WO2002099653A1

WO2002099653A1 - Computer system having virtual addressing and method for determining a physical address from a virtual address

Info

Publication number: WO2002099653A1
Application number: PCT/EP2002/006146
Authority: WO
Inventors: Berndt Gammel; Oliver Kniffler; Ralph Ledwa; Holger Sedlak
Original assignee: Infineon Technologies Ag
Priority date: 2001-06-05
Filing date: 2002-06-04
Publication date: 2002-12-12
Also published as: DE10127186A1

Abstract

The invention relates to a computer system having virtual addressing, comprising a non-volatile memory (12, 14) for storing a representation specification, by which means a virtual address is clearly associated with a physical address. Said computer system also comprises a machine for determining the state of the hardware, which can access (26) the non-volatile memory (12, 14) and is embodied in such a way that it can determine the physical address corresponding to the virtual address, on the basis of the virtual address and the representation specification. Given that the representation specification is stored in the non-volatile memory (12, 14) and the machine for determining the state of the hardware (18a) can access said non-volatile memory (12, 14) by means of a bus (26), the computer system can be initialised as soon as it is in the virtual addressing mode in such a way that it does not operate in the physical addressing mode. The point of attack which usually represents the physical addressing mode is thus overcome.

Description

description

Computer system with virtual addressing and method for determining a physical address from a virtual address

The present invention relates to computer systems and in particular to computer systems with virtual addressing.

Virtual addressing has long been known in the field of workstations. Using a specific mapping rule, virtual addresses are mapped to physical addresses. The physical addresses address memory cells of a physical memory, such as. As the main memory, a hard drive, a tape storage, etc. Virtual addresses, however, do not refer directly to physical memory cells, but only indirectly, via the mapping rule. The advantage of this type of addressing is that the programmer of an application does not have to worry about the various physical memories available in a computer system. The programmer has a virtual address space available, which he can use for his program as required. The mapping to the physical address space made available by a special computer system is created separately from the program code, so that a program programmed with virtual addresses can run on different computer systems by providing different mapping rules.

The advantages of virtual addressing for chip cards are described in the specialist publication "Protected Virtual Memory - 32-bit power without handbrake on", Stephan Ondrusch, 10th GMD SmartCard Workshop, Darmstadt, 9 February 2000 Chip cards, on which various applications are to run, which should be separated from each other for security reasons, each process or task is assigned a separate Gener virtual address space is provided, which is defined when creating the program code for the process and set up by the operating system at runtime. Under the control of the operating system of the chip card, access rights to other chip resources, e.g. B. shared memory areas, registered and constantly monitored by hardware. This makes it possible to create the program codes for two processes on a chip card independently of one another by making two separate virtual address spaces available. The mapping rules for the two virtual address spaces onto the only available physical address space can ensure that the two processes do not interfere or that the two processes share a physical memory area in a controlled manner, for example in order to use certain routines together, so that these routines only must be saved once in the memory of the chip card, or in order to achieve a secure data exchange between the processes.

In a processor with a virtual memory system, an application therefore runs in the so-called virtual address space. Each address of the virtual memory at which the application can read / write data or executable code is mapped to an address in the physical memory at which this data or code is actually stored. The virtual address (VA) and the physical address (PA) assigned via the mapping rule need not have any relation to each other. The virtual address space can also be significantly larger than the physical address space.

Virtual addresses where there is no readable / writable data or executable code are usually not mapped to a physical memory. This image is completely transparent for the application being executed. When the memory is organized in pages, the virtual address space is divided into equally large, overlap-free memory areas. A page in the virtual address space is assigned a page in the physical address space via the mapping rule, the page in the physical address space also being referred to as a page frame.

The useful data memory of a page frame of the physical address space is just as large as that of a page of the virtual address space.

The assignment of a virtual page to a physical page is usually achieved via the so-called page table or page table, which address pairs of each

Contains start addresses of the virtual pages and the assigned physical pages.

In the case of workstations, part of the page table is in a cache, which is also referred to as the “Translation Look Aside Buffer (TLB). If the start address pair for a virtual page and the assigned physical page are in the TLB, the calculation of the address mapping into the virtual memory area is accelerated since only access to a table is required in order to obtain the physical address assigned to a virtual address.

Is the start address pair, i. H. the virtual address and the assigned physical address, not in the TLB, a TLB miss (TLB failure) takes place, which usually leads to a trap to the operating system, which has to add the address tuple to the TLB.

In the area of workstations, the mapping rule between virtual address space and physical address space is implemented, for example, as a single page table can be kept in volatile memory. When a workstation is started up, it starts in real addressing mode. This means that the operating system of the workstation causes the CPU of the workstation to gradually build up a page table in the real, ie physical addressing mode, in the volatile working memory of the workstation. Only when a page table is constructed can the workstation switch to virtual addressing mode. If the CPU then asks for data at a virtual address, the associated physical address is determined in the volatile main memory of the CPU so that the data can be called up from the memory. Usual workstations are characterized in that they start up in a real addressing mode and then switch to the virtual addressing mode when the mapping rule is set up from the virtual address space to the physical address space in the volatile memory.

A disadvantage of this concept is the fact that a relatively large working memory area is required to save a page table. This disadvantage is not of the utmost importance for workstations, since they have very large amounts of memory available. For other applications, such as B. for security-relevant computer systems, such as those implemented in chip card ICs, the memory resources are limited due to the small amount of space available. Providing a large amount of volatile working memory to store a page table means that the applications running on the chip card may have insufficient working memory and thus experience a loss in performance.

A further disadvantage of the known concept is that a substantial administrative burden is necessary next to supply, when booting the computer system to construct the Page Table, ie from stored information according to calculate ^"and after the address mappings and store. In addition to the fact that computer resources are required for this purpose, corresponding programs must also be provided on a chip card in order to take the precautions required for the virtual addressing mode. Even such programs require memory space, which is a rare commodity, particularly for chip cards or other security ICs.

A further disadvantage of the described concept of initializing in the physical addressing mode and the subsequent switchover to the virtual addressing mode is that the advantages of the virtual addressing mode, that is to say the separation of two applications to be separated from one another, are not obtained from the beginning, but rather only when the CPU has ended the real mode and switched to the virtual addressing mode. A physical addressing mode or a “real” addressing mode represents a security weakness, particularly in the case of security controllers, which is also referred to as a “single point of attack”. If an attacker succeeds in penetrating the operating system of the chip card IC while it is in the physical addressing mode, the attacker can access the physical memory cells without barriers and read out or even manipulate sensitive data. The security features of the virtual addressing mode are thus not achieved from the beginning, but only when the computer system has switched to the virtual addressing mode.

The object of the present invention is to create a safe and simple computer system.

This object is achieved by a computer system with virtual addressing according to claim 1 and by a method for determining a physical address from a virtual address according to claim 17. The present invention is based on the finding that the security of a computer system with virtual addressing can be improved in that the computer system does not use a physical addressing mode, but instead works in the virtual addressing mode from the outset. To achieve this, a mapping rule is stored in a non-volatile memory of the computer system, by means of which a physical address can be determined from a virtual address. The mapping specification is stored in the non-volatile memory, so that it is available immediately when the computer system is started up and does not have to be generated in a real mode and stored in the volatile memory, as in the prior art. This also eliminates the entire administrative effort and the programs required to generate a mapping rule, for example in the form of a hash table, since the mapping rule is already available in the non-volatile memory.

So that the computer system can start up in the virtual addressing mode, according to the invention, in addition to the non-volatile memory in which the mapping rule is stored, a hardware state machine is provided which can access the non-volatile memory and is designed to use the virtual address and the mapping rule to determine the physical address assigned to the virtual address. As is customary in state machines, the hardware state machine automatically executes a predetermined algorithm, the algorithm which the hardware state machine executes receives input data from the non-volatile memory on the one hand and the virtual address as input data on the other hand, to output the physical address as output data.

The simplest way, but not the most optimal way, is to create a complete page table in the non- to store volatile memory. In this case, the hardware state machine would be activated if the CPU of the computer system wanted data at a virtual address. In this case, the hardware state machine will read in the virtual address, access the non-volatile memory, extract the physical address assigned to the virtual address from the page table and then output it.

For reasons of efficiency and storage space, however, it is preferred to store the mapping rule in the form of a hierarchical tree with a root node for a root level, at least one intermediate node for at least one intermediate level and an end node for an end level, so that the hardware state machine, controlled by the performs a so-called page table walk ("page table walk") in order to output the physical address which corresponds to the entered virtual address after passing through the tree. In a preferred exemplary embodiment, the In the present invention, in which the virtual address space is significantly larger than the physical address space, and thus lists for nodes have relatively few entries used and, on the other hand, have relatively many zero entries, the lists for nodes of the hierarchical tree are compressed to save space in non-volatile memory.

In the case of such a hierarchically organized mapping rule between the virtual and physical address, it is not necessary to store the entire mapping rule in the non-volatile memory, but at least the part of the mapping rule by which it is possible to start the system startup process in virtual mode. With suitable list entries in virtual mode, it is then possible to save the required data from the physical memory in the volatile working memory generate the remaining part of the mapping rule and use it for further address translations from virtual to physical. The hardware state machine can therefore also access data programmed in the volatile memory at runtime after the system has been started up in virtual mode.

In a preferred embodiment of the present invention, page-by-page addressing is also preferred. To avoid memory fragmentation, as many combined lists as possible are stored in one and the same physical page.

An advantage of the present invention is that the computer system can only carry out virtual addressing and no physical addressing, and the security weakness is no longer present.

Another advantage of the present invention is that no programs or no administrative effort are required to set up a page table in the volatile memory, since the page table or the hierarchical tree is persistently stored in the non-volatile memory.

Another advantage of the present invention is that in the case of the mapping rule as a hierarchical tree structure, by implementing access rights at the node of the tree, a differentiated access rights assignment can be achieved with an adjustable granularity.

Another advantage of the present invention is that saving the mapping instruction in non-volatile memory in a form that can be used by the hardware state machine without the CPU being turned on saves CPU resources. Of course, the mapping rule, for example the page Table or the hierarchical structure of node lists can be created. However, this can be carried out "off-line" to a certain extent outside of the operation of the computer system, or "off-card" in the case of a chip card. The creation of the mapping rule and the storage of the mapping rule in the non-volatile memory thus does not take up any valuable on-line resource of memory or CPU, but can, if there is enough time, for example in the manufacture of the chip card or in the case of a dynamic Mo. - The specification of the mapping is then made when the computer system is not currently carrying out any security-relevant application. According to the invention, processing steps can therefore be shifted out of on-line operation in order to save valuable online resources, such as. B. Free computer power, storage space, energy consumption etc., or save.

Preferred exemplary embodiments of the present invention are explained in detail below with reference to the accompanying drawings. Show it:

1 shows a computer system according to the invention with virtual addressing;

2 shows a schematic illustration of a mapping of a virtual address space into a physical address space for a computer system on a chip card;

3 shows an overview of an address translation using a page table;

4a shows a schematic representation of an address translation using a mapping rule in the form of a hierarchical tree structure;

Fig. 4b is a table showing the node levels and the address areas addressed by a node according to a preferred embodiment of the present invention;

5 shows an example of a mapping rule in the form of a hierarchical tree structure in which intermediate nodes can be skipped;

FIG. 6 shows a table for representing node sizes at different levels for the example of FIG. 4a;

7 shows an example of a mapping rule in the form of an n-tree with the same sizes for additional nodes of a level;

8 is a schematic illustration of a compression method for node lists in order to improve the ratio of entries used to the total number of entries in a list;

Fig. 9 compression examples according to the compression method of Fig. 8;

Fig. 10 is a compressed representation of the tree of Fig. 7;

FIG. 11 shows a storage space-optimized storage of the tree from FIG. 10; and

12 is a representation of a virtual address modified to refer to a physical address at which a node list is stored.

1 shows a computer system according to the invention with a CPU 10, a non-volatile memory in the form of a ROM 12 and an E ² PROM 14, which is also referred to in FIG. 1 as NVM (NVM = non volatile memory). The computer system can also have a volatile memory 16, which in FIG. is drawn, and possibly other peripheral components such. B. include a coprocessor, an input / output interface, a random number generator, etc.

The computer system also has a memory management unit (MMU) 18 and a cache 20, wherein the cache 20 can be divided into an instruction cache and a data cache if the computer system is constructed in accordance with the Harvard architecture , The CPU is connected to the memory management unit 18 via a virtual address bus 22. The memory management unit 18 comprises a hardware state machine 18a and preferably a translation look-aside buffer (TLB) 18b in order to determine a physical address from a virtual address supplied by the CPU 10 via the bus 22, in order to assign that to a virtual address Addressing data from a memory 12, 14, 16 and loading it into the cache 20 via a data / command bus 24, from which the CPU 10 receives the data assigned to a virtual address via a further command / data bus 26.

From Fig. 1 it can also be seen that the hardware state machine 18a of the memory management unit 18 can access a non-volatile memory in the form of the ROM 12 or the NVM 14 via an access bus 26 in order to implement the mapping rule which is used to calculate the physical address from the virtual address is required to load from the non-volatile memory. The hardware state machine 18a can thus access the non-volatile memory via the access bus 26 in order to determine the physical address assigned to the virtual address using a virtual address and the mapping rule stored in the non-volatile memory.

1 that the CPU 10 preferably addresses exclusively via the virtual address bus 22, in particular the hardware state machine 18a address. based, which can access the non-volatile memory according to the invention directly, so that the computer system according to the invention does not require a physical addressing mode, but rather can start up in virtual addressing mode, so that there is no point of attack in the form of an operating system of the computer system according to the invention running in physical addressing mode.

In the following, virtual storage systems are discussed in general. A protective mechanism for multitasking computer systems is that separate processes or applications are assigned separate virtual address spaces, so that multitasking operation with different applications is possible, but these applications must be completely separated from one another for security reasons. In a preferred exemplary embodiment of the computer system according to the invention, which is suitable for a chip card, a virtual address space of 4 gigabytes is provided, as can be seen in FIG. 2. For reasons of better efficiency, the address space is divided into virtual memory pages 30, a memory page having a size of 64 bytes, that is 512 bits. The memory pages of the virtual address space can be addressed using a 32-bit wide virtual address.

It is essential in the concept of virtual addressing that an application that runs on the CPU cannot directly access the physical memory, but only its own virtual address space. Using the memory management unit 18 of FIG. 1, the virtual address space is mapped into physical memory addresses using a mapping rule 32, which is symbolized by the arrows shown in FIG. 2. In the exemplary embodiment shown in FIG. 2, the physical address space is fixed at 4 MB, although it is pointed out that a conventional chip card does not have as much memory by far. Typical memory sizes for the E ² PROM 14 from 1 are 64 kbytes. The RAM 16 of FIG. 1 is typically 8 Kbytes, while the ROM 12 of FIG. 1 is typically 168 Kbytes. If a virtual address space of 4 GB is mapped to approximately 240 kByte memory cells, it can be seen that a large amount of virtual addresses does not first have to be mapped into physical memory addresses, and that, in addition, a large number of physical memory addresses do not refer to actually existing physical addresses Show memory cells. On the other hand, the overdimensioning of the virtual address space compared to the physical address space and the overdimensioning of the physical address space with respect to the memory cells actually present allow simple modifications in such a way that additional memories can be easily added subsequently or that the physical address space can be expanded as necessary can.

As will be explained later, the mapping rule 32 according to the invention is not built up by the CPU in the RAM 16, but rather is developed, for example, during the manufacture of the chip card and programmed in the ROM 12 in the form of a correspondingly designed ROM mask before the computer system according to the invention in Is put into operation. In operation, apart from the state machine, the computer system therefore does not require any resources to generate the mapping rule 32. The steps required for this have already been carried out off-line in order not to have to use up valuable online capacities of the computer system for this purpose.

A virtual address is converted into a corresponding physical address e.g. B. translated using a translation table commonly referred to as a page table. The page table can be organized in the form of a single table which has entries, each entry comprising a virtual address and the physical address assigned to it. As will be explained later, however, it is preferred according to the present invention to use the imaging organize the font in the form of a hierarchical page assignment tree. A mapping rule organized in this way has the advantage of greater flexibility for managing access rights. It is also more suitable for handling small page sizes, which is important when the computer system is used as a security IC in a chip card. Small page sizes, e.g. B. less than or equal to 256 bytes, also serve to avoid page table fragmentation. A memory page therefore has, as has been explained with reference to FIG. B. a size of 64 bytes, ie 512 bits. This means that the page offset must be 6 bits long in order to be able to address the 64 bytes starting from the start address for the page.

In the following, reference is made to FIG. 3. Fig. 3 shows a schematic representation of an address translation using a page table. A virtual address 30, an AMO field 32 and a TID field 34 are used as input. The AMO field 32 denotes the access mode that is set by the current state of the CPU and the intended access type (read, write, execute, etc.). The TID field 34 is required for multitasking operation and provides a task identifier (Task Identifier) which indicates which task the virtual address 30 is assigned to in order to be able to differentiate between different virtual address spaces of different applications. The so-called extended virtual address is obtained from the virtual address 30 and the TID field 34, which has the start address for the virtual page (VP 36) and an offset value (DP 38).

The assignment rule in the form of a page table 40 comprises various entries, each entry having a column 42 for the start address of the virtual page and a column 44 for the start address of the physical page, which ^" is assigned to the virtual page in column 42. has. According to a preferred exemplary embodiment of the present invention, the page table furthermore comprises a column 46 for access rights (EAR = EAR = Effective Access Rights), wherein a rights module 48 is used to check whether the CPU mode defined by the AMO field 32 has access to a virtual one Has an address with a specific EAR field. If it is determined that the CPU has no access to a virtual address, the address translation is refused and an access violation is issued. Therefore, since the access rights check takes place before the address translation, that is to say in the virtual address space, the CPU cannot even get the physical address, let alone the content of the memory cell which is addressed by the physical address. An associative search is carried out in the page table in order to provide the mapping of the virtual address to the physical address. The virtual address in the page table must match field 36 of the extended virtual address. If no such entry is found in the page table, a page fault is output by a module 50. If, on the other hand, a suitable entry is found, the physical page address is read from column 44. In a preferred embodiment of the present invention, a virtual page is exactly the same size as a physical page, and the offset of the virtual address (DP 38) and the offset 52 of the physical address are the same, so that no offset values are stored in the page table or special processing of offset values is necessary.

As has already been explained with reference to FIG. 1, the memory processing unit 18 preferably comprises a TLB in order to achieve faster addressing. According to a preferred exemplary embodiment of the present invention, the page table described with reference to FIG. 3 is kept in the TLB, the TLB optionally being present in addition to the hardware state machine 18a. The TLB is designed in the form of the cache table shown in FIG. 3 and comprises one List of virtual addresses with corresponding physical addresses for quick access. The TLB is filled with the last used address pairs and can be updated either randomly or according to time. One possibility, for example, is that as soon as the TLB is filled up and a new entry is to be added, the oldest entry is deleted in order to make room for a new entry. The size of the TLB is a hardware factor and can therefore be selected specifically depending on the design.

For example, if the hardware resources are limited due to the chip space required, the TLB will not be too large and the hardware state machine will be activated more often, while in other cases where the TLB can be kept very large, the hardware - State machine is only active at the beginning when the TLB, which is a volatile buffer, is still empty to gradually fill up the TLB.

In particular due to size restrictions for the TLB, not all virtual pages can often be mapped to their corresponding physical pages using the TLB. In addition, due to the large overdimensioning of the virtual address space compared to the physical address space, not all virtual pages have to be mapped to physical pages, but only virtual addresses for the physical addresses at which code or data for the actually active tasks of a multitasking environment are saved.

If a virtual page is not mapped to a physical page that either does not exist or that does not point to an actual physical memory cell, a page error is output, which indicates that the virtual address was damaged or that at an error occurred in the address translation. If no entry with a corresponding virtual address is found in the TLB, the hardware state machine 18a of FIG. 1 is activated in accordance with the present invention in order to convert a virtual address which was not found in the TLB into a physical address in order to load the physical address together with its virtual address into the TLB. For this purpose, as has been stated, the hardware state machine will access the non-volatile memory (e.g. 12 or 14 of FIG. 1) to determine the physical address using the mapping rule stored there.

According to the invention, a hierarchical tree structure with physically addressed nodes is preferred as the image. Such a hierarchical tree structure, which can also be called a multilevel page table mapping rule, has the advantage that it is not necessary to keep a large page table in the non-volatile memory, but that instead of one large table, several levels or levels with smaller lists can be used. This allows more efficient management, especially with small physical memory pages.

The hardware state machine 18a is then able to traverse the hierarchical tree structure from node to node to finally determine a physical address for a given virtual address. This process is called "page table walking".

Such a process is described with reference to FIG. 4a. In

FIG. 4a shows a virtual address 400 which has different sections 402 to 310. Section 410 is assigned to a root level, ie the highest level. Section 408 is assigned to the next higher level, in the example level 4. Section 406 of virtual address 400 is assigned in accordance with level 3. Section 404 is assigned to level 2, while section 402 is assigned to Level 1, ie the end node, is assigned. The last section of the physical address, which can also be referred to as a section for level 0, contains the page offset, which is identified in FIG. 3 by the reference symbol 38. The virtual address also includes a so-called package address 412, which addresses a memory package. In the preferred embodiment, the virtual address space is divided into 256 packages of equal size, so that each package has an address space of 16 MB. This makes it possible, for example, to assign different access rights for different storage packages in the virtual address space.

The section 410 of the virtual address 400, which comprises only 1 bit in a preferred exemplary embodiment, is assigned to a root node of the hierarchical tree structure.

The list for the root node can be stored in the non-volatile or in registers of the memory management unit. Alternatively, the list for the root node can also be stored at a fixed location in the physical memory.

The list for the root node is referred to as package descriptor buffer 414 and, due to the fact that section 410 of virtual address 400 has only one bit, comprises only two list entries. An entry in the root list 414 includes an index indexed by the bit of section 410 of the virtual address. If the bit in section 410 has a value of one, as in the case of

4a, the first entry in list 414 is selected. The entry further includes a pointer 416 to the physical address of the page in non-volatile memory, on which a list 418 for the first intermediate node to which section 408 of virtual address 400 is assigned is stored. If the bit in ^"the portion 410 of the virtual address, however, a zero, is the second entry of the list 414 is selected, which comprises a pointer 420 to the physical address of a memory page in the non-volatile memory, in which a further list 422 for the first intermediate node to which the section 408 of the virtual address 400 is assigned is stored. After the virtual address section 408 comprises four bits, lists 418 and 422 each have 16 entries for the first intermediate node. Each entry has a length of 32 bits, so that in the exemplary embodiment shown in FIG. 4a, each list takes up exactly one memory page in the non-volatile memory.

After the hardware state machine has determined the upper entry of the root list 414 based on the section 410 of the virtual address 400, the hardware state machine can use the pointer 416 to access the physical memory page in which the list 418 for the first intermediate node is stored. The hardware state machine then reads the section 408 of the virtual address 400 and, based on the fact that the section has the value "1100", selects the thirteenth entry in the list 418.

In addition to an entry index, the thirteenth entry again comprises a pointer 424 to a list 426 for a further intermediate node to which the section 406 of the virtual address 400 is assigned.

The hardware state machine then reads in the section and selects the first entry in the list 426 since the section 406 has the value “0000”.

The first entry in the list 426 in turn contains a pointer 428 to a list 430 which is assigned to a further intermediate node with a lower hierarchy. The hardware state machine now reads the section 404 of the virtual address 400 and selects the eighth entry in this list, since the value of the section 404 is “Olli”. The selected entry of the list 430 in turn contains a pointer 432 to a physical address of the physical page in the non-volatile memory, in which a list 434 for an end node which is assigned to the section 402 of the virtual address 400 is stored. The hardware state machine now reads the section 402 of the virtual address and selects the twentieth entry of the list 434 from the list 434 due to the fact that the value of the section 402 is "10011". Since the section 402 of the virtual address 400 associated with the end level, the selected entry of the list 434 for the end node contains a pointer 436 to the physical address of the physical page which corresponds to the virtual start address of the virtual page, to the physical address to which the pointer 436 points now only the page offset has to be added, as is symbolically represented by a dashed arrow 438 in FIG. 4a, in order to obtain the physical address 440 which is assigned to the virtual address 400.

It should be pointed out that the concept described in FIG. 4a can also be used if no page-by-page memory organization is used, but a direct addressing of memory cells without a page address and

Offset value. In this case, the last step, which is represented by arrow 438 in FIG. 4a, would simply be omitted.

As has already been stated, the virtual address space is significantly larger than the physical address space. For this case, there are many entries in the lists shown in FIG. 4 for the different nodes that do not refer to a next-lower node. In Fig. 4a, these are all entries that do not contain an exit pointer.

These entries are also referred to as zero entries. Due to the clarity of the presentation, all Chen pointers, which point to nothing in FIG. 4a, the lists assigned to the same have been omitted. A complete mapping rule would, however, include a corresponding list for each pointer in FIG. 4a.

Apart from the PAD section 412, in the exemplary embodiment shown in FIG. 4a, the virtual address 400 is divided into six parts or sections. Each section is assigned a level in the address translation process performed by the hardware state machine. The highest level, i.e. H. Level 5, as was done, indexes one of two entries in list 414. Of course, list 414 could also contain multiple entries. In this case, section 410 of virtual address 40 would have to have more bits accordingly. With two

Bits might already have four entries in list 414.

4b shows the address area that can be addressed to a certain extent by each level. The entire 16 megabytes of the virtual address space can be addressed by the root list 414 (last line of the table in FIG. 4b), the upper pointer 416 selecting the upper eight megabytes, while the lower pointer 420 selecting the lower eight megabytes , Therefore, the list 418 or, analogously, the list 422 can address a physical address space of eight megabytes, with each entry in the list 418, i. H. each arrow pointing out of list 418 can address 512 kilobytes. Each pointer from list 418 points to a list 426 of the third level (third

Row of the table of Fig. 4b). Similarly, each pointer from a third level list, such as. B. the pointer 428, again address an address range of 32 kilobytes. The 32 kilobyte address range is the address range spanned by the second level list 430, and an entry in this list can in turn address an address range of two kilobytes. FIG. 5 shows a section of the hierarchical page table structure from FIG. 4a, but with a different virtual address, which in sections 408 and 406 has loud ones for the fourth level and for the third level. In contrast to the mapping rule shown in FIG. 4a, the mapping rule in the form of the hierarchical tree which begins with the root list 414 and ends with the physical address 440 allows skipping at least one level. The skipping of a level is signaled in the virtual address by a certain section, for example by the fact that there are all ones in one section, as is the case in FIG. 5. However, any other predetermined code could also be reserved for skipping a level. The pointer which starts from the root list 414 and is labeled 500 in FIG. 5 no longer points to a list of the fourth level or the third level, but immediately to the list 430 of the second level. It is possible to skip any number of levels or nodes. The bits in the virtual address that correspond to these levels must have the predetermined code to signal the level machine to skip levels. This optimization requires additional information for the pointer 500, and this additional information is stored in the entries in the root list 414. Of course, only level 3 could be skipped, while the level 4 node may not be skipped. In this case, the additional information should be available in an entry in a list for the level 4 node.

In the following, reference is made to FIG. 6. FIG. 6 shows a table corresponding to FIGS. 4a and 5 for the meaning of the bits of the virtual address and the relationship between the node size, ie the maximum number of entries in the node list. In other words, each row of the table in FIG. 6 represents a section of the leftmost one in FIG 6 represents the level of the virtual address. In the first line of the table of FIG. 6, which relates to level 5, that is to say to the root level, it is stated that section 410 has only one bit, namely in which preferred embodiment of the present invention, bit 23 of the virtual address. One bit can be used to index two different entries in the root list so that the node size of the root node is 2. The fourth level comprises bits 19-22. Four bits can be used to index 16 different entries in a list for the fourth level, so that the node size, that is to say the size of a list in the fourth level, is 16. The number of lists in the fourth level is 2 because the root list has two entries.

Both the section for the third level and the section for the second level both have four bits, so that a list of the second level or the third level can also have a maximum of 16 entries. The section 402 for the first level comprises five bits, so that through this section 32 entries of a list can be indexed, as is also clear from the list 434 for the first level of Fig. 4a, it has 32 lines while a list the second level has only 16 lines. The zero level, i. H. the page offset starting from a start page address comprises six bits, so that 64 list entries can be indexed with it. After a physical page has 64 bytes, minimal offsets of one byte can be addressed. For example, if the page size were 128 bytes, the minimum memory size that can be addressed would be two bytes.

In the following, reference is made to FIG. 7. In FIG. 7, as in FIGS. 5 and 4a, entries used in a list are shown in bold, while zero entries are shown as a blank rectangle. From the mapping rule shown in Ffg ^{^"."} 7 It is clear that very many zero Entries exist, and just a few used entries. This is because the virtual address space is significantly larger than the physical address space. In the preferred embodiment of the present invention, the virtual address space is 4 gigabytes, while the physical address space is only 4 megabytes. However, if a page-by-page memory organization is used, a page of memory must still be provided for each list shown in FIG. In the example of a mapping rule shown in FIG. 7, 10 memory pages must therefore be used in order to manage only 4 physical pages in which code or data are present. In applications where there is a sufficient amount of non-volatile memory to store the lists for the levels, this does not matter.

However, if space is limited and is a valuable resource, it is preferred to compress the n-node lists to increase the ratio of the number of entries used in a list to the total number of entries in the list. The so-called n-nodes are therefore switched to the q-nodes. While the expression "n-node" means that all lists of a node of a level have the same number of entries, namely n entries, the expression "q-node" means that the node list is compressed and that the number of entries into one List for one and the same level can vary from list to list.

Partially filled node lists are compressed and, as is particularly explained with reference to FIG. 11, several compressed nodes can be stored on one page of the physical memory area. The compressed nodes are called q nodes, and the hierarchical tree structure with compressed nodes is referred to as the q tree. The theory behind a q-node is that all entries in a list, ie all non-zero pointers, can be placed in a n-node in a structure (the q-node) that is smaller than the original one - before n node is. This is accomplished by dividing the n-node into smaller sections, taking the smallest section containing all non-zero pointers for maximum compression. In order to specify the position of a pointer in the n-node, an offset value for the q-node pointer is required. This offset value is also referred to as a virtual offset.

In the following, reference is made to FIG. 8 in order to illustrate a possible type of compression of a list 800 of an n-node. List 800 includes two non-zero entries that can be binary indexed by 1100 and 1110. Possible q nodes are shown next to list 800. In principle, three different "compressed" lists, ie q-nodes, 802, 804 and 806 can be generated in the described section-wise compression. The list 802 corresponds to the list 800. This is the trivial form of compression, the q-node -List 802 is exactly the same size as list 800 and no offset bit is required, whereas list 804 is already compressed to half the storage space and contains two entries that can be indexed with 110 and 100. Um Coming from the entries in the compressed list 804 to the entries in the uncompressed list 800 requires a virtual offset bit which has a value of 1. The virtual offset bit corresponds to the most significant bit (msb) of both entries in the list 800. Compression is therefore possible if the msbs of the non-zero entries in list 800 are the same, since the most significant bits of the entries in the compressed list 804 are also the same achieve higher compression, as shown by the compressed list 806. The two non-zero entries of list 806 have most significant bits ~ ^~ are not equal, so that no further compression is possible is. In order to return from the compressed list 806 to the uncompressed list 800, two offset bits are required, namely the two most significant bits of the entries in the list 800, which are the same for both non-zero entries in the list.

Depending on the degree of compression of the node (no compression, a compression from 16 entries to 8 entries and finally a compression from 16 entries to 4 entries), the virtual offset value is 0, 1 bit or 2

Bits. The compression to 8 entries, i. H. half a page of memory means that the pointers in the original n-node are only in either the upper or lower half. The virtual offset must therefore be 1 bit to specify the position, the offset bit with a value of 0 means that all non-zero entries are in the lower half, while an offset bit of 1 means that all entries in the list are 800 in the upper half of the n-node list.

Analogously to this, as has been illustrated with reference to FIG. 8, a further compression is possible with the list 800 since all non-zero entries are not only in the upper half but even in the upper quarter of the list. In this case the offset bits are at a value of "11", indicating that the pointers can be found in the n-node list in the fourth quarter. If no compression is performed (list 802) because the compression method does not Compression allowed, as shown in Fig. 9, no offset bits are required either, and the size of the list in the next lower node is specified in the node list, which includes the pointer that points to the next lower (compressed) node For example, the list 430 of FIG. 4a is compressed, for example by half, the entry 426 of the next higher list would also specify the size of the list in addition to the physical address at which the list 430 is stored would be, for example, a compression by half, only 8 entries large, although the section 404 of the virtual address, which corresponds to level 2, has 4 bits and actually indexes a 16 entry list. The section 404 of the virtual address would then be designed such that a bit of the same, typically the most significant bit, is interpreted as a virtual offset bit.

This also results in another control mechanism. The hardware state machine will compare the most significant bit of section 404 to the size bit in the non-zero entry of list 426 and continue address translation if matched, while if the bits do not match, a page fault is issued because then at least either the mapping rule or the virtual address is incorrect.

In the following, FIG. 9 is discussed in order to show further examples of how n-nodes can be reduced to their minimum q-nodes if the compression method described with reference to FIG. 8 is used. The list 900 in Fig. 9 only includes a non-zero entry indexed by the bit combination "1100". The minimum q-node comprises only a single entry and, accordingly, 4 virtual offset bits "1100". A list 900 with only a single non-zero entry can thus be reduced in a simple manner with respect to its storage space requirement by 1/16 times.

List 902 includes two non-zero entries that can be indexed with "0001" and "0011". The two entries have two equal most significant bits, so that two virtual offset bits 00 are created and the list can be reduced by a quarter.

List 904 includes two non-zero entries, the ^"most significant bits of which are not equal, however, so this one selected compression algorithm no compression is achievable. The q-node is therefore exactly the same size as the n-node.

The sample list 906 includes two entries with "0100" and

"0101". The three most significant bits are the same so that compression can be achieved 1/8 times, which leads to the virtual offset bits "010".

The sample list 908 includes four non-zero entries between "1010" and "1101". All four entries have the same most significant bit, so that a compression by ^ times can be achieved, which leads to a virtual offset bit of "1".

It should be noted that the q-nodes of level 1 (FIG. 4a) play a special role. Since their entries do not point to other q nodes, but directly to the physical memory pages, no additional information, such as B. a size value of a hierarchically low q-list can be stored together with the pointers. As a result, an entry in a level 1 list is used to store two pointers. Therefore, section 402 of the virtual address associated with level 1 comprises five virtual address bits. The additional bit specifies which of the pointers to use in the selected q-node entry. It should be noted that one of the two pointers can also be 0. After an entry in a level 1 list stores two pointers, the list length of a list, such as The list 434 of Fig. 4a, twice the length of a higher level list, such as. B. level 430.

In the following, reference is made to FIG. 10 to illustrate how the compressed q nodes can be used to minimize the memory usage. First, for example according to the table in FIG. 9, the mini paint q-nodes of a hierarchical mapping rule identified. This results in a mapping rule as shown in FIG. 10. The filled rectangles indicate used entries, while the empty rectangles indicate zero entries. Each q-node is surrounded by a thick line. It can be seen that in the selected example of the mapping rule, all lists except a list 1000 could be compressed. The list 1000 could not be compressed with the compression method chosen, since the two non-zero entries it contains are not listed in the same half of the list.

In the mapping rule shown in FIG. 10, all, including the compressed, lists are each stored on their own physical memory pages or “page frames”, so that the page frames are occupied very loosely, but the number of page frames has not yet been reduced In the embodiment shown in Fig. 10, the unoccupied words in the page frames can, however, already be occupied by other data, so that a list for the mapping rule and additional data can be stored in a physical memory page However, it is preferred to move on to a concept according to FIG. 11 in order to concentrate the mapping regulation information, that is to say the lists for the individual levels, in as few physical memory pages as possible, so that complete memory pages are freed up in order to store other data in the same to be able to.

Since most q-nodes are small, in the mapping rule shown in FIG. 11, all node lists except a node list 1100 can be packed into the same physical memory page 1102. As a result, the mapping rule or the page assignment structure is reduced from 10 to 2 memory pages. In this way, the q-tree structure provides considerable optimization in terms of equal to the option shown in FIG. 4a, in which no list compression has been carried out.

The only "wasted" memory is due to the lists, which contain several null pointers and cannot be further compressed. List 1100 falls into this category. Experience has shown, however, that there are few such q-nodes. Normal programs usually use at least some contiguous memory areas , such as code, static data, stack, and heap, memory layouts of this type have a smaller overhead for the mapping structure, but fragmented memory layouts are sometimes necessary.

Although only the list compression function shown in more detail in FIG. 9 has been shown above, it should be pointed out that all list compression methods can be used. The compression therefore does not have to be based exclusively on the fact that entries must be in the same half or in the same quarter of a list. For example, the list 1100 could be compressed using an alternative compression method based on entries in different halves of the list. Depending on the layout of the virtual address and the meaning of the offset bits in a section of the virtual address, several different compression methods can also be combined if the memory requirements are such that a small number of lists that cannot be compressed, such as z. B. List 1100 of FIG. 11 is not acceptable.

In a preferred embodiment of the present invention, a node addressing mode (NAM) is provided in order to be able to modify the mapping rule in the non-volatile memory. The format for a virtual address 1200 shown in FIG. 12 is used for this. The virtual address is as in Fig. A in divided several sections, the sections 1210 to 1202 basically corresponding to the sections 410 to 402 of FIG. 4a. The last section 1212, which had designated the offset value in FIG. 4a, is however used at the virtual address 1200 to signal the q-node level, the list of which is to be modified in the NAM mode.

The NAM mode is used to manipulate virtual addresses, since for security reasons only a virtual addressing mode is to be used so that the CPU has no direct access to physical pages. By setting the section 1212 of the virtual address 1200, lists for individual levels and in particular the entries in these lists can be accessed.

To this end, each packet descriptor included in the root list 414, i.e. H. the package descriptor buffer, a NAM bit is stored which, when set, allows access to the q-node lists for this special memory package. However, it should be noted that only packages in privileged layers, i.e. H. privileged modes of the operating system that can manipulate the NAM bit. When the NAM bit is set, the last section 1212 of the virtual address is no longer interpreted as a page offset value, but is used to signal the hardware state machine whether the q-node at level 4, level 3, is at E. - Level 2 or level 1 should be addressed to access the list or entries in the corresponding list.

If the NAM bit is set, the virtual address is thus interpreted differently by the hardware state machine than in the case described in FIG. 4a.

If the NAM bit is set, the hardware state machine now only performs an address translation until the q node of the stop level defined by section 1212 is recovered. Then a final bus cycle is generated on the physical side, which is indicated by the pointer of an entry in the list for the defined stop level. The requested list data is then accessed and is preferably stored in the data cache 20 (FIG. 1). It should be noted that this address translation is not stored in the TLB 18b (FIG. 1), since it is the mapping rule itself and not an assignment of a virtual address to a physical address.

Claims

claims

1. Computer system with virtual addressing, a virtual address being assigned to a physical address via a mapping rule, with the following features:

a non-volatile memory (12, 14) for storing at least a portion of the mapping rule; and

a hardware state machine (18a) which can access the non-volatile memory (26) and is designed to determine the physical address assigned to the virtual address using the virtual address and at least part of the mapping rule.

2. The computer system of claim 1, wherein the virtual address includes an address for a virtual memory page and a virtual offset value to address a word in the virtual memory page, and wherein the physical address includes an address for a physical memory page and a physical offset value to address a word in the physical memory page.

3. Computer system according to claim 2, in which the mapping rule is designed such that the virtual memory page and the physical memory page are the same size, and the virtual offset value and the physical offset value are the same size.

4. Computer system according to one of the preceding claims, which is arranged to be initialized in a virtual mode.

5. Computer system according to one of the preceding claims, further comprising the following features: volatile memory (18b) in which assignments of physical addresses to virtual addresses can be stored,

the computer system being arranged to first access the volatile memory (18b) to determine whether a requested virtual address is stored, and

wherein the computer system is arranged to activate the hardware state machine (18a) for address translation if the requested virtual address is not stored in the volatile memory (18b).

6. Computer system according to one of the preceding claims,

where the mapping rule is hierarchical as a tree with

Node (414, 418, 422, 426, 430, 434) is structured, the tree having a root node (414), at least one intermediate node (418, 422, 426, 430) and an end node (434),

in which a list for a node is stored in the non-volatile memory, the list of a node having entries, an entry having an entry index and a pointer (424, 428, 432, 436) to a physical address, where the pointer for the physical address points to a physical address of the non-volatile memory, with which a list can be retrieved for another node of the tree,

in which the virtual address (400) is divided into sections (402, 404, 406, 408, 410), whereby for the root node (414), the at least one intermediate node (418, 422, 426, 430) and the end node (434 ) there is one section each, the section (402, 404, 406, 408, 410) identifying a list entry of an associated list, and wherein the hardware state machine (18a) is arranged to extract a portion from the virtual address to access the non-volatile memory (12, 14) to use the extracted portion to make an entry in a list for the node associated with the section, and to continue extracting and accessing sequentially until the end node is reached to obtain the physical address (440) associated with the virtual address (400).

7. Computer system according to claim 6,

in which the packet description buffer (414) has a non-volatile memory portion in which the list for a root node of the mapping rule is stored,

wherein the list (414) for the root node has at least two entries, each entry having the physical address (416) of a list for an intermediate node of a lower node level, and

wherein the virtual address has a root section (410) that identifies the entry in the root list for the virtual address.

8. Computer system according to claim 6 or 7,

wherein the hardware state machine (18a) is configured to skip (500) an intermediate node level when the portion (406, 408) of the virtual address (400) that the

Is assigned between node level, has a predetermined value, and

where, in the event of an intermediate node being skipped, the entry in a list of the output node contains the physical address of a list of a jump output node. points that follows a skipped node in the hierarchical tree.

9. Computer system according to one of claims 6 to 8,

where the number of virtual addresses is greater than the number of physical addresses, so that a list has blank entries that do not refer to a physical address,

in which the list of a node stored in the non-volatile memory is compressed so that the ratio of the number of entries containing a pointer to a physical address to the total number of entries in the list compared to an uncompressed list is increased, and

where an entry in the list identifies the compression of the node to which the list belongs or the compression of a lower node in the hierarchy.

10. Computer system according to claim 9, in which the non-volatile memory (12, 14) is organized page by page,

in which at least two compressed lists are stored in the same memory page (1102), and

in which a list entry of a list of a higher node comprises the physical address of the memory page and an offset value at which the list of the lower node is stored in the memory page.

11. Computer system according to claim 10, in which only compressed lists are stored in a memory page of the non-volatile memory (12, 14), the number of entries of which are the same after compression.

12. Computer system according to one of claims 6 to 11,

in which the list entries traversed for a virtual address have access rights information (EAR) for the virtual address which identify whether or how, in an operating mode of the computer system, data can be accessed at the physical address which is assigned to the virtual address by the mapping rule , and

wherein the TLB (18b) is arranged to perform an access right check (48) based on the access right information before determining a physical address.

13. Computer system according to one of claims 6 to 12,

wherein the hardware state machine (18a) is arranged to be placed in a node addressing mode, and

in which the virtual address is designed to identify, via a section (1212) thereof, the node whose list is to be accessed.

14. Computer system according to one of the preceding claims, which is intended for security-relevant applications.

15. Computer system according to one of the preceding claims, which is integrated on a chip card.

16. Computer system according to one of the preceding claims, in which at least the part of the mapping rule stored in the non-volatile memory is programmed in the form of a ROM mask during the manufacture of the computer system.

17. A method for determining a physical address from a virtual address, comprising the following steps: Obtaining a virtual address;

Accessing (26) a non-volatile memory (12, 14) in which at least part of a mapping rule is stored, via which the virtual address is uniquely assigned to a physical address;

Determining (18a) the physical address using at least a portion of the mapping rule stored in the non-volatile memory; and

Output of the determined physical address.

18. The method according to claim 17, wherein the mapping rule is structured hierarchically as a tree with nodes (414, 418, 422, 426, 430, 434), the tree being a root node (414), at least one intermediate node (418, 422, 426) , 430) and an end node (434),

in which the virtual address (400) is divided into sections (402, 404, 406, 408, 410), whereby for the root node (414), the at least one intermediate node (418, 422, 426, 430) and the end node (434 ) there is one section each, the section (402, 404, 406, 408, 410) identifying a list entry of an associated list, and where the step of determining comprises the following steps:

Extracting a section (410) for the root node from the virtual address (400);

Accessing a list (414) associated with the extracted portion (410) of the virtual address to obtain a pointer (416) to a physical address of a list for an intermediate node;

Extracting a section (408) from the virtual address (400) for the intermediate node;

Accessing an entry in the list using the extracted section (408) to retrieve a pointer (424) to a physical address where a list (426) for a lower section is stored; and

Repeating the extracting and accessing steps until all portions of the virtual address have been processed to use the list for the end node and a portion (402) of the virtual address for the end node to determine the physical address (440) that the virtual address rile address (400) is assigned.