System and method for controlling access to physical address space

Abstract

The present application provides a system and method for controlling access to a physical address (PA) space, wherein the system comprises: a plurality of processing circuits for executing a plurality of virtual machines, a given region of the PA space is dedicated for addressing the plurality of virtual machines; a plurality of system resources addressed by the PA space; a plurality of memory management units (MMUs) coupled to the corresponding processing circuits, a given MMU is configured to translate a virtual address indicated in an access request to a requested physical address according to a configuration setting of the given MMU; and a plurality of memory protection units (MPUs), a given MPU is configured to allow or reject the access request according to information indicated in a permission filter whether a requesting VM can access the requested physical address. Implementing embodiments of the present application can provide a low complexity access control scheme.

Description

Technical Field

[0001] This invention relates to a computing system for protecting the memory of a computing system, and more particularly to a system and method for controlling access to the physical address space. Background Technology

[0002] A hypervisor enables multiple operating systems to run in parallel on a single physical machine. These operating systems, called "guest operating systems," can include multiple instances of an operating system and different operating systems. Multiple virtual machines (VMs) can run on the hypervisor. Each VM runs a guest operating system to manage resource allocation for the VM. The hypervisor typically uses a Memory Management Unit (MMU) to support address translation and memory protection for the VMs. In a multiprocessor system, each processor core can have its own MMU.

[0003] The Virtual Machine Monitor (MMU) is responsible for translating virtual addresses into physical addresses. The MMU may include one or more Translation Look-aside Buffers (TLBs) to store the mapping between virtual addresses and their corresponding physical addresses. Some MMUs provide a two-stage memory translation mechanism. Each memory access from an application running on the VM undergoes a two-stage translation within the MMU. The guest operating system configures a first-stage translation table that maps virtual addresses to intermediate physical addresses. The virtual machine monitor configures a second-stage translation table that maps intermediate physical addresses to physical addresses. Therefore, the two-stage translation allows the virtual machine monitor to control the guest's view of memory and restrict the physical memory that the guest can access.

[0004] MMU hardware can be complex and expensive. MMU management typically requires highly complex software and negatively impacts memory usage and performance. Furthermore, in shared memory environments where multiple devices can access the same memory location, complexity increases significantly, and security may be compromised. Therefore, there is a need to develop a low-complexity, low-overhead memory protection scheme for virtual machine systems. Summary of the Invention

[0005] This invention provides a system and method for controlling access to the physical address space, which can provide a low-complexity access control scheme.

[0006] In one embodiment, the present invention provides a system for controlling access to a physical address (PA) space, comprising: a plurality of processing circuits executing a plurality of virtual machines, wherein a given region of the physical address space is dedicated to addressing the plurality of virtual machines; a plurality of system resources addressed by the physical address space; a plurality of memory management units (MMUs) coupled to respective processing circuits, wherein a given MMU is configured to translate a virtual address indicated in an access request from a request processing circuit into a requested physical address according to configuration settings of the given MMU; and a plurality of memory protection units (MPUs), wherein a given MPU coupled to a target system resource allocated the requested physical address is configured to allow or deny the access request based on information in a permission filter indicating whether a requesting VM running on the request processing circuit can access the requested physical address.

[0007] In another embodiment, a method for controlling access to a physical address (PA) space, performed by a system including multiple processing circuits and multiple system resources, includes: receiving a request for access to a virtual address from a request processing circuit, wherein the request processing circuit executes a requesting virtual machine, wherein a given region of the physical address space is dedicated to addressing multiple virtual machines executed in the system; translating the virtual address into a requested physical address accessible to the request processing circuit by a given memory management unit (MMU) coupled to the request processing circuit according to the configuration settings of the given MMU; and allowing or denying the request by a given MPU coupled to a target system resource allocated the requested physical address according to information in a permission filter indicating whether the requesting VM running on the request processing circuit can access the requested physical address. Attached Figure Description

[0008] Figure 1 This is a block diagram of a system 100 according to one embodiment.

[0009] Figure 2 This is a diagram illustrating process 200 according to one embodiment.

[0010] Figure 3 This is a diagram illustrating the management of memory protection according to one embodiment.

[0011] Figure 4 This is a diagram illustrating a configuration 450 for a second-level MMU manager 241 and a hardware VM manager 251 according to one embodiment.

[0012] Figure 5 This is a diagram illustrating the address mapping between the VM and PA spaces according to one embodiment.

[0013] Figure 6 This is a diagram illustrating VM memory protection according to one embodiment.

[0014] Figure 7 This is a flowchart illustrating a method 700 for controlling access to a PA space according to one embodiment. Detailed Implementation

[0015] Certain terms are used in the specification and claims to refer to specific components. Those skilled in the art will understand that hardware manufacturers may use different names to refer to the same component. This specification and claims do not distinguish components by differences in name, but rather by differences in function. The terms "comprising" and "including" used throughout the specification and claims are open-ended and should be interpreted as "comprising but not limited to." "Substantially" or "approximately" means that, within an acceptable margin of error, those skilled in the art can solve the technical problem and substantially achieve the technical effect. Furthermore, the terms "coupled" or "coupled" herein include any direct and indirect electrical connection means. Therefore, if a first device is described as coupled to a second device, it means that the first device can be directly electrically connected to the second device, or indirectly electrically connected to the second device through other devices or connection means. The following description is a preferred mode for carrying out the invention and is intended to illustrate the spirit of the invention rather than to limit the scope of protection of the invention. The scope of protection of the invention shall be determined by the appended claims.

[0016] The following description represents the preferred embodiments of the present invention. These descriptions are intended to set forth the general principles of the invention and not to limit it. The scope of protection of the invention should be determined based on the claims.

[0017] Embodiments of this invention provide an access control mechanism that uses a combination of a two-level MMU and a Memory Protection Unit (MPU) to control access to the Physical Address (PA) space. The system uses hardware such as registers to configure a predetermined number of virtual machines (VMs) and a dedicated PA space region for addressing the VMs. These VMs are referred to herein as hardware VMs or simply VMs. Each VM is allocated a specific PA block or segment and can be configured with specific domain permissions. VMs provide a low-complexity alternative to or complement to access control performed by a traditional MMU. VMs also combine the advantages of master-side access control performed by the MMU and target-side access control performed by the MPU.

[0018] In one embodiment, the MMU manager manages the configuration of the Level 2 MMU; for example, configuring host access permissions to physical addresses (i.e., configuring which host has permission to access which physical address). Furthermore, the hardware VM manager manages the configuration of the MPU (more specifically, the corresponding permission filter); for example, configuring VM access permissions to physical addresses (i.e., configuring which VM has permission to access which physical address). In one embodiment, either access control for the Level 2 MMU or the MPU can be enabled or disabled.

[0019] Figure 1 This is a block diagram of a system 100 according to one embodiment. System 100 includes multiple masters, such as 110a, 110b, 110c, etc., which are collectively referred to as hosts. In this document, a host is a hardware component that initiates a request to access target system resources (such as memory, peripheral devices, etc.). Examples of hosts include, but are not limited to, one or more of the following processing circuitry: Central Processing Unit (CPU), Graphics Processing Unit (GPU), Digital Signal Processor (DSP), Multimedia Processor, Artificial Intelligence Processing Unit (APU), Direct Memory Access (DMA) control, and / or other general-purpose and / or special-purpose processing circuitry.

[0020] In one embodiment, the host computer can be part of a System-on-a-Chip (SoC) platform. It is understood that... Figure 1 The embodiments described herein are simplified for illustrative purposes. In a concrete implementation, additional hardware components may be included and may be omitted. Figure 1 Some of the components shown.

[0021] In one embodiment, the host has permission to access target system resources (e.g., memory 120). Memory 120 may be system memory or the main memory of system 100. Memory 120 may include random access memory (RAM) devices, such as dynamic random access memory (DRAM) devices, flash memory devices, and / or other volatile or non-volatile memories. The host may access memory 120 via bus 180 or other forms of interconnect. Access to memory 120 is performed under the control of memory interface controller 125. In one embodiment, the host is used to execute instructions stored in memory 120 to run applications and perform system activities.

[0022] In one embodiment, the host has access to target system resources (e.g., peripheral device 140), which may also be referred to as an input / output (I / O) device, such as a keyboard, speaker, microphone, display, camera, etc. Peripheral device 140 can be accessed via bus 180 or other forms of interconnection under the control of peripheral interface controller 145. Peripheral device 140 may include I / O devices and may be memory-mapped. For example, peripheral interface controller 145 may include or control device controllers mapped to a physical address range within which I / O data rates, formats, etc., are transferred between the host and the device controller.

[0023] In one embodiment, each host uses a memory management unit (MMU) to perform two-level address translation. A portion of the MMU may be referred to as the system SMMU. Therefore, it should be understood that the MMU shown or described herein may include one or more SMMUs.

[0024] The first-level MMU 115 translates the Virtual Address (VA) space into the Intermediate Physical Address (IPA) space, and the second-level MMU 116 translates the IPA space into the Physical Address (PA) space, which is addressable by all system resources (e.g., memory 120 and peripheral devices 140). The mapping from VA to IPA space (i.e., the first-level MMU 115) is controlled by the guest operating system running on VMs (e.g., VMs 130a, 130b, 130c, etc.), and the mapping from IPA to PA space (i.e., the second-level MMU 116) is controlled by the virtual machine monitor 240 or the host operating system used to manage the hardware resources of system 100. The virtual machine monitor 240 may run on the host operating system. Alternatively, the virtual machine monitor 240 may be part of the host operating system. In one embodiment, multiple hosts may share the same MMU; for example, multiple DMA controls may share the same SMMU to perform data transfers between devices in system 100.

[0025] In one embodiment, each Level 2 MMU 116 provides host-side access control according to configurable settings that specify the host's access rights to pages (e.g., 4K-byte blocks) in the PA space, i.e., which host can access which page in the PA space. The configurable settings are managed by the Level 2 MMU manager 241 in the virtual machine monitor 240. In one embodiment, the virtual machine monitor 240 includes a PA validator 242 that verifies the validity of the PA requested in the access request. If the requested PA is validated, the access request is passed to the target-side access control.

[0026] Target-side access control is performed by the MPU, for example Figure 1MPU127 and MPU147 are included in the memory interface control 125. MPU127 is a hardware circuit including local memory for storing access permission information for each VM (regarding the PA space). The access permission information can be stored in a data structure called a permission filter 126. MPU127 can also store mappings (e.g., allocation relationships) between VMs and hosts. Different hosts can be mapped to the same VM (i.e., shared VMs) or different VMs. In one embodiment, permission filter 126 stores indications for one or more address ranges for the corresponding VM and host, where the one or more address ranges contain physical addresses accessible to the VM and the host that allocated the VM. For each address range, permission filter 126 can indicate access permissions, such as read, write, execute, etc. The address range can be a fixed-size address block or a configurable-size address segment. MPU127 grants or denies access requests to physical addresses based on the information stored in the corresponding permission filter 126.

[0027] In one embodiment, the peripheral interface controller 145 includes an MPU 147, which performs similar functions to MPU 127. MPU 147 uses a permission filter 146 to store access permission information for VMs and hosts, with access permissions relating to regions in the PA space allocated to the controller of peripheral device 140. MPUs 127 and 147, along with permission filters 126 and 127, provide target-side protection by restricting the physical memory and memory-mapped resources accessible to the VMs. This hardware-based memory protection mechanism has low complexity and low overhead. MPUs 127 and 147, along with permission filters 126 and 127, can be configured by a hardware VM manager 251 in a virtual machine monitor 240. In one embodiment, the mapping between each VM and its corresponding PA region, block, or segment is stored in a hardware VM setup 252. For example, in Figure 5 In the example, the virtual address assigned to the VM is mapped to the extended PA region 520 (e.g., the virtual address assigned to VM0 is mapped to R0 in the extended PA region 520), and the addresses of the system resources (e.g., memory 120, peripheral device 140, etc.) are located in the physical address space 510. Therefore, the hardware VM setup 252 stores the mapping relationship between the VM and the PA blocks / segments by storing the mapping relationship between the extended PA region 520 and the blocks / segments in the physical address space 510.

[0028] Figure 2 This is a diagram illustrating process 200 according to one embodiment, which includes a multi-level address mapping in response to an access request. Initially, a host identified by a host identifier (Master_ID) sends an access request to its MMU, the access request identifying a requested virtual address (VA). (As in conjunction with...) Figure 1 The first-level MMU 115 translates the VA into an intermediate physical address (IPA) (step 201), and the second-level MMU 116 translates the IPA into a physical address (PA) (for example, translating the IPA into...). Figure 5 (Step 202). PA verifier 242 verifies that the host is allowed to access PA (Step 203). Virtual machine monitor 240 sets up hardware VM settings 252 ( Figure 1 The virtual monitor 240 identifies the VM_ID of the VM assigned the PA and passes the access request identifying the PA, Master_ID, and VM_ID to MPU 127 (step 204). For example, in step 204, the virtual monitor 240 can find the VM corresponding to the physical address translated by the second-level MMU 116 and the corresponding VM_ID from the mapping relationship between VMs and corresponding PA regions, blocks, or segments stored in the hardware VM settings 252. MPU 127 allows or denies the access request based on the information stored in the permission filter 126 (step 205).

[0029] Figure 3 This is a diagram illustrating memory protection management according to one embodiment. In this embodiment, a second-level MMU manager 241 manages and configures address translation regarding PA addresses allowed for access by each host, performed by a second-level MMU 116 and a PA checker 242. In this embodiment, hosts include, but are not limited to, CPUs, GPUs, APUs, and multimedia processors. Each host runs one VM, and different hosts run different VMs. The memory protection provided by the second-level MMU 116 and PA checker 242 can be further enhanced by a hardware VM manager 251, which manages and configures hardware VM settings 252, MPU 127, and permission filter 126. The hardware VM manager 251 also manages any additional MPUs and permission filters in the system; for simplicity, they are... Figure 3 and Figure 4 The example is not shown. The MPU (and its corresponding permission filter) provides hardware-based memory isolation to prevent each host from accessing VMs allocated to other hosts. In one embodiment, both the MMU and MPU are used to provide hardware-based memory isolation to further enhance system security.

[0030] Hardware VM setup 252 stores the mapping between VMs and PA blocks / segments. Hardware VM setup 252 also stores the mapping between hosts and VMs. Therefore, after PA verifier 242 verifies that a requesting host (e.g., CPU) is allowed to access the PA in the access request, MPU 127 performs further verification and permission filter 126 determines whether the VM running on the requesting host (e.g., CPU VM) is allowed to access the PA.

[0031] In one embodiment, the PA block size in each VM (e.g., the PA block size in the extended PA region 520) is larger than the page size used by the Level 2 MMU 116. For example, the PA block size can be configured as 2 megabytes (2MB), 1 gigabyte (1GB), etc. The page size used by the Level 2 MMU 116 can be 4 kilobytes (4KB). Management access control with a small page size (e.g., 4KB) incurs significant overhead and degrades system performance. Therefore, in some embodiments, access control performed by the Level 2 MMU 116 can be disabled to improve system performance. In these embodiments, memory protection can be provided by the MPU and a permission filter.

[0032] Figure 4 This is a diagram illustrating a configuration 450 for a second-level MMU manager 241 and a hardware VM manager 251 according to one embodiment. Figure 4 Add configuration 450 Figure 3 In the diagram. Virtual machine monitor 240 can use configuration 450 to instruct the second-level MMU manager 241 to enable or disable host-side access control performed by the second-level MMU 116. Similarly, virtual machine monitor 240 can use configuration 450 to instruct hardware VM manager 251 to enable or disable target-side access control performed by MPU 127 and license filter 116. Therefore, in terms of access control, there are three alternatives: (1) Disable the second-level MMU 116 and enable MPU 127 and license filter 126. (2) Enable the second-level MMU 116 and disable MPU 127 and license filter 126. (3) Enable the second-level MMU 116, MPU 127, and license filter 126. For example, when the system is running at low performance and the PA block size used by MPU 127 is larger than the 4KB size used by the second-level MMU 116, virtual machine monitor 240 can disable access control performed by the second-level MMU 116 to improve system performance.

[0033] In one embodiment, virtual machine monitor 240 analyzes the requested PA addresses to identify an access pattern. For example, when all requested PA addresses from a host fall within a restricted address range, virtual machine monitor 240 can enable appropriate MPUs and permission filters to restrict access to that address range. This restricted address access can be configured to be used by a single host, shared by multiple hosts at the same time, or used by multiple hosts in a time-division multiplexing manner.

[0034] Refer again Figure 1Host 100 supports multiple VMs 130. Each VM 130 runs a guest operating system used to manage VA space and IPA space allocation for managing applications. Virtual Machine Monitor 240 manages the VMs 130, for example, managing the scheduling of hardware resources for the VMs 130. Virtual Machine Monitor 240 manages the mapping between the IPA space and the extended PA space used for the VMs 130. Figure 5 As shown, the extended PA space 550 is the PA space 510 for addressing system resources (e.g., memory 120, peripheral device 140, etc.) plus the extended PA region 520 allocated to VM 130. The extended PA region 520 is remapped to a contiguous PA address space (located in PA space 510) dedicated to addressing VM 130.

[0035] Figure 5 This is a diagram illustrating the address mapping between the VM and PA spaces according to one embodiment. In the second-level MMU translation, the virtual address allocated to the VM is mapped to an extended PA region 520 (i.e., the physical address in the extended PA region 520 is used as the VM's virtual address). For example, the virtual address allocated to VM0 is mapped to R0 (for the extended PA region 520 allocated to VM0). In the example including four VMs, each VM is allocated one extended PA region, and different VMs are allocated different extended PA regions. All extended PA regions 520 are non-overlapping and have the same size. The extended PA regions 520 are outside the PA space 510; the PA space 510 and the extended PA regions 520 are collectively referred to as the extended PA space 550. It will be understood that the memory protection mechanism described herein is applicable to any number of VMs.

[0036] All extended PA regions 520 are remapped to remapped PA regions 530 in PA space 510. The remapped PA regions 530 are dedicated to addressing VMs. The remapping is implemented in hardware. In one embodiment, different extended PA regions 520 have different offset values ​​relative to the remapped PA regions 530. These offset values ​​are also called base address offsets. For example, the extended PA region (R0) assigned to VM0 has an offset (S0) relative to the remapped PA region; more specifically, the base address of R0 is offset by S0 from the base address of the remapped PA region 530. The extended PA region assigned to VM1 has an offset (S1) relative to the remapped PA region 530, where S1 = S0 + the size of R0. The offsets for the extended PA regions assigned to VM2 and VM3 can be calculated similarly. Taking R0 as an example, remapping R0 to the remapped PA region 530 involves shifting each address in R0 by S0. The remapping of other extended PA regions can be calculated similarly.

[0037] In one embodiment, the extended PA region 520 allocated to the VM may not be immediately adjacent to the PA space 510; or, the extended PA region 520 allocated to the VM may be immediately adjacent to the PA space 510. For example... Figure 5 As shown, in one embodiment, the extended PA regions 520 allocated to different VMs may be contiguous within the extended PA space 550; or, the extended PA regions 520 allocated to different VMs may be non-contiguous within the extended PA space 550. In one embodiment, the base address and / or size of each extended PA region 520 may be configurable.

[0038] Allocating the extended PA region 520 to the VMs allows the system to use different page sizes (or block sizes) for the guest operating system and the host operating system. Assume VMs 0-3 run on multiple instances of the guest operating system within the computing system. The guest operating system can use a first page size for virtual memory management. The host operating system of the computing system can use a second page size (or block size) larger than the first page size for virtual memory management. A larger page size reduces the overhead of host system operations. In other words, a smaller page size may be more suitable for VM operations. Each processor's MMU can perform address translation by using the second page size for host system operations and the first page size for VM operations.

[0039] Figure 6 This diagram illustrates VM memory protection according to one embodiment. In this embodiment, four VMs (VM0-VM3) are allocated extended PA regions (e.g., R0, R1, R2, and R3, respectively). The four extended PA regions have the same size (e.g., K bytes) and do not overlap. The base address offsets of the four VMs are denoted as S0, S1, S2, and S3, respectively. All four extended PA regions are mapped to a remapped PA region.

[0040] Within each extended PA region, the virtual machine monitor or host operating system can allocate one or more address blocks and / or address ranges (located in physical address space 510) to the corresponding VM. The block size can be fixed (e.g., each block is 2MB), while the address ranges can be configurable. Figure 6In this embodiment, VM0 allocates address block D0, VM1 allocates address blocks D11 and D12, VM2 allocates address block D2, and VM3 allocates address segment D3. When R0-R3 are mapped to the remapped PA region, all allocated address blocks or segments do not overlap. In one embodiment, each address segment can be individually switched on (i.e., activated) or switched off (i.e., deactivated) for allocation.

[0041] Also refer to Figure 1 The memory interface controller 125 can receive a request from a requesting VM (e.g., VM0) for access to a requested address in the PA space (i.e., one or more address blocks and / or address segments in the physical address space 510). Based on the request and hardware VM settings 252, the domain ID (also known as the VM ID) of the requesting VM is identified as VM0. The MPU 127 examines the identified VM ID against the permission filter 126 to determine whether the request should be allowed or denied. The permission filter 126 associates VM0 with a list of address blocks and / or address segments that are allowed or denied access by VM0. The permission filter 126 may also associate VM0 with the host running VM0. Figure 5 and Figure 6 The description applies to... Figure 1 Access control of the memory 120 and peripheral devices 140 in the memory.

[0042] Figure 7 This is a flowchart illustrating a method 700 for controlling access to a PA space according to one embodiment. In one embodiment, method 700 may be provided by a system (e.g., Figure 1 The system (100) is executed by a plurality of processing circuits and a plurality of system resources addressable within a PA space (e.g., PA space 510). The processing circuits may include one or more processors and one or more direct memory access (DMA) controllers. The system resources may include one or more system memory devices and one or more peripheral devices.

[0043] Method 700 begins at step 710, in which the system receives a request from a request processing circuit for accessing a virtual address. The request processing circuit executes the requesting VM, where a given region (e.g., 530) within the PA space (e.g., PA space 510) is dedicated to addressing the VM executed in the system. At step 720, a given MMU coupled to the request processing circuit translates the virtual address into a requested PA accessible to the request processing circuit based on configurable settings of that given MMU. At step 730, a given MPU coupled to a target system resource allocated the requested PA grants or denies the request based on information in a permission filter indicating whether the requested PA can be accessed by the requesting VM executing on the request processing circuit.

[0044] In one embodiment, the system includes multiple MMUs and multiple MPUs. Each MMU includes a first-level MMU and a second-level MMU. The second-level MMU performs host-side access control on the corresponding processing circuitry and can be configured to be disabled. Each MPU performs target-side access control on the corresponding system resources and can be configured to be disabled. The second-level MMU performs host-side access control using a page size, while the MPU performs target-side access control using a block size larger than a page size.

[0045] In one embodiment, information in the license filter used by a given MPU associates the requesting VM with an address in a given region of the PA space accessible to the requesting VM. This address may be indicated by one or more address blocks of the same size, one or more address segments of a configurable size, or a combination of one or more address blocks and one or more address segments.

[0046] In one embodiment, the information in the license filter used by a given MPU can be configured to include only addresses that the request processing circuitry is authorized to access. In one embodiment, the system is configured to run multiple VMs, wherein the total number of VMs and a given region in the PA space are pre-configured in the hardware.

[0047] Already referred to Figure 1 An exemplary embodiment is described Figure 7 The flowchart operation. However, it should be understood that Figure 7 The operation of the flowchart can be performed by Figure 1 Other embodiments of the invention besides the one described herein are implemented, and Figure 1 The embodiments may perform operations different from those discussed in the reference flowchart. Although Figure 7 The flowchart illustrates a specific sequence of operations performed by certain embodiments of the present invention, but it should be understood that such sequence is exemplary (e.g., alternative embodiments may perform operations in a different order, combine certain operations, overlap certain operations, etc.).

[0048] Various functional components or blocks have been described herein. As will be understood by one of ordinary skill in the art, functional blocks are preferably implemented by circuits (dedicated or general-purpose circuits that operate under the control of one or more processors and coded instructions), which typically include transistors configured to control the operation of the circuits according to the functions and operations described herein.

[0049] While the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the scope of the invention. Anyone skilled in the art can make modifications and refinements without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention shall be determined by the claims.

Claims

1. A system for controlling access to a physical address space, characterized in that, include: Multiple processing circuits execute multiple virtual machines, wherein a given region of the physical address space is dedicated to addressing the multiple virtual machines; Multiple system resources addressed by this physical address space; Multiple memory management units coupled to corresponding processing circuits, wherein a given memory management unit is configured to translate a virtual address indicated in an access request from a request processing circuit into a requested physical address according to the configuration settings of the given memory management unit. as well as Multiple memory protection units, wherein a given memory protection unit coupled to a target system resource allocated the requested physical address is configured to allow or deny the access request based on information in a permission filter indicating whether the requesting virtual machine running on the request processing circuitry can access the requested physical address; The total number of virtual machines and the given region in the physical address space are pre-configured in the hardware.

2. The system for controlling access to the physical address space as described in claim 1, characterized in that, Each memory management unit includes a first-level memory management unit and a second-level memory management unit. The second-level memory management unit is used to perform host-side access control on the corresponding processing circuitry, and the second-level memory management unit can be selectively disabled.

3. The system for controlling access to the physical address space as described in claim 1, characterized in that, Each memory protection unit is used to perform target-side access control on the corresponding system resources, and each memory protection unit can be selectively disabled.

4. The system for controlling access to the physical address space as described in claim 1, characterized in that, The information in the permission filter used by the given memory protection unit associates the requesting virtual machine with the address of a given region in the physical address space that can be accessed by the requesting virtual machine.

5. The system for controlling access to the physical address space as described in claim 4, characterized in that, The address is indicated by one or more address blocks of the same size, one or more address segments of configurable size, or a combination of one or more address blocks and one or more address segments.

6. The system for controlling access to the physical address space as described in claim 1, characterized in that, The information in the permission filter used by the given memory protection unit is configured to include only the addresses that the request processing circuit is authorized to access.

7. The system for controlling access to the physical address space as described in claim 1, characterized in that, Each memory management unit includes a first-level memory management unit and a second-level memory management unit. The second-level memory management unit is used to perform host-side access control using the page size, and the given memory protection unit performs target-side access control using a block size larger than the page size.

8. The system for controlling access to the physical address space as described in claim 1, characterized in that, The plurality of processing circuits includes one or more processors and one or more direct memory access controllers.

9. The system for controlling access to the physical address space as described in claim 1, characterized in that, These multiple system resources include one or more memories and one or more peripheral devices.

10. A method for controlling access to a physical address space, executed by a system comprising multiple processing circuits and multiple system resources, characterized in that, The method includes: A request to access a virtual address is received from a request processing circuit, wherein the request processing circuit executes the requesting virtual machine, and wherein a given region of the physical address space is dedicated to addressing multiple virtual machines executed in the system; The virtual address is translated into a requested physical address accessible by the request processing circuit by a given memory management unit coupled to the request processing circuit, according to the configuration settings of the given memory management unit; and The given memory protection unit coupled to the target system resource allocated the requested physical address allows or denies the request based on information in the permission filter indicating whether the requesting virtual machine running on the request processing circuitry can access the requested physical address. The total number of virtual machines and the given region in the physical address space are pre-configured in the hardware.

11. The method for controlling access to the physical address space as described in claim 10, characterized in that, Each memory management unit includes a first-level memory management unit and a second-level memory management unit, and the method further includes: Enable or disable host-side access control performed by the Level 2 memory management unit on the request processing circuit.

12. The method for controlling access to the physical address space as described in claim 10, characterized in that, Further includes: Enables or disables target-side access control performed by the given memory protection unit on system resources.

13. The method for controlling access to the physical address space as described in claim 10, characterized in that, The information in the permission filter used by the given memory protection unit associates the requesting virtual machine with the address of a given region in the physical address space that can be accessed by the requesting virtual machine.

14. The method for controlling access to the physical address space as described in claim 13, characterized in that, The address is indicated by one or more address blocks of the same size, one or more address segments of configurable size, or a combination of one or more address blocks and one or more address segments.

15. The method for controlling access to the physical address space as described in claim 10, characterized in that, The information in the permission filter used by the given memory protection unit is configured to include only the addresses that the request processing circuit is authorized to access.

16. The method for controlling access to the physical address space as described in claim 10, characterized in that, Each memory management unit includes a first-level memory management unit and a second-level memory management unit. The second-level memory management unit is used to perform host-side access control using the page size, and the given memory protection unit performs target-side access control using a block size larger than the page size.

17. The method for controlling access to the physical address space as described in claim 10, characterized in that, The plurality of processing circuits includes one or more processors and one or more direct memory access controllers.

18. The method for controlling access to the physical address space as described in claim 10, characterized in that, These multiple system resources include one or more memories and one or more peripheral devices.

Images