Apparatus and method for controlling memory access in a data processing system having multiple subsystems

Abstract

Apparatus, methods, and techniques are disclosed for controlling memory accesses in a data processing system. The data processing system includes a plurality of subsystems, each including at least one processing element and at least one peripheral device. Memory transaction control circuitry receives memory transaction information including a stream identifier indicative of a memory transaction issued by a peripheral device. A master control register indicates an address of a flow table having a plurality of entries, each entry including a native subsystem identifier. At least one subsystem control register corresponding to each of the plurality of subsystems stores memory access check configuration information. Upon receiving the memory transaction information, an entry of the flow table is selected according to the stream identifier. At least one subsystem control register corresponding to a subsystem identified by the native subsystem identifier of the entry is selected. Memory access rules are then caused to be enforced according to the memory transaction information and the memory access check configuration information stored in the selected at least one subsystem control register.

Description

[0001] This technology relates to data processing. More specifically, it relates to the control of memory access in a data processing system that comprises multiple subsystems.

[0002] In a data processing system comprising multiple subsystems, these subsystems may not trust each other. However, these multiple subsystems may need to share access to various components of the data processing system, particularly memory components and some control registers. This means that control over memory access received from devices in multiple subsystems must be carefully coordinated to protect these subsystems from each other.

[0003] At least some examples provide an apparatus for controlling memory access in a data processing system, wherein the data processing system includes multiple subsystems during operation, each subsystem including at least one processing element and at least one peripheral device, the apparatus comprising: A memory transaction control circuit is used to receive memory transaction information from a peripheral device of a data processing system, wherein the memory transaction information includes a stream identifier indicating the peripheral device. A master control register stores a value indicating the address of a flow table, wherein the flow table comprises multiple entries, and each entry includes its own subsystem identifier; and At least one subsystem control register corresponding to each of the multiple subsystems, wherein the at least one subsystem control register is used to store memory access check configuration information. The memory transaction control circuit responds to the reception of memory transaction information: Select an entry from multiple entries in a flow table, identified by a value indicating the address of the flow table, based on the flow identifier; Select at least one subsystem control register corresponding to the subsystem identified by the entry's own subsystem identifier; and This results in the execution of memory access rules based on the memory transaction information and the memory access check configuration information stored in at least one selected subsystem control register.

[0004] At least some examples provide a method for controlling memory access in a data processing system, wherein the data processing system includes multiple subsystems during operation, each subsystem including at least one processing element and at least one peripheral device, the method comprising: Receive memory transaction information from a peripheral device of the data processing system, wherein the memory transaction information includes a stream identifier indicating the peripheral device; The value indicating the address of the flow table is stored in the main control register, where the flow table includes multiple entries, and each of the multiple entries includes its own subsystem identifier; The memory access check configuration information is stored in at least one subsystem control register corresponding to each of the multiple subsystems; and In response to receiving memory transaction information: Select an entry from multiple entries in a flow table, identified by a value indicating the address of the flow table, based on the flow identifier; Select at least one subsystem control register corresponding to the subsystem identified by the entry's own subsystem identifier; and This causes memory access rules to be executed based on memory transaction information and memory access check configuration information stored in at least one selected subsystem control register.

[0005] At least some examples provide an apparatus for controlling memory access in a data processing system, wherein the data processing system includes multiple subsystems during operation, each subsystem including at least one processing element and at least one peripheral device, the apparatus comprising: A component for receiving memory transaction information from a peripheral device of a data processing system, wherein the memory transaction information includes a stream identifier indicating the peripheral device. The component used to store the value of the address indicating the flow table in the main control register, wherein the flow table includes multiple entries, and each of the multiple entries includes its own subsystem identifier; A component for storing memory access check configuration information in at least one subsystem control register corresponding to each of the multiple subsystems; A component for selecting, in response to the receipt of memory transaction information, an entry from a plurality of entries in a flow table identified by a value indicating the address of the flow table, based on a flow identifier; A component for selecting at least one subsystem control register corresponding to the subsystem identified by the entry's own subsystem identifier; and A component for causing the execution of memory access rules based on incoming memory transaction information and memory access check configuration information stored in at least one selected subsystem control register.

[0006] At least some examples provide a computer program for controlling a host data processing device to provide an instruction execution environment, which includes: Memory access control logic is used to control memory access in a data processing system, wherein the data processing system includes multiple subsystems during operation, each subsystem including at least one instance of processing element logic and at least one instance of peripheral device logic. The memory access control logic includes: Memory transaction checking logic is used to receive memory transaction information of memory transactions issued by an instance of peripheral device logic of the data processing system, wherein the memory transaction information includes a stream identifier indicating the instance of the peripheral device logic. The main control register logic stores values ​​indicating the addresses of flow tables, where each flow table comprises multiple entries, and each entry includes its own subsystem identifier; and At least one instance of subsystem control register logic corresponding to each of the multiple subsystems, wherein the at least one instance of subsystem control register logic is used to store memory access check configuration information. The memory transaction check logic responds to the receipt of memory transaction information: Select an entry from multiple entries in a flow table, identified by a value indicating the address of the flow table, based on the flow identifier; Select at least one instance of the subsystem control register logic corresponding to the subsystem identified by the entry's own subsystem identifier; and This causes memory access rules to be executed based on the memory transaction information and the memory access check configuration information stored in at least one instance of the selected subsystem control register logic.

[0007] The invention will be further described by way of example only, with reference to embodiments of the invention shown in the accompanying drawings, and in conjunction with the following description: Figure 1 A data processing system comprising multiple subsystems according to some implementation schemes is illustrated schematically; Figure 2 The illustration schematically shows the use of a flow ID associated with a memory transaction to look up a proprietary subsystem identifier in a flow table according to some implementation schemes, and on this basis access the corresponding subsystem control register, as well as access memory access rule information and memory access check configuration information. Figure 3 A data processing system according to some embodiments is schematically illustrated, which includes multiple subsystems and various styles of system memory protection units (SMPUs). Figure 4The diagram schematically illustrates a means for controlling various memory accesses, including those corresponding to outgoing memory transactions, using memory transaction information from incoming memory transactions and information provided by global control registers and subsystem control registers, according to some embodiments. Figure 5 An apparatus for controlling memory access in a data processing system having active and inactive modes, according to some embodiments, is schematically shown. Figure 6 This is a flowchart illustrating a sequence of steps taken according to a method according to some embodiments, wherein memory transaction information is received and used to determine memory access check configuration information and cause the execution of the corresponding memory access rule; Figure 7 The cascading lookup process according to some implementations is illustrated, in which the flow ID of the memory transaction selects an entry in the flow table, the entry in the flow table selects a context descriptor table, and the sub-flow ID selects an entry in the context descriptor table in order to determine memory access permissions in the page table hierarchy. Figure 8A The cascading lookup process according to some implementations is illustrated schematically, wherein the stream ID of the memory transaction selects an entry in the stream table, the sub-stream ID selects an entry in the context descriptor table, and the entry in the context descriptor table provides the base address and size of the MPU region table; Figure 8B The illustration schematically shows a manner according to some exemplary embodiments, in which configuration data defining the set of memory access permissions can be collected in a hierarchical manner, as global control registers, flow tables, context descriptors, and MPU region attribute tables are accessed sequentially; Figure 8C This schematically illustrates the use of memory-mapped subsystem control register addresses to control cache maintenance operations in some implementations; Figure 9 A memory transaction processing circuit according to some embodiments is illustrated schematically, which uses the stream ID of an incoming memory transaction to determine the own subsystem ID to be applied to an outgoing memory transaction; Figure 10 The global control register is schematically shown according to some implementation schemes; Figure 11 A firewall device positioned between a system interconnect and a memory device is schematically illustrated according to some embodiments; and Figure 12 A specific implementation of the available simulator is shown.

[0008] In one example of this document, there is an apparatus for controlling memory access in a data processing system, wherein the data processing system includes multiple subsystems during operation, each subsystem including at least one processing element and at least one peripheral device, the apparatus comprising: A memory transaction control circuit is used to receive memory transaction information from a peripheral device of a data processing system, wherein the memory transaction information includes a stream identifier indicating the peripheral device. A master control register stores a value indicating the address of a flow table, wherein the flow table comprises multiple entries, and each entry includes its own subsystem identifier; and At least one subsystem control register corresponding to each of the multiple subsystems, wherein the at least one subsystem control register is used to store memory access check configuration information. The memory transaction control circuit responds to the reception of memory transaction information: Select an entry from multiple entries in a flow table, identified by a value indicating the address of the flow table, based on the flow identifier; Select at least one subsystem control register corresponding to the subsystem identified by the entry's own subsystem identifier; and This results in the execution of memory access rules based on the memory transaction information and the memory access check configuration information stored in at least one selected subsystem control register.

[0009] A hierarchical arrangement of control registers used by memory transaction control circuitry to determine memory access check configuration information for accessing a given set of memory transaction information provides an arrangement in which each subsystem can be provided with individual control over its own memory access configuration; however, the overall control of this arrangement is retained by a trusted entity in the system and performed by the memory transaction control circuitry itself (e.g., as part of the system MPU (Memory Protection Unit), though not mandatory). This is because the master control register is used to define the location where the flow table will be accessed (e.g., by providing a base address or other value indicating the address of the flow table), and this master control register is under the control of a trusted entity and cannot be modified by (potentially distrustful) subsystems. Therefore, this means that entries in the flow table can be trusted. Furthermore, each entry in the flow table includes its own subsystem identifier, allowing the memory transaction control circuitry to reliably determine its own subsystem to associate with each memory transaction received from the peripheral device. The identifier of the own subsystem is then used to determine at least one subsystem control register corresponding to the subsystem, and the subsystem control register (directly or indirectly) provides the required memory access check configuration information. Therefore, when the memory transaction information includes a stream identifier indicating the peripheral device from which the memory transaction originates, this provides a reliable mechanism to ensure that memory transactions received from peripheral devices are correctly associated with their respective subsystems, and on this basis, the correct memory access check configuration information can be retrieved and used to execute memory access rules appropriate for the memory transaction and the peripheral device that generated it.

[0010] The information required to execute appropriate memory access rules can take various forms. In some embodiments, memory access check configuration information can be provided relatively directly to the memory transaction control circuitry. In some embodiments, an additional lookup layer can be used to derive additional information required to configure memory access rules. Therefore, in some embodiments, the execution of memory access rules further depends on additional memory access check configuration information, which includes: A context descriptor table, wherein the context descriptor table has a plurality of context descriptors, each context descriptor including a value indicating the address of the memory region attribute table; and The memory region attribute definition is accessed by the memory transaction control circuit according to the value of the address indicating the memory region attribute table. The address of the context descriptor table is determined based on one of the following: Additional values ​​in the selected entries of the flow table; and Another value in at least one of the selected subsystem control registers.

[0011] Therefore, the context descriptor table can be used to allow access to desired configuration information, particularly by providing a value indicating the address of a memory region attribute table. This value can be the address itself, it can indicate only a portion of the address (sufficient to uniquely identify it), or it can indicate, for example, an additional location where the desired address information is to be found. Furthermore, the address of the context descriptor table can be determined from various sources, and the implementation specifies that the address can be determined based on one of the following: an additional value in the selected entry of the flow table; and an additional value in at least one selected subsystem control register.

[0012] The context descriptor table can be accessed in various ways under the control of information found in the flow table. However, in some implementations, the memory transaction information also includes a sub-flow identifier indicating the originating context in the peripheral device of the memory transaction, and the additional memory access check configuration information based on the value indicating the address of the context descriptor table includes: A context descriptor is selected from the context descriptor table, identified by the value of the address indicating the context descriptor table, based on the sub-stream identifier; Retrieve the value indicating the address of the memory region attribute table from the selected context descriptor; and Access the memory region attribute table identified by the value indicating the address of the memory region attribute table to retrieve at least one memory region attribute definition in the memory region attribute definitions.

[0013] Therefore, in such an arrangement, where the memory transaction information provides a sub-stream identifier indicating the originating context in the peripheral device of the memory transaction, this allows for the support of multiple contexts in any of the peripheral devices and the differentiation among these multiple contexts in terms of memory access control. Thus, a context descriptor can be selected from the context descriptor table based on the sub-stream identifier. The corresponding memory region attribute table can then be accessed to retrieve at least one memory region attribute definition suitable for the originating context. This provides an additional level of isolation between the multiple contexts representing the operation of a given peripheral device.

[0014] Context descriptors stored in a context descriptor table can hold various information related to controlling memory access, and in some embodiments, the context descriptor selected in the context descriptor table also stores a value indicating the size of the memory region attribute table, and accessing the memory region attribute table involves accessing a memory region defined by a value indicating the address of the memory region attribute table and a value indicating the size of the memory region attribute table. Therefore, this provides a flexible and configurable way to access appropriate memory region attributes from a memory region attribute table thus defined. It should be understood that the size of the memory region attribute table can be encoded in various ways; for example, it can be directly specified in a field in the context descriptor, or the field in the context descriptor can be used to indirectly derive the size (e.g., by raising 2 to a power of the value of that field). In some embodiments, multiple fields of the context descriptor can together indicate the size of the memory region attribute table. For example, the context descriptor can contain the high-order address (or limit address) of the memory region attribute table, which, when combined with the base address of the memory region attribute table, indicates the size of the memory region attribute table. In other embodiments, the size of the memory region attribute table can be fixed, so it is not necessary to store a value indicating the size of the memory region attribute table in the context descriptor.

[0015] Memory region attribute definitions can be defined in various ways, but in some implementations, the retrieved memory region attribute definition includes additional memory access rule information containing permission information, and the retrieved memory region attribute definition also includes values ​​indicating the start and end addresses of the memory region. Therefore, these values ​​can be, for example, explicit start and end addresses, they can be a start address and length, or any other equivalent mechanism that allows defining the desired memory block.

[0016] Memory region attribute tables can be provided in various ways, but in some implementations, the memory region attribute table, identified by the value indicating the address of the memory region attribute table, forms part of the page table hierarchy, and the additional memory access rule information includes permission information defined in the page table hierarchy.

[0017] In some embodiments where the memory transaction information also includes a sub-stream identifier indicating the originating context in the peripheral device of the memory transaction, additional information may be provided in the memory transaction information to indicate the validity (or conversely, invalidity) of such a sub-stream identifier. In other embodiments, the invalidity of the sub-stream identifier can be encoded by using an invalid value for the sub-stream identifier, for example, by selecting a value of 0 to encode the invalidity of the sub-stream identifier. Thus, in some embodiments, the memory transaction control circuitry further responds to a sub-stream identifier validity flag in the memory transaction information, performing the selection of an entry in the context descriptor table based on a predetermined sub-stream identifier when the sub-stream identifier validity flag indicates the invalidity of the sub-stream identifier. Therefore, instead of using the sub-stream identifier that forms part of the memory transaction information, an alternative (predetermined) sub-stream identifier is used to perform the selection of an entry in the context descriptor table. Thus, this default selection can allow the memory transaction to continue, but where it is limited to access permitted by the memory region attribute table, which then leads to the access of that memory region attribute table. Thus, another aspect of control over memory access to peripheral devices in a data processing system is provided.

[0018] In some implementations, the device itself can receive incoming memory transactions and then execute relevant memory access rules based on the memory transaction information and memory access check configuration information. In other implementations, the device can provide a control mechanism for determining relevant memory access rules based on memory transaction information and memory access check configuration information, without receiving incoming memory transactions itself. For example, another system component can receive incoming memory transactions and reference the relevant memory transaction information to the device.

[0019] Furthermore, the device can be configured to issue outgoing memory transactions. Therefore, in some embodiments, the device also includes a memory transaction transport interface to issue outgoing memory transactions targeting data storage devices of the data processing system, wherein the outgoing memory transactions include an assigned home subsystem identifier. The memory transaction transport interface can be used to forward incoming transactions via relevant memory access rules. The memory transaction transport interface can be used to transport transactions generated by memory transaction control circuitry to various memory tables (e.g., flow tables, context descriptor tables, or memory region attribute tables). This then means that the recipient of these outgoing memory transactions can then refer to the assigned home subsystem identifier to determine the correct access (and conversely, deny access). This simplifies the configuration where such a recipient only needs to filter based on the subsystem identifier, as it does not need to know the relationship between the peripheral device and its home subsystem. Furthermore, it reduces the number of bits that need to be carried on the system interconnect. In some embodiments, a single memory transaction transport interface can be used for both forwarding incoming transactions and transactions generated by memory transaction control circuitry. In other embodiments, a separate memory transaction transport interface can be used, where the interface is used to forward incoming transactions as part of another component of the system that receives incoming transactions from peripheral devices.

[0020] In cases where the flow table itself can be stored in memory and thus accessed via memory transactions, the memory transaction control circuitry can issue its own memory transaction to retrieve the relevant contents of the flow table when memory access rules are executed (as described above). Such flow table accesses can then be flagged in various ways to ensure their security, and in some embodiments, the memory transaction control circuitry further responds to the receipt of memory transaction information by causing the memory transaction transport interface to issue a first outgoing memory transaction to access the flow table, wherein the first assigned own subsystem identifier in the first outgoing memory transaction is one of the following: a predetermined value indicating a valid subsystem; and a value indicating that the first outgoing memory transaction does not have an associated own subsystem identifier.

[0021] Furthermore, such subsequent memory access transactions can also be marked by their own subsystems when they are subsequently used to access memory access check configuration information based on the address in the context descriptor table. Therefore, in some embodiments, the memory transaction control circuitry further responds to the reception of memory transaction information by causing the memory transaction transport interface to issue a second outgoing memory transaction to access memory access check configuration information based on the address in the context descriptor table, wherein the second assigned subsystem identifier in the second outgoing memory transaction is determined based on the subsystem identifier of the selected entry in the flow table.

[0022] In a similar manner, the memory region attribute table can then be accessed using further subsequent memory accesses, and this memory access transaction can also be marked by its own subsystem. Therefore, in some embodiments, the memory transaction control circuitry further responds to the receipt of memory transaction information by causing the memory transaction transport interface to issue a third outgoing memory transaction to access the memory region attribute table according to the value of the address indicating the memory region attribute table, wherein the third assigned self-subsystem identifier in the third outgoing memory transaction is determined based on the self-subsystem identifier of the selected entry in the flow table.

[0023] The memory transaction control circuitry can be arranged to operate in a variety of different modes. For example, it can be arranged to have an inactive mode, wherein the aforementioned accesses to the flow table in the main control register and to at least one subsystem control register do not occur in response to received memory transaction information. However, in such a state, the device may not be completely inactive, and in some embodiments, when the device is set to inactive mode, the memory transaction control circuitry further responds to the receipt of memory transaction information such that all outgoing memory transactions issued by the memory transaction transport interface have one of the following: a predetermined value indicating a valid subsystem as an assigned own subsystem identifier; and a value indicating that the transaction does not have an associated own subsystem identifier.

[0024] Either or both of the entries in the main control register and the flow table can also be used to provide additional configuration parameters for configuring outgoing memory transactions (such as those triggered by receiving memory transaction information, for example, to access various configuration data in memory). Therefore, in some embodiments, the memory transaction control circuitry further responds to the receipt of memory transaction information by configuring at least one outgoing memory transaction associated with the received memory transaction information issued by the memory transaction transport interface according to at least one of the following: additional configuration parameters in the main control register; and additional configuration parameters in a selected entry of the flow table. Similarly, the subsystem control register can also be used to provide additional configuration parameters for configuring outgoing memory transactions (such as those triggered by receiving memory transaction information, for example, to access various configuration data in memory). Therefore, in some embodiments, the memory transaction control circuitry further responds to the receipt of memory transaction information by configuring at least one outgoing memory transaction associated with the received memory transaction information issued by the memory transaction transport interface according to additional configuration parameters in at least one subsystem control register corresponding to each of the plurality of subsystems. Memory transaction control circuitry can use such configuration parameters to induce modifications to incoming memory transactions that are checked against their memory access rules before being forwarded.

[0025] Certain subsystem control registers can be used to control operations performed on a corresponding subsystem. These subsystem control registers can be configured to store subsystem-readable and writable data (which may include subsystem configuration parameters), but can also be configured such that a write to at least one address in a target subsystem control register will trigger a memory-related operation on behalf of that subsystem. Therefore, in some embodiments, when a register write transaction specifies a write to at least one address in a target subsystem control register, the memory transaction control circuitry further responds to the receipt of the register write transaction by making all operations initiated as a result of the write to at least one address in the target subsystem control register subject to a proprietary subsystem identifier associated with the register write transaction. Thus, regardless of the nature of the operation triggered by a write to that target subsystem control register, the operation is then subject to the proprietary subsystem identifier, i.e., such that the operation may only affect its own subsystem and is prevented from having (direct) impact on any other subsystem. In some embodiments, the subsystem control register may be memory-mapped, and the register write transaction may include a memory write transaction targeting an address of a register. In other implementations, register write transactions may include register-specific write transactions that can be encoded differently as memory write transactions.

[0026] As described above, the operation initiated as a result of writing to at least one address in the target subsystem control register can take various forms. However, in some embodiments, the operation initiated as a result of writing to at least one address in the target subsystem control register is a cache invalidation operation, wherein the apparatus further includes a cache, and the cache invalidation operation is limited to cache contents associated with the own subsystem identifier. Therefore, in this example, only cache contents belonging to the own subsystem will be invalidated, while cache contents belonging to other subsystems will remain unmodified. In some embodiments, the cache may include a context descriptor cache for caching entries from the context descriptor table. Alternatively or additionally, some embodiments may include a memory region attribute table entry cache for caching entries from the memory region attribute table.

[0027] In some implementations, each peripheral device is associated with only a single stream identifier, which is used to mark all memory transactions it generates. However, other implementations specify that a given peripheral device may be associated with multiple stream identifiers. Having multiple stream identifiers associated with a peripheral device allows the peripheral device to differentiate between operations performed on behalf of, for example, completely separate (and non-trusting) system components (in terms of the memory transactions it issues), and this thus supports separation and secure isolation between these two worlds. Therefore, in some implementations, at least one peripheral device of a data processing system is a multi-stream identifier peripheral device associated with more than one stream identifier, wherein the more than one stream identifier of the multi-stream identifier peripheral device is associated with mutually independent operations of the multi-stream identifier peripheral device. For example, a peripheral device for performing encryption (such as a dedicated cryptographic accelerator) can represent various system components, particularly different subsystems, to perform encryption operations. Thus, this use of multiple stream identifiers supports secure isolation between those "users" of the hardware.

[0028] The independent operation of peripheral devices can be associated with the same subsystem or with different subsystems. Therefore, in some implementations, the independent operation of multi-stream identifier peripheral devices is associated with different subsystems within multiple subsystems of the data processing system.

[0029] Various techniques can be employed to protect the integrity of the main control register, but in some implementations, the main control register also includes a lock bit storage device for storing lock bits, wherein modification of the contents of the main control register is not permitted when the lock bits have a predetermined lock bit value. Therefore, once the lock bits have a predetermined lock bit value, the integrity of the contents of the main control register is ensured. For example, at system startup, trusted software can configure a system configuration that includes the contents of the main control register, and once it is correctly configured, the lock bits can eventually be set to the predetermined lock bit value. This could mean that a processing element (CPU) running trusted software at startup can subsequently be used to run untrusted software without any risk to the integrity of the contents of the main control register.

[0030] Enforcement of memory access rules can be provided in various ways. For example, in some embodiments, the memory transaction control circuitry can enforce memory access rules, allowing only approved memory transactions to continue and blocking those that violate the memory access rules. However, in other embodiments, one or more additional components may be provided to perform this enforcement. Thus, when the memory transaction control circuitry determines the applicable memory rules for a given memory transaction, those applicable memory rules are enforced by one or more additional components. For example, in some embodiments, the apparatus further includes a memory transaction filtering circuitry that, in response to the receipt of a memory transaction, determines from memory transaction information and memory access check configuration information whether to approve the memory transaction, and when the memory transaction is approved, the memory transaction filtering circuitry is arranged to modify the memory transaction to include its own subsystem identifier. In the case that the memory transaction is then marked with its own subsystem identifier, this then provides the receiver of the memory transaction with an efficient mechanism to determine whether the memory transaction should continue. For example, this efficiency is supported by the fact that the stream identifier no longer needs to be carried by the memory transaction.

[0031] Therefore, according to such an arrangement, the device can be part of a data processing system comprising additional components, at least one of which, in response to a received memory transaction, filters the memory transaction based on its own subsystem identifier value. For example, such filtering can protect a given target memory device, and the component thus acts as a firewall. The additional component can then also have its own configuration dataset, which it compares against to determine whether it should be allowed to proceed to the target memory device, based on its location within the data processing system. Therefore, in some embodiments, there exists a data processing system that includes the means described above, and further includes: additional filtering means for receiving memory transactions after the means have modified the memory transaction, wherein the additional filtering means includes: a memory transaction receiving interface for receiving the memory transaction, wherein the memory transaction specifies a value indicating at least a portion of a memory address and a self-owned subsystem identifier value indicating a self-owned subsystem; an access configuration storage device; and additional memory transaction filtering circuitry that, in response to receiving a memory transaction by the memory transaction receiving interface: when the content of the access configuration storage device indicates that a memory transaction having a self-owned subsystem identifier value indicating a self-owned subsystem is approved to access a memory location associated with the value indicating at least a portion of the memory address, forwards the memory transaction to a target memory device; and when the content of the access configuration storage device does not indicate that a memory transaction having a self-owned subsystem identifier value indicating a self-owned subsystem is approved to access a memory location associated with the value indicating at least a portion of the memory address, prevents the memory transaction from entering the target memory device.

[0032] Access to the configuration storage device can be configured in various ways depending on system requirements; however, in some implementations, the access to the configuration storage device includes access permissions to each proprietary subsystem of the target memory device. In some implementations, access to the configuration storage device includes access permissions to memory regions within the target memory device of each proprietary subsystem.

[0033] The combination of memory access inspection circuitry and filtering performed by the firewall can provide effective isolation between different contexts within a subsystem and between different subsystems.

[0034] In one example of this paper, there is a method for controlling memory access in a data processing system, wherein the data processing system includes multiple subsystems during operation, each subsystem including at least one processing element and at least one peripheral device, the method comprising: Receive memory transaction information from a peripheral device of the data processing system, wherein the memory transaction information includes a stream identifier indicating the peripheral device; The value indicating the address of the flow table is stored in the main control register, where the flow table includes multiple entries, and each of the multiple entries includes its own subsystem identifier; The memory access check configuration information is stored in at least one subsystem control register corresponding to each of the multiple subsystems; and In response to receiving memory transaction information: Select an entry from multiple entries in a flow table, identified by a value indicating the address of the flow table, based on the flow identifier; Select at least one subsystem control register corresponding to the subsystem identified by the entry's own subsystem identifier; and This causes memory access rules to be executed based on memory transaction information and memory access check configuration information stored in at least one selected subsystem control register.

[0035] In one example of this document, there is an apparatus for controlling memory access in a data processing system, wherein the data processing system includes multiple subsystems during operation, each subsystem including at least one processing element and at least one peripheral device, the apparatus comprising: A component for receiving memory transaction information from a peripheral device of a data processing system, wherein the memory transaction information includes a stream identifier indicating the peripheral device. The component used to store the value of the address indicating the flow table in the main control register, wherein the flow table includes multiple entries, and each of the multiple entries includes its own subsystem identifier; A component for storing memory access check configuration information in at least one subsystem control register corresponding to each of the multiple subsystems; A component for selecting, in response to the receipt of memory transaction information, an entry from a plurality of entries in a flow table identified by a value indicating the address of the flow table, based on a flow identifier; A component for selecting at least one subsystem control register corresponding to the subsystem identified by the entry's own subsystem identifier; and A component for causing the execution of memory access rules based on incoming memory transaction information and memory access check configuration information stored in at least one selected subsystem control register.

[0036] In one example of this paper, there is a computer program that controls a host data processing device to provide an instruction execution environment, which includes: Memory access control logic is used to control memory access in a data processing system, wherein the data processing system includes multiple subsystems during operation, each subsystem including at least one instance of processing element logic and at least one instance of peripheral device logic. The memory access control logic includes: Memory transaction checking logic is used to receive memory transaction information of memory transactions issued by an instance of peripheral device logic of the data processing system, wherein the memory transaction information includes a stream identifier indicating the instance of the peripheral device logic. The main control register logic stores values ​​indicating the addresses of flow tables, where each flow table comprises multiple entries, and each entry includes its own subsystem identifier; and At least one instance of subsystem control register logic corresponding to each of the multiple subsystems, wherein the at least one instance of subsystem control register logic is used to store memory access check configuration information. The memory transaction check logic responds to the receipt of memory transaction information: Select an entry from multiple entries in a flow table, identified by a value indicating the address of the flow table, based on the flow identifier; Select at least one instance of the subsystem control register logic corresponding to the subsystem identified by the entry's own subsystem identifier; and This causes memory access rules to be executed based on the memory transaction information and the memory access check configuration information stored in at least one instance of the selected subsystem control register logic.

[0037] Some specific implementation schemes will now be described with reference to the accompanying drawings.

[0038] Figure 1 A data processing system 10 is schematically illustrated in some exemplary embodiments. The data processing system includes two data processing elements (i.e., processors or CPUs) 12, 14, which are connected to the rest of the data processing system via a system interconnect 16. The system interconnect 16 typically provides interconnection, particularly providing access to the processing elements to memory devices such as SRAM 18 and flash memory 20. It should be noted that... Figure 1 A set of peripheral control registers 22 is also shown; these are memory-mapped control registers and are therefore addressable by the master device (such as a processing element) in the data processing system using the memory addresses they are mapped to. Figure 1 In the example shown, each of these memory devices is isolated from the system interconnect via firewall devices 24, 26, and 28, which are arranged to filter memory transactions attempting to access the corresponding connected memory device in a manner described in more detail below. Flash memory device 20 is shown with an associated cache 30. Each of the processing elements 12 and 14 is shown also having its own memory protection unit (MPU) 32 and 34, which checks memory transactions generated by software executing on the corresponding processing element against defined memory access rules. Figure 1 The diagram also shows three peripheral devices 36, 38, and 40 that form part of the data processing system 10. These peripheral devices are connected via I / O interconnect 42. I / O interconnect 42 is then connected to system interconnect 16 via system memory protection / management unit (SMPU / SMMU) 44. Therefore, SMPU / SMMU 44 checks memory transactions from multiple peripheral devices. Ownership and control of these peripheral devices may belong to multiple (potentially distrustful) subsystems. Figure 1The example illustration shows two subsystems, one (“Subsystem 0”) based on processing element 12 and the other (“Subsystem 1”) based on processing element 14. As shown by dashed line 46, Subsystem 0 includes processing element 12, peripheral device 36, and peripheral device 38. As shown by dashed line 48, Subsystem 1 includes processing element 14, peripheral device 40, and peripheral device 38. Therefore, peripheral device 38 is shared by both subsystems. Similarly, SRAM device 18, cache 30, flash memory device 20, and peripheral control register 22 are also shared by both subsystems. As will be described in more detail below with reference to the accompanying drawings, memory transactions entering SMPU / SMMU 44 from peripheral devices 36, 38, and 40 have a flow ID indicating which peripheral device the transaction originated from. In some cases, such as when peripheral devices are shared between subsystems (as in the case of peripheral device 38), a peripheral device may have multiple flow IDs associated with it, making it distinguishable between operations of that peripheral device within each respective subsystem. It should be recognized that the subsystems defined in the data processing system 10 are characteristics of the data processing system during operation. In this sense, before the data processing system is started, peripheral devices may not necessarily be associated with any specific subsystem, but as part of the startup of the data processing system, a configuration may be imposed (through trusted software) that assigns the peripheral devices to one or more subsystems of the data processing system.

[0039] The SMPU / SMMU 44 uses a stream ID associated with a memory transaction received from one of the peripheral devices and a series of tables in memory to determine the memory access rules applicable to the memory transaction. These memory mapping tables include a master control register, from which the location of the stream table is determined, and the stream ID associated with the memory transaction is used to reference entries within the stream table to derive a proprietary subsystem identifier associated with the memory transaction. The proprietary subsystem identifier is then used to select at least one subsystem control register corresponding to that subsystem, where various configuration information related to memory access checks for the memory transaction is stored. This configuration information can be used (at least partially) directly to provide rules for checking memory transactions and can also be used (at least partially) indirectly, i.e., by pointing to an additional storage location where the rules for checking memory transactions are stored. By changing the proprietary subsystem identifier of an entry in the stream table, the associated stream ID can be assigned to a different subsystem. Since different peripheral devices are associated with different stream IDs, the proprietary subsystem identifier can control which subsystem owns and controls the peripheral device.

[0040] Figure 2 The above is illustrated schematically according to some implementation schemes. Figure 1The information mentioned and some of the tables, and how to interact with them. Incoming memory transaction 60 (e.g., as by...) Figure 1 The SMPU / SMMU44 receive in the exemplary configuration contains Stream ID 62. Global Control Register 64 (also known as the Master Control Register) provides the location of the stream table in memory. Figure 2 As shown, this can be achieved by explicitly storing the global control register 64 of the flow table base address 66. However, it will be appreciated that the location of the flow table in memory can be provided in other ways by the value in the global control register 64, for example by an abbreviated address (which is still sufficient to uniquely identify the flow table location) or by a pointer indicating where the flow table will be found. Alternatively, the global control register 64 can specify the high-order address of the flow table in memory. The flow table 68 stored in memory is then accessed, whereby the flow ID 62, provided along with the incoming memory transaction 60, is used to select one of the multiple entries in the flow table. Figure 2 In the example shown, entry 70 of the flow table (“STE1”) is selected. The entry in the flow table provides a proprietary subsystem identifier (“OSI”) that indicates the subsystem associated with the peripheral device that generated the incoming memory transaction. Based on this proprietary subsystem identifier, the subsystem control register 72 is then accessed (in the data processing system, a different subsystem control register is provided for each subsystem, and in practice, some subsystems may have more than one subsystem control register). The subsystem control register 72 then provides configuration information that defines the memory access checks that must be performed for memory transaction 60. Therefore, this memory access check configuration information 74 can be provided at least partially directly by the subsystem control register 72, but can also be provided at least partially by referencing memory access rule information 76 stored in memory. This memory access rule information 76 can be accessed by giving the base address of its starting point in memory. Figure 2 Two alternatives for providing the base address are shown. In the first example, the base address (“BA”) is also stored in the flow table entry 70 of the accessed flow table 68. In the second example, the base address (“BA”) is stored in the subsystem control register 72. It will be appreciated again that the location in memory of the memory access rule information 76 can be provided in other ways by values ​​other than an explicit address, such as an abbreviated address (which is still sufficient to uniquely identify the memory location), a pointer indicating where the information will be found, or a value of the high-order address of the specified table.

[0041] The apparatus that performs the functions of the SMMU / SMPU described above can take many forms, some of which are... Figure 3 It is shown schematically in the middle. Figure 3A heterogeneous data processing system 100 is schematically illustrated. A series of different devices that typically access memory 102 via interconnect 104 are shown. Complex device 110 includes its own built-in memory access checking capabilities, including an embedded SMPU 112. Two peripheral devices 114 and 116 are connected to a "standalone" (monolithic) SMPU 120 via I / O interconnect 118, through which all memory transactions generated by them are passed to the system interconnect 104. Peripheral devices 122, 124, 126, and 128 are connected to the system interconnect 104 via a distributed SMPU 130. Key components of SMPU 130 are control and region lookup hardware 132 and at least one region checker 134 and 136. Region checkers 134 and 136 are under the control of control and region lookup hardware 132, but can independently perform some memory transaction checks, which have previously been coordinated by control and region lookup hardware 132. Previously retrieved memory access rules and permissions can be stored in the corresponding cache memories 144, 146 of the zone checkers 134, 136 to facilitate faster processing of similar memory transactions in the future. Therefore, when one of the zone checkers 134, 136 receives a memory transaction for which it already has the required rules and permissions available, it can process the memory transaction check without further referencing the control and zone lookup hardware 132. However, for a “new” memory transaction for which it does not have the required rules and permissions available, the necessary information (specifically, the stream ID of the memory transaction and the memory address sought for access) is passed to the control and zone lookup hardware 132, which then references one or more main control registers and subsystem control registers in a manner described herein to derive the required rules and permissions, which can then be passed back to the zone checker for independent use. Peripheral devices 122, 124, 126 are connected to the zone checker 134 via I / O interconnect 138. Peripheral device 128 is connected to the zone checker 136. The additional "smart" device 140 includes its own area checker 142, which is still associated with (and under the control of) the control and area lookup hardware 132. Therefore, Figure 3 A series of different peripheral devices in the data processing system 100 shown share access to memory 102 and memory-mapped device control register 150. Various configurations of the shown SMPU provide memory access checking capabilities to ensure that valid memory transactions generated by peripheral devices are correctly checked and controlled, even if the respective peripheral devices belong to multiple subsystems within the data processing system. Explicit allocation of peripheral devices to subsystems is... Figure 3 Although not shown, in principle any number of subsystems can be defined for the operational data processing system shown, and each peripheral device can be assigned to one or more of those subsystems.

[0042] As referenced above Figure 3 The techniques described herein can be implemented in various ways by a system component commonly referred to as the SMPU. Figure 3 Various examples of ways to provide such a SMPU are given, including in particular a distributed SMPU 130. According to this arrangement, the SMPU is basically composed of two parts: the first part has overall control over the process (e.g., control and region lookup hardware 130), and the second part is arranged to perform specific memory access checking tasks (e.g., region checkers 134, 136, 142). Figure 4An exemplary implementation of this task breakdown is provided. An incoming memory transaction 200 (including a stream ID 202) is received by a memory access check circuit 204. The memory access check circuit 204 includes a cache 206 storing previously required memory access check parameters. Referring to the parameters of the incoming memory transaction, particularly its stream ID 202 and the memory address sought for access, the memory access check circuit 204 first checks in its cache 206 whether the required memory access check parameters are currently stored there. If they are stored there, the memory access check circuit 204 executes memory access rules defined relative to those parameters of the incoming memory transaction. Thus, if the incoming memory transaction 200 violates those memory access rules, the incoming memory transaction can be blocked, or if the incoming memory transaction satisfies those memory access rules, the incoming memory transaction can be allowed to pass. An outgoing memory transaction 208 from the memory access check circuit 204 includes a subsystem identifier 210 (initially determined by the operation of the memory transaction control circuit 214 as described below). When a lookup by the memory access check circuit 204 and its cache 206 results in a miss, the memory access check circuit 204 passes memory transaction information 212 to the memory transaction control circuit 214. The memory transaction information 212 includes the necessary information for determining the memory access check parameters, and therefore includes the stream ID 202 and the address that the incoming memory transaction 200 is seeking to access. In response to the receipt of the memory transaction information 212, the memory transaction control circuit refers to the global control register 216 to determine the base address of the stream table. The memory transaction control circuit 214 then generates its own memory transaction to extract the contents of an entry in the stream table. The specific entry extracted is determined by the stream ID 202. Based on the returned information (including its own subsystem identifier), the memory transaction control circuit 214 then refers to the selected subsystem control register 218 to retrieve memory access check configuration information applicable to the received memory transaction 200. In some implementations, this configuration information can provide all the information needed to define the required memory access rules 220, which can then be passed back to the memory access checking circuitry 204 (and stored in the cache 206). However, in Figure 4 In the illustrated implementation, the selected subsystem control register 218 provides the base address of the context descriptor table stored in memory. Therefore, the memory transaction control circuitry 214 then generates its own memory transaction to retrieve the contents of a specific context descriptor from the context descriptor table. In fact, in Figure 4In the example, the content of the received context descriptor provides two parameters: the base address of the MPU region attribute table and the attribute table size. Therefore, this information defines the memory blocks that should be accessed to retrieve these required attributes. This is also accomplished by generating another memory transaction through memory transaction control circuitry 214 to retrieve these attributes. Once retrieved in this way, these attributes define memory access rules 220, which are passed back to memory access checking circuitry 204 and stored in its cache 206. It should also be noted that the memory transaction 222 generated by memory transaction control circuitry 214 also includes a subsystem identifier 224. While there is a unique subsystem identifier associated with each defined subsystem in the data processing system, there is also a specific subsystem identifier that the system uses to identify memory transactions associated with a higher system privilege level than that associated with any of the subsystems. In cases such as... Figure 4 In some exemplary embodiments shown, this is a subsystem ID of zero. Therefore, access to the flow table generated by the memory transaction control circuit 214 has a subsystem identifier of zero. When the flow table is owned and protected by an entity in the data processing system with a higher system privilege level than any of the subsystems mentioned above, those subsystems (which can only forward memory access requests with their own associated subsystem identifiers) cannot modify the flow table. This is protected by filtering and allowing only write transactions with a zero subsystem identifier to reach it. Subsequently, the aforementioned access to the context descriptor table and MPU region attribute table is performed using memory transactions with subsystem identifiers having their own subsystem identifiers derived from the flow table of the received memory transactions.

[0043] Figure 5 The apparatus in some exemplary embodiments is illustrated schematically. Here, the memory transaction control circuitry is embodied as SMPU 250. SMPU 250 is arranged to receive incoming memory transactions 252 (with associated flow identifier 254). How SMPU 250 processes the incoming memory transaction 252 depends on its current operating mode. SMPU 250 has two modes: active mode and inactive mode. Which mode SMPU 250 operates in is defined by a signal (“active / inactive”) received by SMPU 250 and originates from a trusted system entity (such as global control register 64). This signal can alternatively be considered an enable / disable signal. However, it is important to note that when SMPU 250 is in its inactive mode (or “disabled”), this does not mean that it is completely transparent to incoming memory transactions 252. Specifically, when SMPU 250 is in its inactive mode, all memory transactions passing through it are given a subsystem identifier of zero. Figure 4In the described exemplary implementation, the subsystem identifier is associated with an entity in the data processing system that operates at a higher privilege level than any other subsystem within the subsystem. Therefore, it should be understood that the inactive mode of SMPU 250 is a special configuration that does not provide the usual protection between subsequent subsystems when SMPU 250 is active. SMPU 250 includes SMPU control circuitry 256 that receives an active / inactive signal and, based on this, controls which of two paths an incoming memory transaction takes through the device. When SMPU 250 is enabled, incoming memory transaction 252 is processed by memory transaction control circuitry 258, which, for example, can be... Figure 4 The memory transaction control circuit 214 operates in the manner described above. Conversely, when the SMPU 250 is disabled, the incoming memory transaction 252 is passed via the inactive mode control circuit 260, which reformats the incoming memory transaction to zero for the subsystem identifier (instead of any of the flow IDs 254 it has upon receipt). It should be understood that another predetermined value other than zero can be used, as the value itself is not critical. Thus, when the SMPU 250 is active, the memory transaction control circuit 258 generates an outgoing memory transaction 262 with an associated subsystem identifier 264 determined according to the techniques described herein (by referring to flow tables, context descriptor tables, etc.), and when the SMPU 250 is in inactive mode, control 260 causes the memory transaction through the SMPU to be mapped to a subsystem identifier of zero, allowing the outgoing memory transaction 266 to proceed further, wherein the subsystem identifier 268 is set to zero. It should be understood that in some implementations, when SMPU 250 is active or inactive, there can be a path through SMPU 250, and transactions can be handled through memory transaction control circuitry 258. In such implementations, when SMPU is inactive, memory transaction control circuitry 258 can be disabled, causing memory access rules not to be applied, and the assigned subsystem ID defaults to zero instead of being derived from an entry in the flow table. Therefore, although the circuit organization can differ, the way transactions are handled when SMPU 250 is active or inactive can be similar. Figure 5 The same as shown.

[0044] Figure 6 This is a flowchart illustrating a sequence of steps in an exemplary method implementation according to the present technology. The process begins at step 300 when memory transaction information is received. From the above... Figure 3 and 4As understood from the discussion, the entity receiving the memory transaction information can also be the recipient of the memory transaction itself, but this is not mandatory, and a separate entity may have already received the memory transaction and passed the associated memory transaction information. After receiving the memory transaction information, at step 302, the main (global) control register is accessed to determine the base address of the flow table. Since this information is stored in the global control register, it cannot be changed by (potentially untrusted) subsystems. Similarly, the memory address associated with flow table 68 may not be writable by (potentially untrusted) subsystems. This again means that the values ​​in the flow table entries can be trusted. Therefore, at step 304, the flow table is accessed based on the flow ID that forms part of the received memory transaction information to select a specific entry. The flow table entry includes a proprietary subsystem field defining the subsystem to which the peripheral device from which the memory transaction originates belongs. This proprietary subsystem field is then used to determine which subsystem control register should be used to manage the remaining transaction checks. Therefore, at step 306, the selected subsystem control register is accessed based on the proprietary subsystem identifier in the selected flow table entry. The contents of the selected subsystem control register provide at least a portion of the required memory access check configuration information, and this is retrieved at step 308. As described elsewhere herein, this may include some information defining the required memory access rules directly provided by the contents of the selected subsystem control register, but may also include the required information derived via, for example, further access to the context descriptor table and the MPU region attribute table. Therefore, in Figure 6 In the final step 310, the corresponding memory access rules for the memory transaction are executed. Again, the recipient of the memory transaction may or may not be the entity that executed steps 300-308 above, and therefore the execution of the memory access rules can be performed by the same entity that executed steps 300-308, or, once the relevant memory rules are determined, they can be signaled back to the individual recipient of the memory transaction for execution.

[0045] Figure 7 This schematically illustrates a cascading lookup process, according to some implementations, for deriving memory access rule information and then accessing a specified memory address (when the memory access rule allows it). Flow table 400 is accessed based on the flow table base address (provided directly or indirectly by a global control register). An entry in flow table 400 is selected based on the flow ID of the memory transaction. Figure 7 The example shown is entry 401 (STE 1). Flow table entries provide their own subsystem identifiers (OSI), and... Figure 7One of the alternatives shown provides the base address of the context descriptor table. In other embodiments, the location of the context descriptor table may be identified by an entry specifying the address of the top of the table or a partial address that still uniquely identifies the location of the table. However, Figure 7 An alternative (dashed lines) is also shown, in which the base address of the context descriptor table (or another value identifying the location of the context descriptor table) is provided by subsystem control register 402 (this particular subsystem control register has been selected based on the OSI indicated by STE1). The context descriptor table is then accessed, where an entry 403 (context descriptor CD) in the context descriptor table is selected based on the substream identifier that forms part of the received memory transaction. Peripheral devices use substream identifiers to distinguish the different contexts from which they can generate memory transactions. Figure 7 In the example shown, context descriptor 403 (CD1) is selected. The contents of the context descriptor selected here provide the base address of the page directory, through which the page table hierarchy can be accessed. Alternatively, the address of the top of the page directory can be specified in a manner similar to specifying other memory locations, and / or a partial address that still uniquely identifies the page directory can be used. The page table hierarchy is then traversed in the usual way, thereby using a portion of the received memory address to determine the "path" taken through the page table hierarchy. Thus, as Figure 7 As shown, the first portion 405 of the memory address is used to determine page directory entry 409 from page directory 406, where the page directory entry points to page table entry in page table 408. The second portion 408 of the (virtual) memory address is used to select the permission dataset from page table entry 410, and page table entry 410 further indicates a 4kB page 411, whereby the final portion 412 of the memory address is used to select the entry within that 4kB page that provides the address translation (i.e., the physical address 413 to be accessed, assuming permissions allow the memory transaction to proceed). For clarity, Figure 7 A simplified page table hierarchy with only two lookup levels is shown, and it should be understood that deeper page table hierarchies can be used to handle wider memory addresses.

[0046] Figure 8A The diagram schematically illustrates a cascading lookup process for deriving memory access rule information according to some implementation schemes. Flow table 450 is accessed based on the flow table base address (provided directly or indirectly by the global (main) control register). Based on the flow ID of the memory transaction, an entry in flow table 450 is selected. Figure 8A The example shown is entry 451 (STE 1). Flow table entries provide their own subsystem identifiers (OSI), and... Figure 8AOne of the alternatives shown provides the base address of the context descriptor table (or another value that uniquely identifies the location in memory). However, Figure 8A An alternative solution (dashed lines) is shown, in which the base address of the context descriptor table (or another value uniquely identifying a location in memory) is provided by subsystem control register 452 (this particular subsystem control register has been selected based on the OSI indicated by STE1). Context descriptor table 460 is then accessed, where entry 461 (context descriptor CD) in the context descriptor table is selected based on the substream identifier of the memory transaction. Figure 8A In the example shown, context descriptor 461 (CD1) is selected. The contents of the context descriptor selected here provide the MPU region table base address 462 and table size 463 (or other values ​​identifying the location and size of the table, such as bottom and top addresses). Using this information, the MPU region attribute table 465 is accessed, from which two data items are derived: the specified MPU region base address register (RBAR) payload and the specified MPU region limit address register (RLAR) payload. Depending on the scheme used here, a single MPU region is defined by the low-order address derived from the RBAR and the high-order address derived from the RLAR. In some embodiments, the RBAR and RLAR payloads may also contain permission information applied to the memory region specified by the base address and limit address. Thus, a combination of RBAR and RLAR values ​​can specify a memory region and the permissions associated with it. Further details on how to perform an MPU region lookup can be found in UK Patent Publication 2575878.

[0047] Figure 8BThe diagram schematically illustrates a method, according to some exemplary embodiments, where configuration data defining a set of memory access rules can be collected hierarchically, as the global (master) control register, flow table, subsystem control register, context descriptor, and MPU region attribute table are accessed sequentially. Thus, when the global control register 500 is accessed (to determine the base address of the flow table), the global control register 500 also provides additional global configuration parameters 501 that will apply to all memory transactions. Next, when a flow table entry 502 in the flow table is accessed based on a flow identifier, the flow table entry also provides additional subsystem configuration parameters 503 that will apply to all memory transactions under the control of that subsystem. Subsequently, when the context descriptor 504 is accessed based on a subflow identifier, the context descriptor also provides additional subflow-specific configuration parameters 505 that will apply to all memory transactions of that subflow from peripheral devices. Additional subsystem-specific configuration parameters 510 can be accessed from the subsystem control register 509 based on the subsystem identifier obtained from the flow table entry. Finally, the MPU region attribute table 506 is accessed, thereby providing permission information 507 applicable to memory transactions. Therefore, the complete set 508 of memory access permissions to be applied to memory transactions can be derived from multiple sources, which are arranged hierarchically. The hierarchical nature of this method of collecting configuration parameters determines where it is appropriate to provide specific items of configuration information within the hierarchical structure. Most of the storage efficiency is achieved through the use of global configuration parameters 501, but these parameters have the smallest granularity because they apply to all memory transactions. At the other end of the spectrum, specific permission information 507 has the finest granularity, but this requires more storage because such permission data 507 is stored for each defined MPU region.

[0048] Figure 8C The diagram schematically illustrates the use of memory-mapped subsystem control register addresses to control cache maintenance operations in some embodiments. This is arranged so that memory transactions originating from processing element (CPU) 520 and directed to the memory-mapped subsystem control register are received by SMPU 521. One of the memory-mapped subsystem control registers used by the SMPU as part of its memory access control activities is subsystem 1 control register 524 (i.e., which is designated to control devices within subsystem 1 of the data processing system). Some memory addresses within subsystem 1 control register 524 are used to control various memory operations associated with subsystem 1. Figure 8C In the example shown, an address such as cache invalidation 525 is configured to trigger a cache invalidation operation in this subsystem. Specifically, a cache operation is triggered when a write is made to this address (regardless of any "write data" nominally associated with the write). This process is in Figure 8CThe diagram shows that processing element 520 sends a write memory transaction specifying an invalid address 525 in the cache memory of subsystem 1. Subsystem 1 control register 524 processes the memory transaction, and the memory transaction forwarded to cache 526 is marked with a subsystem identifier identifying subsystem 1 (because the memory transaction targets the address of the memory-mapped register associated with subsystem 1). Cache 526 is shown storing entry 528 associated with subsystem 0, entry 529 associated with subsystem 1, and entry 530 associated with subsystem 2. Cache control circuitry 527 of cache 526 then ensures that only those entries 529 associated with subsystem 1 are invalidated. In some embodiments, if the access does not originate from a processing element associated with subsystem 1 or another trusted processing entity, other parts of the system (e.g., Figure 1 Firewall device 28 in the system can block access to the subsystem control register of subsystem 1.

[0049] Figure 9 The diagram schematically illustrates how circuit processing in some implementations can provide substream IDs along with memory transactions. Transaction processing circuitry 550 is shown, which can be a standalone device and part of another device, or it can be part of any form of SMPU described herein (e.g., as shown in the diagram). Figure 3(As shown). The incoming memory transaction 552 is shown as including a stream ID 553, a sub-stream ID 554, and a sub-stream ID validity bit 555. These information items are received by the stream ID and sub-stream ID processing circuitry 560 of the memory transaction processing circuitry 550. The stream ID processing performed is generally as described elsewhere herein, i.e., the memory transaction processing circuitry 550 refers to the stream table using the stream ID 553 to select a specific stream table entry, which provides the memory transaction with its own subsystem identifier. Here, the stream ID and sub-stream ID processing circuitry 560 also receives the sub-stream ID 554 and the sub-stream ID validity bit 555. Thus, the sub-stream ID validity bit 555 can be used by the system to control whether the sub-stream ID 554 should be considered valid for the memory transaction. When the sub-stream ID validity bit 555 indicates that the sub-stream ID 554 is valid, it is not modified, and when the sub-stream ID validity bit 555 indicates that the sub-stream ID 554 is invalid, the fixed sub-stream ID 561 (which is zero in some embodiments) is replaced. Therefore, the outgoing memory transaction 570 includes a proprietary subsystem identifier 571 and a sub-stream ID 572, where the sub-stream ID 572 may be the same as the sub-stream ID 554 (if the sub-stream ID is valid), or it may be set to a predetermined value (if the sub-stream ID is invalid). In some embodiments, the modified sub-stream ID value may only be needed within the memory transaction processing circuitry to perform checks on memory access rules. In such embodiments, the sub-stream ID can be stripped from the outgoing memory transaction to reduce the number of signals required in the system interconnect 16.

[0050] Figure 10 The configuration of the global (master) control register 600 according to some implementation schemes is illustrated schematically. In this example, the global control register 600 is shown as a set storing a flow table base address 601 and global configuration parameters 602. As shown, the flow table base address provides access to the flow table, while the global configuration parameters can be applied to memory transactions processed by the SMPU 44 or otherwise affect the operation of the SMPU. The global control register 600 is further shown as including a lock bit 603. This lock bit is used in association with any (attempted) modification of the contents of the global control register, whether the modification attempts to modify the flow table base address 601 or the global configuration parameter 602. Typically, modification of the contents of the global control register only occurs when the data processing system to which the global control register is a part is initially configured by a trusted entity within the data processing system operating at a high system privilege level. Note that the lock bit 603 is used to gate any attempted modification of the contents. Figure 10This is represented by AND gate 604. Therefore, the contents of the global control register can only be modified when lock bit 603 has a predetermined value (e.g., say 0), which is configured to have this predetermined value when the data processing system is first initialized. It should also be noted that the path to setting lock bit 603 comes from one of the global configuration parameters 602. This configuration specifies that the trusted system entity initially configures the flow table base address 601 and global configuration parameters 602 appropriately for the desired subsequent operation of the data processing system; however, as a final modification to the global configuration parameters, as part of its initialization configuration action, the trusted system entity modifies lock bit 603. Specifically, it rewrites it to have its "locked" value (e.g., 1 to continue the example above). Therefore, this means that it is impossible to further modify the flow table base address 601 and global configuration parameters 602 (and actually modify lock bit 603). The only way to change these parameters is to restart the complete system initialization. This provides a mechanism by which the contents of the global control register 600 can be trusted during use during the operation of the data processing system, even if the processing element that initially sets the global control register 600 is subsequently used to execute untrusted software.

[0051] Figure 11 A firewall device configuration in a data processing system according to some embodiments is schematically illustrated. System interconnect 650 is shown connected to memory device 670 via firewall device 660. Therefore, firewall device 660 protects memory device 670 relative to access transmitted by system interconnect 650. Reference Figure 1Any of firewall devices 24, 26, and 28 can be configured according to the example arrangement shown for firewall device 660. The memory transaction 661 received by firewall device 660 from system interconnect 650 includes a memory address 662 (found within memory device 670) and a proprietary subsystem identifier 663. In some embodiments, the memory address received by firewall device 660 is derived (by system interconnect 650) from a memory address previously presented to system interconnect 650 by a processing element or SMPU. This derivation may include performing address decoding and removing bits no longer needed from the address. Therefore, the resulting address received by the firewall may be relative to the base address of memory device 670, rather than the full physical address. The filtering circuitry 665 of firewall device 660 uses these two data items to determine whether memory transaction 661 should be allowed to proceed to memory device 670. The filtering device 665 makes this determination based on information stored in access configuration storage device 666. Therefore, the access configuration storage device 666 can define a range of memory addresses that can be accessed by certain proprietary subsystems (and may not be accessible by other subsystems). The access configuration storage device can also (alternatively or additionally) store the permissions for each subsystem, simply defining which subsystems have (full) access to memory device 670. Thus, the filtering circuit 665 determines whether access to memory address 662 is permitted for proprietary subsystem 663, and based on this, the filtering circuit controls a gating 668 that either blocks a memory transaction or allows it to proceed to memory device 670. It should be noted that the firewall device 660 only needs to filter based on subsystem identifiers and does not need to know the relationship between peripheral devices and their proprietary subsystems. This simplifies the configuration of this component and reduces the number of bits that need to be carried over the system interconnect.

[0052] Figure 12A specific implementation of a usable simulator is illustrated. While the previously described embodiments implement the invention in terms of means and methods for operating specific processing hardware supporting the technologies involved, an instruction execution environment according to the embodiments described herein can also be provided, which is implemented using a computer program. Such computer programs are generally referred to as simulators, in part because they provide a software-based implementation of a hardware architecture. Types of simulator computer programs include emulators, virtual machines, models, and binary converters, including dynamic binary converters. Typically, the simulator implementation can run on a host processor 730 supporting the simulator program 710, which optionally runs a host operating system 720. In some arrangements, multiple emulation layers may exist between the hardware and the provided instruction execution environment and / or multiple different instruction execution environments provided on the same host processor. Historically, powerful processors were required to provide simulator implementations that execute at a reasonable speed, but this approach may be reasonable in certain situations, such as when it is desirable to run code native to another processor for compatibility or reuse reasons. For example, the simulator implementation may provide additional functionality to the instruction execution environment that is not supported by the host processor hardware, or provide an instruction execution environment that is typically associated with a different hardware architecture. In some implementations, the simulator may also simulate a system accompanying the simulated processor, wherein the simulated system may include system interconnects, memory, peripherals, and an SMPU or SMMU that are either not present in the host hardware 730 or do not have all the features required to run the guest operating system and / or application 700 in the simulated environment. An overview of the simulation is given in the following literature: “Some Efficient Architecture Simulation Techniques,” Robert Bedichek, Winter 1990 USENIX Conference, pp. 53–63.

[0053] With respect to embodiments previously described with reference to specific hardware constructions or features, in simulated embodiments, equivalent functionality may be provided by suitable software constructions or features. For example, specific circuitry may be implemented as computer program logic in simulated embodiments. Similarly, memory hardware such as registers or caches may be implemented as software data structures in simulated embodiments. One or more hardware elements referenced in the previously described embodiments are present in an arrangement on host hardware (e.g., host processor 730), and where appropriate, some simulated embodiments may utilize the host hardware.

[0054] The emulator program 710 may be stored on a computer-readable storage medium (which may be a non-transitory medium) and provides a program interface (instruction execution environment) to the target code 700 (which may include application programs, operating systems, and management programs), the program interface being identical to the interface of the hardware architecture modeled by the emulator program 710. Therefore, the emulator program 710 can be used to execute program instructions of the target code 700 from within the instruction execution environment, including those program instructions that cause memory transactions to be generated from the (simulated) peripheral devices as described above, enabling a host computer 730, which does not actually possess the hardware features of the aforementioned devices (e.g., SMPU), to simulate these features.

[0055] In summary, apparatus, methods, and techniques for controlling memory access in a data processing system are disclosed. The operational data processing system includes multiple subsystems, each including at least one processing element and at least one peripheral device. A memory transaction control circuit receives memory transaction information including a flow identifier indicating the issuing peripheral device. A main control register indicates the address of a flow table with multiple entries, each entry including its own subsystem identifier. At least one subsystem control register corresponding to each of the multiple subsystems stores memory access check configuration information. Upon receiving memory transaction information, an entry in the flow table is selected based on the flow identifier. At least one subsystem control register corresponding to the subsystem identified by the entry's own subsystem identifier is selected. This then causes memory access rules to be executed based on the memory transaction information and the memory access check configuration information stored in the selected at least one subsystem control register.

[0056] In this application, the phrase "configured as..." is used to mean that the elements of the device have a configuration capable of performing the defined operations. In this context, "configuration" means the arrangement or manner of interconnection of hardware or software. For example, the device may have dedicated hardware that provides the defined operations, or a processor or other processing device may be programmed to perform the function. "Configured as" does not mean that the elements of the device need to be changed in any way to provide the defined operations.

[0057] While exemplary embodiments have been described in detail herein with reference to the accompanying drawings, it should be understood that the invention is not limited to those precise embodiments, and various changes, additions, and modifications can be made therein by those skilled in the art without departing from the scope of the invention as defined by the appended claims. For example, features of dependent claims may be combined with features of independent claims in various ways without departing from the scope of the invention.

Claims

1. An apparatus for controlling memory access in a data processing system, wherein the data processing system includes a plurality of subsystems in operation, each subsystem including at least one processing element and at least one peripheral device, the apparatus comprising: A memory transaction control circuit is used to receive memory transaction information from a peripheral device of the data processing system, wherein the memory transaction information includes a stream identifier indicating the peripheral device. A master control register, which stores a value indicating the address of a flow table, wherein the flow table comprises multiple entries, and wherein each of the multiple entries includes a subsystem identifier; and At least one subsystem control register corresponding to each of the plurality of subsystems, the at least one subsystem control register being used to store memory access check configuration information. The memory transaction control circuit described herein responds to the receipt of the memory transaction information as follows: The entry from the plurality of entries of the flow table, identified by the value indicating the address of the flow table, is selected based on the flow identifier; Select at least one subsystem control register corresponding to the subsystem identified by the self-owned subsystem identifier of the entry; as well as This results in the execution of memory access rules based on the memory transaction information and the memory access check configuration information stored in at least one selected subsystem control register. At least one peripheral device of the data processing system is a multi-stream identifier peripheral device associated with more than one stream identifier, wherein the more than one stream identifier of the multi-stream identifier peripheral device is associated with mutually independent operations of the multi-stream identifier peripheral device.

2. The apparatus of claim 1, wherein the execution of the memory access rule further depends on additional memory access check configuration information, wherein the additional memory access check configuration information includes: A context descriptor table, wherein the context descriptor table has a plurality of context descriptors, each context descriptor including a value indicating the address of a memory region attribute table; as well as The memory region attribute definition is accessed by the memory transaction control circuit according to the value of the address indicating the memory region attribute table. The address of the context descriptor table is determined based on one of the following: Additional values ​​in the selected entries of the flow table; and Another value in at least one of the selected subsystem control registers.

3. The apparatus of claim 2, wherein the memory transaction information further includes a substream identifier indicating the originating context in the peripheral device of the memory transaction, and wherein accessing the additional memory access check configuration information based on the value of the address indicating the context descriptor table includes: A context descriptor is selected from the context descriptor table based on the value identified by the address indicating the context descriptor table, according to the sub-stream identifier; Retrieve the value indicating the address of the memory region attribute table from the selected context descriptor; as well as Access the memory region attribute table identified by the value of the address indicating the memory region attribute table to retrieve at least one memory region attribute definition from the memory region attribute definitions.

4. The apparatus of claim 3, wherein the context descriptor selected in the context descriptor table further stores a value indicating the size of a memory region attribute table, and accessing the memory region attribute table includes accessing a memory region defined by the value indicating the address of the memory region attribute table and the value indicating the size of the memory region attribute table.

5. The apparatus of claim 4, wherein the retrieved at least one memory region attribute definition includes additional memory access rule information containing permission information, and the retrieved at least one memory region attribute definition further includes values ​​indicating the start and end addresses of the memory region.

6. The apparatus according to any one of claims 3 to 5, wherein the memory region attribute table, identified by the value of the address indicating the memory region attribute table, forms part of a page table hierarchy, and the additional memory access rule information includes permission information defined in the page table hierarchy.

7. The apparatus according to any one of claims 3 to 5, wherein the memory transaction control circuitry further responds to a sub-stream identifier validity flag in the memory transaction information, and when the sub-stream identifier validity flag indicates the invalidity of the sub-stream identifier, performs the selection of the entry in the context descriptor table according to a predetermined sub-stream identifier.

8. The apparatus according to any one of claims 1 to 5, further comprising a memory transaction transfer interface for issuing outgoing memory transactions targeted at the data storage device of the data processing system. The outgoing memory transaction includes the assigned own subsystem identifier.

9. The apparatus of claim 8, wherein the memory transaction control circuitry further responds to the receipt of the memory transaction information: The memory transaction transport interface issues a first outgoing memory transaction to access the flow table, wherein the first assigned home subsystem identifier in the first outgoing memory transaction is one of the following: Indicates a predetermined value for the effective subsystem; and This indicates that the first outgoing memory transaction does not have a value associated with its own subsystem identifier.

10. The apparatus of claim 8, wherein the memory transaction control circuitry further responds to the receipt of the memory transaction information: The memory transaction transport interface is caused to issue a second outgoing memory transaction to access the memory access check configuration information according to the address in the context descriptor table, wherein the second assigned subsystem identifier in the second outgoing memory transaction is determined according to the subsystem identifier of the selected entry in the flow table.

11. The apparatus of claim 8, wherein when the apparatus is configured in an inactive mode, the memory transaction control circuitry further responds to the receipt of the memory transaction information such that all outgoing memory transactions issued by the memory transaction transport interface have one of the following: The designated valid subsystem is indicated by a predetermined value as the identifier of the assigned self-owned subsystem; and This indicates that the transaction does not have a value for an associated self-owned subsystem identifier.

12. The apparatus of claim 8, wherein the memory transaction control circuitry further responds to the receipt of the memory transaction information by configuring at least one outgoing memory transaction associated with the received memory transaction information issued by the memory transaction transport interface according to at least one of the following: Other configuration parameters in the main control register; and Additional configuration parameters in the selected entries of the flow table.

13. The apparatus according to any one of claims 1 to 5, wherein when a register write transaction specifies a write to at least one address in a target subsystem control register, the memory transaction control circuit further responds to the receipt of the register write transaction such that all operations initiated as a result of the write to the at least one address in the target subsystem control register are restricted by the own subsystem identifier associated with the target subsystem control register.

14. The apparatus of claim 13, wherein the operation initiated as a result of the write to the at least one address in the target subsystem control register is a cache invalidation operation, and wherein the apparatus further includes a cache, and the cache invalidation operation is limited to cache contents associated with the proprietary subsystem identifier.

15. The apparatus of claim 1, wherein the independent operations of the multi-stream identifier peripheral device are each associated with a different subsystem within the plurality of subsystems of the data processing system.

16. The apparatus according to any one of claims 1 to 5, wherein the main control register further includes a lock bit storage device for storing a lock bit, wherein when the lock bit has a predetermined lock bit value, the contents of the main control register are not allowed to be modified.

17. The apparatus according to any one of claims 1 to 5, further comprising a memory transaction filtering circuit, the memory transaction filtering circuit determining, in response to receiving the memory transaction, from the memory transaction information and the memory access check configuration information whether to approve the memory transaction, and When the memory transaction is approved, the memory transaction filtering circuit is configured to modify the memory transaction to include the proprietary subsystem identifier.

18. A data processing system, the data processing system comprising the apparatus of claim 17, further comprising: An additional filtering device for receiving the memory transaction after the device has modified the memory transaction, wherein the additional filtering device includes: A memory transaction receiving interface for receiving the memory transaction, wherein the memory transaction specifies a value indicating at least a portion of a memory address and a self-owned subsystem identifier value indicating a self-owned subsystem. Access to configuration storage device; and Additional memory transaction filtering circuitry, in response to receiving the memory transaction by the memory transaction receiving interface: When the contents of the access configuration storage device indicate that a memory transaction having a subsystem identifier value indicating the subsystem is approved to access a memory location associated with the value indicating at least a portion of the memory address, the memory transaction is forwarded to the target memory device; and When the contents of the access configuration storage device do not indicate that a memory transaction having a subsystem identifier value indicating the subsystem is approved to access the memory location associated with the value indicating at least a portion of the memory address, the memory transaction is prevented from entering the target memory device.

19. The apparatus of claim 18, wherein the access to the contents of the configuration storage device includes access rights to each of the target memory device's own subsystems.

20. The apparatus of claim 18 or claim 19, wherein the access to the contents of the configuration storage device includes access rights to memory regions within the target memory device of each proprietary subsystem.

21. A method for controlling memory access in a data processing system, wherein the data processing system includes multiple subsystems during operation, each subsystem including at least one processing element and at least one peripheral device, the method comprising: Receive memory transaction information from a peripheral device of the data processing system, wherein the memory transaction information includes a stream identifier indicating the peripheral device; The value indicating the address of the flow table is stored in the main control register, wherein the flow table includes multiple entries, and each of the multiple entries includes its own subsystem identifier; The memory access check configuration information is stored in at least one subsystem control register corresponding to each of the plurality of subsystems; as well as In response to the receipt of the memory transaction information: The entry from the plurality of entries of the flow table, identified by the value indicating the address of the flow table, is selected based on the flow identifier; Select at least one subsystem control register corresponding to the subsystem identified by the self-owned subsystem identifier of the entry; as well as This results in the execution of memory access rules based on the memory transaction information and the memory access check configuration information stored in at least one selected subsystem control register. At least one peripheral device of the data processing system is a multi-stream identifier peripheral device associated with more than one stream identifier, wherein the more than one stream identifier of the multi-stream identifier peripheral device is associated with mutually independent operations of the multi-stream identifier peripheral device.

22. An apparatus for controlling memory access in a data processing system, wherein the data processing system includes a plurality of subsystems in operation, each subsystem including at least one processing element and at least one peripheral device, the apparatus comprising: A component for receiving memory transaction information from a peripheral device of the data processing system, wherein the memory transaction information includes a stream identifier indicating the peripheral device; A component for storing the value of an address indicating a flow table in a main control register, wherein the flow table comprises multiple entries, and wherein each of the multiple entries comprises a proprietary subsystem identifier; A component for storing memory access check configuration information in at least one subsystem control register corresponding to each of the plurality of subsystems; A component for selecting, in response to the receipt of the memory transaction information, an entry from the plurality of entries of the flow table identified by the value indicating the address of the flow table, based on the flow identifier; A component for selecting at least one subsystem control register corresponding to the subsystem identified by the self-owned subsystem identifier of the entry; as well as A component for causing the execution of memory access rules based on the memory transaction information and the memory access check configuration information stored in at least one selected subsystem control register. At least one peripheral device of the data processing system is a multi-stream identifier peripheral device associated with more than one stream identifier, wherein the more than one stream identifier of the multi-stream identifier peripheral device is associated with mutually independent operations of the multi-stream identifier peripheral device.

23. A computer program product for controlling a host data processing device to provide an instruction execution environment, and comprising: Memory access control logic, used to control memory access in a data processing system, wherein the data processing system includes multiple subsystems during operation, each subsystem including at least one instance of processing element logic and at least one instance of peripheral device logic, the memory access control logic including: A memory transaction checking logic is provided to receive memory transaction information of a memory transaction issued by an instance of the peripheral device logic of the data processing system, wherein the memory transaction information includes a stream identifier indicating the instance of the peripheral device logic. The main control register logic stores a value indicating the address of a flow table, wherein the flow table comprises multiple entries, and each of the multiple entries includes a subsystem identifier; and At least one instance of the subsystem control register logic corresponding to each of the plurality of subsystems, the at least one instance of the subsystem control register logic being used to store memory access check configuration information. The memory transaction check logic is in response to the receipt of the memory transaction information: The entry from the plurality of entries of the flow table, identified by the value indicating the address of the flow table, is selected based on the flow identifier; Select at least one instance of the subsystem control register logic corresponding to the subsystem identified by the self-owned subsystem identifier of the entry; and This causes memory access rules to be executed based on the memory transaction information and the memory access check configuration information stored in at least one instance of the selected subsystem control register logic. At least one peripheral device of the data processing system is a multi-stream identifier peripheral device associated with more than one stream identifier, wherein the more than one stream identifier of the multi-stream identifier peripheral device is associated with mutually independent operations of the multi-stream identifier peripheral device.

Images