A processor is provided with a first memory protection unit applying a first set of permissions and a second memory protection unit applying a second set of permissions. A memory access will only be permitted if both the first set of permissions and the second set of permissions are satisfied. The processor also includes a memory management unit which serves to translate from virtual addresses VA to physical addresses PA. A selectable one of the first memory protection unit and the memory management unit is active at any given time under control of a selection bit set by a hypervisor program executing at an exception level with higher privilege than the exception level at which the guest operating systems execute.