Memory address translation management

Apparatus for processing data comprising:

• processing means for executing a hypervisor program to provide a virtual machine execution environment and for executing a virtual machine program using said virtual machine execution environment;
• and
• memory management means for managing a translation of a virtual address generated by said virtual machine program to a physical address of a memory using first stage translation data specifying a translation from said virtual address to an intermediate physical address and second stage translation data specifying a translation from said intermediate physical address to said physical address;
• wherein
• said memory management means controls access to said memory to provide one or more virtual-machine private regions within said memory that are accessible to said virtual machine program and are at least marked as inaccessible to said hypervisor program;
• said first stage translation data includes attribute data to mark respective regions of said memory as one of one or more device regions or as one of one or more non-device regions;
• and
• when a memory access request by said virtual machine program is to a target region of said memory that is both a virtual machine private region and a device region, said memory management means modifies management of said translation performed in dependence upon said second stage translation data to provide private-device region management.

A method of processing data comprising:

• executing a hypervisor program to provide a virtual machine execution environment;
• executing a virtual machine program using said virtual machine execution environment;
• managing a translation of a virtual address generated by said virtual machine program to a physical address of a memory using first stage translation data specifying a translation from said virtual address to an intermediate physical address and second stage translation data specifying a translation from said intermediate physical address to said physical address;
• and
• controlling access to said memory to provide one or more virtual-machine private regions within said memory that are accessible to said virtual machine program and are at least marked as inaccessible to said hypervisor program;
• wherein
• said first stage translation data includes attribute data to mark respective regions of said memory as one of one or more device regions or as one of one or more non-device regions;
• and
• when a memory access request by said virtual machine program is to a target region of said memory that is both a virtual machine private region and a device region, modifying management of said translation performed in dependence upon said second stage translation data to provide private-device region management.