Processing system, related integrated circuit, device and method

Abstract

A communication system couples together a plurality of processing cores, each processing core having an associated register storing a virtual machine ID, the virtual machine ID being inserted into requests sent by the corresponding processing core. A master circuit is associated with a master interface circuit, wherein the master interface circuit is associated with a register storing a second virtual machine ID, the second virtual machine ID being inserted into requests sent by the master circuit. A slave circuit is associated with a slave interface circuit, the slave interface circuit being configured to selectively forward read or write requests addressed to an address sub-range. The slave interface circuit is associated with a third register storing a third virtual machine ID associated with the address sub-range, and is configured to receive a request addressed to the address sub-range, extract the virtual machine ID from the request, determine whether the extracted virtual machine ID corresponds to the third virtual machine ID, and then forward or reject the request.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to a processing system including multiple microprocessors, and more particularly, a processing system configured to execute a virtual machine. Background Art

[0002] Figure 1 A typical electronic system, such as that of a vehicle 30 having an engine 35 , is shown including a plurality of processing systems 10 , such as embedded systems or integrated circuits, e.g., field programmable gate arrays (FPGAs), digital signal processors (DSPs), or microcontrollers (e.g., specific for the automotive market).

[0003] For example, in Figure 1 1 shows three processing systems (PS) 101, 102, and 103 connected via an appropriate communication system 20. For example, the communication system may include a vehicle control bus (such as a controller area network (CAN) bus and / or Ethernet) and a possible multimedia bus (such as a media-oriented systems transport (MOST) bus) connected to the vehicle control bus via a gateway. Typically, the processing system 10 is located at different locations in the vehicle and may include, for example, an engine control unit, a transmission control unit (TCU), an anti-lock braking system (ABS), a body control module (BCM), and / or a navigation and / or multimedia audio system. Thus, one or more of the processing systems in the processing system 10 may also implement real-time control and regulation functions. These processing systems are generally identified as electronic control units.

[0004] Figure 2 Shown can be used as Figure 1 1 is a block diagram of an exemplary digital processing system 10, such as a microcontroller, for example.

[0005] In the example considered, the processing system 10 includes a microprocessor 102 (typically a central processing unit (CPU)) that is programmed via software instructions. Typically, the software executed by the microprocessor 102 is stored in a non-volatile program memory 104 (such as flash memory or EPROM). Thus, the memory 104 is configured to store firmware for the processing unit 102, wherein the firmware includes software instructions to be executed by the microprocessor 102. Generally speaking, the non-volatile memory 104 can also be used to store other data, such as configuration data, for example, calibration data.

[0006] The microprocessor 102 is also typically associated with volatile memory 104b, such as random access memory (RAM). For example, the memory 104b may be used to store temporary data.

[0007] like Figure 2As shown, communication with the memory 104 and / or 104b is typically performed via one or more memory controllers 100. The memory controller(s) 100 may be integrated into the microprocessor 102 or connected to the microprocessor 102 via a communication channel, such as a system bus of the processing system 10. Similarly, the memory 104 and / or 104b may be integrated with the microprocessor 102 in a single integrated circuit, or the memory 104 and / or 104b may take the form of separate integrated circuits and be connected to the microprocessor 102, for example, via traces of a printed circuit board.

[0008] In the example considered, the microprocessor 102 may be associated with one or more (hardware) resources 106, for example selected from the group consisting of:

[0009] One or more communication interfaces IF, e.g., for exchanging data via the communication system 20, such as a Universal Asynchronous Receiver / Transmitter (UART), a Serial Peripheral Interface Bus (SPI), an Inter-Integrated Circuit (I2C), a Controller Area Network (CAN) bus, and / or an Ethernet interface, and / or a debug interface; and / or

[0010] one or more analog-to-digital converters AD and / or digital-to-analog converters DA; and / or

[0011] One or more dedicated digital components DC, such as hardware timers and / or counters, or cryptographic co-processors; and / or

[0012] One or more analog components AC, such as comparators, sensors such as temperature sensors, etc.; and / or

[0013] One or more mixed signal components MSC, such as PWM (Pulse Width Modulation) drivers.

[0014] Typically, the dedicated digital component DC may also correspond to an FPGA integrated in the processing system 10. In this case, for example, the memory 104 may also include program data for such an FPGA.

[0015] Thus, the digital processing system 10 can support different functionalities. For example, the behavior of the microprocessor(s) 102 is determined by firmware (e.g., software instructions executed by the microprocessor 102 of the microcontroller 10) stored in the memory 104. Thus, by installing different firmware, the same hardware (microcontroller) can be used for different applications.

[0016] In this respect, future generations of such processing systems 10 (e.g., microcontrollers suitable for use in automotive applications) are expected to exhibit an increase in complexity, primarily due to an increase in the number of requested functionalities (new protocols, new features, etc.) and strict constraints on execution conditions (e.g., lower power consumption, increased computing power and speed, etc.).

[0017] For example, more complex multi-core processing systems 10 have recently been proposed. For example, such multi-core processing systems can be used to execute (in parallel) Figure 1 Several of the processing systems 10 are shown, such as several processing systems of a vehicle.

[0018] Figure 3 An example of a multi-core processing system 10 is shown. Specifically, in the example considered, the processing system 10 comprises n processing cores 1021 to 102n connected to an (on-chip) communication system 114. For example, in the context of a real-time control system, the processing cores 1021 to 102n may be Typically, the communication system 114 may include one or more bus systems based on, for example, Advanced eXtensible Interface (AXI) and / or a Network on Chip (NoC).

[0019] For example, as shown in the example of processing core 1021, each processing core 102 may include a microprocessor P 1020 and a communication interface IF 1022 configured to manage communications between the microprocessor 1020 and the communication system 114. Typically, the interface 1022 is a master interface configured to forward a given (read or write) request from the microprocessor 1020 to the communication system 114 and to forward an optional response from the communication system 114 to the microprocessor 1020. However, each microprocessor 1020 may also be associated with a slave interface IF 1024. For example, in this manner, a first microprocessor 1020 may send a request to a second microprocessor 1020 (via the master interface 1022 of the first microprocessor, the communication system 114, and the slave interface 1024 of the second microprocessor).

[0020] Typically, each processing core 1021 to 102n may also include other local resources, such as one or more local memories M 1026, typically identified as Tightly Coupled Memory (TCM).

[0021] As previously mentioned, processing cores 102 1 to 102 n are typically arranged to exchange data with non-volatile memory 104 and / or volatile memory 104 b. In multi-core processing system 10, these memories are typically, for example, system memory shared by processing cores 102 1 to 102 n. However, as described above, each processing core 102 1 to 102 n may include one or more additional local memories 1026.

[0022] For example, Figure 3 As shown, the processing system 10 may include one or more memory controllers 100 configured to connect at least one non-volatile memory 104 and at least one volatile memory 104b to the communication system 114. As previously described, one or more of the memories 104 and / or 104b may be integrated into an integrated circuit of the processing system 10 or externally connected to the integrated circuit. For example, the processing system 10 may include:

[0023] A first volatile memory 104b, integrated in an integrated circuit of the processing system 10 and connected to the communication system 114 via the first memory controller 100, and

[0024] The second volatile memory 104 b is external to the integrated circuit of the processing system 10 and is connected to the communication system 114 via the second memory controller 100 .

[0025] As previously mentioned, processing system 10 may include one or more resources 106, such as one or more communication interfaces or coprocessors (eg, cryptographic coprocessors).

[0026] The resources 106 are typically connected to the communication system 114 via corresponding slave communication interfaces IF 1064. For example, in this way, the processing core 102 can send a request to the resource 106, and the resource returns a given data. Typically, one or more of the resources 106 may also include a corresponding master interface 1062. For example, such a master interface 1062 may be useful in cases where a resource must initiate communication in order to exchange data with another circuit connected to the communication system 114 (such as the resource 106 or the processing core 102) via a (read and / or write) request. For example, for this purpose, the communication system 114 may actually include an Advanced Microcontroller Bus Architecture (AMBA) high-performance bus (AHB), and an Advanced Peripheral Bus (APB) for connecting the resources / peripherals 106 to the AMBA AHB bus.

[0027] Typically, such a processing system also includes one or more direct memory access (DMA) controllers 110. Specifically, the DMA controller 110 includes at least one functional channel connected to the resources 106. Typically, the resource 106 associated with a given channel can also be selected based on configuration data. Specifically, the channel is a read or write channel (which can also be programmable) and is typically associated with configuration data that indicates:

[0028] In the case of a read channel, the memory address range from which the DMA controller should read data; and

[0029] In case of a write channel, the DMA controller should write data to its memory address range.

[0030] For example, in this way the communication interface IF can be connected to the DMA controller 110 via two channels:

[0031] a read channel configured to autonomously read data to be transferred from a first memory range in the memory 104 b and to provide the read data to the communication interface IF (which then transfers the corresponding data); and

[0032] The write channel is configured to receive data received from the communication interface IF and to autonomously write these data to a second memory range in the memory 104b.

[0033] Therefore, the DMA controller 110 is generally associated with:

[0034] a slave interface 1104 for receiving configuration data from the communication system 114 , the configuration data being used to configure the channels of the DMA controller 110 , such as an address range associated with each channel; and

[0035] The master interface 1102 is used to transmit a read or write request to the memory controller 100 via the communication system 114 .

[0036] Therefore, from a hardware point of view, Figure 3 The illustrated processing system 10 includes multiple processing cores 102 and other circuitry, such as resources 106 and a memory controller 100 , connected to a communication system 114 .

[0037] In this regard, processing system 10 may execute several software tasks, for example, by executing the tasks sequentially on the same processing core 102 and / or executing the tasks in parallel on multiple processing cores 102. However, such tasks may perform quite different operations. Therefore, from a security and / or safety perspective, each task should only have given access rights.

[0038] For example, in many processing systems 10, this problem is addressed by using software and / or hardware address range protection.

[0039] For example, Figure 4 As shown, such address range protection is usually achieved by dividing software tasks into tasks of an operating system OS and tasks of an application APP executed by the operating system OS. In this case, the operating system OS can manage a (eg virtual) address range for each application APP.

[0040] Specifically, in the software protection mechanism, all read and write requests of the application APP must pass through the operating system OS, which can therefore determine whether a given request belongs to the (virtual) address range associated with the application.

[0041] In contrast, in hardware address protection, a (eg, virtual) address range is passed directly to the hardware layer, which can therefore determine whether a given software task can access a given address.

[0042] For example, in the ARM AArch64 architecture, the operating system OS can configure multiple virtual address ranges, which are identified by address space IDs (ASIDs). For example, in this way, the operating system OS can, for example:

[0043] Configuring a single virtual address range for the application APP, wherein the address range is separate from the address range used by the operating system OS; or

[0044] Configure the corresponding virtual address range for each application APP.

[0045] Essentially, when the operating system (OS) is configured with multiple virtual address ranges, the OS sets the corresponding ASID when switching between applications. For example, in this way, applications can be developed separately from the OS. For example, each application development team can be associated with a corresponding application address range.

[0046] For example, in the ARM AArch64 architecture, so-called translation tables (TTBs) are used for this purpose. Specifically, the translation table allows a given virtual address to be mapped to a corresponding physical address or another virtual address. For example, in the ARMAArch64 architecture, two translation tables can be specified:

[0047] a first translation table mapping a given virtual address range of the operating system OS to a physical address; and

[0048] The second table maps one or more virtual application addresses to virtual addresses of the operating system.

[0049] Therefore, virtual application addresses may be first mapped to virtual operating system addresses and then mapped to corresponding physical addresses. For example, in the ARM AArch64 architecture, typically, the OS translation table is implemented in exception level EL1, while the application translation table is implemented in exception level EL0.

[0050] Specifically, in the ARM AArch64 architecture, this mapping of virtual addresses (VA) to physical addresses (PA) of the communication system 114 is implemented directly within the memory management unit (MMU) of the processing core 102. Since the physical address range of the communication system 114 is associated with memory ranges in the memory 104 and / or 104b and the resources 106, the read and write access rights of a given application APP or operating system OS can be restricted to a given memory range and / or resource 106.

[0051] Therefore, the ARM AArch64 architecture is based on the Virtual Memory System Architecture (VMSA). In contrast, ARMAArch32 typically uses the Protected Memory System Architecture (PMSA) instead of VMSA. Specifically, in the case of AArch32 with PMSA (typically for processor), the processing system 10 does not perform address translation.

[0052] For example, in this case, the operating OS (typically a real-time operating system (RTOS), such as OSEK ("OffeneSysteme und deren Schnittstellen für die Elektronik in Kraftfahrzeugen") or Autosar-OS) can be configured to use direct physical addresses to define multiple statically allocated areas to the task group. As mentioned above, in the AArch32 PMSA architecture, the processing system 10 does not include a memory management unit (MMU), which performs virtual address translation. Instead, in this case, the processing system 10 includes a memory protection unit (MPU). Specifically, instead of defining a mapping of virtual addresses to physical addresses, the MPU allows one or more memory areas in the physical address space to be specified, for example via a table, and allows corresponding access rights and memory attributes to be specified. For example, this access rights table for the OS and the application APP can be implemented in exception level EL1.

[0053] also, Figure 5It is shown that virtualization has recently been proposed, wherein a hypervisor HYP is executed by a processing system 10. Specifically, the hypervisor HYP generally corresponds to a specific operating system that allows configuration of m virtual machines VM1 to VMm, wherein each virtual machine VM can execute a corresponding operating system OS and one or more corresponding applications APP.

[0054] Therefore, when using the VMSA architecture, each virtual machine VM1...VMm may have associated with it a corresponding virtual address range, the so-called intermediate physical address (IPA). For example, in the ARM AArch64 architecture, the virtual machine translation table is typically implemented in the exception level EL2. For example, in the ARM AArch64 architecture, the value virtual machine ID (VMID) identifies the number of a given ID. This value is used because a given processing core 102 is not necessarily univocally associated with a given corresponding virtual machine. For example, multiple virtual machines can be executed on the same processing core 102 (via a time scheduling scheme), or a given virtual machine can be executed by multiple processing cores 102 (in parallel or sequentially). In essence, when switching from one virtual machine to another, the hypervisor HYP sets the corresponding VMID of the given processing core 102.

[0055] Similarly, when using the PMSA architecture, each virtual machine VM1...VMm may be associated with a corresponding physical address range. For example, in the ARM AArch32 PMSA architecture, the virtual machine access permission table is typically implemented in the exception level EL2. Typically, the corresponding access permission table in the exception level EL2 is again identified by a VMID, which is set by the hypervisor HYP for each processing core 102. Therefore, also in the ARM AArch32 PMSA architecture, the memory space is covered by 2 levels of protection, one controlled by the hypervisor HYP in the exception level EL2 that sets the address range boundaries of the virtual machine VM, while the underlying exception level EL1 is under the control of the operating system OS that sets the access permissions of each task. Obviously, this means that each software task (OS or APP) must know in advance the physical addresses of the various resources 106 it can access.

[0056] in this regard, Figure 6 A possible mapping of the translation table in the ARM AArch64 architecture with the hypervisor HYP is shown.

[0057] Specifically, given that the physical address range includes addresses associated with various circuits of the processing system 10 connected to the communication system 114 (such as memories 104 and 104 b, resources 106, DMA controller 110, and processing core 102), a given request transmitted to the communication system 114 must indicate a physical address PA. As described above, in the ARM AArch64 architecture, these physical addresses PA can be mapped to virtual addresses via the MMU of each processing core 102 via translation tables configured within the MMU of the processing core 102. For example, this may mean that the hypervisor HYP must reconfigure these tables when switching between different virtual machines VM.

[0058] For example, in Figure 6 The following conversion table is used:

[0059] Table TTBR_EL2, used to map the virtual address range of the hypervisor HYP to the physical address PA;

[0060] a table VTTBR_EL2 for each virtual machine VM (or at least for the virtual machine VM currently executed by a given processing core 102 ), for mapping an intermediate physical address IPA of the corresponding virtual machine VM to a physical address range PA;

[0061] Table TTBR_EL1 for mapping virtual operating system addresses VA_OS to intermediate physical address ranges IPA for an operating system OS executed by a given virtual machine VM; and

[0062] One or more tables TBR_EL0 are used to define, for a given operating system OS, corresponding application address ranges for mapping virtual application addresses VA_APP to virtual operating system addresses VA_OS.

[0063] Generally, the table TTBR_EL2 is purely optional, since in case of a trusted hypervisor HYP the hypervisor may also have access to the entire memory space.

[0064] Essentially, in the ARM AArch32 PMSA architecture, the translation tables VTTBR_EL2, TTBR_EL2, and TTBR_EL2 will be replaced with tables that directly specify access rights to a given physical address range. In practice, in this case, the processing core 102 will directly provide physical addresses (rather than virtual addresses as in the VMSA architecture), and the MPU of the processing core 102 is configured to verify whether the request of the processing core 102 can be executed based on the access rights specified for the VMID and optional ASID provided by the processing core 102.

[0065] Therefore, the translation table in the ARM AArch64 architecture or the access permission table in the ARM AArch32 PMSA architecture, when managed in an appropriate manner via the hypervisor HYP and optionally via the operating system OS, provides an effective solution for separating access permissions to one virtual machine VM (and optionally applications APP executed by the virtual machine) from access permissions to another virtual machine VM. For example, in this way, one or more dedicated physical address ranges PA can be associated with each virtual machine VM and optionally with the hypervisor HYP.

[0066] However, as described above, other bus masters may also be connected to the communication interface 114, such as a bus master 1102 of a DMA controller or a bus master 1062 of another resource 106. These bus masters will thus be able to access the complete physical memory range PA of the communication system 114.

[0067] In the ARM AArch64 architecture, this problem is addressed by providing one or more system memory management units (SMMUs) that allow translation tables to be defined for other bus masters of the processing system 10. Thus, similar to the aforementioned translation tables, the hypervisor HYP can also configure translation tables for other bus masters. Similarly, in the ARM AArch32 PMSA architecture, the processing system 10 may include one or more system memory protection units (SMPUs) or similar address space protection circuits that allow access permission tables to be defined for other bus masters of the processing system 10.

[0068] For example, in this way, access to the resource 106 can be managed. For example, suppose the processing system 10 runs two virtual machines VM, which must communicate via the SPI bus. In this case, the hypervisor HYP can configure the translation / access permission table so that:

[0069] In the case where the processing system 10 includes at least two SPI interfaces 106, allocating an address range associated with the first SPI interface to the first virtual machine VM, and allocating an address range associated with the second SPI interface to the first virtual machine VM; or

[0070] In case the processing system 10 includes one SPI interface 106, the address range associated with the SPI interface is allocated to the hypervisor HYP, which can then manage two virtual (software) SPI interfaces.

[0071] Thus, the ARM AArch64 and AArch32 architectures provide a complete solution for configuring virtual machines by configuring translations or access permission tables for requests sent by any bus master (processing core 102 or another bus master) to the communication system 114. However, in the context of real-time control systems, the use of such translations or access permission tables can be quite inefficient.

[0072] Specifically, as previously described, access control is implemented in the memory management unit or memory protection unit of the processing core 102, and (for other bus masters) in the system memory management unit / system memory protection unit. However, not all processing cores / processing systems include a memory management unit or a memory protection unit, such as ARM processors. processing core. In fact, such a memory management unit or memory protection unit is complex, thus increasing the cost and power consumption of the processing system. Therefore, the memory management unit or memory protection unit is hardly feasible in low-cost and low-power solutions.

[0073] Furthermore, in the ARM AArch64 and AARch32 architectures, such translation or access permission tables are configured by storing corresponding data in the volatile memory 104b, and each memory management unit or memory protection unit must cache this data. However, in the event of a cache miss, a cache controller associated with the memory management unit or memory protection unit must obtain the missing data, which introduces significant latency. Summary of the Invention

[0074] As described above, various embodiments of the present disclosure relate to a processing system, such as an integrated circuit. Specifically, the processing system includes a communication system having a given physical address range and a plurality of processing cores, wherein each processing core includes at least one microprocessor configured to execute software instructions. Specifically, each microprocessor is associated with a (first) master interface circuit, which is configured to forward a read or write request from the microprocessor to the communication system, wherein the read or write request includes a physical address within the physical address range of the communication system.

[0075] In various embodiments, a processing system includes a first / slave circuit, such as a resource / peripheral device or a memory controller, to which has associated a slave interface circuit configured to selectively forward read or write requests addressed to a given address sub-range from a communication system to the first circuit.

[0076] In various embodiments, the processing system includes, in addition to the microprocessor, at least one additional master circuit, the second / master circuit being associated with a (second) master interface circuit configured to forward read or write requests from the second circuit to the communication system.

[0077] Specifically, the main interface circuit of the microprocessor is associated with a first register, the first register being used to store a corresponding first virtual machine ID. Specifically, in various embodiments, the main interface circuit of the microprocessor is configured to read the first virtual machine ID from the first register and insert the first virtual machine ID into a read or write request forwarded from the microprocessor to the communication system, the virtual machine ID being transmitted along with the request.

[0078] However, in various embodiments, the second host interface circuit is further associated with a second register for storing a second virtual machine ID, and is configured to read the second virtual machine ID from the second register and insert the second virtual machine ID into a read or write request forwarded from the second circuit to the communication system. For example, in various embodiments, the second circuit is a DMA controller, in which a corresponding virtual machine ID can be stored for each DMA channel.

[0079] Therefore, in addition to the target address, the request sent by the bus master device also includes a virtual machine ID that identifies the sender. Optionally, the request may also include an address space ID.

[0080] Therefore, in various embodiments, the slave interface circuit can determine whether the request is authorized. Specifically, for this purpose, in various embodiments, the slave interface circuit is associated with a register for storing a third virtual machine ID associated with a given first address sub-range. Specifically, in this case, the slave interface circuit can be configured to receive a read or write request addressed to a given address sub-range from the communication system, extract the virtual machine ID from the received request, read the third virtual machine ID from the third register, and determine whether the virtual machine ID extracted from the received request corresponds to the third virtual machine ID. For example, in response to determining that the virtual machine ID extracted from the received request corresponds to the third virtual machine ID, the slave interface circuit can forward the read or write request to the first circuit. Conversely, in response to determining that the virtual machine ID extracted from the received request does not correspond to the third virtual machine ID, the slave interface circuit can prohibit forwarding the read or write request to the first circuit, for example, rejecting the read or write request.

[0081] Typically, the slave interface can also manage separate read and write access permissions. To this end, the third register can be configured to store a read virtual machine ID and a write virtual machine ID. In this case, the slave interface circuit can determine whether the received request is a read request or a write request, and in response to determining that the received request is a read request, determine whether the virtual machine ID extracted from the received request corresponds to the read virtual machine ID. Conversely, in response to determining that the received request is a write request, the slave interface circuit can determine whether the virtual machine ID extracted from the received request corresponds to the write virtual machine ID.

[0082] Therefore, the first register, the second register, and the third register can be used to define whether the microprocessor, the first (slave) circuit, and the second (master) circuit belong to the same virtual machine. For this purpose, the first register, the second register, and the third register can be programmed by software instructions executed by the microprocessor. Specifically, in various embodiments, the configuration of the virtual machine ID can be performed only via the hypervisor. Specifically, in this case, the processing system can be configured to execute the hypervisor and one or more virtual machines on multiple processing cores, wherein each virtual machine is associated with a corresponding virtual machine ID, and wherein the processing system is configured so that the first register, the second register, and the third register can be programmed via the hypervisor but not via one or more virtual machines.

[0083] For example, such a hypervisor may be configured to store a first virtual machine ID value in a first register associated with a master interface circuit of a first processing core, store a second virtual machine ID value in a first register associated with a master interface circuit of a second processing core, and store the first virtual machine ID value in a second register (of the first / slave circuit) and a third register (of the second / master circuit). Subsequently, the hypervisor may start the first virtual machine on the first processing core and the second virtual machine on the second processing core. Thus, in this case, the slave interface circuit will be configured to forward read and / or write requests received from the first virtual machine / first processing core and the second circuit to the first circuit, but prohibit forwarding of read and / or write requests received from the second virtual machine / second processing core.

[0084] Therefore, in various embodiments, the request should also identify a request sent by a hypervisor. For example, to this end, when the processing core is executing the hypervisor, the corresponding first master interface circuit can be configured to insert a given virtual machine ID and / or one or more bits indicating privilege information associated with the hypervisor into a read or write request forwarded from the corresponding microprocessor to the communication system. For example, to set the virtual machine ID of the microprocessor, the hypervisor can send a request via the communication system or a dedicated coprocessor bus. The virtual machine ID of the slave interface circuit can be programmed by sending a request to the same slave interface circuit or to one or more dedicated slave interface circuits. Similarly, the virtual machine ID of the master interface circuit can be programmed by sending a request to a slave interface circuit uniquely associated with the master interface circuit or to one or more dedicated slave interface circuits. Therefore, such a slave interface circuit can be configured to receive a read or write request addressed to a corresponding address sub-range, extract the virtual machine ID and / or privilege information from the received request, and, in response to determining that the virtual machine ID extracted from the received request has a given value corresponding to the determined virtual machine ID and / or privilege information, forward the read or write request to the corresponding register. The determined virtual machine ID may be predetermined.

[0085] In an embodiment, a processing system includes a communication system having a physical address range. A plurality of processing cores are coupled to the communication system. Each processing core includes: a microprocessor that, in operation, executes software instructions; and a first master interface circuit associated with the processing core, wherein the first master interface circuit, in operation, forwards a read or write request from the microprocessor to the communication system, the read or write request including a physical address in the physical address range. The processing system includes: a first circuit; a first slave interface circuit associated with the first circuit, wherein the first slave interface circuit, in operation, selectively forwards a read or write request addressed to an address sub-range of the physical address range from the communication system to the first circuit; a second circuit; a second master interface circuit associated with the second circuit, wherein the second master interface circuit, in operation, forwards a read or write request from the second circuit to the communication system; a first register associated with the first master interface circuit, wherein the first register, in operation, stores a first virtual machine ID; a second register associated with the second master interface circuit, wherein the second register, in operation, stores a second virtual machine ID; and a third register associated with the first slave interface circuit, wherein the third register, in operation, stores a third virtual machine ID. The first register, the second register, and the third register are programmable by software instructions executed by the microprocessor. In operation, the first master interface circuit reads the first virtual machine ID from the first register and inserts the first virtual machine ID into the read or write request forwarded from the microprocessor to the communication system. In operation, the second master interface circuit reads the second virtual machine ID from the second register and inserts the second virtual machine ID into the read or write request forwarded from the second circuit to the communication system. In operation, the first slave interface circuit responds to a read or write request received from the communication system and addressed to an address within an address sub-range of a physical address range by: extracting a virtual machine ID from the received request; reading the third virtual machine ID from the third register; determining whether the virtual machine ID extracted from the received request corresponds to the third virtual machine ID; in response to determining that the virtual machine ID extracted from the received request corresponds to the third virtual machine ID, forwarding the read or write request to the first circuit; and in response to determining that the virtual machine ID extracted from the received request does not correspond to the third virtual machine ID, prohibiting forwarding the read or write request to the first circuit.

[0086] In an embodiment, an apparatus includes: a plurality of processing systems; and a communication bus that, in operation, couples the plurality of processing systems together, each of the plurality of processing systems including: a communication system having a physical address range; a plurality of processing cores coupled to the communication system, each processing core including: a microprocessor that, in operation, executes software instructions; and a first master interface circuit associated with the processing core, wherein the first master interface circuit, in operation, forwards a read or write request from the microprocessor to the communication system, the read or write request including a physical address within the physical address range; a first circuit; and a first slave interface circuit associated with the first circuit. wherein a first slave interface circuit selectively forwards read or write requests addressed to an address sub-range of a physical address range from the communication system to the first circuit during operation; a second circuit; a second master interface circuit associated with the second circuit, wherein the second master interface circuit forwards read or write requests from the second circuit to the communication system during operation; a first register associated with the first master interface circuit, wherein the first register stores a first virtual machine ID during operation; a second register associated with the second master interface circuit, wherein the second register stores a second virtual machine ID during operation; and a third register associated with the first slave interface circuit, wherein the third register stores a third virtual machine ID during operation. wherein the first register, the second register, and the third register are programmable by software instructions executed by the microprocessor; in operation, the first master interface circuit reads the first virtual machine ID from the first register and inserts the first virtual machine ID into the read or write request forwarded from the microprocessor to the communication system; in operation, the second master interface circuit reads the second virtual machine ID from the second register and inserts the second virtual machine ID into the read or write request forwarded from the second circuit to the communication system; and in operation, the first slave interface circuit responds to a read or write request received from the communication system and addressed to an address in an address sub-range of a physical address range by: extracting a virtual machine ID from the received request; reading the third virtual machine ID from the third register; determining whether the virtual machine ID extracted from the received request corresponds to the third virtual machine ID; in response to determining that the virtual machine ID extracted from the received request corresponds to the third virtual machine ID, forwarding the read or write request to the first circuit; and in response to determining that the virtual machine ID extracted from the received request does not correspond to the third virtual machine ID, prohibiting forwarding of the read or write request to the first circuit.

[0087] In an embodiment, a method includes controlling communications over a communication system having a physical address range and coupling a processing core, a first circuit, and a second circuit. The controlling includes: enabling a hypervisor on a microprocessor of the processing core; under control of the hypervisor, storing a first virtual machine ID value in a first register associated with a first master interface circuit associated with the microprocessor; under control of the hypervisor, storing a second virtual machine ID value in a second register associated with a second master interface circuit associated with the second circuit; under control of the hypervisor executing on the first processing core, storing a third virtual machine ID value in a third register; inserting, by the first master interface circuit, the stored first virtual machine ID into a read or write request forwarded from the first processing core to the communication system; inserting, by the second master interface circuit, the stored second virtual machine ID into a read or write request forwarded from the second circuit to the communication system; and, under control of a slave interface circuit associated with the first circuit, selectively forwarding read or write requests addressed to an address subrange of the physical address range from the communication system to the first circuit. The selective forwarding includes: extracting a virtual machine ID from a request addressed to the address sub-range; reading a third virtual machine ID from a third register; determining whether the virtual machine ID extracted from the request corresponds to the third virtual machine ID; in response to determining that the virtual machine ID extracted from the request corresponds to the third virtual machine ID, forwarding the request to the first circuit; and in response to determining that the virtual machine ID extracted from the request does not correspond to the third virtual machine ID, prohibiting forwarding the request to the first circuit.

[0088] In one embodiment, the contents of a non-transitory computer-readable medium configure a computing system to control communications over a communication system having a physical address range, the communication system coupling a processing core, a first circuit, and a second circuit. The communications control includes: enabling a hypervisor on a microprocessor of the processing core; under control of the hypervisor, storing a first virtual machine ID value in a first register associated with a first master interface circuit associated with the microprocessor; under control of the hypervisor, storing a second virtual machine ID value in a second register associated with a second master interface circuit associated with the second circuit; under control of the hypervisor executing on the first processing core, storing a third virtual machine ID value in a third register; inserting, by the first master interface circuit, the stored first virtual machine ID into a read or write request forwarded from the first processing core to the communication system; inserting, by the second master interface circuit, the stored second virtual machine ID into a read or write request forwarded from the second circuit to the communication system; and, under control of a slave interface circuit associated with the first circuit, selectively forwarding, from the communication system to the first circuit, read or write requests addressed to an address subrange of the physical address range. The selective forwarding includes: extracting a virtual machine ID from a request addressed to the address sub-range; reading a third virtual machine ID from a third register; determining whether the virtual machine ID extracted from the request corresponds to the third virtual machine ID; in response to determining that the virtual machine ID extracted from the request corresponds to the third virtual machine ID, forwarding the request to the first circuit; and in response to determining that the virtual machine ID extracted from the request does not correspond to the third virtual machine ID, prohibiting forwarding the request to the first circuit. BRIEF DESCRIPTION OF THE DRAWINGS

[0089] Embodiments of the present disclosure will now be described with reference to the accompanying drawings, provided by way of non-limiting examples only, in which:

[0090] Figure 1 An example of an electronic system including multiple processing systems is shown;

[0091] Figure 2 An example of a processing system such as a microcontroller is shown;

[0092] Figure 3 An example of a multi-core processing system is shown;

[0093] Figure 4 An example of software executed by a processing system is shown, where the software is divided into an operating system and applications;

[0094] Figure 5 An example of software executed by a processing system is shown, where the software is partitioned into a hypervisor and multiple virtual machines;

[0095] Figure 6 shows the configuration for Figure 5 An example of configuring a virtual address translation table of a virtual machine;

[0096] Figure 7 shows an embodiment of a multi-core processing system according to the present disclosure,

[0097] Figure 8 An embodiment of a processing core according to the present disclosure is shown;

[0098] Figure 9 An embodiment of a resource including a slave interface utilizing firewall configuration data is shown;

[0099] Figure 10 An embodiment of a resource including a master interface and a slave interface is shown;

[0100] Figure 11 An embodiment of software executed by a processing system is shown, wherein the software is partitioned into a hypervisor and multiple virtual machines;

[0101] Figure 12 Shows the Figure 12 An embodiment of configuring access rights of a virtual machine;

[0102] Figure 13 Shown for Figure 12 An embodiment of firewall configuration data for a processing system is shown;

[0103] Figure 14 An embodiment of a universal master and slave interface is shown;

[0104] Figure 15 An embodiment of a bus master including multiple functional channels is shown;

[0105] Figure 16 An embodiment of a bus master, particularly a DMA controller, is shown;

[0106] Figure 17 Shown for Figure 16 Embodiments of a security configuration for a processing system. DETAILED DESCRIPTION

[0107] In the following description, numerous specific details are provided to provide a thorough understanding of the embodiments. The embodiments may be practiced without one or more of the specific details (or with other methods, components, materials, etc.). In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the embodiments.

[0108] Reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, appearances of the phrases "in one embodiment" or "in an embodiment" throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0109] The headings provided herein are for convenience only and do not interpret the scope or meaning of the embodiments.

[0110] In the following Figures 7 to 17 In, reference has been made Figure 1 and Figure 6 Described parts, elements, or components may be denoted by the same reference numerals used previously in these figures; the description of these previously described elements will not be repeated below so as not to unduly burden the detailed description of the present invention.

[0111] As described above, various embodiments of the present disclosure relate to solutions for managing access permissions in a multi-core processing system.

[0112] For example, Figure 7 1 shows an embodiment of a processing system 10a according to the present disclosure. Figure 3 The described architecture corresponds to the

[0113] Specifically, also in this case, the processing system 10a includes:

[0114] a communication system 114a, such as a bus or a NoC;

[0115] Multiple processing cores 102a, such as processing cores 102a1 to 102a n , wherein each processing core 102 includes a software programmable microprocessor 1020a, a master interface 1022a, and a slave interface 1024a; and

[0116] The at least one resource 106 has a slave interface 1064a.

[0117] Typically, a slave interface is associated with a corresponding physical address or address range. For example, Figure 8 and Figure 9 102a, and a slave interface 1064a of resource 106a is associated with a corresponding physical address or address range PA_106. Typically, each slave interface is associated with a different and unique address or address range within the physical address range of communication system 114a. For example, processing cores 102a1 to 102a1 may be associated with a slave interface 1024a of processing core 102a.n The various slave interfaces 1024a and 1064a of the resource 106 are associated with non-overlapping addresses or address ranges PA_102 and PA_106 .

[0118] Thus, the master interface is configured to send a read or write request REQ to the communication system 114a and eventually receive a corresponding response to the request from the communication system 114a. Figure 8 , where the master interface 1022a of the process 102a is configured to send a request REQ to the communication system 114a. Specifically, such a read or write request REQ will include a physical address PA associated with the slave interface to which the request REQ should be sent.

[0119] Thus, in this manner, the microprocessor can send a write or read request REQ to a given resource 106 by including in the request REQ the physical address associated with the slave interface 1064a of the resource 106. For example, a slave interface typically manages multiple addresses, since addresses can be mapped to different functions, such as configuration registers, registers containing data to be transmitted or received data, etc.

[0120] However, the first microprocessor 1020a may also send the request REQ to the second microprocessor by including the physical address PA_106 associated with the slave interface 1024a of the second microprocessor in the request REQ.

[0121] Generally, although the master and slave interfaces of the various circuits are shown as separate logical blocks, these interfaces may actually reuse the same physical interface for communicating with the communication system 114a.

[0122] like Figure 7 As shown, in various embodiments, the processing system 10a further includes a memory controller 100a configured to connect to internal and / or external volatile memory 104b and / or non-volatile memory 104. For example, as previously described, the memory 104 may be configured to store software instructions to be executed by the processing core 102a, and the memory 104b may be used to store temporary processing results.

[0123] In various embodiments, the processing system 10a may also include a DMA controller 110a.

[0124] Specifically, if Figure 8 As shown, in various embodiments, each processing core 102a includes registers for storing a virtual machine ID (VMID) and optionally includes registers for storing an address space ID (ASID).

[0125] like Figure 8As shown in , in various embodiments, register VMID can be programmed via slave interface 1024a of the corresponding processing core 102a. Generally, although Figure 8 The slave interface is shown connected to the communication system 114a, but in practice, in addition to the system bus or NoC, the communication system 114a may also include an additional coprocessor bus, such as the microprocessor 1020a connecting the same processing core 102a or all processing cores 102a. For example, in an ARM core, the corresponding register for storing the VMID is called VSCTLR.

[0126] Specifically, Figure 11 A typical scenario of software executed by a processing system 10a is shown. Specifically, in the embodiment considered, the software includes a hypervisor HYPa and a plurality of virtual machines VM, such as three virtual machines VM1, VM2, and VM3. For example, the processing system 10a may include four processing cores 102a, where:

[0127] The virtual machine VM1 may be a complex electronic control unit (ECU);

[0128] Virtual machines VM2 and VM3 may relate to a multimedia system and a navigation system, respectively.

[0129] For example, since the multimedia system and the navigation system can use the same display device, only one of these machines may be executed at a given time. For example, in this case, the hypervisor HYPa may be executed on the first processing core 102a, and the hypervisor HYPa may start the virtual machine VM1 on the second and third processing cores 102a, and start the virtual machine VM2 on the fourth processing core 102a. In addition, when receiving a given command from the virtual machine VM2, the hypervisor HYPa may stop the virtual machine VM2 and start the virtual machine VM3 on the fourth processing core 102a.

[0130] Typically, the number of processing cores 102a and the number of virtual machines VM may depend on application needs. For example, a real-time control system should typically be assigned to one or more dedicated processing cores, while other virtual machines and even a hypervisor HYP may be executed based on a time scheduling mechanism similar to that of software tasks managed by an operating system OS.

[0131] As mentioned above, register VMID should contain the ID of the virtual machine executed by the corresponding processing core 102a. For example, consider Figure 11In an exemplary scenario, the following VMIDs may be used: VMID0 (e.g., 0) for the hypervisor HYPa and VMID1 to VMID3 (e.g., 1 to 3) for the virtual machines VM1 to VM3. Thus, in this case, the boot loader will start the hypervisor HYPa on the first processing core 102a, and the hypervisor HYPa may program the VMIDs of the other processing cores 102a and then start the corresponding virtual machines on the other processing cores, e.g.,

[0132] Programming the value VMID1 for the second and third processing cores 102a; and

[0133] The value VMID2 for the fourth processing core 102a is programmed.

[0134] In contrast, when the hypervisor HYPa executed by the processing core 102a determines that the processing core 102a (e.g., the fourth process) should switch from a given first virtual machine (e.g., VM2) to a given second virtual machine (e.g., VM3), the hypervisor HYPa may:

[0135] stopping the first virtual machine, and in an embodiment, further storing context information of a processing core associated with the first virtual machine;

[0136] Reprogramming the register VMID of the processing core 102a and storing the VMID of the second virtual machine VM2 in the register VMID, and in an embodiment, also re-storing the context information of the processing core associated with the second virtual machine; and

[0137] Start or resume the operation of the second virtual machine VM1.

[0138] Conversely, when supported, the register ASID can be programmed directly or indirectly via the corresponding microprocessor 1020a of the processing core 102. Specifically, as will be described in more detail below, the address space ID can be used to organize the addresses assigned to a given virtual machine VM into smaller subsets. For example, a first address space ID can be assigned to the operating system OS of the virtual machine VM executed by the processing core 102a, and one or more additional address space IDs can be assigned to the application APP of the virtual machine VM executed by the processing core 102a. Therefore, in various embodiments, the register ASID can be programmed by the operating system of the virtual machine VM executed by the given processing core 102.

[0139] Specifically, similar registers are provided in the ARM AArch64 or AArch32 architecture. Specifically, these registers are used to perform address translation via a translation table and a memory management unit of the processing core, or to directly perform access control on physical addresses via a memory protection unit. In contrast, in various embodiments of the present disclosure, the master interface 1022a of the processing core 102a is configured to transmit not only the physical address PA associated with the target slave client, but also the contents of the register VMID and register ASID (when used) together with the request REQ.

[0140] Therefore, about Figure 9 , the slave interface 1064a of the resource 106a will receive a request REQ comprising the physical address PA_106 associated with the slave interface 1064a. However, the request also comprises the data VMID and optionally the ASID of the processing core 102a that has sent the request REQ.

[0141] Thus, in various embodiments, the slave interface 1064a includes a firewall that is configured to compare the data VMID and, optionally, ASID included in the request REQ with firewall configuration data 1066 that defines whether a given VMID (or combination of VMID and ASID) may send a request to the slave interface 1064a.

[0142] In various embodiments, these firewall configuration data 1066 may also individually specify whether a given VMID (or a combination of VMID and ASID) can send read requests and / or can send write requests. For example, in the case where the slave interface 1064a only manages a single address or address range PA_106, the configuration data may include:

[0143] A first field for storing a VMID (or a combination of VMID and ASID) to which a read request may be sent; and

[0144] The second field is used to store the VMID (or a combination of VMID and ASID) to which the write request can be sent.

[0145] Thus, where a given virtual machine (or process identified by a combination of VMID and ASID) has read and write access to a given address range, the same VMID (or combination of VMID and ASID) will be stored to both the first and second fields.

[0146] In contrast, in order to exchange data between different virtual machines or processes, so-called inter-process communication (IPC), a first VMID (or a combination of VMID and ASID) can be stored to the first field and a second VMID can be stored to the second field, whereby the first VMID can read data from the address range and the second VMID can write data to the address range (peer communication).

[0147] In various embodiments, the first field may also be used to store a value identifying a "wildcard" indicating that all VMIDs or processes can read data from the corresponding address range. For example, this allows broadcast communication from one virtual machine to all other virtual machines.

[0148] Similarly, in the case where the slave interface 1064a is configured to manage multiple address ranges PA_106, for each managed address range, the configuration data may include:

[0149] a corresponding first field for storing a VMID (or a combination of VMID and ASID) to which a read request may be sent; and

[0150] A corresponding second field is used to store the VMID (or combination of VMID and ASID) to which the write request may be sent.

[0151] Therefore, if the firewall of interface 1064a determines that the VMID and optional ASID included in the request REQ can access interface 1064a, the firewall forwards the corresponding request to resource 106. Conversely, if the firewall of interface 1064a determines that the VMID and optional ASID included in the request REQ cannot access interface 1064a, the firewall / slave interface can:

[0152] Ignore the request REQ; or

[0153] The error is sent to the processing core 102 that sent the request REQ and / or to a specific address associated with, for example, an error monitoring module or a slave interface of the processing core 102 executing the hypervisor HYPa, and / or directly to a module responsible for collecting and processing system errors. The specific address may be predetermined.

[0154] Therefore, in an embodiment, the security configuration of the communication between the master interface and the slave interface includes:

[0155] Security configuration data SECM of the primary interface, including the data VMID and optional ASID included in the request REQ; and

[0156] The security configuration SECS of the slave interface comprises firewall configuration data 1066 which defines access rights to the slave interface (in particular the physical address range managed by the slave interface) based on the data VMID and optionally ASID included in the request REQ.

[0157] Therefore, in Figures 7 to 9 In the illustrated embodiment, processing core 102a does not include a memory management unit (configured to perform address translation operations) or a memory management unit (configured to verify access permissions), but each processing core 102a can send a request REQ to communication system 114a, where the request can include a physical address within the full address range associated with communication system 114a. Instead, access protection is implemented via a firewall within slave interface 1064a of target resource 106a. However, processing core 102a may also include an additional MMU or MPU.

[0158] Generally, the above operations of the master interface 1022a and the slave interface 1064a can also be implemented in other master interfaces and slave interfaces.

[0159] For example, in various embodiments, each slave interface, such as the slave interface 1024a of the processing core 102a and the slave interface 1004a of the memory controller 100a, may include a firewall that allows configuration of a VMID (or a combination of a VMID and an ASID) that may send read and / or write requests to the corresponding slave interface.

[0160] Similarly, other master interfaces (such as the master interface 1062a of resource 106a or another bus master) may also include registers for setting the VMID and, optionally, the ASID. In general, the inventors have observed that it is often sufficient for other master interfaces to include only the VMID register, since other bus masters are generally unaware of applications / processes and can omit the ASID register. However, in general, the master interface of resource 106a (or another bus master) may also include an ASID register for storing an address space ID.

[0161] For example, Figure 10An embodiment of resource 106a is shown that also includes a host interface 1062a. Specifically, in the embodiment under consideration, resource 106 includes a register VMID for storing a virtual machine ID. Specifically, similar to processing core 102a, the content of register VMID is programmable by sending a write request REQ containing an address PA_106 associated with register VMID. For example, in this manner, the hypervisor HYPa executed by processing core 102a can send a request REQ for programming register VMID of resource 106a.

[0162] Therefore, by configuring the firewall that manages the slave interface for a given physical address, the firewall of the slave interface can determine whether the request is sent from an allowed VMID (or combination of VMID and ASID).

[0163] Typically, the configuration of the virtual machine VM, including the programming of the security configuration data SECM of the various bus masters (in particular the register VMID) and the setting of the security configuration data SECS of the slave interfaces (in particular the firewall configuration data 1066), can be performed solely by the hypervisor HYPa. For this purpose, in various embodiments, each slave interface of a given circuit manages at least two address ranges:

[0164] An address range associated with security configuration data, the security configuration data including:

[0165] Security configuration data SECS from the interface (firewall configuration data 1066), and

[0166] In case the circuit further comprises a master interface, security configuration data SECM of the master interface (register VMID and optional register ASID);

[0167] One or more address ranges used to control the operation of circuitry.

[0168] In general, instead of implementing a firewall in a slave interface, a firewall can also be implemented in communication system 114a, and more specifically, at each interface of communication system 114a that connects communication system 114a to a corresponding slave interface. This has the following advantages: for example, conventional IP blocks of processing core 102a and resources 106a do not need to be modified, but rather additional firewall circuitry can be added between conventional communication system 114a and the various circuits connected to communication system 114a. Accordingly, a corresponding firewall circuit can also be located between each slave circuit and the corresponding interface of communication system 114a. In fact, in various embodiments, each firewall circuit is configured to monitor (and potentially reject) requests forwarded from communication system 114a to a slave interface, rather than monitoring requests forwarded from a master interface to communication system 114a, as would be implemented at most by an MMU or MPU.

[0169] Therefore, in general, the term "slave interface circuit" must be interpreted in the sense that the circuit relates to the connection point of the slave interface of the circuit to the interface of the communication system 114a, and may include the slave interface of the circuit and / or the corresponding interface of the communication system 114a. Therefore, in general, each of these slave interface circuits is associated with an address range (associated with one or more corresponding configuration registers) for storing security configuration data SECS (firewall configuration data 1066) of the corresponding slave interface circuit. For example, when a firewall is implemented in the communication system 114a, the communication system 114a itself may include a slave interface that allows configuration of various security configuration data SECS.

[0170] Similarly, instead of implementing a mechanism that adds the VMID and optionally the ASID to the request REQ in the primary interface of the circuit, the circuit may be provided between the primary interface and a corresponding interface of the communication system 114a.

[0171] Thus, in general, the term "master interface circuit" can be interpreted in this sense as a connection point of the master interface of the circuit to the interface of the communication system 114a, and can include the master interface of the circuit and / or the corresponding interface of the communication system 114a. Thus, in general, each of these master interface circuits is associated with an address range (associated with one or more corresponding configuration registers) for storing security configuration data SECM (register VMID and optional register ASID) of the corresponding master interface circuit. For example, also in this case, the communication system 114 itself can include a slave interface that allows the configuration of various security configuration data SECM.

[0172] In various embodiments, the firewall configuration data 1066 is configured to store at least one VMID (and optionally one or more ASIDs) for each of the one or more address ranges managed by the slave interface circuitry, the at least one VMID (and optionally one or more ASIDs) indicating which VMID (and optionally ASID) can access the corresponding address range. Thus, the slave interface circuitry is configured to extract the address and VMID (and optionally ASID) from the request REQ, determine the corresponding firewall configuration data 1066 for the extracted address, and compare the VMID (and optionally ASID) stored for the determined firewall configuration with the VMID (and optionally ASID) extracted from the request.

[0173] For example, Figure 12An embodiment is shown in which the hardware layer HW of a processing system 10a comprises two interfaces IF1 and IF2 and a memory controller 100a that manages access to a memory, such as a volatile memory 104b. Specifically, in the embodiment considered, the processing system 10a again executes a hypervisor and three virtual machines VM1, VM2 and VM3, where:

[0174] Virtual machine VM1 should have exclusive access to interface IF1.

[0175] The hypervisor HYPa shall have exclusive access to the interface IF2, but manage two virtual / software interfaces IF2a and IF2b accessible by the virtual machines VM2 and VM3; and

[0176] The hypervisor HYPa and each virtual machine should have access to the corresponding memory range managed by the memory controller 100 a .

[0177] in this regard, Figure 13 A possible organization of the physical address range PA associated with the communication system 114a is shown in the case of two interfaces IF1 and IF2 and a memory controller 110a. Specifically, in the embodiment considered, the memory controller 110a is configured to manage access rights for a plurality of memory blocks, such as eight blocks MEM_01 to MEM_08. For example, considering a 2048K-byte memory, each memory block may correspond to a corresponding 256K-byte memory. In this case, the address range may include:

[0178] a physical address range PA1 associated with a security configuration IF1_SEC of the slave interface circuit of the first interface IF1 ;

[0179] a physical address range PA2 associated with the register interface IF1_REG of the first interface IF1;

[0180] a physical address range PA3 associated with the security configuration IF2_SEC of the slave interface circuit of the second interface IF2;

[0181] a physical address range PA4 associated with the register interface IF2_REG of the second interface IF2;

[0182] a physical address range PA5 associated with the security configuration MEM_SEC of the slave interface circuit of the memory controller 100a; and

[0183] Physical address ranges PA6 to PA13 associated with memory blocks MEM_01 to MEM_08 managed by the memory controller.

[0184] Usually, although Figure 13 Not shown, but in various embodiments, the address range associated with processing core 102a also includes at least two physical address ranges: a first address range associated with security configuration data for the slave interface circuitry and master interface circuitry of the processing core (VMID / ASID and firewall configuration data to be included in the request REQ sent by the processing core) and one or more address ranges for exchanging data with microprocessor 1020.

[0185] As mentioned above, the security configuration data SECS / SECM should only be programmable by the hypervisor HYPa, for example, the address ranges PA1 , PA3 and PA5 should only be programmable via the hypervisor HYPa.

[0186] For example, in various embodiments, a processing system executing a hypervisor HYPa and n virtual machines VM1 to VMn is configured to use:

[0187] the first VMID for the hypervisor HYPa, and

[0188] A corresponding VMID for each of the n virtual machines VM1 to VMn.

[0189] For example, in various embodiments, the value VMID may comprise 8 bits, which allows for the use of 256 different VMIDs.

[0190] Therefore, access to the security configuration data can be ensured by using a VMID corresponding to a reset value (e.g., zero) of the firewall configuration data 1066 for the hypervisor HYPa. Typically, firewall configuration data associated with the security configuration data (e.g., PA1, PA3, and PA5) can also be fixed and hardwired. For example, only VMID=0 can program various security configuration data.

[0191] Additionally or alternatively, dedicated bits of the communication exchanged via the communication system 10a may indicate the request REQ sent by the hypervisor HYPa. For example, in the case of a communication system generally based on the AXI protocol or an ARM Cortex-R52, privileged information of the AXI protocol, such as bits ARPROTM[0] and AWPROTM[0] of the AXI protocol, may be used.

[0192] Thus, in this case, a firewall managing access to given security configuration data (eg, IF1_SEC, IF2_SEC, MEM_SEC) may only allow access to such data if the correct VMID and / or privilege information is set.

[0193] As described above, the security configuration data SECM and / or SECS associated with the various slave and / or master interface circuits may also be programmed by sending requests to one or more dedicated slave interfaces. For example, where security configuration data (e.g., IF1_SEC, IF2_SEC, MEM_SEC) are managed within the communication system 114a, the firewall managing the slave interfaces for the address ranges (e.g., PA1, PA3, and PA5) associated with these security configuration data may only allow requests REQ that are sent together with the VMID (associated with the hypervisor HYPa) and / or when privilege information is set.

[0194] Therefore, in this case, the hypervisor HYPa can program various security configuration data SECS (firewall configuration data 1066) in order to set access rights to one or more address ranges managed by the corresponding circuit, and, if the circuit also includes a master interface, program security configuration data SECM (register VMID and optional register ASID).

[0195] For example, the security configuration data IF1_SEC can be used to set (multiple) VMIDs (and optionally (multiple) ASIDs), which have access to the physical address range PA2 assigned to the register interface IF1_REG, the security configuration data IF2_SEC can be used to set (multiple) VMIDs (and optionally (multiple) ASIDs), which have access to the physical address range PA2 assigned to the register interface IF2_REG, and the security configuration data MEC_SEC can be used to set (multiple) VMIDs (and optionally (multiple) ASIDs) with access to the physical address range PA6 to PA13 assigned to the memory blocks MEM_01 to MEM_08.

[0196] For example, in Figure 13 In the embodiment shown, the hypervisor HYPa configures the various slave interfaces so that:

[0197] The VMID associated with the virtual machine VM1 can access the physical address range PA2 associated with the register interface IF1_REG of the first interface IF1;

[0198] The VMID associated with the hypervisor HYPa can access the physical address range PA4 associated with the register interface IF2_REG of the second interface IF2;

[0199] The VMID associated with the hypervisor HYPa can access the physical address ranges PA6 and PA7 associated with the memory blocks MEM_01 and MEM_02; and

[0200] Each VMID associated with virtual machines VM1, VM2, and VM3 may access a physical address range.

[0201] As previously mentioned, in the case where the circuit also includes a master interface circuit, the security configuration data also includes data SECM (at least the contents of the register VMID). For example, the master interface 1062a of resource 106a also transmits the contents of the register VMID (and optionally the register ASID) of resource 106a with each read or write request. In this configuration, separation of the various resources 106a can be achieved by assigning a separate VMID to each resource 106a and programming the corresponding access rights of the firewall configuration data 1066 of the slave interface. However, the inventors have observed that each resource 106a is either a dedicated resource associated with a specific virtual machine VM or a shared resource and is therefore assigned to the hypervisor HYPa. Therefore, managing separate VMIDs may be quite useless, but it is sufficient to store the VMID of the virtual machine VM (or hypervisor HYPa) to which the circuit is assigned in the register VMID of a given circuit. In fact, the configuration of the firewall of the slave interface means that a given slave interface processes requests containing the same VMID in the same way.

[0202] As mentioned above, other bus masters may also support register ASIDs. This may be useful, for example, when a virtual machine uses the field ASID to identify requests sent by an operating system (OS) (e.g., identified via a first ASID) and requests sent by an application (APP) (e.g., identified via one or more additional ASIDs). Figure 13 As described, the slave interface circuit of the memory controller 100 a may allow configuration of access permissions for each of a plurality of address ranges (eg, address ranges PA6 to PA13 ).

[0203] In this case, the hypervisor HYPa can program the firewall configuration data 1066 to indicate whether a given ASID can also access the allocated memory range. Figure 13 , the firewall configuration data (included in the security configuration data MEM_SEC) can indicate that the operating system OS of a given virtual machine can access two storage blocks assigned to the corresponding VMID, while the application (identified via a given ASID) can only access the second storage block assigned to the corresponding VMID.

[0204] Therefore, in the embodiment described here, address range protection is implemented directly in the target slave interface circuitry, for example:

[0205] Access to the physical address ranges PA1 and PA2 is managed by the firewall of the slave interface circuit of interface IF1;

[0206] Access to the physical address ranges PA3 and PA4 is managed by the firewall of the slave interface circuit of interface IF2;

[0207] Access to the physical address range PA5 to PA13 is managed by a firewall of the slave interface circuitry of the memory controller 100a.

[0208] Therefore, the firewall of each slave interface circuit must only verify access rights for physical addresses managed by the corresponding slave interface circuit. However, this also means that the various software tasks must know in advance the physical memory range assigned to the corresponding software task (via VMID and optionally via ASID). For example, as described above, the processing core 102a directly sends a request containing the physical address PA. Therefore, the software executed by a given virtual machine must know the physical address range assigned to the virtual machine because no address translation is performed. For example, to this end, the software executed by the virtual machine VM1 must know in advance that it can only access the physical memory ranges PA2, PA8 and PA9. For example, this specification must be provided to the software development team assigned to develop the software for the first virtual machine VM1. In fact, as mentioned above, this virtual memory mapping function may be incompatible with real-time control systems. However, in any case, for example, for virtual machines that do not perform real-time control functions, the operating system OS of the given virtual machine can still manage the virtual address translation table for the application layer.

[0209] In addition, as regards Figure 13 As described, protection can be achieved by dividing the managed address range into one or more subsets of address sub-ranges and providing a configuration register for each subset (or two in the case of handling read and write requests differently), the configuration register being used to store(s) VMID(s) (and optionally(s) ASID(s)) that can access the corresponding sub-range. For example, in various embodiments, each firewall can be configured to manage 4, 8, 16, or 32 address ranges.

[0210] Therefore, in various embodiments, the verification operation within the firewall can be implemented using fast and low-complexity combinational logic circuitry that only needs to determine the address sub-range of the request (based on the physical address included in the request) and compare the VMID (and optionally the ASID) included in the request with the VMID(s) (and optionally the ASID(s)) stored in the firewall configuration register associated with the address sub-range. Therefore, this operation does not introduce significant latency and is therefore suitable for real-time control systems.

[0211] In various embodiments, the master interface circuit and / or the slave interface circuit may also manage multiple circuits.

[0212] For example, Figure 14 An embodiment is shown in which a master interface circuit MIF1 manages at least two master circuits M1 and M2. As previously described, the master interface circuit can initiate communications on the communication system 114a. Thus, the master interface MIF1 uses the communication protocol of the communication system 114a for communicating with the communication system 114a, but the master interface circuit MIF1 can use a different protocol for communicating with the master circuits M1 and M2. For example, the communication system 114a can be a NoC, and:

[0213] The main circuits M1 and M2 may be connected to the main interface circuit MIF1 via a bus; or

[0214] The main circuits M1 and M2 may be connected to the master interface circuit MIF1 via respective independent communication channels.

[0215] For example, Figure 15 An embodiment of a universal bus master BM is shown, wherein the master interface circuit MIF1 comprises a plurality of functional channels, such as channels CH0 to CH3.

[0216] In this case, the bus master BM may include a slave interface circuit SIF1 that manages access to a register interface REG_IF2 configured to store channel configuration information. For example, the channel configuration information may indicate whether a given channel can initiate communication, select which circuit should be connected to a given channel, specify a given target physical address, etc.

[0217] In various embodiments, the bus master BM may further include a control circuit CTRL. In this case, the slave interface circuit SIF1 may further manage access to a register interface REG_IF1 configured to store control configuration information.

[0218] For example, the control circuit CTRL may be a state machine that may be configured to automatically increment a target physical address associated with a given channel after each data transmission for that particular channel.

[0219] Thus, in the embodiment considered, the bus master BM may correspond to the DMA controller 110 a .

[0220] For example, Figure 16 As shown, such a DMA controller 110a can be used to receive data from one or more circuits (such as resources or peripheral devices 106a, such as three interfaces IF1, IF2, IF3, an analog-to-digital converter ADC and a timer circuit TIMER) and generate a request REQ, which includes the received data and a physical address associated with the slave interface circuit connected to the communication system 114a (such as the first memory controller 100a (for example, managing access to the non-volatile memory 104), the second memory controller 100b (for example, managing access to the volatile memory 104b), the processing core 102a and / or the resource 106a).

[0221] As described above, in various embodiments, the master interface circuit MF1 is further configured to transmit, together with each request REQ, an ID associated with the master circuit handled by the master interface circuit MF1 .

[0222] For example, in Figure 14 In the embodiment shown, the master interface MIF1 manages two master circuits M1 and M2. Thus, in the embodiment considered, the master interface circuit MIF1 is associated with two registers VMID[0] and VMID[2] for storing the IDs to be included in the requests REQ sent by the master interface circuit MIF1 to the communication system 114a based on the requests received from the master circuits M1 or M2, respectively.

[0223] Similarly, Figure 17 An embodiment is shown, wherein Figure 16 The main interface circuit of the DMA controller 110a is shown to have associated with each functional channel a corresponding register for storing the VMID associated with the channel (e.g., VMID[0], VMID[1], VMID[2], etc.). Figure 17 In the embodiment, the VMID to be included in the request REQ to be sent to the communication system 114a is selected via the multiplexer MUX according to the signal CH_ID indicating the number of the channel to which the DMA controller 110a wants to transmit the request REQ.

[0224] As mentioned above, the registers containing the virtual machine ID form part of the security configuration SECM of the master interface circuit MIF1. In particular, in various embodiments, these security configuration SECMs can be programmed only via the hypervisor HYPa. For example, as previously mentioned, the hypervisor HYPa executed by the processing core 102a can send a corresponding write request to the slave interface SIF1, which can be associated with a bus master or can be a dedicated slave interface. Generally, in the case where the slave interface circuit SIF1 is associated with a bus master, the slave interface circuit SF1 can also be used to manage the bus master (see, for example Figure 15 ) and / or the master circuits M1 and M2 managed by the master interface MIF1 (see Figure 14 ) other functions.

[0225] Thus, in the embodiment considered, the master interface MIF1 is configured to insert into the request REQ (in addition to the data identifying the request):

[0226] a physical target address PA associated with the target slave interface circuit; and

[0227] A single VMID that identifies the primary circuit as the source of the request.

[0228] As mentioned above, the master interface MIF1 can also insert the ASID into the request.

[0229] Thus, the slave interface SIF2 associated with the physical target address may receive the request REQ, extract the VMID and compare the VMID with the firewall configuration data stored to the security configuration data SECS of the slave interface SIF2.

[0230] For example, in Figure 14 In this example, the slave interface SIF2 manages two slave devices S1 and S2. Therefore, in this case, the slave interface SIF2 can use (at least):

[0231] a first physical address range PA3 associated with the slave device S1;

[0232] A second physical address range PA4 is associated with the slave device S2.

[0233] As described above, the security configuration data SECM and / or SECS can be managed via the slave interface circuit and / or dedicated slave interface circuit of the corresponding circuit. Figure 14 An embodiment is shown in which one or more slave interfaces SIF1 manage security configuration data SECM and / or SECS. Thus, in this case, the slave interface SIF1 can use (at least):

[0234] a first physical address range PA1 associated with security configuration data SECM of the master interface circuit MIF1; and / or

[0235] A second physical address range PA2 is associated with the security configuration data SECS of the slave interface SIF2.

[0236] Thus, in the embodiment under consideration, the hypervisor HYPa executed by the processing core 102a can send a write request to the address range PA2 (e.g. managed by the slave interface SIF1) for programming the security configuration data SECS (in particular the firewall configuration data). Specifically, in the embodiment under consideration, the firewall configuration data includes (at least):

[0237] a register VMID_FW[0] for storing at least one VMID for a second physical address range PA3 associated with the slave device S1; and

[0238] Register VMID_FW[1], for storing at least one VMID for a second physical address range PA3 associated with slave device S1

[0239] Therefore, when the slave interface SIF2 receives the request REQ, the slave interface SIF2 can determine the corresponding address range and compare the VMID included in the request REQ with at least one VMID stored in the security configuration data SECS, which is associated with the address range of the physical address included in the request REQ.

[0240] For example, in Figure 14 In the embodiment shown, the hypervisor HYPa may send a write request to the address ranges PA1 and PA2 (eg, managed by the slave interface SIF1) in order to store:

[0241] the first VMID in the register VMID[0] of the security configuration data SECM and in the register VMID_FW[0] of the security configuration data SECS; and

[0242] The second VMID in the register VMID_FW[1] of the security configuration data SECM and in the register VMID[1] of the security configuration data SECS.

[0243] Thus, in this case, master circuit M1 can exchange data with slave device S1 (but not with slave device S2 ), and master circuit M2 can exchange data with slave device S2 (but not with slave device S1 ).

[0244] Similarly, Figure 17The various slave interface circuits shown may also be associated with registers for storing corresponding security configuration data (particularly firewall configuration data), which indicates that the VMID of the master device is allowed to send requests to the slave device. For example, the memory controllers 100a and 100b may be associated with security configuration data SECS1 and SECS2, which respectively allow one or more allowed VMIDs to be stored for each of the multiple memory blocks. Similarly, any other resource 106a may be associated with security configuration data SEC3 for specifying corresponding access rights. In addition, the corresponding security configuration data SECS to be used by a given slave interface circuit can be programmed via the same slave interface circuit or via one or more dedicated slave interfaces.

[0245] Thus, in various embodiments, the hypervisor may allocate a given circuit to a particular virtual machine VM identified by a given VMID by:

[0246] In the case of a master circuit, storing the VMID of the virtual machine VM to the register VMID of the security configuration data SECM associated with the functional channel of the corresponding master interface MF1 handling communications between the master circuit and the communication system 114a; and

[0247] In the case of a slave circuit, the VMID of the virtual machine VM is stored in the register VMID_FW of the security configuration data SECS associated with the physical address range accessible to the virtual machine.

[0248] For example, as described in Italian patent application no. 102020000006322 in the context of an SPI interface, the interface itself may also manage a plurality of separate (queued) physical channels that exchange data via a single hardware interface. Furthermore, document 102020000006322 discloses data exchange between the processing core 102 and the interface 106 via DMA communication. For this purpose, the various physical channels are configured via global configuration registers and corresponding local configuration registers are configured for each channel. For example, with respect to Figure 12 and Figure 13 According to the arrangement shown in FIG, the hypervisor HYPa may be configured to send a request to configure the security configuration data SECS so as to achieve the following access rights:

[0249] The VMID of the hypervisor HYP can access:

[0250] The address range associated with the interface's global configuration registers,

[0251] The address range associated with the local configuration registers of queuing interface IF2, and

[0252] The address ranges associated with memory blocks MEM_01 and MEM_02; and

[0253] The VMID of virtual machine VM1 can access:

[0254] The address range associated with the local configuration registers of queuing interface IF1, and

[0255] The address range associated with memory blocks MEM_03 and MEM_04.

[0256] Furthermore, the hypervisor HYPa may be configured to send requests to:

[0257] Implement DMA transfer for queue interface IF1 and queue interface IF2,

[0258] A target address range for DMA transfer is specified for the queuing interface IF1 and the queuing interface IF2, wherein the target address range of the queuing interface IF1 belongs to the address range of the memory blocks MEM_03 and MEM_04, and the target address range of the queuing interface IF2 belongs to the address range of the memory blocks MEM_01 and MEM_02,

[0259] The security configuration data SECM associated with the DMA controller 110 a is set, wherein the channel allocated to the interface IF1 uses the VMID of the virtual machine VM1 , and the channel allocated to the interface IF2 uses the VMID of the hypervisor HYPa.

[0260] Thus, the present disclosure provides a low-complexity and extremely fast solution for achieving separation between different virtual machines, which is particularly important in the context of multi-core real-time control systems.

[0261] Of course, without prejudice to the principle of the present disclosure, the details of construction and the embodiments may vary widely with respect to what is described and illustrated herein purely by way of example, without thereby departing from the scope of the present disclosure.

[0262] The processing system (10a) can be summarized as comprising: a communication system (114a) having a given physical address range (PA); a plurality of processing cores (102a), each processing core comprising a microprocessor (1020a) configured to execute software instructions and associated with a first master interface circuit (1022a), the first master interface circuit being configured to forward a read or write request (REQ) from the microprocessor (1020a) to the communication system (114a), the read or write request (REQ) comprising a physical address in the physical address range; a first circuit (S1) associated with a slave interface circuit (SIF2) configured to selectively forward a read or write request (REQ) addressed to a given address sub-range (PA3) from the communication system (114a) to the first circuit (S1); and a second circuit (M1) associated with a second master interface circuit (MIF1) configured to The method further comprises: configuring the first master interface circuit (1022a) to forward a read or write request (REQ) from the second circuit (M1) to the communication system (114a); wherein the first master interface circuit (1022a) is associated with a first register (SECM) for storing a first virtual machine ID (VMID), and is configured to read the first virtual machine ID (VMID) from the first register (SECM) and insert the first virtual machine ID (VMID) into the read or write request (REQ) forwarded from the microprocessor (1020a) to the communication system (114a); wherein the second master interface circuit (MIF1) is associated with a second register (SECM) for storing a second virtual machine ID (VMID[0]), and is configured to read the second virtual machine ID (VMID[0]) from the second register (SECM) and insert the second virtual machine ID (VMID[0]) into the read or write request (REQ) forwarded from the second circuit (M1) to the communication system (114a);The slave interface circuit (SIF2) is associated with a third register (SECS) for storing a third virtual machine ID (VMID_FW[0]) associated with the given first address sub-range (PA3), and is configured to receive a read or write request (REQ) addressed to the given address sub-range (PA3) from the communication system (114a), extract a virtual machine ID from the received request (REQ), read the third virtual machine ID (VMID_FW[0]) from the third register (SECS), determine whether the virtual machine ID extracted from the received request (REQ) corresponds to the third virtual machine ID (VMID_FW[0]), and respond forwarding the read or write request (REQ) to the first circuit (S1) in response to determining that the virtual machine ID extracted from the received request (REQ) corresponds to the third virtual machine ID (VMID_FW[0]), and prohibiting forwarding the read or write request (REQ) to the first circuit (S1) in response to determining that the virtual machine ID extracted from the received request (REQ) does not correspond to the third virtual machine ID (VMID_FW[0]); and wherein the first register (SECM), the second register (SECM), and the third register (SECS) are programmable by software instructions executed by the microprocessor (1020a).

[0263] The third register (SECS) can be configured to store a read virtual machine ID and a write virtual machine ID, and wherein the determining whether the virtual machine ID extracted from the received request (REQ) corresponds to the third virtual machine ID (VMID_FW[0]) may include: determining whether the received request (REQ) is a read request or a write request; in response to determining that the received request (REQ) can be a read request, determining whether the virtual machine ID extracted from the received request (REQ) corresponds to the read virtual machine ID, and in response to determining that the received request (REQ) can be a write request, determining whether the virtual machine ID extracted from the received request (REQ) corresponds to the write virtual machine ID.

[0264] The processing system (10a) may be configured to execute a hypervisor (HYPa) and one or more virtual machines (VMs) on the plurality of processing cores (102a), wherein each virtual machine (VM) may be associated with a corresponding virtual machine ID, and wherein the processing system (10a) may be configured such that the first register (SECM), the second register (SECM), and the third register (SECS) may be programmable via the hypervisor (HYPa) but not programmable via the one or more virtual machines (VMs).

[0265] The hypervisor (HYPa) can be configured to: store the first virtual machine ID value in the first register (SECM) associated with the first main interface circuit (1022a) of the first processing core (102a1), store the second virtual machine ID value in the first register (SECM) associated with the first main interface circuit (1022a) of the second processing core (102a2), store the first virtual machine ID value in the second register (SECM) and the third register (SECS), start the first virtual machine (VM1) on the first processing core (102a1), and start the second virtual machine (VM2) on the second processing core (102a1), whereby the slave interface circuit (SIF2) is configured to forward the read and / or write requests (REQ) received from the first virtual machine (VM1) and the second circuit (M1) to the first circuit (S1); and prohibit forwarding the read and / or write requests (REQ) received from the second virtual machine (VM2).

[0266] When the processing core (102a) is executing the hypervisor (HYPa), the corresponding first host interface circuit (1022a) can be configured to insert a given virtual machine ID (VMID) associated with the hypervisor (HYPa) and / or one or more bits indicating privilege information into the read or write request (REQ) forwarded from the corresponding microprocessor (1020a) to the communication system (114a).

[0267] The microprocessor (1020a) may be associated with a first slave interface circuit (1024a), which is configured to forward a read or write request (REQ) addressed to a given first address sub-range (PA_102) from the communication system (114a) to the first register (SECM); and / or wherein the second circuit (M1) may be associated with a second slave interface circuit (SIF1), which is configured to forward a read or write request (REQ) addressed to a given second address sub-range (PA1) from the communication system (114a) to the second register (SECM).

[0268] The processing system may comprise a further slave interface (SIF1) configured to forward read or write requests (REQ) addressed to a given third address sub-range (PA2) from the communication system (114a) to the third register (SECS); or the slave interface circuit (SIF2) may be configured to forward read or write requests (REQ) addressed to a given further address sub-range from the communication system (114a) to the third register (SECS).

[0269] At least one of the slave interface circuit (SIF2), the further slave interface (SIF1), the first slave interface circuit (1024a), and the second slave interface circuit (SIF1) may be configured to: receive a read or write request (REQ) addressed to a corresponding address sub-range; extract a virtual machine ID and / or privilege information from the received request REQ; and in response to determining that the virtual machine ID extracted from the received request (REQ) corresponds to a determined virtual machine ID and / or that the privilege information may have a given value, forward the read or write request (REQ) to the corresponding register. The determined virtual machine ID may be predetermined.

[0270] The first register (SECM) may be configured to store a first address space ID (ASID), and the first master interface circuit (1022a) may be configured to insert the first address space ID (ASID) into the read or write request (REQ) forwarded from the microprocessor (1020a) to the communication system (114a); wherein optionally, the second register (SECM) may be configured to store a second address space ID (ASID), and the second master interface circuit (MIF1) may be configured to insert the second address space ID (ASID) into the read or write request (REQ) forwarded from the second circuit (M1) to the communication system (114a). ); and wherein the third register (SECS) can be configured to store a third address space ID (ASID), and the slave interface circuit (SIF2) can also be configured to: extract the address space ID from the received request (REQ), read the third address space ID (ASID) from the third register (SECS), determine whether the address space ID extracted from the received request (REQ) corresponds to the third address space ID (ASID), and forward the read or write request (REQ) to the first circuit (S1) only when the address space ID extracted from the received request (REQ) also corresponds to the third address space ID (ASID).

[0271] The processing system may include a third circuit (M2), wherein the second register (SECM) may be configured to store a fourth virtual machine ID (VMID[1]), wherein the second master interface circuit (MIF1) may be configured to forward a read or write request (REQ) from the third circuit (M2) to the communication system (114a), and wherein the second master interface circuit (MIF1) may be configured to read the fourth virtual machine ID (VMID[1]) from the second register (SECM) and insert the fourth virtual machine ID (VMID[1]) into the read or write request (REQ) forwarded from the third circuit (M2) to the communication system (114a).

[0272] The second circuit (M1), the third circuit (M2) and the second main interface circuit (MIF1) can implement a DMA controller (110a), wherein the second circuit (M1) corresponds to a read channel (CH1) for sending a read request, and the third circuit (M2) corresponds to a write channel (CH2) for sending a write request.

[0273] The integrated circuit can be summarized as including a processing system (10a).

[0274] A device such as a vehicle may be summarized as including a plurality of processing systems (10a), wherein the processing systems (10a) are connected via a further communication system (20).

[0275] A method of operating a processing system (10a) may be summarized as including: enabling a hypervisor (HYPa) on at least one of the processing cores (102a).

[0276] The hypervisor (HYPa) can be configured to: store the first virtual machine ID value in the first register (SECM) associated with the first main interface circuit (1022a) of the first processing core (102a1), store the second virtual machine ID value in the first register (SECM) associated with the first main interface circuit (1022a) of the second processing core (102a2), store the first virtual machine ID value in the second register (SECM) and the third register (SECS), start the first virtual machine (VM1) on the first processing core (102a1), and start the second virtual machine (VM2) on the second processing core (102a1).

[0277] In one embodiment, a processing system includes a communication system having a physical address range. A plurality of processing cores are coupled to the communication system. Each processing core includes a microprocessor that, in operation, executes software instructions; and a first host interface circuit associated with the processing core, wherein the first host interface circuit, in operation, forwards a read or write request from the microprocessor to the communication system, the read or write request including a physical address within the physical address range. The processing system includes: a first circuit; a first slave interface circuit associated with the first circuit, wherein the first slave interface circuit selectively forwards read or write requests addressed to an address sub-range of a physical address range from the communication system to the first circuit; a second circuit; a second master interface circuit associated with the second circuit, wherein the second master interface circuit forwards read or write requests from the second circuit to the communication system; a first register associated with the first master interface circuit, wherein the first register stores a first virtual machine ID in operation; a second register associated with the second master interface circuit, wherein the second register stores a second virtual machine ID in operation; and a third register associated with the first slave interface circuit, wherein the third register stores a third virtual machine ID in operation. The first register, the second register, and the third register are programmable by software instructions executed by the microprocessor. In operation, the first master interface circuit reads the first virtual machine ID from the first register and inserts the first virtual machine ID into the read or write request forwarded from the microprocessor to the communication system. The second master interface circuit is operable to read the second virtual machine ID from the second register and insert the second virtual machine ID into the read or write request forwarded from the second circuit to the communication system. The first slave interface circuit is operable to respond to a read or write request received from the communication system and addressed to an address in an address sub-range of a physical address range by: extracting a virtual machine ID from the received request; reading the third virtual machine ID from the third register; determining whether the virtual machine ID extracted from the received request corresponds to the third virtual machine ID; in response to determining that the virtual machine ID extracted from the received request corresponds to the third virtual machine ID, forwarding the read or write request to the first circuit; and in response to determining that the virtual machine ID extracted from the received request does not correspond to the third virtual machine ID, prohibiting forwarding the read or write request to the first circuit.

[0278] In one embodiment, the third register stores a read virtual machine ID and a write virtual machine ID during operation; determining whether the virtual machine ID extracted from the received request corresponds to the third virtual machine ID includes: determining whether the received request is a read request or a write request; in response to determining that the received request is a read request, determining whether the virtual machine ID extracted from the received request corresponds to the read virtual machine ID; and in response to determining that the received request is a write request, determining whether the virtual machine ID extracted from the received request corresponds to the write virtual machine ID. In one embodiment, the plurality of processing cores execute a hypervisor and one or more virtual machines during operation, wherein each virtual machine is associated with a corresponding virtual machine ID; the first register, the second register, and the third register are programmable via the hypervisor; and the first register, the second register, and the third register are not programmable via the one or more virtual machines. In one embodiment, the system includes a plurality of first registers, each first register being associated with a corresponding first master interface circuit, wherein the hypervisor, in operation: stores a first virtual machine ID value in a first register of the plurality of first registers associated with the first master interface circuit of the first processing core; stores a second virtual machine ID value in another first register associated with the first master interface circuit of the second processing core; stores the first virtual machine ID value in the second register and the third register; starts a first virtual machine on the first processing core; and starts a second virtual machine on the second processing core, wherein the first slave interface circuit, in operation: responds to a read or write request received from the first virtual machine or the second circuit via the communication system and addressed to an address in an address sub-range by forwarding the read or write request to the first circuit; and prohibits forwarding a read or write request received from the second virtual machine to the first circuit via the communication system.

[0279] In one embodiment, when a processing core is executing the hypervisor, a corresponding first master interface circuit associated with the processing core is operable to insert a virtual machine ID associated with the hypervisor into the read or write request forwarded from the corresponding microprocessor of the processing core executing the hypervisor to the communication system. In one embodiment, when a processing core is executing the hypervisor, a corresponding first master interface circuit associated with the processing core is operable to insert one or more bits indicating privilege information into the read or write request forwarded from the corresponding microprocessor of the processing core executing the hypervisor to the communication system. In one embodiment, when a processing core is executing the hypervisor, a corresponding first master interface circuit associated with the processing core is operable to insert a virtual machine ID associated with the hypervisor and one or more bits indicating privilege information into the read or write request forwarded from the corresponding microprocessor of the processing core executing the hypervisor to the communication system.

[0280] In one embodiment, the microprocessor is associated with a second slave interface circuit, which is operable to forward read or write requests addressed to a first address sub-range from the communication system to the first register; the second circuit is associated with a third slave interface circuit, which is configured to forward read or write requests addressed to a second address sub-range from the communication system to the second register; or the microprocessor is associated with a second slave interface circuit, which is operable to forward read or write requests addressed to a first address sub-range from the communication system to the first register, and the second circuit is associated with a third slave interface circuit, which is configured to forward read or write requests addressed to a second address sub-range from the communication system to the second register. In one embodiment, the processing system includes a fourth slave interface circuit, which is operable to forward read or write requests addressed to a third address sub-range from the communication system to the third register; or the first slave interface circuit is configured to forward read or write requests addressed to a third address sub-range from the communication system to the third register. In one embodiment, at least one of the first slave interface circuit, the second slave interface circuit, the third slave interface circuit, and the fourth slave interface circuit, in operation: receives a read or write request addressed to a corresponding address sub-range; extracts a virtual machine ID, privilege information, or both the virtual machine ID and privilege information from the received request; and in response to determining that the virtual machine ID extracted from the received request corresponds to the determined virtual machine ID or the privilege information has a determined value, forwards the read or write request to a corresponding register.

[0281] In one embodiment, the first register stores a first address space ID during operation, and the first master interface circuit inserts the first address space ID into the read or write request forwarded from the microprocessor to the communication system during operation; the second register stores a second address space ID during operation, and the second master interface circuit inserts the second address space ID into the read or write request forwarded from the second circuit to the communication system during operation; the third register stores a third address space ID during operation, and the slave interface circuit operates to: extract the address space ID from the received request, read the third address space ID from the third register, determine whether the address space ID extracted from the received request corresponds to the third address space ID, and forward the read or write request to the first circuit in response to determining that the address space ID extracted from the received request corresponds to the third address space ID.

[0282] In one embodiment, the system includes a third circuit, wherein the second register is operable to store a fourth virtual machine ID, wherein the second master interface circuit is operable to forward a read or write request from the third circuit to the communication system, and wherein the second master interface circuit is operable to read the fourth virtual machine ID from the second register and insert the fourth virtual machine ID into the read or write request forwarded from the third circuit to the communication system. In one embodiment, the second circuit, the third circuit, and the second master interface circuit implement a DMA controller, wherein the second circuit corresponds to a read channel for sending read requests, and the third circuit corresponds to a write channel for sending write requests.

[0283] In one embodiment, the system includes an integrated circuit comprising: a communication system; a plurality of processing cores; a first circuit; a first slave interface circuit; a second circuit; a second master interface circuit; a first register; a second register; and a third register.

[0284] In one embodiment, an apparatus comprises: a plurality of processing systems; and a communication bus that, in operation, couples the plurality of processing systems together, each of the plurality of processing systems comprising: a communication system having a physical address range; a plurality of processing cores coupled to the communication system, each processing core comprising: a microprocessor that, in operation, executes software instructions; and a first master interface circuit associated with the processing core, wherein the first master interface circuit, in operation, forwards a read or write request from the microprocessor to the communication system, the read or write request comprising a physical address within the physical address range; a first circuit; and a first slave interface circuit associated with the first circuit. a circuit, wherein a first slave interface circuit is operable to selectively forward read or write requests addressed to an address sub-range of a physical address range from the communication system to the first circuit; a second circuit; a second master interface circuit associated with the second circuit, wherein the second master interface circuit is operable to forward read or write requests from the second circuit to the communication system; a first register associated with the first master interface circuit, wherein the first register is operable to store a first virtual machine ID; a second register associated with the second master interface circuit, wherein the second register is operable to store a second virtual machine ID; and a third register associated with the first slave interface circuit, wherein the third register is operable to store a first virtual machine ID. three virtual machine IDs, wherein the first register, the second register, and the third register are programmable by software instructions executed by the microprocessor; the first master interface circuit, in operation, reads the first virtual machine ID from the first register and inserts the first virtual machine ID into the read or write request forwarded from the microprocessor to the communication system; the second master interface circuit, in operation, reads the second virtual machine ID from the second register and inserts the second virtual machine ID into the read or write request forwarded from the second circuit to the communication system; and the first slave interface circuit, in operation, responds to a read or write request received from the communication system and addressed to an address in an address sub-range of a physical address range by: extracting a virtual machine ID from the received request; reading the third virtual machine ID from the third register; determining whether the virtual machine ID extracted from the received request corresponds to the third virtual machine ID; in response to determining that the virtual machine ID extracted from the received request corresponds to the third virtual machine ID, forwarding the read or write request to the first circuit; and in response to determining that the virtual machine ID extracted from the received request does not correspond to the third virtual machine ID, prohibiting forwarding the read or write request to the first circuit.

[0285] In one embodiment, the device includes a plurality of integrated circuits, each integrated circuit including one or more of the plurality of processing systems, wherein a communication bus is operable to couple the plurality of integrated circuits together. In one embodiment, the device is a vehicle having an engine, and the plurality of processing systems are operable to generate control signals to control the engine.

[0286] In one embodiment, a method includes controlling communications over a communication system having a physical address range and coupling a processing core, a first circuit, and a second circuit. The controlling includes: enabling a hypervisor on a microprocessor of the processing core; under control of the hypervisor, storing a first virtual machine ID value in a first register associated with a first master interface circuit associated with the microprocessor; under control of the hypervisor, storing a second virtual machine ID value in a second register associated with a second master interface circuit associated with the second circuit; under control of the hypervisor executing on the first processing core, storing a third virtual machine ID value in a third register; inserting, by the first master interface circuit, the stored first virtual machine ID into read or write requests forwarded from the first processing core to the communication system; inserting, by the second master interface circuit, the stored second virtual machine ID into read or write requests forwarded from the second circuit to the communication system; and, under control of a slave interface circuit associated with the first circuit, selectively forwarding read or write requests addressed to an address subrange of the physical address range from the communication system to the first circuit. Selectively forwarding includes: extracting a virtual machine ID from a request addressed to the address sub-range; reading a third virtual machine ID from a third register; determining whether the virtual machine ID extracted from the request corresponds to the third virtual machine ID; forwarding the request to the first circuit in response to determining that the virtual machine ID extracted from the request corresponds to the third virtual machine ID; and prohibiting forwarding the request to the first circuit in response to determining that the virtual machine ID extracted from the request does not correspond to the third virtual machine ID.

[0287] In one embodiment, the method includes: starting a first virtual machine on a second processing core coupled to a communication system; and, under control of a hypervisor, storing a fourth virtual machine ID value in a fourth register associated with a first host interface circuit of the second processing core. In one embodiment, the first virtual machine ID and the third virtual machine ID are the same virtual machine ID associated with the hypervisor. In one embodiment, the method includes: storing a read virtual machine ID and a write virtual machine ID in a third register, wherein determining whether the virtual machine ID extracted from a request corresponds to the third virtual machine ID includes: determining whether the received request is a read request or a write request; in response to determining that the received request is a read request, determining whether the virtual machine ID extracted from the received request corresponds to the read virtual machine ID; and in response to determining that the received request is a write request, determining whether the virtual machine ID extracted from the received request corresponds to the write virtual machine ID.

[0288] In one embodiment, the contents of a non-transitory computer-readable medium configure a computing system to control communications over a communication system having a physical address range, the communication system coupling a processing core, a first circuit, and a second circuit. The controlling communications includes: enabling a hypervisor on a microprocessor of the processing core; under control of the hypervisor, storing a first virtual machine ID value in a first register associated with a first master interface circuit associated with the microprocessor; under control of the hypervisor, storing a second virtual machine ID value in a second register associated with a second master interface circuit associated with the second circuit; under control of the hypervisor executing on the first processing core, storing a third virtual machine ID value in a third register; inserting, by the first master interface circuit, the stored first virtual machine ID into a read or write request forwarded from the first processing core to the communication system; inserting, by the second master interface circuit, the stored second virtual machine ID into a read or write request forwarded from the second circuit to the communication system; and, under control of a slave interface circuit associated with the first circuit, selectively forwarding, from the communication system to the first circuit, read or write requests addressed to an address subrange of the physical address range. Selectively forwarding includes: extracting a virtual machine ID from a request addressed to an address sub-range; reading a third virtual machine ID from a third register; determining whether the virtual machine ID extracted from the request corresponds to the third virtual machine ID; forwarding the request to the first circuit in response to determining that the virtual machine ID extracted from the request corresponds to the third virtual machine ID; and prohibiting forwarding the request to the first circuit in response to determining that the virtual machine ID extracted from the request does not correspond to the third virtual machine ID. In one embodiment, the method includes: starting a first virtual machine on a second processing core coupled to a communication system; and storing a fourth virtual machine ID value in a fourth register associated with a first host interface circuit of the second processing core under control of a hypervisor. In one embodiment, the first virtual machine ID and the third virtual machine ID are the same virtual machine ID associated with the hypervisor. In one embodiment, the method includes: storing a read virtual machine ID and a write virtual machine ID in a third register, wherein determining whether the virtual machine ID extracted from the request corresponds to the third virtual machine ID includes: determining whether the received request is a read request or a write request; in response to determining that the received request is a read request, determining whether the virtual machine ID extracted from the received request corresponds to the read virtual machine ID; and in response to determining that the received request is a write request, determining whether the virtual machine ID extracted from the received request corresponds to the write virtual machine ID. In one embodiment, the computing system includes a microprocessor, and the content includes instructions executed by a hypervisor.

[0289] Some embodiments may take the form of or include a computer program product. For example, according to one embodiment, a computer readable medium is provided, comprising a computer program adapted to perform one or more of the methods or functions described above. The medium may be a physical storage medium, such as, for example, a read-only memory (ROM) chip, or a disk, such as a digital versatile disk (DVD-ROM), a compact disk (CD-ROM), a hard disk, a memory, a network, or a portable medium article to be read by an appropriate drive or via an appropriate connection, including as encoded in one or more bar codes or other related codes stored on one or more such computer readable media and readable by an appropriate reader device.

[0290] In addition, in some embodiments, some or all of the methods and / or functionalities may be implemented or provided in other manners, such as at least partially implemented or provided in firmware and / or hardware, which firmware and / or hardware include but are not limited to one or more application-specific integrated circuits (ASICs), digital signal processors, discrete circuits, logic gates, standard integrated circuits, controllers (e.g., by executing appropriate instructions, and including microcontrollers and / or embedded controllers), field programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), etc., as well as devices using RFID technology and various combinations thereof.

[0291] The various embodiments described above can be combined to provide further embodiments. Aspects of the embodiments can be modified, if necessary, to employ concepts of the various patents, applications, and publications to provide further embodiments.

Claims

1. A processing system comprising: A communication system having a physical address range; A plurality of processing cores coupled to the communication system, each processing core comprising: a microprocessor operable to execute software instructions; and a first host interface circuit associated with the processing core, wherein the first host interface circuit is operative to forward a read or write request from the microprocessor to the communication system, the read or write request including a physical address in the physical address range; First Circuit; a first slave interface circuit associated with the first circuit, wherein the first slave interface circuit is operative to selectively forward read or write requests addressed to an address sub-range of the physical address range from the communication system to the first circuit; Second Circuit; a second master interface circuit associated with the second circuit, wherein the second master interface circuit is operable to forward read or write requests from the second circuit to the communication system; a first register, the first register being associated with the first host interface circuit, wherein the first register stores a first virtual machine ID during operation; a second register associated with the second host interface circuit, wherein the second register is operable to store a second virtual machine ID; and a third register associated with the first slave interface circuit, wherein the third register stores a third virtual machine ID in operation, wherein the first register, the second register, and the third register are programmable by software instructions executed by the microprocessor; wherein the first host interface circuit is operable to read the first virtual machine ID from the first register and insert the first virtual machine ID into the read or write request forwarded from the microprocessor to the communication system; wherein the second host interface circuit is operable to read the second virtual machine ID from the second register and insert the second virtual machine ID into the read or write request forwarded from the second circuit to the communication system; and The first slave interface circuit is operable to respond to a read or write request received from the communication system and addressed to an address in the address sub-range of the physical address range by: Extracting a virtual machine ID from the received request; Read the third virtual machine ID from the third register; determining whether the virtual machine ID extracted from the received request corresponds to the third virtual machine ID; In response to determining that the virtual machine ID extracted from the received request corresponds to the third virtual machine ID, forwarding the read or write request to the first circuit; and In response to determining that the virtual machine ID extracted from the received request does not correspond to the third virtual machine ID, forwarding the read or write request to the first circuit is prohibited.

2. The processing system according to claim 1, wherein: The third register stores a read virtual machine ID and a write virtual machine ID during operation; as well as The determining whether the virtual machine ID extracted from the received request corresponds to the third virtual machine ID includes: Determine whether the received request is a read request or a write request; in response to determining that the received request is a read request, determine whether the virtual machine ID extracted from the received request corresponds to the read virtual machine ID; and in response to determining that the received request is a write request, determine whether the virtual machine ID extracted from the received request corresponds to the write virtual machine ID.

3. The processing system according to claim 1, wherein: The plurality of processing cores are operable to execute a hypervisor and one or more virtual machines, wherein each virtual machine is associated with a corresponding virtual machine ID; The first register, the second register, and the third register are programmable via the hypervisor; The first register, the second register, and the third register are not programmable via the one or more virtual machines.

4. The processing system of claim 3 , comprising a plurality of first registers, each first register being associated with a corresponding first host interface circuit, wherein the hypervisor is in operation, storing the first virtual machine ID value in a first register of a plurality of first registers associated with a first host interface circuit of the first processing core; storing the second virtual machine ID value in another first register associated with the first host interface circuit of the second processing core; Storing the first virtual machine ID value in the second register and the third register, Starting a first virtual machine on the first processing core; as well as Starting a second virtual machine on the second processing core, wherein the first slave interface circuit, in operation: responding to a read or write request received from the first virtual machine or the second circuit via the communication system and addressed to an address in the address sub-range by forwarding the read or write request to the first circuit; as well as Forwarding a read or write request received from the second virtual machine to the first circuit via the communication system is prohibited.

5. The processing system according to claim 3, wherein: When a processing core is executing the hypervisor, a corresponding first host interface circuit associated with the processing core is operable to insert a virtual machine ID associated with the hypervisor into the read or write request forwarded to the communication system from the corresponding microprocessor of the processing core executing the hypervisor.

6. The processing system according to claim 3, wherein: When a processing core is executing the hypervisor, a respective first host interface circuit associated with the processing core is operable to insert one or more bits indicating privilege information into the read or write request forwarded to the communication system from the respective microprocessor of the processing core executing the hypervisor.

7. The processing system according to claim 3, wherein: When a processing core is executing the hypervisor, a corresponding first host interface circuit associated with the processing core is operable to insert a virtual machine ID associated with the hypervisor and one or more bits indicating privilege information into the read or write request forwarded to the communication system from the corresponding microprocessor of the processing core executing the hypervisor.

8. The processing system according to claim 1, wherein: The microprocessor is associated with a second slave interface circuit, the second slave interface circuit being operable to forward read or write requests addressed to a first address sub-range from the communication system to the first register; The second circuit is associated with a third slave interface circuit, the third slave interface circuit being configured to forward read or write requests addressed to a second address sub-range from the communication system to the second register; or The microprocessor is associated with a second slave interface circuit, which, in operation, forwards read or write requests addressed to a first address sub-range from the communication system to the first register, and the second circuit is associated with a third slave interface circuit, which is configured to forward read or write requests addressed to a second address sub-range from the communication system to the second register.

9. The processing system of claim 8, wherein: the processing system comprising a fourth slave interface circuit operable to forward read or write requests addressed to a third address sub-range from the communication system to the third register; or The first slave interface circuit is configured to forward read or write requests addressed to the third address sub-range from the communication system to the third register.

10. The processing system of claim 8, wherein at least one of the first slave interface circuit, the second slave interface circuit, the third slave interface circuit, and the fourth slave interface circuit is in operation: receiving a read or write request addressed to a corresponding address sub-range; extracting the virtual machine ID, the privilege information, or both the virtual machine ID and the privilege information from the received request; as well as In response to determining that the virtual machine ID extracted from the received request corresponds to the determined virtual machine ID or the privilege information has a determined value, forwarding the read or write request to a corresponding register.

11. The processing system according to claim 1, wherein the first register is operable to store a first address space ID, and the first host interface circuit is operable to insert the first address space ID into the read or write request forwarded from the microprocessor to the communication system; wherein the second register is operable to store a second address space ID, and the second host interface circuit is operable to insert the second address space ID into the read or write request forwarded from the second circuit to the communication system; and wherein the third register is operable to store a third address space ID, and the slave interface circuit is operable to: Extracting the address space ID from the received request, Read the third address space ID from the third register, determining whether the address space ID extracted from the received request corresponds to the third address space ID, and In response to determining that the address space ID extracted from the received request corresponds to the third address space ID, the read or write request is forwarded to the first circuit.

12. The processing system of claim 1 , comprising a third circuit, wherein the second register is operable to store a fourth virtual machine ID, wherein the second master interface circuit is operable to forward a read or write request from the third circuit to the communication system, and wherein the second master interface circuit is operable to read the fourth virtual machine ID from the second register and insert the fourth virtual machine ID into the read or write request forwarded from the third circuit to the communication system.

13. The processing system of claim 12, wherein the second circuit, the third circuit, and the second host interface circuit implement a DMA controller, wherein the second circuit corresponds to a read channel that sends read requests, and the third circuit corresponds to a write channel that sends write requests.

14. The processing system of claim 1 , comprising an integrated circuit, the integrated circuit comprising: said communication system; the plurality of processing cores; the first circuit; the first slave interface circuit; the second circuit; the second main interface circuit; the first register; the second register; and the third register.

15. A device comprising: multiple processing systems; as well as a communication bus operatively coupling the plurality of processing systems together, wherein each processing system in the plurality of processing systems comprises: A communication system having a physical address range; A plurality of processing cores coupled to the communication system, each processing core comprising: a microprocessor operable to execute software instructions; and a first host interface circuit associated with the processing core, wherein the first host interface circuit is operative to forward a read or write request from the microprocessor to the communication system, the read or write request including a physical address in the physical address range; First Circuit; a first slave interface circuit associated with the first circuit, wherein the first slave interface circuit is operative to selectively forward read or write requests addressed to an address sub-range of the physical address range from the communication system to the first circuit; Second Circuit; a second master interface circuit associated with the second circuit, wherein the second master interface circuit is operable to forward read or write requests from the second circuit to the communication system; a first register, the first register being associated with the first host interface circuit, wherein the first register stores a first virtual machine ID during operation; a second register associated with the second host interface circuit, wherein the second register is operable to store a second virtual machine ID; and a third register associated with the first slave interface circuit, wherein the third register stores a third virtual machine ID in operation, wherein The first register, the second register, and the third register are programmable by software instructions executed by the microprocessor; The first host interface circuit is operable to read the first virtual machine ID from the first register and insert the first virtual machine ID into the read or write request forwarded from the microprocessor to the communication system; The second host interface circuit is operable to read the second virtual machine ID from the second register and insert the second virtual machine ID into the read or write request forwarded from the second circuit to the communication system; and The first slave interface circuit is operable to respond to a read or write request received from the communication system and addressed to an address in an address sub-range of the physical address range by: Extracting a virtual machine ID from the received request; Read the third virtual machine ID from the third register; determining whether the virtual machine ID extracted from the received request corresponds to the third virtual machine ID; In response to determining that the virtual machine ID extracted from the received request corresponds to the third virtual machine ID, forwarding the read or write request to the first circuit; and In response to determining that the virtual machine ID extracted from the received request does not correspond to the third virtual machine ID, forwarding the read or write request to the first circuit is prohibited.

16. The apparatus of claim 15, comprising a plurality of integrated circuits, each integrated circuit comprising one or more of the plurality of processing systems, wherein the communication bus operatively couples the plurality of integrated circuits together.

17. The apparatus of claim 15, wherein the apparatus is a vehicle having an engine, and the plurality of processing systems are operable to generate control signals to control the engine.

18. A method comprising: Controlling communications over a communications system having a physical address range and coupling the processing core, the first circuit, and the second circuit together, the controlling comprising: Starting a hypervisor on the microprocessor of the processing core; Under control of the hypervisor, storing a first virtual machine ID value in a first register associated with a first host interface circuit associated with the microprocessor; Under control of the hypervisor, storing a second virtual machine ID value in a second register associated with a second primary interface circuit associated with the second circuit; Under control of the hypervisor executing on the first processing core, storing a third virtual machine ID value in a third register; inserting, by the first host interface circuit, the stored first virtual machine ID into a read or write request forwarded from the first processing core to the communication system; inserting, by the second host interface circuit, the stored second virtual machine ID into a read or write request forwarded from the second circuit to the communication system; and Under control of a slave interface circuit associated with the first circuit, selectively forwarding read or write requests addressed to an address sub-range of the physical address range from the communication system to the first circuit, the selectively forwarding comprising: extracting a virtual machine ID from said request addressed to said address subrange; Read the third virtual machine ID from the third register; determining whether the virtual machine ID extracted from the request corresponds to the third virtual machine ID; In response to determining that the virtual machine ID extracted from the request corresponds to the third virtual machine ID, forwarding the request to the first circuit; and In response to determining that the virtual machine ID extracted from the request does not correspond to the third virtual machine ID, forwarding the request to the first circuit is prohibited.

19. The method according to claim 18, comprising: launching a first virtual machine on a second processing core coupled to the communication system; as well as Under control of the hypervisor, a fourth virtual machine ID value is stored in a fourth register associated with the first host interface circuit of the second processing core.

20. The method of claim 18, wherein the first virtual machine ID and the third virtual machine ID are the same virtual machine ID associated with the hypervisor.

21. The method according to claim 18, comprising: Storing a read virtual machine ID and a write virtual machine ID in the third register, wherein determining whether the virtual machine ID extracted from the request corresponds to the third virtual machine ID comprises: determining whether the received request is a read request or a write request; In response to determining that the received request is a read request, determining whether the virtual machine ID extracted from the received request corresponds to the read virtual machine ID; and In response to determining that the received request is a write request, it is determined whether the virtual machine ID extracted from the received request corresponds to the write virtual machine ID.

22. A non-transitory computer-readable medium having content that configures a computing system to control communications over a communication system having a physical address range, the communication system coupling a processing core, a first circuit, and a second circuit, the controlling communications comprising: Starting a hypervisor on the microprocessor of the processing core; Under control of the hypervisor, storing a first virtual machine ID value in a first register associated with a first host interface circuit associated with the microprocessor; Under control of the hypervisor, storing a second virtual machine ID value in a second register associated with a second primary interface circuit associated with the second circuit; Under control of the hypervisor executing on the first processing core, storing a third virtual machine ID value in a third register; inserting, by the first host interface circuit, the stored first virtual machine ID into a read or write request forwarded from the first processing core to the communication system; inserting, by the second host interface circuit, the stored second virtual machine ID into a read or write request forwarded from the second circuit to the communication system; as well as Under control of a slave interface circuit associated with the first circuit, selectively forwarding read or write requests addressed to an address sub-range of the physical address range from the communication system to the first circuit, the selectively forwarding comprising: extracting a virtual machine ID from said request addressed to said address subrange; Read the third virtual machine ID from the third register; determining whether the virtual machine ID extracted from the request corresponds to the third virtual machine ID; In response to determining that the virtual machine ID extracted from the request corresponds to the third virtual machine ID, forwarding the request to the first circuit; and In response to determining that the virtual machine ID extracted from the request does not correspond to the third virtual machine ID, forwarding the request to the first circuit is prohibited.

23. The non-transitory computer-readable medium of claim 22, the method comprising: launching a first virtual machine on a second processing core coupled to the communication system; as well as Under control of the hypervisor, a fourth virtual machine ID value is stored in a fourth register associated with the first host interface circuit of the second processing core.

24. The non-transitory computer-readable medium of claim 22, wherein the first virtual machine ID and the third virtual machine ID are the same virtual machine ID associated with the hypervisor.

25. The non-transitory computer-readable medium of claim 22, the method comprising: Storing a read virtual machine ID and a write virtual machine ID in the third register, wherein determining whether the virtual machine ID extracted from the request corresponds to the third virtual machine ID comprises: determining whether the received request is a read request or a write request; In response to determining that the received request is a read request, determining whether the virtual machine ID extracted from the received request corresponds to the read virtual machine ID; and In response to determining that the received request is a write request, it is determined whether the virtual machine ID extracted from the received request corresponds to the write virtual machine ID.

26. The non-transitory computer-readable medium of claim 22, wherein the computing system comprises the microprocessor and the contents comprise instructions executed by the hypervisor.

Images