hit within the translation lookaside buffer 42 in response to a received normal translation request, then this results in the return of a translation response by the response interface 46 as before. The hit response is also checked by check permission circuitry 38. If the check performed by the check permission circuitry 38 indicates at the second stage of address translation permission data is more restrictive than the first stage of address translation and permission data, then a speculative page table walk operation is initiated and performed by the page table walking circuitry 44 in order to obtain the last intermediate physical address associated with that translation. This last intermediate physical address IPA is then stored together with the virtual address to which it corresponds into the cache 36. Accordingly, if the response returned from a response interface 46 initiates a permission fault resulting in the hypervisor generating an intermediate address lookup instruction ATS1E1, then this may again be serviced from the cache 36 without waiting for a further page table walk to be performed. Thus, in the case of the circuitry of
It will be appreciated that in the example of
Although illustrative embodiments of the invention have been described in detail herein with reference to the accompanying drawings, it is to be understood that the invention is not limited to those precise embodiments, and that various changes and modifications can be effected therein by one skilled in the art without departing from the scope and spirit of the invention as defined by the appended claims.
Number | Date | Country | Kind |
---|---|---|---|
1609276.9 | May 2016 | GB | national |