System, method and apparatus for accessing shared memory

Abstract

A system, apparatus, and method for protecting coherent memory content in a coherent data processing network by filtering data access requests and snoop responses based on read / write (R / W) access permissions. Requests are augmented with access permissions in a memory protection unit, and the access permissions are used to control memory accesses by master nodes of the network.

Description

Background Technology

[0001] This disclosure relates generally to computer memory, and more specifically to schemes for accessing shared memory.

[0002] In many instruction execution systems, shared memory contents can be corrupted by unauthorized access to requests to read or write data to shared memory. These unauthorized accesses can unintentionally damage memory contents. Attached Figure Description

[0003] The accompanying drawings provide visual representations that will be used to more fully describe the various representative embodiments and can be used by those skilled in the art to better understand the disclosed representative embodiments and their inherent advantages. In these drawings, similar reference numerals denote corresponding elements.

[0004] Figure 1 An exemplary 1x3 mesh CMN (Coherent Mesh Network) system is shown;

[0005] Figure 2 This is a block diagram of a data processing system with a memory protection unit (MPU) according to various embodiments of the present disclosure;

[0006] Figure 3 Examples of memory protection unit (MPU) address areas and permissions according to various embodiments of this disclosure are shown;

[0007] Figure 4 It is a signal flow diagram of read and write transactions with access permissions according to various embodiments of this disclosure;

[0008] Figure 5 This is a signal flow diagram of read and write transactions without access permissions according to various embodiments of this disclosure;

[0009] Figure 6 This is a signal flow diagram of the monitoring transactions according to various embodiments of this disclosure;

[0010] Figure 7 This is a signal flow diagram of another monitoring transaction according to various embodiments of this disclosure;

[0011] Figures 8 to 10 This is a signal flow diagram of additional access transactions according to various embodiments of this disclosure;

[0012] Figure 11A and Figure 11B This is a flowchart illustrating request filtering based on access permissions according to various embodiments of this disclosure;

[0013] Figure 12A means for filtering requests according to various embodiments of the present disclosure is shown; and

[0014] Figures 13A to 13D The diagram illustrates the coloring of transaction identifiers by a memory protection unit according to various embodiments of this disclosure. Detailed Implementation

[0015] While this disclosure can have many different embodiments, specific embodiments are shown in the accompanying drawings and will be described in detail herein. It should be understood that this disclosure should be considered as an example of the principles described and is not intended to limit this disclosure to the specific embodiments shown and described. In the following description, similar reference numerals are used to describe the same, similar, or corresponding parts in several views of the drawings.

[0016] In this document, relational terms such as first and second, top and bottom, etc., are used only to distinguish one entity or action from another entity or action, and do not necessarily require or imply any actual such relationship or order between such entities or actions. The terms “comprising,” “including,” “containing,” or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article of manufacture, or apparatus that comprises a list of elements includes not only those elements but may also include other elements not expressly listed or inherent to such process, method, article of manufacture, or apparatus. Without further limitation, an element beginning with “comprising” does not exclude the presence of additional identical elements in the process, method, article of manufacture, or apparatus that includes that element.

[0017] Throughout this document, the terms “an embodiment,” “certain embodiments,” “implementation,” or similar terms refer to a particular feature, structure, or characteristic described in connection with that embodiment, which is included in at least one embodiment of this disclosure. Therefore, the appearance of such phrases in various places throughout this specification does not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics can be combined in any suitable manner without limitation in one or more embodiments.

[0018] As used herein, the term "or" will be interpreted inclusively, meaning any one or any combination. Therefore, "A, B, or C" means "any of the following: A; B; C; A and B; A and C; B and C; A, B, and C." Exceptions to this definition will only occur if the combination of elements, functions, steps, or actions is inherently mutually exclusive in some way.

[0019] For simplicity and clarity, reference numerals may be repeated in the accompanying drawings to indicate corresponding or similar elements. Numerous details are set forth to provide an understanding of the embodiments described herein. These embodiments may be practiced without these details. In other instances, well-known methods, procedures, and components have not been described in detail to avoid obscuring the embodiments. This specification should not be construed as limiting the scope to the embodiments described herein.

[0020] The implementation described in this article demonstrates how to use per-memory-region, per-master-device read / write permissions to protect shared memory contents from unauthorized access in a data processing network.

[0021] According to this disclosure, an improved measure is provided for accessing shared memory while preventing unauthorized access.

[0022] Figure 1 This is a schematic diagram of an exemplary data processing network 100. In this simplified example, the network is configured as a 1x3 mesh CMN (Coherent Mesh Network). Crosspoints (MXPs) provide the intersections within the data processing network and are responsible for routing protocol packets of messages to the correct nodes based on the destination node identifier. An example of a CMN is... CoreLink TM The CMN-600 coherent mesh network is designed for a wide range of intelligent connectivity systems, including network infrastructure, storage devices, servers, HPC, automotive, and industrial solutions. Its highly scalable networking is designed for… The v8-A processor is optimized and can be customized across a wide range of performance points. The data processing network may include coherent interconnects, such as, for example, based on… 5CHI protocol CMN series products ( and (This is a registered trademark of Arm Limited). Interconnect specifications identify devices in an interconnect, as described below.

[0023] The network may include one or more requesting nodes that act as requesting master devices to operate and initiate data transactions. An example requesting node is:

[0024] •RN-F: Fully Coherent Request Node, such as a Central Processing Unit (CPU), a Coherent Graphics Processing Unit (GPU), or other accelerators that operate as a requesting master device.

[0025] •RN-I: I / O Coherent Request Node, which is used, for example, to tunnel input / output (I / O) traffic to a Coherent Hub Interface (CHI) or other network interconnects.

[0026] •RN-D: Distributed Virtual Memory (DVM) request node that supports DVM traffic.

[0027] The network may also include one or more master nodes that receive access requests from requesting nodes. Each master node acts as a coherence and serialization point for a given set of memory addresses and may include a listener filter for monitoring data transactions and maintaining records of which data lines are stored at or owned by one or more nodes. When a memory access is received at a master node, a listener request may be sent to a node that has a copy of the accessed data in its local cache. Exemplary master nodes include fully coherent master nodes (HN-F) that service normal memory requests and I / O coherent master nodes (HN-I) that service I / O requests. Such nodes may include cache memory and listener filters to achieve efficient coherence resolution, allowing listeners to be sent when needed. The cache memory is typically fast random access memory (RAM), which the processor can access faster than regular RAM.

[0028] In addition, the data processing network includes one or more slave nodes that service a request from the master node when the master node cannot service it locally. Examples of slave nodes are memory controllers or requesting nodes. Otherwise, the request is serviced by the master node that receives the request.

[0029] like Figure 1 As shown, RNF (Fully Coherent Request Node) 102 is operatively coupled to MXP (Mesh Cross Point) 104. MXP 104 is operatively coupled to MXP 108 and MXP 114. MXP 108 is operatively coupled to RNI (I / O Coherent Request Node) 106 and HNF (Fully Coherent Master Node) 110. MXP 114 is operatively coupled to SNF (Fully Coherent Slave Node) 112 and HND (Master Node) 118. Requesting nodes 102 and 106 access data by sending requests to master nodes (HN-F / HN-I) 118 and 110. Slave node 112 may be, for example, a dynamic memory controller (DMC).

[0030] For read access, master node 118 looks up the incoming address in the cache and slave node 112. If the address is available in the cache, the request is serviced by providing the data. If the data is not available in the cache but is hit in slave node 112, master node 110 sends a listen request to RN-F 102, which contains the cached line and is servicing the request. Depending on the type of listen request, the listener RN-F 102 may either send the data back to master node 110 (making the master node service the request) or send the data directly to the requesting node 106 in a process called DCT (Direct Cache Transfer).

[0031] For write accesses from RN-F 102, master node 118 checks whether the request is for a partial write or a full cache line write. Depending on the size of the request, master node 118 can merge the requested data with memory data or monitored data. The merged data is either written to memory (slave node) or can be populated into the cache based on the request attributes and if the cache exists on the master node.

[0032] If the request causes any error in the master node, such as a cache access error or a listener error, the master node will complete the request by responding with an error status, and may optionally propose an abort so that the master node is aware of the access status.

[0033] Coherent network protocols such as The CHI protocol can specify various action requests:

[0034] 1. A request to read data will be followed by a response that will include the data.

[0035] 2. No data read request - the response will not include data.

[0036] 3. Write Request - Writes clean / modified data from the requester to the cache or memory.

[0037] 4. Cache Maintenance Operations (CMO) - Flush cache lines to memory such as DRAM, I / O main cache or downstream cache, and other memory outside the master node.

[0038] 5. Atomic Request - Performs an atomic operation on a sub-cache line in memory.

[0039] 6. Storage Request - Cache lines will be stored in the RN-F cache for future access operations.

[0040] In coherent networks, various actions are performed to ensure shared data is maintained coherently. For example, these actions ensure that nodes do not have expired copies of data. However, read / write access by unauthorized master devices can corrupt memory contents, and permission-based filtering alone is insufficient in coherent systems where unauthorized master devices can expose corrupted data in many different ways. Therefore, in protected memory systems, specific nodes may not allow certain desired actions, such as writing modified data to shared memory. This has implications for coherence maintenance.

[0041] This disclosure relates to protecting memory in coherent data processing networks.

[0042] In one implementation, a request message from a first requesting node in the data processing network is received at the master node of the data processing network. The request message includes a request for an action on data associated with a first address in the shared memory of the data processing network, and one or more access permissions the first requesting node has for the first memory address. For example, the requested action could be used to read, write, or change the coherence state of the data associated with the first memory request. The master node determines whether the first requesting node allows the requested action based on one or more access permissions. When the first requesting node allows the requested action, the data associated with the first memory address is accessed from the system cache, the local cache of a second requesting node in the data processing network, or the shared memory according to a coherence protocol. However, when the first requesting node does not allow the requested action, a response message is sent to the first requesting node without accessing the data associated with the first memory address.

[0043] Access permissions can be provided using a memory protection unit (MPU) located at the intersection of the data processing network. The MPU couples registers at the intersection, which can be configured to limit the access permissions requested.

[0044] Figure 2 A system 200 with an example of a data processing network including a memory protection unit (MPU) is shown. Figure 2 The diagram shows master nodes RN-F 202, RN-I 216, mesh cross points (MXP) 206, 212, 220, master nodes HN-I 210, HN-F208, slave nodes SN-F218, and MPUs 204, 214. Figure 2 The system 200 can be, for example, a coherent mesh network.

[0045] Each of the requesting master nodes (RN-F202 and RN-I216) in system 200 is coupled to the network interconnect via memory protection units (MPU204 and MPU214, respectively). The MPUs (204, 214) contain configurable registers that are programmed with address areas and corresponding read / write permissions, such as... Figure 3 As shown.

[0046] As described above, the memory protection unit (MPU) 204, 214 can be a computer hardware unit. The MPU can be implemented as part of the central processing unit (CPU), part of the interconnect structure, or a separate hardware module or block. In some implementations, the MPU is a simplified version of the memory management unit (MMU) that only provides memory protection support, and can be implemented in low-power processors that only require memory protection and not other memory management features such as virtual memory management.

[0047] The first requesting node 202 is coupled to the master node 208 via the first memory protection unit 204 of the data processing system 200. The first memory protection unit 204 receives an action request from the first requesting node 202, determines one or more access permissions to be assigned to the first requesting node based on a first memory address, and enhances the action request using one or more access permissions of the first requesting node before sending the action request to the master node 208.

[0048] In one embodiment according to this disclosure, access permissions are stored in request bits that are not used in the existing architecture interface, thereby enabling memory protection to be added to the existing instant messaging protocol. In another embodiment, existing fields in the request (such as a transaction identifier field) are extended to store access permissions. In yet another embodiment, additional fields are added to the request for storing access permissions.

[0049] Figure 3 Example 300 of the address area and permissions of a Memory Protection Unit (MPU) is shown. MPU areas 0, 320(a) to MPU areas N, 320(n) (where “n” is any suitable number) each have a read area 322, a write area 324, a start address 326, and an end address 328. The number of MPU areas is a design choice and any suitable number can be used. MPU area 0, 320(a) has an associated read portion 322(a), a write portion 324(a), a start address 326(a), and an end address 328(a). Similarly, MPU area N 320(n) has an associated read portion 322(n), a write portion 324(n), a start address 326(n), and an end address 328(n).

[0050] When requesting a node (e.g., Figure 2As shown in 202) towards the intersection (e.g., Figure 2 When a request is sent as shown in 204), the address from the request is searched in the MPU for the area represented by start address 326 and end address 328. When a match is found, the corresponding read and write permission attributes for that area 320 are sent to the master node along with the request.

[0051] If no matching region is found, the MPU may also include default read / write permissions. HN then uses R / W permissions to allow access to the memory contents.

[0052] These permission definitions include:

[0053] R: Requesting read permission

[0054] W: The request has write permissions.

[0055] ~R: The request does not have read permission.

[0056] ~W: The request does not have write permissions.

[0057] Read requests from the requesting node to the master node are intercepted by the MPU. The MPU looks up the memory address to be read in its table to determine the requesting node's access permissions to that memory address. The MPU then enhances the read request using access permissions (APs) and forwards the enhanced request to the master node. Therefore, the process is as follows:

[0058] Request node → RN_Req → MPU area lookup → RN_Req+AP → Master node.

[0059] For a listener request sent by the master node to RN-F, the listener address from the listener request is looked up in the MPU. Access permissions are used to enhance the listener response, and the enhanced listener response is sent back to the master node. The master node can then use its access permissions to the listener response to make decisions. The process is as follows:

[0060] Master node → HNF_Snp_request → MPU lookup → SnoopResponse+AP → Master node.

[0061] The master node filters listening responses based on R / W access permissions.

[0062] Figure 4 An example 400 of a read / write request type with access permissions is shown. The first requesting node CPU 402 communicates with the master node 404 and the slave node 406. In the example shown, the slave node 406 is a dynamic memory controller (DMC).

[0063] Read request 408 is transmitted from CPU 402 to master node 404, which performs permission filtering, cache, or memory access 411. In this example, the CPU has read and write (R / W) access permissions to the address and uses these permissions to enhance read request 408. Read request 410 is allowed and transmitted to DMC 406. In response to message 410, data 412 is transmitted from DMC 406 to CPU 402.

[0064] Confirmation 414 was transferred from CPU 402 to master node 404.

[0065] Write request 416 is sent from CPU 402 to master node 404. In response, master node 404 performs permission filtering, cache allocation, or memory write 417. Before the memory write, a "buffer ready" message 418 is sent from master node 404 to CPU 402 to indicate that the master node is ready to receive data and has storage available for buffering the data. Data 420 is transferred from CPU 402 to master node 404, and write request 422 is transferred from master node 404 to DMC 406. A "buffer ready" message 426 is sent from DMC 406 to master node 404. Finally, if this is an object whose cache line is disturbed, memory write 427 is performed by master node 404. Data 428 is transferred from master node 404 to DMC 406.

[0066] Therefore, in some implementations, the master node responds to action requests based on enhanced access permissions. In other words, the master node "filters" action requests based on enhanced access permissions. For example, when an action request includes a read request and one or more access permissions do not include read permission, the master node sends virtual data back to the first requesting node instead of servicing the request.

[0067] When an action request includes a write request for modified data and one or more access permissions do not include write permissions, the master node discards the modified data and optionally invalidates the modified data at the first requesting node.

[0068] Figure 5 Example 500 of access-based request filtering according to various embodiments of this disclosure is shown. A series of actions are indicated by arrows representing the flow of information between the CPU, master node, and DMC. Figure 5 The CPU timeline 502, master node timeline 504, and DMC timeline 506 are shown, with time increasing from top to bottom. The information flow can be generated by the hardware of the data processing network, by software executing on the processor, or by a combination of both.

[0069] like Figure 5The requester protection mechanism shown prevents well-protected data from being sent to CPU 502. The first transaction is a read request 510 from the CPU. Read request 512 is transferred from the CPU to the master node. Read request 512 is enhanced using access permissions (~R / ~W). The master node's permission filter determines that read is not allowed based on the access permissions, therefore no cache or memory access is performed at 520. Instead, virtual data 514 is transferred from the master node to the CPU, and acknowledgment 518 is transferred from the CPU back to the master node.

[0070] The second transaction is write request 530. A write request message 532, enhanced with access permissions (~R / ~W), is sent from the CPU to the master node. In response, the master node 504 determines that the CPU does not have write permissions based on the access permissions and discards the request at 540. Before discarding the request, a "Buffer Ready" message 534 is transmitted from the master node to the CPU, and data 536 is transmitted from the CPU to the master node. However, because the requester does not have write permissions, data 536 is discarded. Data 536 is not written to memory. Alternatively, the master node may send an error message to the CPU in the "Buffer Ready" message 534.

[0071] Figure 5 The device and system operation demonstrate that the requester protection mechanism provides request filtering based on access permissions. These permissions include read, write, and listen permissions.

[0072] Read permission: If the RN does not have read permission for the read request, the master node (HN) will not look in the internal cache or listen in on any RN-F cache that may have a cache line. The HN will respond to the request with zero data and an error status indicating that the read request encountered an MPU violation.

[0073] Write permissions: If the RN does not have write permissions, the HN will process the request, but any dirty data from the RN will not be updated to memory. The HN can indicate a permission error for any completed response when needed.

[0074] Listening Permissions: If it is necessary to monitor the coherence of the RN-F, then check the permissions for the listener response. If the RN-F being monitored returns data, that data will be filtered. Listener responses containing dirty data are only accepted if the RN-F has write permissions. Figure 6 As shown.

[0075] When an action request includes a read request for data, and a copy of the requested data is stored in the local cache of the second requesting node, the master node can retrieve the data from the second requesting node by sending a listener message and receiving a data response. The data response is enhanced by the second requesting node's access permissions. If the retrieved data is in a modified state, the master node continues according to its access permissions, as described below. Figure 6 and Figure 7 As shown.

[0076] When the second requesting node has write permission to the modified data and the first requesting node does not have write permission to the modified data, the master node writes the modified data to the shared memory at the first memory address to turn the modified data into clean data, and then sends the clean data to the first requesting node.

[0077] When the second requesting node has write permission to the modified data and the first requesting node does not have write permission to the modified data, the master node sends the modified data to the first requesting node.

[0078] When the second requesting node does not have write permission to the modified data, the master node retrieves clean data from the shared memory at the first memory address, sends the clean data to the first requesting node, and invalidates the data associated with the first memory address at the second requesting node.

[0079] Figure 6 This is a signal flow diagram 600 for monitored Central Processing Unit (CPU) filtering based on access permissions. A monitored response containing dirty data is only permitted if the RN-F has write permission. Similarly, clean data is only accepted if the RN-F has read permission. If an MPU violation exists, the data is discarded. The master node will retrieve data from the DMC and service requests. Figure 6 As shown, the signal flow diagram 600 of the read request transaction 610 is initiated by the first request node CPU0. Figure 6The CPU0 timeline 602(a), the master node timeline 604, the second requesting node (CPU1) timeline 602(b), and the DMC timeline 606 are also shown. A read request with read and write permissions (R / W) 612 is transmitted from the first requesting node (CPU0) to the master node. The master node's permission filter allows cache and / or memory access 613 because CPU0 has read permissions. A listen request 614 is transmitted from the master node to the second requesting node (CPU1), which has been determined to have a copy of the requested data. CPU1 responds by returning modified or "dirty" listen data 616 to the master node. The listen data is enhanced by CPU1's (R / W) access permissions. Since CPU1 does not have write permissions, the listen data is discarded by the master node at 618, and a read request 620 is sent from the master node to the DMC to retrieve clean data. The clean data 622 is then transmitted from the DMC to CPU0, and acknowledgment 624 is sent from CPU0 to the master node.

[0080] Figure 7 Another implementation 700 is shown, in which the first requesting node (CPU0) has read permissions but not write permissions (R / ~W). This measure is an example of access permission-based control over "clean" data versus "dirty" (modified) data, and CPU0 timeline 702(a), master node timeline 704, second requesting node (CPU1) timeline 702(b), and DMC timeline 706 are shown. In this case, the master node writes the modified data to the DMC and provides clean data to the first requesting node. If the modified data is provided without a DMC write, any subsequent eviction from the CPU will be discarded (due to write permission filtering), resulting in the loss of the modified data.

[0081] Figure 7 A read request transaction 710 initiated by the first requesting node CPU0 is also shown. A read request 712 with read permissions but no write permissions (R / ~W) is transmitted to the master node. Since CPU0 has read permissions, the master node's permission filter allows cache and / or memory access 713. A listen request 714 is transmitted from the master node to the second requesting node (CPU1). CPU1 transmits modified dirty data 716 with (R / W) permission enhancement to the master node 704. Since write is allowed, the master node sends a write request 734 (with R / W permissions) to the DMC to initiate writing the modified data to memory 735. A "buffer ready" 736 signal is transmitted from the DMC to the master node, and then data 738 is transmitted from the master node to the DMC to complete the write-back to memory and change the data's coherence state from modified (dirty) to clean. Clean data 730 is transmitted from the master node to CPU0, and acknowledgment 732 is transmitted from CPU0 to the master node.

[0082] When an action request includes a request to invalidate data at a first address that the first requesting node does not have write access to, and when a copy of the data is stored at the second requesting node, the master node retrieves the data associated with the first memory address from the second requesting node. If the retrieved data is in a modified coherence state, the master node writes the retrieved data to shared memory at the first memory address to change the coherence state of the data associated with the first memory address from "modified" to "clean," and invalidates the data associated with the first memory address at the second requesting node.

[0083] Figure 8 This is the signal flow diagram 800 for the method used to filter invalid request permissions. Figure 8 The CPU0 timeline 802(a), the master node timeline 804, the second requesting node (CPU1) timeline 802(b), and the DMC timeline 806 are shown. Invalidation transaction 810 is initiated by CPU0. A request to invalidate data stored on other nodes can be specified as a request to ensure data uniqueness. A "ensure uniqueness" request 812, enhanced with (R / W) access permissions, is transmitted to the master node. The permission filter at the master node converts the request into a "clean-unique" request at 814. A "snoop-clean-invalid" request 816 is transmitted from the master node to CPU1. CPU1 transmits modified data 818, enhanced with (R / W) permissions, to the master node to provide listening data 818. In message 820, invalidation completion is sent from the master node to CPU0, and acknowledgment 822 is sent from CPU0 to the master node.

[0084] To prevent the loss of modified data, the master node sends a write request 824 with (R / W) permissions to the DMC. A "Buffer Ready" signal 826 is transmitted from the DMC to the master node, and then data 830 is transmitted from the master node to the DMC. Therefore, the data is written to memory at 832.

[0085] In cases where a request is invalidated, is of the invalidation type, and has read-only permissions (e.g., ReadOnceMakeInvalid, MakeUnique, etc.), where the RN (requesting node) can receive data or receive a completion without data, while invalidating memory contents from all downstream or peer caches, the master node converts such requests into non-intrusive requests, such as... Figure 8As shown. For example, MakeUnique request 812 is converted to CleanUnique request 814, and ReadOnceMakeInvalid(unmarked) is converted to ReadOnceCleanInvalid(unmarked). Such conversions ensure that existing dirty or modified data in the system is written to memory, and the completion does not corrupt any memory contents.

[0086] For CMO, if the requesting node has read-only permissions, the master node will perform a similar conversion to a non-intrusive request. For example, `MakeInvalid` will be converted to `CleanInvalid`. If the requesting node does not have read or write permissions, the transaction will be completed without updating the memory.

[0087] Another sequence is No Data Request Complete, where certain request types such as MakeUnique and CleanUnique have no data completion. If the CPU doesn't need permission error notification (bus error), it can mistakenly transition to a "clean" state. Therefore, clean data is data suitable for storage in coherent memory. This data differs from dirty data because it is valid, or clean, or acceptable. Subsequent listening to this cache line can expose bad data to other CPUs and memory locations. To avoid this, the master node follows No Data Request Complete, where the listening request (SnpMakeInvalid) is invalidated to invalidate the cache line in the RN cache. This ensures that the CPU does not have a cache line in a unique state.

[0088] Figure 9This is a signal flow diagram 900 for a method of permission filtering for write requests according to various implementation schemes. In this regard, timeline 902 for the first requesting node (CPU0), timeline 904 for the master node (HN-F), and timeline 906 for the second requesting node (CPU1) are shown. Access request 908 is a "WriteClean" request for writing modified (dirty) data to memory to change the data's state from dirty to clean. However, the enhanced access permissions granted by this request indicate that CPU0 does not have write permissions to the data address. Upon receiving the request, master node HN-F determines that CPU0 does not have write permissions. The master node does not listen to CPU1 and does not write the data back to memory. The master node sends a completion message 910 back to CPU0, indicating that the master node is ready to receive data. CPU0 sends the data to the master node in message 912. Therefore, for time period 914, CPU0 has modified (dirty) "bad" data that cannot be written back to memory. Once the data is written back to the master node in message 912, CPU0 changes the data status to "clean". However, the data is still "bad". The master node then sends invalidation message 916 to CPU0 to invalidate the data stored at CPU0. CPU0 acknowledges this in message 918. Therefore, for time period 920, CPU0 displays the data status as "clean", but for time period 922, the data is displayed as invalid.

[0089] Figure 10This is a signal flow diagram of a method for permission filtering of read requests according to various embodiments of this disclosure. The flowchart includes a timeline 1002 for a first requesting node (CPU0), a timeline 1004 for the master node (HN-F), a timeline 1006 for a second requesting node (CPU1), and a timeline 1008 for the memory controller (DMC). An access request 1010 from the first requesting node (CPU0) is a "ReadShared" request to obtain a copy of data stored at the second requesting node (CPU1). Since CPU0 has read access to the memory address, the master node sends a listener message 1012 for the data to CPU1. During time period 1014, the data at CPU1 is "bad" data because it has been modified but cannot be cleaned by writing back to memory because CPU1 does not have write access to the data. However, CPU1 returns the modified (dirty) data to the master node in listener response 1016. The access permission in listener response 1016 indicates to the master node that CPU1 does not have write access and the data is "bad". The master node sends a read request 1018 for clean data to the memory controller (DMC). The clean data is sent back to the first requesting node (CPU0) in message 1020, and acknowledged to the master node in message 1022. CPU0 now has good data, but CPU1 still has bad data. Therefore, the master node sends a fail message 1024 to CPU1, which CPU1 acknowledges in response 1026. In this way, the "bad" data at CPU1 is not passed to CPU0, thus preventing it from being written back to memory at CPU0, and the memory is protected.

[0090] Figure 11A and Figure 11B This is a flowchart 1100 of a method for filtering access permissions according to an embodiment of the present disclosure. The method can be implemented in the hardware of a data processing network.

[0091] See Figure 11A At box 1102, a new request is accessed from the first requesting node (RN-F or RN-I), and at box 1104, an address lookup is performed in the MPU within the MXP. At box 1106, the request is accompanied by R / W (read / write) permissions.

[0092] At box 1108, the master node (HN-F) receives the request and checks permissions. At decision box 1110, it determines whether the permissions are acceptable. If the permissions are unacceptable, as shown in the negative branch 1112 of decision box 1110, an error response is sent at box 1114 and the protocol flow is completed.

[0093] When the permissions are deemed acceptable, as shown by the affirmative branch 1116 from decision box 1110, a cache / listener filter lookup is performed at box 1118. Then, at decision box 1120, it is determined whether listening is required. If not, as shown by the negative branch 1122 from decision box 1120, the process continues to point "A" and from there continues to... Figure 11B Decision box 1124 in the middle.

[0094] See now Figure 11B If listening does not require going to the slave node SN-F, as shown in the negative branch 1126 of policy block 1124, the protocol flow is completed without errors at block 1130.

[0095] If it is determined that the destination is SN-F, as shown in the affirmative branch of decision box 1124, then the request is sent to the DMC at box 1158, and a response is received from the DMC at box 1160. As described above, the protocol flow is completed error-free at box 1030.

[0096] See you again Figure 11A When a listening request is required as indicated by the affirmative branch 1132 of decision box 1120, at box 1134, the listening request is sent from the master node to the node indicated in the listening filter as having a data replica (referred to as the "listened-to node"). At box 1136, the MXP intercepts the listening request and performs a listening address lookup in the MPU against the listened-to node's permissions. At box 1138, the MXP uses the MPU permissions to color the listening transaction identifier and forwards the listening request to the listened-to node. At box 1140, the listened-to node then processes the listening request and sends a listening response with the colorized transaction identifier.

[0097] At box 1142, MXP intercepts the listening response and populates the MPU permissions field from the colored transaction identifier, and the process continues to point "B".

[0098] Refer again Figure 11B The master node (HN-F) receives the listening response at box 1144 and checks the permissions of the monitored node. At decision box 1146, it determines whether the monitored node's data can be used. If so, as shown by the affirmative branch 1148 of decision box 1146, the protocol flow is completed error-free at box 1130.

[0099] If the monitored data cannot be used, as shown by the negative branch 1150 of decision box 1146, then at decision box 1152 it is determined whether the request should go to SN-F. If so, as shown by the positive branch of decision box 1152, then the request is sent to DMC at box 1158, the DMC response is received at box 1160, and the protocol flow is completed without errors at box 1130.

[0100] If it is determined that the request will not go to SN-F, as shown in the negative branch 1154 of decision box 1152, then an error response is sent at box 1156 and the protocol flow is completed.

[0101] The listening request received at the monitored party or the second requesting node contains the memory address of the monitored data. This memory address can be used in the MPU to determine access permissions. The listening response typically does not include a memory address that may include a transaction identifier. In one embodiment, when a listening request is received, access permissions are associated with a transaction identifier in the MPU to enhance the listening response using access permissions. This can be done, for example, by storing a table in the MPU. When a listening response is received from the monitored party, the same transaction identifier in the listening response is then used to identify the access permissions. In another embodiment, access permissions are added to the transaction identifier message sent to the monitored party. Thus, access permissions are stored in the request to the monitored party and returned in the response from the monitored party. For example, the number of transaction identifiers can be reduced by a factor of four, and access permissions are stored in the two most significant bits of the transaction identifier. The transaction identifier is then referred to as being "colored" by access permissions. In this embodiment, the memory protection unit intercepts the listening message destined for the second requesting node, uses one or more access permissions of the second requesting node to color the transaction identifier in the listening message to provide a colored listening message, and forwards the colored listening message to the second requesting node. The memory protection unit then intercepts the listening response from the second requesting node, decolorizes the transaction identifier in the listening response, and forwards the decolorized listening response, enhanced with one or more access permissions, to the master node.

[0102] In any implementation, the master node sends a listening message to the second requesting node or the monitored entity via the MPU, and the second requesting node sends a listening response including the monitored data. The second memory protection unit enhances the listening response using one or more access permissions for the second requesting node. This is done, for example, by looking up access permissions using a transaction identifier or by reading access permissions from a colored transaction identifier. When one or more access permissions for the second requesting node indicate that the second requesting node does not have read permissions to the monitored data, the master node receives the enhanced listening response and discards the monitored data. Similarly, when the monitored data is modified and one or more access permissions for the second requesting node indicate that the second requesting node does not have write permissions to the modified data, the master node also discards the monitored data. Furthermore, when the master node discards the monitored data where the coherence protocol allows the second requesting node to retain a copy of the first data, the monitored data at the second requesting node can be invalidated.

[0103] When the master node discards the monitored data, it retrieves clean data from the shared memory at the first memory address and sends it to the first requesting node.

[0104] Figure 12 A device 1200 for filtering requests according to an embodiment of the present disclosure is shown. The device is used to determine whether to grant access to shared memory or deny access requests based on permission requests. The device 1200 includes CPU01202(a), CPU01202(n), module 1204(a), module 1204(n), cache 1206(a), cache 1206(n), node module 1246, and DMC 1236. CPU01202(a) can be considered a first processor or a first CPU master device, or a CPU / IO. CPU01202(n) can be considered a second processor or a second CPU master device.

[0105] The coherent interconnect 1246 includes cross points (MXPs) 1212 and 1220 and a master node HN-F 1216. MXPs 1212 and 1220 each contain a memory protection unit (MPU) (1213 and 1221, respectively).

[0106] CPU01202(a) and CPU11202(n) communicate bidirectionally with coherent interconnect 1246 via links 1210, 1242 and 1224, 1226, respectively. Coherent interconnect 1246 communicates bidirectionally with DMC (Memory Controller) 1236 via links 1234, 1238. The bidirectional communication can be a data communication bus, wires, wire bundles, wireless channels, or other suitable transmission media that allow data transmission (transmission and / or reception) between the components of device 1200.

[0107] During operation, cache 1206(a) of CPU01202(a) sends a data access request to MXP 1212 of interconnect 1246, as shown by line 1242. The MPU at intersection 1212 utilizes the access permission enhancement request.

[0108] The MPU at intersection 1212 sends the request to the master node (HN-F) 1216 via line 1214. On link 1218, HN-F 1216 sends a listen request to CPU1 (1202(n)) via MXP 1220. The MPU at 1220 uses access permissions to color the transaction identifier in the listen request and forwards the listen request to cache 1206(n) of CPU1 1202(n) via line 1224.

[0109] After being received at cache 1206(n), the data response is sent from cache 1206(n) to the MPU at crossover point 1220 via line 1226. The transaction identifier in the data response is de-colored by the MPU and forwarded to HN-F 1216 via line 1228. HN-F module 1216 transmits the data to DMC 1236 via line 1234.

[0110] HN-F module 1216 sends data to MXP 1212 via line 1240. MXP 1212 forwards the data to cache 1206(a) of CPU01202(a) via line 1210.

[0111] Therefore, in various embodiments, an apparatus including multiple crosspoint switches, a master node, and an interconnector is provided. The crosspoint switch includes a first memory protection unit and provides an interface to a first requesting node, while the interconnector is coupled between the multiple crosspoint switches, the master node, and shared memory. The master node provides a coherence point for accessing the shared memory. The memory protection unit intercepts messages destined for the master node from the first requesting node, enhances the intercepted messages using one or more access permissions of the first requesting node, and forwards the enhanced messages to the master node. The master node responds to the enhanced messages according to one or more access permissions.

[0112] The message received at the memory protection unit is associated with a first memory address in the shared memory, and the memory protection unit is configured to look up one or more access permissions in the address table of the first memory protection unit based on the first memory address.

[0113] The memory protection unit at the second requesting node receives a listening message from the master node, as the master node is configured to send a listening message in response to an access request from the first requesting node. The second requesting node responds to the listening message by sending a listening response containing the monitored data back to the master node. The memory protection unit at the second requesting node intercepts the listening response, enhances the listening response using one or more access permissions of the second requesting node, and forwards the enhanced listening response to the master node. The master node is further configured to discard the monitored data when one or more access permissions for the second requesting node indicate that the second requesting node does not have read permission for the monitored data, and to discard the monitored data when the monitored data is modified and one or more access permissions for the second requesting node indicate that the second requesting node does not have write permission for the modified data.

[0114] In addition, when monitored data is discarded, the master node retrieves clean data from the shared storage and forwards the clean data to the first requesting node.

[0115] When a message from the first requesting node includes a read request for data associated with a first memory address in shared memory, and one or more access permissions indicate that the first requesting node does not have read permissions for the first memory address, the master node sends virtual data to the first requesting node. When a message from the first requesting node includes a write request for first data, and one or more access permissions indicate that the first requesting node does not have write permissions for the first memory address, and the write request is of a type that allows the first requesting node to retain a copy of the first data, the master node may invalidate the first data at the first requesting node. When one or more access permissions indicate that the first requesting node does not have write permissions for the first memory address, the master node may discard the write request.

[0116] Access permissions in the listener response can be obtained by coloring the transaction identifier received in the listener request.

[0117] Figures 13A to 13D The MPU coloring of the transaction identifier is shown. The public transaction identifier is included in all messages that are part of the same transaction, such as those along... Figure 12 The request links 1242, 1214, 1218, and 1236, and the response links 1234, 1238, 1240, and 1210, are shown to transmit messages and enable the response to be associated with the request. According to one embodiment, the transaction identifier may be restricted, allowing identifier bits to be used for access permissions.

[0118] Figure 13A The diagram shows register 1320 used to hold the transaction identifier, which has bits 1322(a)...(n) (where “n” is any suitable number). In this example, register 1320 has two bits, 1322(a) and 1322(b), that are not used for the restricted transaction identifier. For example, these bits could be filled with zeros. (The last sentence appears to be incomplete and possibly refers to a different context.) Figure 12 The register state 1320 corresponding to the listening request described as listening request 1218 is transferred from HN-F 1216 to MXP 1230.

[0119] Figure 13B Register 1320 is shown with bits 1322(a)...(n) (where “n” is any suitable number). Register 1320 has two bits, 1322(a) and 1322(b), filled with R and W respectively. (The last part is incomplete and likely refers to a different register.) Figure 12The register state 1320 corresponding to the listen request described as listen request 1234 is transferred from MXP 1230 to cache 1206(n) of CPU1 1202(n). The MPU in MXP uses the address in the listen request to retrieve access permissions and fills two unused bits 1322(a) and 1322(b) in the transaction identifier field with access permissions. The transaction identifier is referred to as "colored" by access permissions.

[0120] Figure 13C Register 1320 is shown with bits 1322(a)...(n) (where “n” is any suitable number). Register 1320 has two bits, 1322(a) and 1322(b), filled with R and W respectively. The state of register 1320 corresponds to... Figure 12 The transaction identifier is transmitted from CPU11202(n) to MXP 1230 via link 1236. No changes are needed to the operation of CPU1, as the CPU returns the same (color-coded with access permissions) transaction identifier as it received.

[0121] Figure 13D The diagram shows register 1320 with bits 1322(a)...(n) (where “n” is any suitable number). Register 1320 has two bits 1322(a) and 1322(b) filled with zeros. Bits 1324(a) and 1324(b) are filled with R and W, respectively. This register 1320 corresponds to the listener response to the master node. It shows that bits R and W are not in transaction identifier 1320. It shows that the access permissions for bits 1324(a) and (b) are removed from the transaction identifier, and... Figure 12 The listener response transmitted from MXP 1230 to HN-F 1216 via link 1238 is replaced with zero. Access permissions are used to enhance the listener response to the master node.

[0122] As used herein, the term "processor" can encompass or utilize programmable hardware such as computers, microcontrollers, embedded microcontrollers, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), and complex programmable logic devices (CPLDs). These hardware examples can also be combined to obtain controller modules with desired functionality. Computers, microcontrollers, and microprocessors can be programmed using languages ​​such as assembly, C, C++, C#, etc. FPGAs, ASICs, and CPLDs are typically programmed using hardware description languages ​​(HDLs) such as VHSIC Hardware Description Language (VHDL) or Verilog, which configure the connections between internal hardware modules with limited functionality on a programmable device.

[0123] This disclosure has been described with reference to flowchart illustrations and / or block diagrams of methods, apparatus, systems, and computer program products according to embodiments described herein. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, may be implemented in hardware, or by executable computer program instructions, or by a combination of both.

[0124] As those skilled in the art will understand, the implementation may be described as a system, method, or computer program product. Therefore, this disclosure may take the form of a completely hardware implementation, a completely software implementation (including firmware, resident software, microcode, etc.), or an implementation combining software and hardware aspects, which may be collectively referred to herein as a “circuit,” a “module,” or a “system.”

[0125] Furthermore, this disclosure may take the form of a non-transitory computer-readable medium containing instructions in a hardware description language (HDL) (such as VHSIC Hardware Description Language (VHDL) or Verilog) that describes the device or stores a netlist description of the device according to claims. Such a description can be used, for example, to configure field-programmable gate arrays (FPGAs) or similar configurable hardware, or as input to design tools for custom integrated circuits.

[0126] Various representative embodiments described in detail herein are given by way of example rather than limitation. Those skilled in the art will understand that various changes can be made to the form and details of the described embodiments to obtain equivalent embodiments that remain within the scope of the appended claims.

Claims

1. A method for memory protection in a data processing network, the data processing network comprising a first request node, a master node, and shared memory coupled by a coherent interconnect, the method comprising: At the first memory protection unit of the data processing network, a request message targeting the master node is received from the first requesting node, wherein the request message includes an action request for data associated with a first memory address in the shared memory; The first memory protection unit determines one or more access permissions of the first requesting node to the first memory address; The request message is enhanced by the first memory protection unit with one or more access permissions of the first requesting node; Send the enhanced request message to the master node; The master node determines whether the requested action is permitted for the first requesting node based on one or more access permissions of the enhanced request message; When the first requesting node allows the requested action, the master node accesses the data associated with the first memory address from the system cache, the local cache of the second requesting node of the data processing network, or the shared memory according to the coherence protocol. as well as When the first requesting node does not allow the requested action, the master node sends a response message to the first requesting node without accessing the data associated with the first memory address.

2. The method according to claim 1, further comprising: The second memory protection unit of the data processing network intercepts a listening response from a second requesting node of the data processing network that is targeted at the master node, wherein the listening response is associated with the first memory address in the shared memory; The second memory protection unit determines one or more access permissions of the second requesting node to the first memory address; The second memory protection unit enhances the listening response with one or more access permissions of the second requesting node; Send the enhanced listening response to the master node; The master node processes the enhanced listening response based on one or more access permissions of the second requesting node.

3. The method of claim 1, wherein the action request includes a read request, and wherein when the one or more access permissions do not include read permissions, the response message to the first request node includes virtual data.

4. The method of claim 1, wherein the action request includes a write request for the modified data, and the method further includes, when the one or more access permissions do not include write permissions, the master node discards the modified data.

5. The method of claim 4, further comprising, when the one or more access permissions do not include write permissions, the master node invalidating the modified data at the first requesting node.

6. The method of claim 1, wherein the action request includes a read request, and wherein accessing the data associated with the first memory address includes: The master node retrieves the modified data associated with the first memory address from the second requesting node; When the second requesting node has write permission to the modified data and the first requesting node does not have write permission to the modified data: The master node writes the modified data to the shared memory at the first memory address to make the modified data clean data; as well as The master node sends the clean data to the first requesting node; When the second requesting node has write permission to the modified data and the first requesting node has write permission to the modified data: The master node sends the modified data to the first requesting node; as well as When the second requesting node does not have write permission to the modified data: The master node retrieves clean data from the shared memory at the first memory address; The master node sends the clean data to the first requesting node; as well as Invalidate the data associated with the first memory address at the second request node.

7. The method of claim 1, wherein the action request includes a request to invalidate data at the first memory address for which the first requesting node does not have write permission, and wherein accessing the data associated with the first memory address includes: The master node retrieves data associated with the first memory address from the second requesting node; When the retrieved data is in a modified coherence state: The master node writes the retrieved data to the shared memory at the first memory address to change the coherence status of the data associated with the first memory address from "modified" to "clean". as well as Invalidate the data associated with the first memory address at the second request node.

8. The method of claim 1, wherein the second requesting node is coupled to the master node via a second memory protection unit, the method further comprising: The master node sends a listening message to the second requesting node; The second requesting node sends a monitoring response including the monitored data; The second memory protection unit enhances the listening response by utilizing one or more access permissions for the second requesting node; The enhanced listening response is received by the master node; When one or more access permissions for the second requesting node indicate that the second requesting node does not have read permission for the monitored data, the master node discards the monitored data. as well as When the monitored data is modified and one or more access permissions for the second requesting node indicate that the second requesting node does not have write permission to the modified data, the master node discards the monitored data.

9. The method according to claim 8, further comprising: When the master node discards the monitored data if the coherence protocol allows the second requesting node to retain a copy of the first data, the monitored data at the second requesting node can be made invalid.

10. The method of claim 8, further comprising: when the master node discards the monitored data: The master node retrieves clean data from the shared memory at the first memory address; and The master node sends the clean data to the first requesting node.

11. The method according to claim 8, further comprising the second memory protection unit: Intercept the listening messages destined for the second request node; The transaction identifier in the listening message is colored using the one or more access permissions of the second request node to provide the colored listening message; Forward the colored listening message to the second request node; Intercept the listening response from the second request node; Decolorize the transaction identifier in the monitoring response; as well as The de-colored listener response, enhanced by the one or more access permissions, is forwarded to the master node.

12. The method of claim 1, wherein the action request includes a request to invalidate data associated with the first memory address, and wherein accessing the data associated with the first memory address includes: The master node retrieves data from the system cache or the local cache of the second request node, wherein the data is in a "modified" coherence state; When the first requesting node does not have write permission to the data: The data is written back to the shared memory according to the coherence protocol to change the coherence state of the data from "modified" to "clean"; Send the data to the first requesting node; as well as Change the coherence status of the data in the system cache or the local cache of the second request node to "invalid".

13. An apparatus for memory protection in a data processing network, the apparatus comprising: Multiple crosspoint switches, wherein a first crosspoint switch of the multiple crosspoint switches includes a first memory protection unit and provides an interface to a first request node; Master node; and An interconnect coupled between the plurality of cross-point switches, the master node, and the shared memory, wherein the master node provides a coherence point for accessing the shared memory; The first memory protection unit intercepts messages from the first requesting node to the master node, enhances the intercepted messages using one or more access permissions of the first requesting node, and forwards the enhanced messages to the master node. and The master node responds to the enhanced message based on one or more access permissions.

14. The apparatus of claim 13, wherein the message is associated with a first memory address in the shared memory, and wherein the first memory protection unit is configured to look up the one or more access permissions in an address table of the first memory protection unit based on the first memory address.

15. The apparatus of claim 13, wherein the second crosspoint switch of the plurality of crosspoint switches includes a second memory protection unit and provides an interface to the second requesting node, and wherein: The master node is configured to send a listening message to the second request node in response to receiving the message from the first request node; The second request node is configured to send a listening response containing the monitored data to the master node in response to receiving the listening message; and The second memory protection unit is configured to intercept the listening response, enhance the listening response using one or more access permissions of the second requesting node, and forward the enhanced listening response to the master node; and The master node is further configured as follows: When one or more access permissions for the second request node indicate that the second request node does not have read permission for the monitored data, the monitored data is discarded; as well as The monitored data is discarded when the monitored data is modified and one or more access permissions for the second requesting node indicate that the second requesting node does not have write permission to the modified data.

16. The apparatus of claim 15, wherein the master node is further configured to retrieve clean data from the shared memory when the monitored data is discarded, and to forward the clean data to the first requesting node.

17. The apparatus of claim 13, wherein the master node is further configured to send virtual data to the first requesting node when the message from the first requesting node includes a read request for data associated with a first memory address in the shared memory and the one or more access permissions indicate that the first requesting node does not have read permission for the first memory address.

18. The apparatus of claim 13, wherein the master node is further configured to invalidate the first data at the first requesting node when the message from the first requesting node includes a write request for the first data and the one or more access permissions indicate that the first requesting node does not have write permission to the first memory address and the write request is of a type that allows the first requesting node to retain a copy of the first data.

19. The apparatus of claim 18, wherein the master node is further configured to discard the write request when the one or more access permissions indicate that the first requesting node does not have write permission to the first memory address.

20. A non-transitory computer-readable medium comprising instructions that, when executed by a device, cause the device to perform the method according to any one of claims 1 to 12.

21. A non-transitory computer-readable medium comprising computer-readable instructions for configuring an integrated circuit including the apparatus of claim 13.

22. An integrated circuit comprising the apparatus of claim 13.

Images