Memory access transaction with security check indication

Abstract

The memory system component includes transaction handling circuitry to receive memory access transactions. Each memory access transaction specifies at least: a posting domain identifier that indicates a posting security domain specified by a posting master device for the memory access transaction, wherein the posting security domain is one of a plurality of security domains; a target address; and a security check indication that indicates whether the memory access transaction is known to pass a security check procedure. The security check procedure determines whether the memory access transaction indicating the posting security domain is authorized to access the target address based on control data that indicates which of the plurality of security domains are allowed to access the target address. The memory system component includes control circuitry to determine whether the security check procedure still needs to be performed based on the security check indication.

Description

BACKGROUND TECHNICAL FIELD

[0002] The present technology relates to the field of data processing. More specifically, it relates to memory access control. BACKGROUND

[0004] In some systems, processors or other devices can operate in a secure domain or a non-secure domain. Access control to memory can depend on the secure domain in which the processor is operating. SUMMARY

[0005] At least some examples provide a memory system component comprising:

[0006] transaction processing circuitry to receive memory access transactions, each memory access transaction specifying at least:

[0007] a release domain identifier indicating a release secure domain specified by a releasing master device for the memory access transaction, wherein the release secure domain is one of a plurality of secure domains;

[0008] a target address; and

[0009] a security check indication indicating whether the memory access transaction is known to pass through a security check procedure;

[0010] wherein the security check procedure is to determine whether the memory access transaction indicating the release secure domain is authorized to access the target address based on control data indicating which of the secure domains in the release secure domain are allowed to access the target address; and

[0011] the memory system component comprises control circuitry to determine, based on the security check indication, whether the security check procedure still needs to be performed.

[0012] At least some examples provide a master device comprising:

[0013] transaction release circuitry to release memory access transactions; and

[0014] encoding circuitry to encode each memory access transaction, wherein the encoding specifies at least:

[0015] a release domain identifier indicating a release secure domain specified for the memory access transaction, wherein the release secure domain is one of a plurality of secure domains;

[0016] a target address; and

[0017] a security check indication indicating whether the memory access transaction is known to pass through a security check procedure;

[0018] wherein the security check procedure is to determine whether the memory access transaction indicating the issuing security domain is authorised to access the target address based on control data indicating which of the security domains are allowed to access the target address.

[0019] At least some examples provide a method comprising:

[0020] receiving memory access transactions, each memory access transaction specifying at least:

[0021] an issuing domain identifier indicating an issuing security domain specified by an issuing master device for the memory access transaction, wherein the issuing security domain is one of a plurality of security domains;

[0022] a target address; and

[0023] a security check indication indicating whether the memory access transaction is known to pass through a security check procedure;

[0024] wherein the security check procedure is to determine whether the memory access transaction indicating the issuing security domain is authorised to access the target address based on control data indicating which of the security domains are allowed to access the target address; and

[0025] the method comprising determining whether the security check procedure still needs to be performed based on the security check indication.

[0026] Further aspects, features, and advantages of the present technology will become apparent from the following description of examples, read in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0027] FIG. 1 An example of a data processing apparatus is schematically illustrated;

[0028] FIG. 2 An example of a physical address space viewed from different angles by a data processing apparatus is schematically illustrated;

[0029] FIG. 3 An example memory access transaction is schematically illustrated;

[0030] FIG. 4 A cache holding data entries is schematically illustrated;

[0031] FIG. 5 An example of a memory system component is schematically illustrated;

[0032] FIG. 6 An example of a memory system component including a security check circuit is illustratively shown;

[0033] FIG. 7 An example of a master device is illustratively shown;

[0034] FIG. 8 An example of a master device including a determination circuit and a security check circuit is illustratively shown;

[0035] FIG. 9 An example of a memory access system is illustratively shown;

[0036] FIG. 10 A flowchart illustrating steps in a method for processing a memory access transaction is shown;

[0037] FIG. 11 A flowchart illustrating steps in a method for processing a memory access transaction including performing a security check is shown;

[0038] FIG. 12A A flowchart illustrating steps in a method for a memory system component to process a memory access transaction including comparing the transaction to a cache entry is shown;

[0039] FIG. 12B A flowchart illustrating steps in a method for a master device is shown, including generating a memory access transaction and comparing the transaction to a cache entry. FIG. 12A the possible outcomes of each combination of a transaction and a security check indication of a cache entry; and

[0040] FIG. 13 A flowchart illustrating steps in a method for a master device is shown, including generating a memory access transaction and comparing the transaction to a cache entry. DETAILED DESCRIPTION

[0041] Some specific examples are shown below. It will be appreciated that the present application is not limited to these examples.

[0042] In some architectures, separate secure and non-secure memory spaces are provided that are respectively associated with secure and non-secure domains. The architecture can assume that the secure and non-secure memory spaces map to physically distinct hardware storage. However, in some implementations, blocks of hardware storage (e.g., blocks of DRAM pages) can be dynamically allocated to either the secure or non-secure domain.

[0043] For example, when operating in a non-secure domain, a device such as a CPU issuing memory access transactions can only access target addresses that are also associated with the non-secure domain. Transactions issued in a secure domain can only access addresses associated with the secure domain, or alternatively in some examples, the secure domain can be allowed to access memory associated with both the secure and non-secure domains. It will be appreciated that in this example, only two domains (a secure domain and a non-secure domain) are described, but the number of domains provided is a design choice and will depend on the implementation, so more than two domains can be provided.

[0044] In some architectures, the mapping of domains to memory regions is fixed. However, in cases where the mapping is not fixed, more detailed control data can be used to define the mapping of secure and non-secure memory spaces. This means that in order to perform a security check on a transaction (to check whether the domain it was issued from is able to access the memory address it is targeting), a lookup can be performed in the control data, which can include access to a table in memory. This can be an energy and time consuming process, so the less often this is done the better.

[0045] In some systems, the master device issuing the memory access request has the ability to perform a security check before the transaction is propagated downstream to the memory system. Other devices using the same interconnect and / or memory units can not have this ability, so a security check can also be performed on the transaction at one of these downstream stages.

[0046] In some systems, downstream stages such as interconnects or memory controllers do not have the ability to know whether a transaction has already been security checked. This means that all transactions must be checked, and can be checked twice or three times at different stages of the system.

[0047] The present technology provides a solution by including an indicator in the encoding of a transaction that shows whether the transaction has been security checked or not. This means that the system designer can flexibly determine whether the check is performed at the master device itself or downstream in the memory system, without causing a two-fold latency. Without such a security check indicator, one or other approach must be chosen, which limits the variety of master devices that can be provided (providing control data checking logic can not be practical for some master devices), or security checks must be performed on all accesses downstream in the memory system (which can need to be performed redundantly if the master device has already done so). As mentioned above, this has a detrimental effect on performance when some master devices in the system perform security checks and the security check is repeated at downstream components.

[0048] In at least one example of the present technology, a memory system component is provided that includes transaction processing circuitry to receive memory access transactions. The memory access transactions each specify at least a release domain identifier, a target address, and a security check indication. The encoding of the transaction can include other information such as the type of access (read or write) or other transaction identifiers, but it will be appreciated that this is not essential to the performance of the present technology.

[0049] The release domain identifier indicates the release security domain specified by the releasing master device for the memory access transaction, where the release security domain is one of a plurality of security domains. The release security domain can be the domain in which the master device is operating at the time of the release request. During a domain switch, there can be other rules that dictate which domain the master device specifies. The release domain identifier can be a simple secure or non-secure flag. It can also be a more complex indication, particularly if the system supports more than two possible domains.

[0050] The master device can be a relatively complex CPU that is capable of operating in any of the possible domains (regions). However, it can be another device that has access to the same memory region that can not be capable of operating in one of the domains (for example, some master devices can be considered to permanently operate in a less secure domain). The release domain identifier can not indicate to the memory system component the master device that released the transaction, but can only indicate which domains are associated with the access.

[0051] The target address included in the memory access transaction defines the location in the memory that should be accessed in response to the transaction. The address has one or more domains that allow access to the data held there depending on the control data.

[0052] The security check indication indicates whether the memory access transaction is known to pass the security check procedure. This does not necessarily indicate that the transaction has already undergone the security check procedure, but provides an indication of whether the transaction is known to pass (for example, as described below, there can be ways of inferring that a transaction will pass the security check without actually performing the security check, for example based on information stored in a cache). In the following description, a "positive" security check indication means that the transaction will pass the security check procedure. A "unknown" indication means that the security check procedure still needs to be performed. The security check indication is not an indication of having passed or failed the procedure - a transaction marked with a "unknown" security check indication can pass or fail the security check procedure when it is later performed.

[0053] Security check indications can be explicit indicators in transaction coding. For at least one domain, the security check indication is explicit and depends on whether it is known that the transaction will pass the security check procedure. In some examples, the security check indication could otherwise be implicit in other details of the transaction. For example, if a transaction published in a secure domain has access to both secure and insecure storage, the secure publication domain identifier may be sufficient to indicate that the transaction will pass the security check procedure. However, a transaction published in an insecure domain may require a separate explicit indication to indicate that it will pass the security check procedure, or alternatively, the security check procedure may still need to be performed.

[0054] The security check procedure is used to determine whether a memory access transaction indicating the publishing security domain is authorized to access the target address, based on control data indicating which security domains within a security domain are allowed to access the target address. The memory regions accessible by each domain are defined by control data, which can be changed as described above. Therefore, the security check procedure checks whether the target address specified by the transaction is an address within the memory region associated with the publishing domain. If the publishing domain can access the target address, the transaction passes the security check procedure. If the target address is in a region that is not allowed to be accessed from the publishing domain, the transaction fails the security check procedure.

[0055] The memory system component also includes control circuitry that determines, based on a security check indication, whether a security check procedure still needs to be performed. If the security check indication suggests that the transaction will proceed through the security check procedure, the control circuitry determines that the security check procedure does not need to be performed.

[0056] In at least one example of this technology, when the control circuitry determines that a security check procedure still needs to be performed, the control circuitry is configured to control the security check circuitry to perform the security check procedure. This may involve sending control signals to another component of the system (e.g., a downstream memory system component in a memory system to which the memory system component will publish transaction routing) or another element of the same memory system component.

[0057] The memory system component may include security check circuitry. Therefore, if it is determined that a security check procedure still needs to be performed, the memory system component can execute that procedure. The security check indication for a transaction can then be modified, and the transaction propagated downstream in the system. Thus, the memory system component can mark a transaction as checked before it reaches the memory itself.

[0058] When a given memory access transaction fails the security check procedure, the security check circuitry can be configured to signal an error and prevent the given memory access transaction from propagating downstream in the memory system components. That is, if the publishing field of a given transaction is not an allowed field of a given target memory address, an error is signaled. By preventing the transaction from propagating downstream, the transaction will not reach the memory access stage, resulting in less latency. Therefore, the security check indication may not have encoding indicating that the transaction failed the security check procedure, but only that the security check procedure has not yet completed, or that the transaction will pass the security check procedure.

[0059] In some examples, when the control circuitry determines that a security check procedure still needs to be performed, it is configured to control the downstream security check circuitry to perform the procedure. The control circuitry ensures that the security check procedure is performed, but this procedure can be performed by another component downstream of the memory system component. In some cases, the very presence of an unknown security check indication can trigger the downstream security check circuitry to perform the procedure. Alternatively, transactions can be propagated downstream without a security check indication, but with a separate control signal to cause the security check circuitry to perform the procedure.

[0060] The target address can be a physical address. Control data defines which domains have access rights; these regions can be areas of the physical address space. These can be areas of physical memory, either on-chip or off-chip. Control data identifies which domains can access the memory at a given address. The storage device can include, for example, dynamic random access memory (DRAM).

[0061] Control data may include multiple entries, each associating at least one region of the address space with at least one of multiple security domains. For example, there may be a table maintaining a mapping between addresses and their allowed domains. A lookup of this table can be performed to determine if a transaction has the correct combination of address and publishing domain. This table may be stored in main memory, or a copy may be cached locally in a memory system component. An address may be associated with more than one allowed domain.

[0062] A security check procedure may include comparing a published domain identifier with at least one of a plurality of security domains associated with an address space region including the target address. That is, a security check procedure may involve directly checking whether the published domain is the same as the allowed domain of the target address. This may include performing the lookup described above and comparing the result with the published domain identifier. Similarly, if the system uses a hierarchical structure of security domains, it is sufficient to check that the published security domain has a security level equal to or higher than the domain associated with the target address. Therefore, the allowed domain of the target address does not necessarily need to match the published domain exactly.

[0063] In some examples, multiple domains include at least one secure domain and a less secure domain. These may otherwise be labeled as secure areas and insecure areas, or similar regions. For example, a master device operating in a secure domain may have access to the memory area associated with the secure domain, while a master device operating in a less secure domain may not be allowed to access the memory area associated with the secure domain. In some implementations, a master device operating in a secure domain accesses memory areas associated with both the secure and insecure domains; however, a device operating in an insecure domain may only access memory areas associated with the insecure domain. In this case, it is not necessarily necessary to refer to control data for security checks performed on transactions published in the secure domain. Therefore, in some examples, checks on security check indications may only be performed for transactions associated with less secure domains, but not for secure transactions.

[0064] In at least one example of this technique, memory access transactions are encoded to indicate that the published security domain is a less secure domain and that the transaction is known to pass a security check procedure. That is, there is explicit encoding for transactions published in a less secure domain that will pass the security check procedure. As mentioned above, (in some examples) a secure publishing domain may imply that the transaction will pass the security check procedure. Alternatively, there may be explicit encoding for each of the publishing domain and the security check indication.

[0065] Memory system components may include caches comprising cache entries for caching data obtained in response to previously received memory access transactions. Each cache entry is indexed by a combination of a destination address and a published security field. By using the combination of destination address and published field for indexing, the cache can store secure and insecure entries with the same destination address in separate cache lines. This is useful for security, performance, and flexibility because it allows cache entries to be allocated before security checks are performed, but it also carries a reduced risk of security vulnerabilities because the secure / insecure field identifiers will index different entries in the cache, and insecure accesses may not hit secure cached data.

[0066] The control circuitry can be configured to determine whether a security check procedure still needs to be performed for a given memory access transaction based on a security check instruction specified by the given memory access transaction and a cache entry check indicator corresponding to a cache entry that corresponds to the combination of the target address and the published security domain of the given memory access transaction. The cache entry check indicator, stored in the cache entry, indicates whether transactions with the same combination of published domain and target address will pass the security check procedure.

[0067] Therefore, information stored in the cache for the same combination of destination address and published security field can be used to infer whether a transaction will pass the security check procedure. For example, if a transaction indicates that a security check procedure is required, but an entry in the cache with the same combination of destination address and published security field indicates that the transaction will pass the security check procedure, it can be assumed that the transaction will also pass the security check procedure. Therefore, if the cache holds a positive indication, the transaction can be updated to have a positive indication even if the security check procedure is not explicitly performed. This means that transactions published from the master device that do not have the capability to perform security checks do not require a full security check procedure performed by memory system components. If similar transactions with the same combination of published field and destination address have been shown to pass the security check procedure, it can be inferred that the current transaction will pass the security check procedure.

[0068] When the cache entry check indicator indicates that a given combination of the target address specified by a given memory access transaction and the published security domain will pass the security check procedure, the control circuit determines that it is not necessary to perform a security check procedure for the given memory access transaction, even if the security check indicator specified by the given memory access transaction indicates that it is not known whether the given memory access transaction will pass the security check procedure.

[0069] Similarly, when a security check indicator for a given memory access transaction indicates that the given memory access transaction will pass the security check procedure, and the cache entry check indicator does not indicate that a given combination of the destination address and the published security domain will pass the security check procedure, the cache is configured to update the cache entry check indicator to indicate that the given combination of the destination address and the published security domain will pass the security check procedure. In other words, when a transaction with a positive security check indicator hits a cache entry, that cache entry can be updated.

[0070] If the security check is performed at the memory system component or another downstream component, the cache entry check indicator can also be updated to indicate that the combination of the target address and the published domain will pass the security check. If the memory system component receives a valid response to a memory access transaction (published downstream), it can be inferred that the security check passed in the downstream component (if the security check fails, an error will be signaled and no response to the transaction will be published). Therefore, receiving a valid response to a memory access transaction can also trigger an update to the cache entry check indicator to indicate that the corresponding combination of domain / address passed the security check.

[0071] In this way, when at least one of the transaction and its corresponding cache entry indicates that the transaction will pass the security check, it is determined that the transaction will pass the security check, and therefore the security check does not need to be executed again.

[0072] In some embodiments of this technology, a master device is provided that includes transaction publishing circuitry for publishing memory access transactions; and encoding circuitry for encoding each memory access transaction. The encoding specifies at least a publishing domain identifier, a destination address, and a security check indication. As described above, if a transaction is encoded with a security check indication, this can be indexed at downstream components in the memory access system. This allows the master device in the same system to optionally include security check circuitry to perform security check procedures without the latency associated with repeatedly checking some transactions.

[0073] The master device may also include security check circuitry for performing security check procedures; and determination circuitry for determining whether a security check procedure should be performed. The security check circuitry in the master device may index a cache of control data used for the security check procedure. The cached control data may be stored in a dedicated cache for control data or in a general cache that is also shared with other types of data. Therefore, the master device can publish, encode, and perform security checks on transactions before they are propagated downstream to main memory.

[0074] The encoding circuit can be configured to set a security check indication based on a determination made by the determining circuit. For example, the determining circuit can determine that a security check procedure should be performed, then the security check circuit can perform the security check procedure (and pass it), and the encoding circuit can subsequently encode a positive security check indication indicating that the security check procedure is known to pass. Alternatively, the determining circuit can determine for a security domain that all transactions will pass the security check procedure and therefore do not perform it, but since it is known that the security check procedure will pass, the transaction is encoded with a positive security check indication. Furthermore, it can be determined that a security check procedure should not (or cannot) be performed, but needs to be performed at a component downstream of the master device; therefore, the transaction is encoded with an unknown security check indication indicating that it is unknown whether the security check procedure will pass and that the security check procedure needs to be performed downstream.

[0075] In some examples, the determining circuit is configured to determine whether to perform a security check procedure based on at least one of the following:

[0076] Publish security domains, and

[0077] Whether the memory access transaction encounters a cache miss at a given level, wherein the cache is one of the following:

[0078] Data cache; and

[0079] A control data cache is used to cache control data, which indicates which security domains in the security domain are allowed to access the target address.

[0080] Because security checks involve inspecting control data, if the relevant control data is unavailable to the master device, it may be more efficient to publish a transaction without performing security checks, allowing the transaction to proceed and execute security checks closer to the point where the control data is stored in memory. This reduces latency in serving transactions compared to the master device waiting for control data to become available before checking and publishing the transaction. Since control data can be stored in a dedicated control data cache or in a general data cache that can store some or all of the control data, a miss in a given level of data cache or control data cache can cause determining circuitry to decide to publish a transaction without performing security checks. In other words, if a cache miss occurs, control data may need to be fetched from memory, so this does not eliminate any latency in performing security checks at the master device. Transactions can propagate downstream in system components, closer to the point where the control data is stored.

[0081] Furthermore, in some examples, if the publishing domain is a security domain, the determining circuit can determine that a transaction will always pass through the security check procedure, so whether or not the security check procedure is executed can depend on the publishing domain.

[0082] Some implementations provide a system that includes a master device and memory system components. Multiple memory master devices and multiple memory system components can exist within the same system.

[0083] FIG. 1 An example of a data processing apparatus 1 to which this technology can be applied is shown. A memory access transaction (or request) is published by the master device and propagated downstream to the memory. The result (e.g., the return of read data in a read transaction or the return of write acknowledgment in a write transaction) is then transmitted back to the master device. CPU 2 and devices 4 & 6 are examples of master devices capable of publishing transactions. CPU 2 may include a memory management unit (MMU) 8 for controlling address translation and access permissions to memory based on a page table structure defined in the memory system. The MMU may also include a cache for address translation data, called a page table buffer (TLB) 10. Memory system components according to this technology may be included in CPU 2. According to this technology, CPU 2 can act as a master device.

[0084] A system memory management unit (SMMU) 12 may be included to control address translation and access to the memory of devices 4 & 6, which do not include an MMU. The previously described memory system components may reside within the SMMU 12. According to this technology, devices 4 & 6 may act as master devices. In some examples, the SMMU 12 may also be considered a "master device" as discussed below because it encodes transactions including physical addresses.

[0085] Interconnect 14 can manage transactions for multiple master devices. It can be a coherent interconnect and includes a coherence unit 16 to execute coherence protocols. Interconnect 14 may also include a system cache 18 to cache data accessible to master devices 2, 4, and 6. Memory system components may be included in interconnect 14 and may utilize cache 18.

[0086] The data processing apparatus 1 may also include physical memory, such as DRAM 20 or non-volatile random access memory (NVRAM) 22, connected to interconnect 14 via memory controllers 24 & 26. DRAM or NVRAM may be an example of on-chip memory, but the memory may also include off-chip memory accessed via input / output units. Memory controllers 24 & 26 control read and write access to memories 20 & 22. Memory controllers 24, 26 may include memory system components according to the present technology. It should be understood that, for simplicity, a system employing the present technology may also include multiple components not shown in this figure.

[0087] FIG. 2 This schematically illustrates examples of the physical address space as seen at different stages in a data processing device. The physical address space seen by CPU 2 (or another host device) is... FIG. 2 The left side is shown and has a size s. In this example, CPU 2 does not have information about which memory regions are accessible to each security and non-security domain. A memory access transaction is then published from the non-security publishing domain with, for example, a target address. At that time, there is no indication as to whether the address is located in an insecure address space.

[0088] From the perspective of interconnect 14, the address space has a size of 2s when the publishing domain and destination address are combined. However, transactions published in a non-secure domain only have access to half of the possible address space, while transactions in a secure domain have access to the other half. That is, each combination of publishing domain and destination address has a unique address in the mapping as seen in interconnect 14. If access If a transaction is published in a non-secure domain, then interconnect 14 will see its access address. However, if it is published in a security domain, it will see... Therefore, as seen in interconnect 14, the published security domain is treated as additional address bits. FIG. 1 The cache 18 shown can be indexed using a combination of NS / S bits and address, therefore the address and Mapped to different cache entries.

[0089] Although FIG. 2An example is shown with a publish field bit appended to the most significant end of the address, but the publish field bit can also be inserted in different locations in the address, so that the secure and insecure parts of the physical address space seen by the interconnect 14 are not necessarily contiguous, but can be multiple interleaved regions separated by regions from another domain.

[0090] At the Physical Alias ​​Point (PoPA), the address space returns to size s. The PoPA is the boundary between components that treat transactions from different publishing domains targeting the same destination address as if they were actually indexed by separate addresses (e.g., interconnect 14) (by treating domain identifiers as additional address information) and components that specify physical addresses that do not include publishing domain identifiers (e.g., memory controller 26). Apart from the PoPA, both secure and non-secure domains will access the same memory region if they specify the same address.

[0091] In addition to PoPA, an address space of size 's' can be compared to a physical address mapping as seen by DRAM. That is, control data indicating memory regions of DRAM can be defined, each associated with a secure domain and a non-secure domain (see...). FIG. 2 (Right-hand side). Control data can be stored in a data structure stored in the memory system, which can be cached in the CPU, interconnect, or other memory system components to allow comparison of the publishing domain of a transaction with the domains that are allowed to access the region corresponding to a specified PA. The data structure can be defined as secure memory, making access to and modification of the control data itself controllable.

[0092] It should be understood that simplification is for the sake of ease of explanation. FIG. 2 Examples. In some systems, DRAM regions associated with secure domains may correspond to a relatively small portion of the address space compared to those associated with non-secure domains. Furthermore, it is not necessary to divide the entire physical address space between secure and non-secure DRAM regions—in fact, the physical address space can be sparsely filled with secure / non-secure DRAM regions, and those secure / non-secure DRAM regions can be fragmented across the DRAM address space because address space pages can be dynamically reallocated between secure and non-secure regions.

[0093] FIG. 3An exemplary memory access transaction 30 is illustrated schematically. Domain ID 32 indicates the publishing domain (or field). This can be a simple I / O indication for a secure / non-secure domain, or it can be a more complex identifier. Destination address 34 is the physical address read / written in response to the transaction. R / W indicator 36 indicates whether the transaction is a read or write transaction. Security check indicator 38 indicates whether it is known that the transaction will pass a security check procedure. It should be understood that in this example, separate encodings are provided for domain ID 32 and security check indicator 38, but in other examples, combined indicators may be provided. Other information may be included in the transaction encoding, but this is not shown here for brevity.

[0094] FIG. 4 A cache 40 holding cache entries is illustrated schematically. Each entry includes a validity indicator 42 indicating whether the entry is valid. A coherence state 44 indicates the coherence state of the entry (e.g., clean / dirty, unique / shared, or other states depending on the coherence protocol used). A security check indicator 46 indicates whether it is known that transactions with the same combination of publishing domain and destination address will pass the security check procedure. The cache is indexed using a portion of the publishing domain and destination address, and a cache label 48 is the remainder of the destination address that distinguishes different addresses indexed to the same cache entry (or a set of cache entries). This approach means that indexing results in separate cache entries associated with both insecure and secure access to the same destination address. A data value 49 is the data value associated with the destination address (which can be clean or dirty). It should be understood again that more information could be kept in each cache entry, but for brevity, more information has been omitted here.

[0095] FIG. 5 This schematically illustrates, for example, what can be located in FIG. 1 Examples of memory system components 50 in interconnect 14 or memory controllers 24, 26. Memory access transaction 30 is received by transaction processing circuitry 52. ​​The memory access transaction includes at least a publishing domain identifier, a destination address, and a security check indication. The publishing domain identifier indicates a publishing security domain specified by the publishing master device. The security check indication indicates whether it is known that memory access transaction 30 will pass a security check procedure. The security check procedure includes checking whether the publishing security domain is authorized to access the destination address based on control data.

[0096] Control circuit 54 checks the security check indication to determine whether a security check procedure needs to be performed. The memory access transaction is then passed to downstream component 60. Therefore, the control circuit can control the downstream component to perform the security check procedure, including transactions involving the target address and publishing domain, which can be propagated downstream separately to the control signal indicating that a security check procedure needs to be performed. The security check circuit may also be included in memory system component 50. This refers to the following... FIG. 6 Description. It should be understood that, for simplicity, memory system components may include other elements not shown herein.

[0097] FIG. 6 An example of a memory system component 50 including a security check circuit 56 is illustrated schematically. The memory access transaction 30, as described above, is received by the transaction processing circuit 52. If an entry with the same combination of publishing domain and destination address does not already exist, the information originating from the transaction can be stored in cache 40. If an entry with the same combination does exist, the entry can be updated to include a positive security check indication if it has not already been stored.

[0098] The security check indication for memory access transaction 30 is checked by control circuit 54. If the security check indication is positive (indicating that no security check procedure needs to be performed), the memory access transaction is passed to downstream component 60.

[0099] If control circuit 54 determines that a security check procedure (unknown indication) still needs to be performed, this can be performed by security check circuit 56 referring to control data 58. The control data can be located in downstream memory, or it can be a local cache held in the memory system component. If the security check procedure passes, security check circuit 56 can then change the security check identifier to indicate a positive security check and propagate the transaction to downstream component 60. The security check procedure can also update cache 40 to indicate that entries with the same combination of destination address and publishing field will pass the security check procedure. If the security check procedure fails, the security check circuit can signal an error and prevent the transaction from propagating to downstream component 60.

[0100] If control circuit 54 determines that a security check procedure (unknown indication) still needs to be performed, but the entries in cache 40 indicate that entries with the same combination of publishing field and destination address will pass the security check procedure, then control circuit 54 can use the positive security check indication to update memory access transaction 30 and propagate the transaction to downstream component 60. This means that security check circuit 56 does not have to undergo the full security check procedure, including the lookup of control data 58.

[0101] If control circuit 54 indicates that a security check procedure still needs to be performed (unknown indication), and the cache entry indicates that it is unknown whether the same combination of the publishing domain and the destination address will pass the security check procedure, then security check circuit 56 refers to control data 58 to perform the security check procedure. If the security check procedure passes, cache 40 can be updated to reflect this in the cache 40 with a positive security check indication. If the security check procedure fails, memory system component 50 signals an error and prevents the transaction from being propagated to downstream component 60.

[0102] FIG. 7 An example of a master device 70 is illustrated schematically. A transaction publishing circuit 72 publishes a memory access transaction. An encoding circuit 74 encodes the memory access transaction to include at least a publishing domain identifier, a destination address, and a security check indication. The publishing domain identifier may be derived from a domain indicator 76 included in the transaction publishing circuit 72. In a master device that supports multiple domains, this may be a register indicating the current domain and updated on domain switching. For example, in a master device that only supports, for example, insecure transactions; the domain indicator 76 may be a hardwired circuit element that always maintains the same value.

[0103] Encoding circuit 74 encodes the target address received directly from the transaction publishing circuit. As described above, the security check indicator indicates whether a security check procedure still needs to be performed. This can be set to a default unknown indicator (the check procedure still needs to be performed because it is unknown whether it will pass), or even if the check procedure has not yet been performed, in some examples, if the domain indicator indicates a security domain and allows that security domain to access all memory addresses, the security check procedure can be set to affirmative (the security check procedure will pass). Once encoded, the memory access transaction is propagated to downstream component 60.

[0104] FIG. 8An example of a master device 70 including a determination circuit 78 and a security check circuit 82 is schematically shown. The transaction publishing circuit 72 publishes a transaction to the determination circuit 78. The determination circuit 78 then determines whether a security check procedure still needs to be performed. For example, if secure domains are allowed to access secure and non-secure memory, and the domain indicator 76 instructs the transaction publishing circuit 72 to operate in the secure domain, the determination circuit 78 can determine that a security check procedure is not required. In this case, the encoding circuit 74 encodes a positive security check indication and propagates the memory access transaction to the downstream component 60. In some cases, the determination circuit 78 may make its determination based on whether the transaction has a miss in cache 80 (especially if the miss in cache 80 is caused by a lookup of control data required by the security check procedure—in which case publishing the transaction without performing the security check procedure may be preferred). If the security check procedure is not performed, the encoding circuit 74 encodes an unknown indication of the security check indicator into the memory access transaction. Otherwise, the security check circuit 82 may perform the security check procedure. The security check procedure can utilize control data, which can be cached in cache 80 or in a separate control data cache. If the security check procedure is executed by security check circuit 82 and the transaction passes the security check procedure, then a security check indication can certainly be encoded by encoding circuit 74. If the security check procedure is executed and the transaction fails the security check procedure, an error can be signaled, and the transaction can be prevented from propagating to downstream component 60.

[0105] FIG. 9 An example of a memory access system 90 is schematically illustrated. The system includes a master device 70, where a transaction publishing circuit publishes a memory access transaction. The transaction includes at least a publishing domain identifier, a destination address, and a security check instruction. An encoding circuit 74 encodes the transaction and then passes it to a memory system component 50. A transaction processing circuit 52 of the memory system component 50 receives the transaction. Referring to the security check identifier, a control circuit 54 checks whether a security check procedure needs to be performed on the transaction. The transaction is then propagated to a downstream component 60.

[0106] FIG. 10A flowchart illustrating the steps in a method for processing memory access transactions is shown. At step S101, the transaction processing circuitry receives the transaction. At step S102, it is determined whether a security check procedure is known to pass based on a security check indication. If so, the process proceeds to step S103 and no security check is required, and at step S104, the transaction is propagated to the downstream component. If the transaction does not indicate that a security check procedure is known to pass, a security check procedure is required as shown in step S105. The security check procedure or cache lookup may be performed at the memory system component, or the component may control another system element to perform the security check procedure. It should be understood that these options are not shown as implementation choices, and many permutations still fall within the scope of this art.

[0107] FIG. 11 A flowchart illustrating the steps of a method for processing a memory access transaction, including performing a security check, is shown. At step S201, a transaction is received. At step S202, it is determined whether it is known that the security check procedure will pass based on a security check indication. If yes, the process proceeds to step S203 and the transaction propagates downstream without performing the security check procedure. Otherwise, at step S204, the security check procedure is performed. If the procedure passes, at step S205, the transaction's security check indication is updated to indicate a positive security check indication, and at step S203, the transaction is propagated downstream. If the security check procedure fails at step S204, an error is signaled at step S206, and the propagation of the transaction to any downstream component is prevented.

[0108] FIG. 12A A flowchart illustrating the steps in a method for processing memory access transactions is shown, including comparing the transaction with cache entries. The transaction is received at step S301. At step S302, it is determined whether a cache entry with the same combination of publishing domain and destination address can be found. If not, a cache entry is created (allocated) for the transaction's publishing domain / destination address at step S303, and the method continues as if a cache entry was found at step S302.

[0109] At step S304, it is determined whether the cache entry has a positive security check indication. That is, whether it is known that a transaction with the same combination of destination address and publishing domain will pass the security check procedure. In either case, at step S305 or S306, another determination is made regarding whether the received transaction has a positive security check indication (whether it is known that it will pass the security check procedure). If both the cache entry and the transaction have positive indications, the transaction is propagated downstream at step S307. If the cache entry has a positive cache entry check indication at step S304 but not a positive transaction security check indication at step S305, the method proceeds to step S308, and the transaction is updated to have a positive security check indication before being propagated downstream at step S307.

[0110] If a cache entry does not have a positive cache entry check indication at step S304, and the transaction does have a positive security check indication at step S306, then at step S309, the cache entry is updated to have a positive cache entry check indication. The transaction is then propagated at step S307. If the transaction does not have a positive security check indication at step S306, a security check procedure is performed at step S310. If the security check procedure passes, the transaction's cache entry check indication and security check indication are updated at step S311 to show a positive indication. The transaction is then propagated at step S307. If the security check procedure fails at step S310, an error is signaled at step S312.

[0111] FIG. 12B It shows FIG. 12A The table shows the possible outcomes of the method illustrated. If both the transaction safety check indication and the cache entry check indication are unknown, a safety check procedure is executed. If the safety check procedure passes, the cache entry and the transaction are marked with a positive indication, and the transaction is propagated. If the safety check procedure fails, an error is signaled. If the transaction safety check indication is positive and the cache entry check indication is unknown, the cache is updated to a positive indication. If the cache entry check indication is positive and the transaction safety indication is unknown, the transaction is updated to have a positive safety check indication. If both the transaction safety check indication and the cache entry check indication are positive, no safety check is performed.

[0112] FIG. 13A flowchart illustrating the steps of a method for generating a memory access transaction, performed at the master device, is shown, including comparing the transaction with cache entries. In this example, a transaction published in a secure domain can access both secure and insecure memory regions. A transaction is generated at step S401, and it is determined at step S402 whether a transaction was generated in a secure domain. If so, the transaction is encoded with a positive security indication at step S403. Steps S402 and S403 are omitted if applied to a system where transactions published in a secure domain can only access secure memory regions.

[0113] If the transaction is not published in the security domain at step S402, then at step S404 it is determined whether the combination of the published domain and the destination address is hit in the cache. If not, the method proceeds to step S405 and the transaction is encoded with an unknown security check indication. If the cache entry is indeed hit, then at step S406 it is determined whether the cache entry indicates that a transaction with the same combination of the published domain and the destination address will pass the security check procedure. If yes, then at step S407 the transaction is encoded with a positive security indication. If the cache entry indicates a negative security indication, then at step S405 the transaction is encoded with an unknown security check indication.

[0114] The following provides a brief overview of examples of this technology.

[0115] Arm ® TrustZone ® The architecture is an example of an architecture that provides separate secure and non-secure memory spaces. However, it is assumed that secure and non-secure memory are physically distinct, and many use cases benefit from the ability to dynamically allocate DRAM pages, such as those owned by secure or non-secure domains.

[0116] Physical alias points (PoPAs) are created by dynamically moving DRAM pages between secure and non-secure domains. Upstream of the PoPA, the two domains are disconnected and cached separately; downstream, aliases are added to the same set of physical DRAM pages.

[0117] PoPA manages checks to determine whether a page is safe or not. This may require examining the structure in memory. This lookup can take some time and requires a cache to store recently acquired entries. Some CPUs or devices, particularly those with specific performance requirements and / or large working sets, may benefit from performing checks before transactions enter the main coherent interconnect.

[0118] This technology provides a transaction that, when presented to the interconnect, is marked to indicate whether a security check has been performed. If true, access to DRAM can bypass the security domain associated with the transaction. If false, the downstream interconnect must ensure that the page is owned by the security domain used for access before accessing the DRAM.

[0119] An example coherence protocol is as follows:

[0120] Transactions accessing different security domains are always kept independent. Security domains are used as address bits.

[0121] When a non-security-checked transaction hits a cache line marked as security-checked, it is considered a security-checked transaction because the existence of a security-checked cache line indicates that the page is known to be owned by the corresponding security domain.

[0122] When a transaction that is being checked for security hits a cache line that was marked as not being checked, the cache line can be marked as being checked for security.

[0123] The process of reassigning a page from one security domain to another may include explicit cache clearing operations and zeroing out data in the page, making the physical alias invisible to the software.

[0124] This example has been described for two security domains, but it can be extended to more than two security domains.

[0125] When one security domain is more secure than another, checks may not be necessary. For example, when using both secure and insecure domains, it may not be necessary to check secure transactions accessing pages held by the secure domain, since the secure transactions are trusted. This means that supporting a combination of "secure and insecure checks" may not be required.

[0126] In this application, the phrase "configured as..." is used to mean that the elements of the device have a configuration capable of performing the defined operation. In this context, "configuration" means the arrangement or manner of interconnection of hardware or software. For example, the device may have dedicated hardware that provides the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured as" does not mean that the elements of the device need to be changed in any way to provide the defined operation.

[0127] While exemplary embodiments of the invention have been described in detail herein with reference to the accompanying drawings, it should be understood that the invention is not limited to those precise embodiments, and various changes and modifications can be made therein by those skilled in the art without departing from the scope and spirit of the invention as defined in the appended claims.

Claims

1. A memory system component, the memory system component comprising: Transaction processing circuitry, wherein the transaction processing circuitry is configured to receive memory access transactions, each memory access transaction specifying at least: A publishing domain identifier, which indicates a publishing security domain specified by the publishing master device for the memory access transaction, wherein the publishing security domain is one of a plurality of security domains; Target address; and A security check indication, which indicates whether it is known that the memory access transaction will pass the security check procedure; The security check procedure is used to determine, based on control data indicating which of the plurality of security domains are allowed to access the target address, whether the memory access transaction instructing the publishing security domain is authorized to access the target address; and The memory system component includes control circuitry configured to determine, based on the security check indication, whether the security check procedure still needs to be executed. The memory access transaction mentioned above supports at least the following encodings: A first code specifies a given value for the publication domain identifier and a first value for the security check indication that the memory access transaction is known to pass through the security check procedure; The second encoding specifies the given value of the publication domain identifier and a second value indicating whether the memory access transaction will pass the security check procedure or fail the security check procedure, which is not yet known.

2. The memory system component of claim 1, wherein when the control circuit determines that the security check procedure still needs to be executed, the control circuit is configured to control the security check circuit to execute the security check procedure.

3. The memory system component of claim 2, wherein the memory system component includes the security check circuit.

4. The memory system component of claim 3, wherein when a given memory access transaction fails the security check procedure, the security check circuit is configured to signal an error and prevent the given memory access transaction from propagating downstream of the memory system component.

5. The memory system component of claim 1, wherein when the control circuit determines that the security check procedure still needs to be executed, the control circuit is configured to control a downstream security check circuit to execute the security check procedure.

6. The memory system component according to any one of claims 1 to 5, wherein the target address is a physical address.

7. The memory system component according to any one of claims 1 to 5, wherein the control data comprises a plurality of entries, each entry associating at least one region of the address space with at least one of the plurality of security domains.

8. The memory system component of claim 7, wherein the security checking procedure includes comparing the release domain identifier with at least one of the plurality of security domains associated with an address space region including the target address.

9. The memory system component according to any one of claims 1 to 5, wherein the plurality of domains includes at least a secure domain and a less secure domain.

10. The memory system component of claim 9, wherein the memory access transaction supports encoding, the encoding indicating that the published security domain is the less secure domain, and that the transaction is known to have passed the security check procedure.

11. The memory system component according to any one of claims 1 to 5, the memory system component comprising a cache, the cache including cache entries for caching data obtained in response to a previously received memory access transaction, each cache entry being indexed by a combination of the target address and the published security domain.

12. The memory system component of claim 11, wherein the cache entry is configured to store at least a cache entry check indicator, the cache entry check indicator indicating whether a corresponding combination of a target address and a published security domain will pass the security check procedure; and The control circuit is configured to determine whether the security check procedure still needs to be performed for the given memory access transaction based on the security check instruction specified by the given memory access transaction and the cache entry check indicator corresponding to the cache entry corresponding to the combination of the target address of the given memory access transaction and the published security domain.

13. The memory system component of claim 12, wherein when the cache entry check indicator indicates that a given combination of the target address specified by the given memory access transaction and the published security domain will pass the security check procedure, the control circuit determines that the security check procedure does not need to be performed for the given memory access transaction, even if the security check indicator specified by the given memory access transaction indicates that it is unknown whether the given memory access transaction will pass the security check procedure.

14. The memory system component of any one of claims 12 and 13, wherein when the security check indication of the given memory access transaction indicates that the given memory access transaction will pass the security check procedure, and the cache entry check indicator does not indicate that a given combination of the target address and the published security domain will pass the security check procedure, the cache is configured to update the cache entry check indicator to indicate that the given combination of the target address and the published security domain will pass the security check procedure.

15. A main device, the main device comprising: A transaction publishing circuit, used to publish memory access transactions; and An encoding circuit, wherein the encoding specifies at least: A publication domain identifier, which indicates a publication security domain specified for the memory access transaction, wherein the publication security domain is one of a plurality of security domains; Target address; and A security check indication, which indicates whether it is known that the memory access transaction will pass the security check procedure; The security check procedure is used to determine, based on control data indicating which of the plurality of security domains are allowed to access the target address, whether the memory access transaction instructing the publishing security domain is authorized to access the target address. The memory access transaction mentioned above supports at least the following encodings: A first code specifies a given value for the publication domain identifier and a first value for the security check indication that the memory access transaction is known to pass through the security check procedure; The second encoding specifies the given value of the publication domain identifier and a second value indicating whether the memory access transaction will pass the security check procedure or fail the security check procedure, which is not yet known.

16. The main device according to claim 15, wherein the main device comprises: A security check circuit, the security check circuit being used to execute the security check procedure; and A determining circuit, the determining circuit being used to determine whether the security check procedure should be performed; The encoding circuit is configured to set the security check indication based on the determination made by the determining circuit.

17. The main device of claim 16, wherein the determining circuit is configured to perform the determination based on at least one of the following: The published security domain, and Whether the memory access transaction encounters a cache miss at a given level, wherein the cache is one of the following: Data cache; and A control data cache is used to cache control data, which indicates which security domains in the security domain are allowed to access the target address.

18. A system comprising: The main equipment according to any one of claims 15 to 17; and Memory system components, the memory system components including: Transaction processing circuitry, the transaction processing circuitry being configured to receive the memory access transaction published by the transaction publishing circuitry of the master device; and A control circuit, the control circuit being used to determine, based on the security check indication, whether the security check procedure still needs to be performed.

19. A method comprising: Receive memory access transactions, each memory access transaction specifying at least: A publishing domain identifier, which indicates a publishing security domain specified by the publishing master device for the memory access transaction, wherein the publishing security domain is one of a plurality of security domains; Target address; and A security check indication, which indicates whether it is known that the memory access transaction will pass the security check procedure; The security check procedure is used to determine, based on control data indicating which of the plurality of security domains are allowed to access the target address, whether the memory access transaction instructing the publishing security domain is authorized to access the target address; and The method includes determining, based on the security check indication, whether the security check procedure still needs to be performed. The memory access transaction mentioned above supports at least the following encodings: A first code specifies a given value for the publication domain identifier and a first value for the security check indication that the memory access transaction is known to pass through the security check procedure; The second encoding specifies the given value of the publication domain identifier and a second value indicating whether the memory access transaction will pass the security check procedure or fail the security check procedure, which is not yet known.

Images