Abstract: An apparatus has memory management circuitry to control access to a memory system based on access control information defined in table entries of a table structure comprising at least two levels of access control table. Table accessing circuitry accesses the table structure to obtain the access control information corresponding to a target address. For a given access control table at a given level of the table structure other than a starting level, the table accessing circuitry selects a selected table entry of the given access control table corresponding to the target address, based on an offset portion of the target address. A size of the offset portion is selected based on a variable nesting control parameter specified in a table entry of a higher-level access control table at a higher level of the table structure than the given access control table.

Abstract: Apparatuses, methods, and programs for performing a translation of a virtual address of a memory access to a physical address associated with a memory location to be accessed are disclosed. A page table descriptor is accessed when performing the translation, which comprises translation parameters for the translation. The descriptor further comprises an integrity check value, wherein the integrity check value is dependent on the translation parameters.

Abstract: Memory access circuitry enforces ownership rights for memory regions. A given memory region is associated with an owner realm specified from multiple realms, each realm corresponding to a portion of at least one software process executed by processing circuitry. A realm management unit (RMU) is provided to perform realm management operations for managing the realms. The memory access circuitry controls access to a given memory region in dependence on at least one status attribute specifying whether the given memory region is an RMU-private memory region reserved for exclusive access by the RMU.

Abstract: An apparatus for processing data comprises memory access circuitry to enforce ownership rights of a plurality of memory regions within a first memory. The memory access circuitry is responsive to a first export command received from a first export command source to perform a first export operation to encrypt the given owned data to form given encrypted data and to store the given encrypted data in a second memory. The memory access circuitry is responsive to a second export command for the given memory region received from a second export command source while the first export operation is being performed to determine whether said second export command source has higher priority than the first export command source and, when the second export command source has a higher priority, to interrupt the first export operation and to perform a second export operation specified by the second export command.

Abstract: An apparatus has address translation circuitry to translate a target virtual address (VA) specified by a memory access request into a target physical address, first/second translation table address storage circuitry to store first/second translation table addresses; and protected region defining data storage circuitry to store region defining data specifying at least one protected region of virtual address space. In response to the memory access request: when the target VA is in the protected region(s), the address translation circuitry translates the target VA based on address translation data from a first translation table structure identified by the first translation table address. When the target VA is outside the protected region(s), the target VA is translated based on address translation data from a second translation table structure identified by the second translation table address.

Abstract: An apparatus (4) comprises memory access circuitry (12) to control access to data stored in a memory; and memory integrity checking circuitry (20) to verify integrity of data stored in the memory, using an integrity tree (26) in which the association between parent and child nodes is provided by a pointer. This helps to reduce the memory footprint of the tree.

Abstract: Apparatus comprising translation circuitry to perform a translation operation to generate a translated second memory address within a second memory address space as a translation of a first memory address within a first memory address space, in which the translation circuitry is configured to generate the translated second memory address in dependence upon translation information stored at one or more translation information addresses; permission circuitry to perform an operation to detect permission information to indicate, for a given second memory address, whether memory access is permitted to the given second memory address; and access circuitry to allow access to data stored at the given second memory address when the permission information indicates that memory access is permitted to the given second memory address.

Abstract: An apparatus has memory management circuitry to control access to a memory system based on access control information defined in table entries of a table structure comprising at least two levels of access control table. Table accessing circuitry accesses the table structure to obtain the access control information corresponding to a target address. For a given access control table at a given level of the table structure other than a starting level, the table accessing circuitry selects a selected table entry of the given access control table corresponding to the target address, based on an offset portion of the target address. A size of the offset portion is selected based on a variable nesting control parameter specified in a table entry of a higher-level access control table at a higher level of the table structure than the given access control table.

Abstract: Address translation circuitry translates a target virtual address (VA) specified by a memory access request into a target physical address (PA) associated with a selected physical address space (PAS) selected from among a plurality of PASs. A granule protection data block is loaded from memory comprising at least one granule protection entry (GPE), each GPE corresponding to a respective granule of PAs and specifying granule protection information (GPI) indicating which of the PASs is an allowed PAS. Filtering circuitry determines whether the memory access request should be allowed to access the target PA, based on whether the selected PAS is indicated as an allowed PAS by the GPI in a target granule protection entry (GPE). Integrity checking circuitry performs a data integrity check on the granule protection data block loaded from memory, and signals a fault when the data integrity check fails.

Abstract: Address translation circuitry (16) translates a virtual address specified by a memory access request issued by requester circuitry into a target physical address (PA). Requester-side filtering circuitry (20) performs a granule protection lookup based on the target PA and a selected physical address space (PAS) associated with the memory access request, to determine whether to allow the memory access request to be passed to a cache or interconnect. In the granule protection lookup, the requester-side filtering circuitry obtains granule protection information corresponding to a target granule of physical addresses including the target PA, which indicates at least one allowed PAS associated with the target granule, and blocks the memory access request when the granule protection information indicates that the selected PAS is not an allowed PAS.

Abstract: Processing circuitry performs processing operations specified by program instructions, and a decoder decodes memory access instructions to generate control signals to control the processing circuitry to perform memory access operations. The memory access instructions have respective encodings specifying protected memory access instructions corresponding to protected memory access operations and less-protected memory access instructions corresponding to less-protected memory access operations. The less-protected memory access operations are associated with less restrictive memory access conditions than the protected memory access operations.

Abstract: There is provided a data processing apparatus, which is suitable for verifying memory systems. Processing circuitry issues a plurality of memory access requests to a plurality of addresses in a memory. Point-of-trust circuitry receives the memory access requests from the processing circuitry via a first set of intermediate circuits. Secure channel circuitry enables secure communication of a correspondence between the plurality of addresses from the processing circuitry to the point-of-trust circuitry. The point-of-trust circuitry determines whether the addresses in the memory of the memory access requests received via the first set of intermediate circuits have a predetermined relationship based on the correspondence.

Abstract: Processing circuitry (10) performs processing in one of at least three domains (82, 84, 86, 88). Address translation circuitry (16) translates a virtual address of a memory access performed from a current domain to a physical address in one of a plurality of physical address spaces (61) selected based at least on the current domain. The domains include a root domain (82) for managing switching between other domains. The physical address spaces (61) include a root physical address space associated with the root domain (82), separate from physical address spaces associated with other domains.

Abstract: Apparatuses, methods, and programs for performing a translation of a virtual address of a memory access to a physical address associated with a memory location to be accessed are disclosed. A page table descriptor is accessed when performing the translation, which comprises translation parameters for the translation. The descriptor further comprises an integrity check value, wherein the integrity check value is dependent on the translation parameters.

Abstract: A realm management unit (RMU) manages ownership of memory regions by realms, each realm corresponding to at least a portion of a software process executed by processing circuitry. Memory access circuitry enforces ownership rights for the regions, with the owner realm having a right to exclude other realms from accessing data stored within its owned region. The memory access circuitry permits execution, from within a current realm, of program code stored in a target memory region having an owner realm other than the current realm, when the target memory region is owned by a code realm and a code realm authorisation table 908 stored in at least one memory region owned by the current realm indicates that execution of program code from the target memory region is permitted by the current realm.

Abstract: An apparatus has processing circuitry for performing data processing in response to software processes and memory access circuitry for enforcing ownership rights for memory regions. A given memory region is associated with an owner realm specified from a multiple realms with each realm corresponding to a portion of at least one software process. The owner realm has a right to exclude other realms from accessing data stored in the given memory region (including realms executed at a higher privilege level). The realms are managed according to a realm hierarchy in which each realm other than a root realm is a child realm initialised in response to a command triggered by its parent realm. In response to an invalidation command, a realm management unit makes the target realm and any descendant realm of the target realm inaccessible to the processing circuitry.

Abstract: Memory access circuitry enforces ownership rights for memory regions. A given memory region is associated with an owner realm specified from multiple realms, each realm corresponding to a portion of at least one software process executed by processing circuitry. A realm management unit initialises the realms. The realm management unit is configured to initialise realms including a full realm which corresponds to a given software process and a sub-realm corresponding to a given address range within the given software process.

Abstract: A data processing apparatus comprises processing circuitry to execute a plurality of processes. An ownership table comprises one or more entries each indicating, for a corresponding block of physical addresses, which of the processes is an owner process that has exclusive control of access to the corresponding block of physical addresses. A new process may be prevented from becoming an owner process until after successful completion of destructive overwriting. Ownership protection circuitry may detect a mismatch between an expected attribute, which is dependent on information in a page table entry, and an attribute specified in the ownership table. Each entry in the ownership table, for example, may indicate a level of encryption to be applied. Access control circuitry such as a memory management unit (MMU) may also determine whether an access request satisfies access permissions. The ownership table may also specify whether a higher privilege level process is allowed to access a block of physical addresses.

Abstract: Memory access circuitry enforces ownership rights for memory regions. A given memory region is associated with an owner realm specified from multiple realms, each realm corresponding to a portion of at least one software process executed by processing circuitry. In response to a first variant of an exception return instruction the processing circuitry returns from processing of an exception while staying within the same realm. In response to a second variant of the exception return instruction the processing circuitry switches processing from a current realm to a destination realm.

Abstract: A realm management unit (RMU) maintains an ownership table specifying ownership entries for corresponding memory regions defining ownership attributes specifying, from among a plurality of realms, an owner realm of the corresponding region. Each realm corresponds to at least a portion of at least one software process. The owner realm has a right to exclude other realms from accessing data stored in the corresponding region. Memory access is controlled based on the ownership table. In response to a region fuse command specifying a fuse target address indicative contiguous regions of memory to be fused into a fused group of regions, a region fuse operation updates the ownership table to indicate that the ownership attributes for the fused group of regions are represented by a single ownership entry. This provides architectural support for enabling improvement of TLB performance.