Enhanced mechanism for partitioning address space

Abstract

Certain aspects provide a technique for partitioning memory associated with one or more application processors (APs). For example, a first AP can partition memory associated with a second AP to create a plurality of memory regions. The first AP can then assign different memory regions associated with the second AP to different processing domains associated with the second AP or other APs for different tasks.

Description

[0001] Cross-reference to related applications

[0002] This application claims priority to U.S. Patent Application No. 19 / 065,855, filed February 27, 2025, which claims the benefit of all of U.S. Provisional Patent Applications Nos. 63 / 634,300, 63 / 634,305, 63 / 634,318, and 63 / 634,319, filed April 15, 2024, which are expressly incorporated herein by reference in their entirety, as if fully set forth herein and for all applicable purposes. Background Technology Technical Field

[0004] Various aspects of this disclosure relate to techniques for memory management and shared access.

[0005] Related technical descriptions

[0006] It can perform partitioning operations on the processor in a computing system to achieve a secure, isolated, and controlled execution environment. This can be achieved using several mechanisms, primarily for purposes such as security, virtualization, and fault tolerance.

[0007] Partitioning ensures that different processes or applications running on the processor are isolated from each other, which can be critical for security reasons. For example, if one process is compromised (e.g., through a buffer overflow or malware), that process should not be able to access or manipulate the data or underlying hardware of other processes.

[0008] Partitioning can help contain failures to specific domains or processes, preventing them from propagating across the entire system. For example, if a particular process or virtual machine crashes, the rest of the system remains unaffected. This is especially important for systems where runtime and reliability are critical, such as real-time applications.

[0009] Partitioning ensures that processors and other resources are allocated effectively and fairly across different tasks or users. For example, in cloud hosting, the hypervisor allocates processor resources to different virtual machines running on the same physical server, thereby ensuring fair performance and preventing one virtual machine from consuming all the resources.

[0010] Virtualization involves creating multiple virtual machines on a single physical processor, each operating in its own isolated environment. This partitioning is managed by a layer called a hypervisor. The hypervisor sits between the physical hardware and the virtual machines, ensuring that each virtual machine receives its own allocation of processor, memory, and storage devices while isolating them from each other. Virtual machines cannot directly interfere with each other, even if they are running on the same physical machine. This creates an environment of mutual distrust, as each virtual machine believes it has its own dedicated hardware. In a typical virtualization architecture, virtual machines are not isolated from the hypervisor. For some security / privacy use cases, such as confidential computing, it is beneficial to have several virtual machines running on the same processor, isolated from and protected by the hypervisor, thus creating a higher-level security domain known as the "world" in some processor architectures. Virtual machines not isolated from the hypervisor exist in the "normal" world, while isolated virtual machines run in another world.

[0011] Memory protection mechanisms enforce boundaries between different portions of the memory associated with the processor, ensuring that one program cannot access or corrupt the memory of another program or kernel. The Memory Management Unit (MMU) in the processor translates virtual addresses into physical addresses and ensures that programs running in user mode cannot directly access memory allocated to other programs or kernels. One or more memory isolation techniques help partition execution into independent, mutually untrusted domains. Summary of the Invention

[0012] One aspect provides a method executed by a first processor, the method comprising: partitioning memory associated with at least one second processor to create a plurality of memory regions; and assigning one or more of the plurality of memory regions to at least one of: each of one or more processing domains associated with the at least one second processor or each of one or more third processors.

[0013] Other aspects provide: an apparatus capable of operating to, configured to, or otherwise adapted to perform the foregoing methods and those methods described elsewhere herein; a non-transitory computer-readable medium including instructions that, when executed by one or more processors of the apparatus, cause the apparatus to perform the foregoing methods and those methods described elsewhere herein; a computer program product embodied on a computer-readable storage medium including code for performing the foregoing methods and those methods described elsewhere herein; and an apparatus including components for performing the foregoing methods and those methods described elsewhere herein. By way of example, an apparatus may include a processing system, a device having a processing system, or a processing system cooperating via one or more networks.

[0014] The following description and related figures illustrate certain exemplary features of one or more aspects. Attached Figure Description

[0015] The accompanying drawings depict certain features of one or more aspects of this disclosure and are therefore not intended to limit the scope of this disclosure.

[0016] Figure 1 Example computing environments with memory management unit (MMU) and translation backup buffer (TLB) according to various aspects of this disclosure are illustrated.

[0017] Figure 2 Examples of system memory management units (SMMUs) according to various aspects of this disclosure are illustrated.

[0018] Figure 3 Systems for managing the partitioning and allocation of memory regions associated with one or more processors are illustrated according to various aspects of this disclosure.

[0019] Figure 4A and Figure 4B Another system for managing the partitioning and allocation of memory regions associated with one or more processors is illustrated according to various aspects of this disclosure.

[0020] Figure 5 Methods for managing the partitioning and allocation of memory regions associated with one or more processors are illustrated according to various aspects of this disclosure.

[0021] For ease of understanding, the same reference numerals are used where possible to designate common elements shared by all figures. Elements and features conceived in one aspect can be beneficially incorporated into other aspects without further elaboration. Detailed Implementation

[0022] The Memory Management Unit (MMU) is a hardware component in the processor responsible for handling memory accesses and performing address translation from virtual addresses to physical addresses. The MMU plays a crucial role in computing systems by enabling efficient memory use, process isolation, and memory protection. The MMU ensures that a process cannot access memory allocated to another process or the operating system. The MMU facilitates memory sharing between processes while ensuring isolation to prevent interference. The MMU may include a Translation Lookahead (TLB), page tables, and / or access control logic. The TLB is a dedicated cache within the MMU that stores recent address translations. Page tables are data structures maintained by the operating system that map virtual addresses to physical addresses. The MMU queries these tables during address translation. Access control logic verifies the permissions for memory access (e.g., whether a process can read, write, or execute a specific memory region).

[0023] A System Memory Management Unit (SMMU) is a dedicated hardware component used in System-on-Chip (SoC) and computing platforms. The SMMU is designed to manage memory access and translation specifically for devices, such as network adapters and other hardware accelerators that need to access system memory. The SMMU functions similarly to an MMU, but operates on peripheral devices rather than the processor. The SMMU enforces device-level access control, ensuring that devices only read from or write to permitted memory regions. By providing device-level address translation and isolation, the SMMU allows virtual machines to use these devices without direct interference from the hypervisor. The SMMU enables multiple devices or virtual machines to securely share the same physical hardware. The SMMU provides isolation by ensuring that devices only access the memory regions assigned to them.

[0024] While the SMMU ensures that each device or process only accesses its assigned memory region, thus preventing unauthorized memory access or memory corruption, adding the SMMU to the system increases hardware design complexity, which can lead to higher costs and longer development cycles.

[0025] Various aspects of this disclosure relate to techniques for managing partitions of memory or physical address space associated with a processor, and for allocating different partitioned memory regions associated with a processor to different devices using another processor (e.g., at a lower hardware cost). The physical address space is a range of memory addresses that can be directly accessed by the processor.

[0026] For example, a first processor can partition the memory associated with a second processor to create multiple memory regions. The first processor can then allocate these different memory regions associated with the second processor to other processors or devices for different tasks. Memory partitioning refers to dividing the total physical memory into different memory regions, each used for a specific purpose or allocated to a specific component, process, or device. Such partitioning is essential for efficient memory utilization, access control, and system functionality.

[0027] Example System-on-Chip (SPC) SoC )

[0028] A system-on-a-chip (SoC) device may include one or more central or application processors, one or more interconnects (or buses), one or more peripheral devices (or upstream devices), and one or more slave devices. An SoC device may also include a memory management unit (MMU) coupled to the processor and one or more system MMUs (SMMUs) coupled to one or more peripheral devices.

[0029] The Memory Management Unit (MMU) is a component of a System-on-a-Chip (SoC) device that handles memory-related tasks, such as address translation between virtual and physical memory addresses. The MMU works in conjunction with the SoC's operating system to manage memory allocation and protect memory regions from unauthorized access. The MMU translates program-generated virtual memory addresses into physical memory addresses, allowing the processor to access appropriate memory locations. Additionally, the MMU enforces memory protection policies by assigning access permissions to memory regions and ensuring that programs can only access memory regions they are authorized to use. The MMU plays a crucial role in optimizing memory usage, enhancing system security, and enabling efficient program execution.

[0030] The main functions of an MMU include address translation, memory protection, and attribute control. Address translation is the conversion from input address to output address. Translation information is stored in a translation table that the MMU references to perform address translations. The MMU can store completed translations in a translation cache to avoid accessing the translation table the next time an input address to the same memory block is received.

[0031] A Storage Management Unit (SMMU) is a hardware component designed to manage memory in complex computing systems, such as those found in modern smartphones, tablets, and embedded devices. The SMMU provides address translation services for peripheral traffic in almost the same way that the processor's MMU translates addresses for processor memory access. Unlike traditional MMUs integrated into the processor, the SMMU operates independently and is used in systems with multiple processors and various types of memory, including main memory, graphics memory, and peripheral memory. The SMMU provides advanced memory management features, including virtual memory address translation, memory protection, and efficient handling of memory access requests from different processing units. The SMMU plays a crucial role in ensuring efficient memory utilization, enabling hardware acceleration, and enhancing overall system performance in heterogeneous computing environments.

[0032] Figure 1 An example computing environment 100 for Translation Backing Buffer (TLB) compression according to various aspects of this disclosure is illustrated. The computing environment 100 includes a processing system 110, which represents a physical computing device or a virtual computing device running on a physical computing device. The processing system 110 includes one or more processors 120, which may represent a central processing unit (CPU) and / or other processing devices configured to execute instructions to perform various computational operations.

[0033] Processor interconnect 123 couples processor 120 to MMU 130 of processing system 110. MMU 130 performs virtual memory address to physical memory address translation. MMU 130 can be coupled to TLB 140 of processing system 110 via TLB path 134. TLB 140 can include a mapping of virtual memory addresses to compressed physical memory addresses.

[0034] The computing environment 100 also includes a physical memory system 150, which may include data and / or instruction 160 and page tables 170. The physical memory system 150 may be, for example, random access memory (RAM). The MMU 130 may be coupled to the physical memory system 150 via a physical memory interconnect 135.

[0035] Page table 170 maps each virtual address used by processing system 110 to a corresponding physical address associated with physical memory system 150. This physical address may reside in physical memory system 150, a hard disk drive (not shown), or some other storage component. When processing system 110 needs data, processor 120 may transfer the virtual address of the requested data to MMU 130. MMU 130 may cooperate with TLB 140 and / or physical memory system 150 to perform the translation, and then return the corresponding physical address to processor 120.

[0036] To perform the translation, MMU 130 first checks TLB 140 to determine if the virtual address of the requested data matches the virtual address of an entry associated with TLB 140. If a match exists between the requested virtual address and the virtual address in a particular TLB 140 entry, the processing system checks the TLB 140 entry to determine if a valid bit is set. If the entry is valid, the TLB 140 entry includes a valid translation of the virtual address. Accordingly, the corresponding physical address can be returned to MMU 130 very quickly, thus completing the translation. The processing system 110 can then use the translated physical address to retrieve the requested data.

[0037] If MMU 130 determines that the virtual address of the requested data does not match the virtual address of an entry associated with TLB 140 (or if the matching TLB 140 entry is marked as invalid), then MMU 130 traverses page table 170 in physical memory system 150 until a matching virtual address is found.

[0038] Each translation can be performed hierarchically. For example, the MMU 130 can traverse the first page table in page table 170 to search for a match. A matching entry found in the first page table may include the first few bits of the physical address and an indication that additional bits can be found in the second page table of page table 170. The MMU 130 can then store the first few bits and traverse the second page table to search for a match. As noted above, a matching entry may include the next few bits of the physical address, and if a matching entry includes an indication that additional bits can be found in the third page table of page table 170, the process is repeated. This process can be repeated until a matching entry indicates that the last level of translation has been reached. The last level may be, for example, the most recently reached level. Once the last level of translation is completed, the MMU 130 should have a complete translation of the complete physical address.

[0039] If a match exists between the requested virtual address and a specific page table entry, the processing system 110 retrieves the physical address from the page table entry. Once a physical address is found, it is returned to the MMU 130. However, performing translations using page table 170 can be significantly slower than using TLB 140. TLB 140 is smaller and farther from the physical memory system 150. Accordingly, searching TLB 140 is much faster. TLB 140 typically copies a subset of the translations located in page table 170. The copied translations are typically associated with the most important, most frequently used, and / or most recently used virtual addresses.

[0040] Conventionally, each entry in TLB 140 may include a single mapping from a virtual address (VA) corresponding to a virtual memory page to a physical address (PA) corresponding to a physical memory page. However, it is generally advantageous to reduce the amount of storage space in TLB 140 used to store VA-PA mappings, in order to reduce the size of TLB 140 and / or store a greater number of such mappings in TLB 140 without increasing the size of TLB 140. Some techniques may involve compressing VAs and / or PAs in such mappings based on address / page contiguity (including based on bits shared between multiple PAs, e.g., corresponding to multiple contiguous physical memory pages) so that multiple VA-PA mappings are stored in a single entry in TLB 140.

[0041] Figure 2 This is an example 200 of various aspects of the SMMU according to this disclosure. The SMMU executes and processes the MMU in the PE element (e.g., Figure 1 The SMMU (SMMU 130) performs similar tasks. For example, the SMMU can translate the address of a direct memory access (DMA) request from a system input / output (I / O) device before it is passed to the system interconnect. The SMMU can only perform DMA address translation when DMA is active. DMA address translation can be performed for isolation or convenience.

[0042] The SMMU can provide translation services only for transactions originating from the device, but not for transactions destined for the device. For example, traffic (or transactions) in the other direction (i.e., from the system or PE to the device) can be managed by other components (such as the PEMMU).

[0043] In some respects, to associate device traffic with transformations and differentiate between different devices behind the SMMU, DMA requests may have additional attributes to identify the flow, besides address, read / write, and permissions. Different flows can be logically associated with different devices, and the SMMU can perform different transformations or checks for each flow.

[0044] In some respects, several SMMUs may exist within a system. Each SMMU can translate traffic from a device or a set of devices.

[0045] The SMMU can support two translation phases in a manner similar to a PE that supports virtualization extensions. Each translation phase can be enabled independently. In Phase 1, an incoming address is logically translated from a Virtual Address (VA) to an Intermediate Physical Address (IPA), which is then fed into Phase 2, where it is translated back to an Outgoing Physical Address (PA). Phase 1 is intended for use by software entities to provide isolation or translation to buffers within the entity. Phase 2 is intended to be available in systems that support virtualization extensions and is designed to virtualize the device DMA into a guest virtual machine (VM) address space. When both Phase 1 and Phase 2 are enabled, the translation configuration is referred to as nested.

[0046] The SMMU may have three interfaces for software use. For example, the SMMU may include memory-based data structures that can be used to map devices to translation tables for translating device addresses. The SMMU may include memory-based circular buffer queues, such as command queues for issuing commands to the SMMU and event queues for event / fault reports from the SMMU. The SMMU may include a set of registers, some of which are security-only registers, for discovery and global SMMU configuration. Registers indicate the base addresses of structures and queues, provide feature detection and identification registers, and global control registers for enabling queue processing and flow translation.

[0047] In some respects, incoming transactions can have addresses, sizes, and attributes such as read / write, secure / insecure, sharing capabilities, and caching capabilities. If more than one device uses the SMMU, the traffic can also have flow IDs, thus distinguishing the source. The flow ID corresponds to the device that initiated the transaction.

[0048] The SMMU can use a set of data structures in memory to locate transition data. Registers can, for example, store the base address of the initial root structure in the flow table. Flow table entries (STEs) can include stage 2 transition table base pointers and also locate stage 1 configuration structures that contain transition table base pointers. Context descriptors (CDs) represent stage 1 transitions, and STEs represent stage 2 transitions. In some respects, there are three address size models to consider in the SMMU, such as the input address size from the system, the intermediate address size (IAS), and the output address size (OAS). The SMMU input address size is 64 bits. The IAS reflects the maximum available IPA generated by stage 1 and input to stage 2 in a specific implementation. The OAS reflects the maximum available PA output from the last transition stage and must match the system physical address size.

[0049] Example partitioning and allocation of memory associated with the processor

[0050] Various aspects of this disclosure provide apparatus, methods, processing systems, and computer-readable media for managing the partitioning and allocation of memory regions (e.g., address spaces) associated with one or more processors for different tasks.

[0051] One or more mechanisms can be used to partition the operation of a processor (e.g., a central processing unit) into mutually untrusted domains (e.g., processing domains or worlds). A mutually untrusted domain associated with a processor can refer to a separate execution environment or context within the processor (or system) that is isolated from each other due to security, privacy, and / or integrity concerns. The mutually untrusted domains associated with a processor do not trust each other, meaning they operate under the assumption that other domains might attempt to compromise their security or integrity. The operation of a processor can be partitioned into mutually untrusted domains to protect the confidentiality of resources in the different domains associated with the processor.

[0052] Different mechanisms for partitioning processor operations into untrusted domains may include the Confidential Virtual Machine Environment (CoVE) mechanism, the Confidential Computing Architecture (CCA) mechanism, and the Trust Domain Extension (TDX) mechanism.

[0053] CoVE is a virtualized computing environment designed with a focus on the confidentiality and security of data running within virtual machines. CoVE uses a combination of hardware and software technologies to ensure that data, code, and the execution environment are protected from external and internal threats, even from malicious system administrators or hypervisors.

[0054] CCA is a security model and framework designed to protect data during processing. CCA utilizes hardware-based technology to ensure that sensitive data remains confidential even when actively used, such as during computation. This architecture is crucial in environments where minimizing the risk of data exposure, including access by privileged users or compromised components, is essential.

[0055] TDX is a security architecture designed to provide strong isolation and security for workloads running in cloud or virtualized environments. TDX provides an architecture for establishing Trusted Execution Environments (TEEs) or trust domains within a system. These trust domains are isolated from the rest of the system, ensuring that the data within them remains confidential and protected from malware, including hypervisors, host operating systems, and even cloud service providers.

[0056] In systems with multiple processors, processors typically operate on a shared memory model. Shared memory is a portion of the main system's random access memory and is accessible to all processors. Each processor can read from and write to this shared memory.

[0057] In some distributed computing systems, software or hardware creates an abstraction of a shared memory space across physically separate processors. This allows a processor to indirectly lend a portion of its memory space to other processors by making it accessible across the network.

[0058] In some systems, a processor may be able to donate resources under its control (e.g., resources in the physical address space) to an external entity (e.g., another processor), allowing the operations of the external entity to remain confidential to the donating processor (i.e., the processor that donated the resources under its control to the external entity). The physical address space refers to the actual range of addresses accessible from the computer's physical memory. This physical address space represents a view of the hardware's memory locations and is determined by the system's memory architecture and the number of address lines on the processor.

[0059] In some systems, one or more confidential processing domains or worlds under processor control can coexist with more than one confidential processing domain or world controlled by more than one external entity.

[0060] In some systems, a stage 3 checker (e.g., based on page table traversal) can be used to verify the validity of stage 1 and stage 2 memory translations from the Memory Management Unit (MMU) / System Memory Management Unit (SMMU) in different processing domains or worlds associated with the processor (e.g., these domains or worlds may be under the control of an untrusted hypervisor). Stage 1 translations convert virtual addresses used by software (e.g., processes or virtual machines) into intermediate physical addresses. Stage 2 translations convert intermediate physical addresses (from stage 1) into actual physical addresses used by the hardware. In memory system design, particularly during hardware development or simulation, a stage 3 checker can be the final stage in a series of verification steps (e.g., checking the correctness of translations after stage 1 and stage 2 translations in a virtualized system).

[0061] In some systems, a trusted external processor entity (e.g., a system-on-chip (SoC) world controller) can help control the programming of the Phase 3 table (e.g., preventing the processor from corrupting the Phase 3 table). For example, if the trusted external processor entity can be provided with multiple interfaces, it can operate a memory partitioning protocol that allows cooperation between multiple untrusted domains or actors associated with the trusted external processor entity.

[0062] In some systems, mapping all untrusted domains to the world can be memory-intensive, as this could make the required tables unreasonably large. In such cases, it may be desirable to combine a stage 3 checker with slave-side memory protection units that sub-partition the physical memory allocated to some or all domains. In some situations, placing the memory protection units under the control of the SoC world controller allows for enhanced memory management protocols.

[0063] The techniques described herein define a domain-separated trusted off-processor entity that can manage or control a processor. This trusted off-processor entity can act as a relay to manage or control physical address (or memory) partitions provided by an xPU. An xPU can refer to a graphics processing unit (GPU), a general-purpose GPU (GPGPU), a field-programmable gate array (FPGA), an accelerated processing unit (APU), an accelerator, or another processor. The techniques described herein allow for the sub-partitioning of off-processor resources (e.g., memory resources) provided by the processor at a lower cost than instantiating additional SMMU components.

[0064] A memory management protocol can be used to manage one or more hardware devices used to implement the techniques described herein, and this memory management protocol can be enhanced with knowledge of SoC subdomains. One approach is to enhance or extend the memory protocol of the hardware device to make it SoC subdomain aware.

[0065] Processor-managed domains or sub-partitions of the world can be implemented at low hardware cost. Furthermore, these hardware devices can be easily integrated with existing systems. These improvements are particularly advantageous in situations where computing resources are limited and / or memory management performance is critical, such as in mobile devices, machine learning, etc.

[0066] Figure 3 A system 300 for managing the partitioning and allocation of memory regions associated with one or more processors is illustrated. System 300 may include a SoC world controller 301 (e.g., the SoC world controller may be a first processor or associated with the first processor), multiple endpoints (e.g., devices) associated with a second processor 302 (such as a main processor), and a memory protection unit (MPU) 310. The SoC world controller 301 may be associated with the MPU 310. The SoC world controller 301 may be able to issue cache management operations (CMO) 311 to any of the second, third, or subsequent processors. The SoC world controller 301 may be associated with multiple endpoints 306, 307, 308 and multiple hypervisors 304 associated with the second processor 302 or endpoints associated with the third and subsequent processors 303.

[0067] The SoC world controller 301 may also be associated with a transition table 320, a protection checker table 322, a transition table traverser 330, and / or a checker table traverser 331.

[0068] Checker table 322 provides a mechanism for partitioning the address space of system 300 into one or more world-accessible regions. Checker table 322 stores data structures in memory that are used to manage and enforce memory protection at the granular level of memory granules (e.g., fixed-size blocks of memory), thereby allowing fine-grained control over memory access. Checker table traverser 331 is a hardware or software mechanism responsible for traversing the data structures in checker table 322 to resolve access permissions and attributes of memory regions. This checker table traverser is part of the MMU in a system that uses checker table 322 to enforce physical memory access control.

[0069] Translation table traverser 330 can be a component of a memory management system based on an MMU in a modern processor. Translation table traverser 330 traverses translation table 320 to resolve memory addresses and enforce access permissions for virtual memory and virtualization systems. Translation table 320 can be configured by hypervisor 304. As already described with respect to translation table 320, checker table 322 can also be a hierarchical data structure decomposed into two or more levels to improve storage and traversal efficiency.

[0070] The SoC world controller 301 may be associated with and implement a memory partitioning interface (or memory partitioning mechanism) 305. The memory partitioning mechanism 305 of the SoC world controller 301 may perform partitioning on the physical address space or memory associated with the second processor 302 to create mutually untrusted memory regions. These mutually untrusted memory regions on the second processor 302 may be referred to as worlds 306, 307, and 308 (e.g., they may be enforced by MMU / SMMU check tables, such as particle protection tables or memory trace tables for supervisor domain isolation). The MMU / SMMU may support separate translation tables and supervisors for each world.

[0071] The SoC world controller 301 can receive partitioning information from one or more mechanisms to partition the memory associated with the second processor 302 into mutually untrusted memory regions. These mechanisms can partition the memory associated with the second processor 302 based on physical addresses (such as MPU 310). MPU 310 can be a hardware component within the processor designed to enforce access restrictions on different regions of memory. MPU 310 ensures that only authorized processes or programs can access specific regions of memory, thereby enhancing the security, stability, and reliability of embedded and real-time systems.

[0072] The SoC world controller 301 may receive partitioning information from one or more mechanisms to partition the memory associated with the second processor 302 into untrusted memory regions, which may partition the memory associated with the second processor 302 based on both translation and physical address (such as MMU).

[0073] The SoC world controller 301 can allocate partitioned memory regions associated with the second processor 302 to different endpoints 306, 307, 308, or other processors. For example, an endpoint can be assigned one or more memory regions or worlds associated with a third or subsequent processor.

[0074] In some respects, the SoC world controller 301 can perform permanent transfer operations corresponding to partitioned memory regions associated with the second processor 302. For example, the memory partitioning mechanism 305 can transfer ownership of a memory region associated with the second processor 302 from one virtual machine endpoint to another virtual machine endpoint within the same world.

[0075] In one example, memory partitioning mechanism 305 may transfer ownership of one or more memory regions associated with the second processor 302 that are allocated for a first processing domain (e.g., application processor (AP) world 2, virtual machine (VM) 2 (307)) associated with the second processor 302 to a second processing domain (e.g., AP world 1, VM 1 (306)) associated with the second processor.

[0076] In another example, memory partitioning mechanism 305 may transfer ownership of one or more memory regions associated with the second processor 302 that are allocated to the donor endpoint (e.g., AP world 2, VM 3 (307)) to the recipient endpoint (e.g., non-AP world 4 or 5 (303)).

[0077] In some respects, the SoC world controller 301 can perform borrowing operations corresponding to partitioned memory regions associated with the second processor 302. For example, the memory partitioning mechanism 305 can transfer access to a memory region to one or more borrowing endpoints without relinquishing ownership, but explicitly relinquishing access rights.

[0078] In one example, memory partitioning mechanism 305 may transfer access permissions of one or more memory regions associated with the second processor 302 that are allocated to a first processing domain associated with the second processor 302 to a second processing domain associated with the second processor 302.

[0079] In another example, memory partitioning mechanism 305 may transfer access rights to one or more memory regions associated with the second processor 302 that are allocated to the lender endpoint to the borrower endpoint.

[0080] In some respects, the SoC world controller 301 can perform shared operations corresponding to partitioned memory regions associated with the second processor 302 to enable access by more than one endpoint. For example, the memory partitioning mechanism 305 can transfer access rights to a memory region to one or more borrowing endpoints while retaining ownership and access rights.

[0081] In one example, memory partitioning mechanism 305 may temporarily share access permissions for one or more memory regions associated with the second processor 302 with a second processing domain associated with the second processor 302 during a threshold period.

[0082] In another example, memory partitioning mechanism 305 may temporarily share access to one or more memory regions associated with the second processor 302 with the receiving endpoint on a third or subsequent processor during a threshold period.

[0083] In some respects, the SoC world controller 301 can perform reclamation operations corresponding to partitioned memory regions associated with the second processor 302. For example, the owner of a memory region can request one or more borrower endpoints to relinquish their access to the memory region, allowing the owner to reclaim the access.

[0084] In one example, the owner of the memory region may request the second processing domain associated with the second processor 302 to relinquish access to the memory region. The owner of the memory region may receive a notification from the second processing domain associated with the second processor 302 that the second processing domain has relinquished access to the memory region.

[0085] In another example, the owner of the memory region can request the borrower endpoint on a third or subsequent processor to relinquish access to the memory region. The owner of the memory region can receive notification from the borrower endpoint that the borrower endpoint has relinquished access to the memory region.

[0086] Figure 4A and Figure 4B Another system 400 is illustrated for managing the partitioning and allocation of memory regions (or address spaces) associated with one or more processors. System 400 may include a SoC world controller, a second processor, a third processor, a fourth processor, a fifth processor, a first peripheral device, and a stage 3 checker.

[0087] The second processor may include Execution Environment (EE) 1 (High-Level Operating System (HLOS)), EE 2 (VM), EE 3 (TEE), and EE 4 (VM). EE 1 is associated with the World 1 hypervisor. EE 4 is associated with the World 3 hypervisor. The third processor may include EE 5 (World 1) and EE 6 (World 4). EE 5 and EE 6 are associated with the inter-world isolator. The first peripheral device may include P1 (World 2), P2 (World 1), and P3 (World 5). P1, P2, and P3 are associated with the inter-world isolator. The fourth processor may include EE 7 (World 4). EE 7 is associated with the World 4 hypervisor. The fifth processor may include EE 8 (World 5).

[0088] The second processor can perform MMU stage 1 and stage 2 memory translations. The third processor, the fourth processor, and the first peripheral device can perform SMMU stage 2 memory translations. SMMU stage 2 memory translations can be based on MMU stage 2 memory translations.

[0089] The SoC world controller can partition an address space or memory (e.g., the address space or memory may be associated with one or more processors). The SoC world controller can allocate one or more partitioned memory regions (e.g., the one or more partitioned memory regions may be associated with one or more processors) to other devices, such as a second processor, a third processor, a fourth processor, a fifth processor, and / or a first peripheral device. In one example, each of the second processor, third processor, fourth processor, fifth processor, and / or first peripheral device may be allocated one or more different partitioned memory regions. In another example, one or more worlds associated with the second processor, third processor, fourth processor, fifth processor, and / or first peripheral device may be allocated one or more different partitioned memory regions.

[0090] Example Method

[0091] Figure 5 A method 500 for managing the allocation of one or more memory regions associated with one or more processors to one or more other processors is described. Method 500 is performed by a first processor. The first processor may include one or more processing cores. For example, the first processor may be a trusted application processor (AP) external entity, a system-on-a-chip (SoC) world controller, a root of trust, etc.

[0092] Method 500 begins at 510, wherein the memory associated with at least one second processor is partitioned to create multiple memory regions (and unused memory regions are marked). For example, the memory associated with at least one second processor may be divided into multiple memory regions, such as a first memory region, a second memory region, etc. The second processor may be a primary AP or a master AP.

[0093] At 520, the first processor receives a request to assign (e.g., donate, lend, share) one or more memory regions among a plurality of memory regions associated with at least one second processor to one or more processing domains or worlds associated with at least one second processor and / or with each of one or more third processors.

[0094] At 530, the first processor identifies a set of free memory regions associated with at least one second processor that satisfy the requirements of the received request.

[0095] At point 540, for each memory region in the identified set associated with at least one second processor, the first processor assigns the memory region to one or more worlds according to the request. The first processor may set attributes for the assigned memory region according to the request. The first processor may clear the contents of the assigned memory region.

[0096] In some respects, at 550, the first processor receives a request to reclaim certain memory regions assigned to one or more worlds.

[0097] At 560, the first processor identifies the set of memory regions to be reclaimed based on the request.

[0098] At point 570, for each memory region in the set of identified memory regions to be reclaimed, the first processor notifies one or more worlds that the assigned memory region is being reclaimed. One or more worlds may optionally clear the contents of the assigned memory region. The first processor may assign the reclaimed memory region to a free pool. The first processor may set an attribute indicating no ownership on the reclaimed memory region.

[0099] In some respects, multiple memory regions associated with at least one second processor may be assigned to different processing domains associated with at least one second processor. The processing domain associated with at least one second processor may be a mutually untrusted domain or a world of the primary AP.

[0100] In some respects, multiple memory regions associated with at least one second processor may be allocated to different third processors. The third processor may be an endpoint, such as a GPU, a neural processing unit, or a high-guarantee processor.

[0101] In some respects, the first processor, at least one second processor, and one or more third processors may have different performance characteristics.

[0102] In some respects, the first processor, at least one second processor, and one or more third processors may have different security features.

[0103] In some respects, each of one or more processing domains associated with at least one second processor may be associated with supervisory software.

[0104] In some respects, method 500 also includes partitioning the memory associated with at least one second processor based on a memory partitioning mechanism associated with the first processor.

[0105] In some aspects, method 500 also includes transferring ownership of one or more memory regions of a plurality of memory regions to be allocated for a first processing domain associated with at least one second processor to the second processing domain associated with at least one second processor.

[0106] In some aspects, method 500 also includes transferring ownership of one or more memory regions of a plurality of memory regions to be allocated for a first processing domain associated with at least one second processor to a receiving third processor.

[0107] In some respects, method 500 also includes transferring ownership of one or more memory regions of a plurality of memory regions to be allocated for the donor third processor to the recipient third processor.

[0108] In some aspects, method 500 also includes transferring access rights to one or more memory regions of a plurality of memory regions allocated for a first processing domain associated with at least one second processor to a second processing domain associated with at least one second processor.

[0109] In some aspects, method 500 also includes transferring access rights to one or more memory regions of a plurality of memory regions allocated for a first processing domain associated with at least one second processor to a receiving third processor.

[0110] In some aspects, method 500 also includes transferring access rights to one or more memory regions of a plurality of memory regions allocated for the lending third processor to the borrowing third processor.

[0111] In some aspects, method 500 also includes sharing access rights with a second processing domain associated with at least one second processor to allocate access to one or more memory regions among a plurality of memory regions of the first processing domain associated with at least one second processor.

[0112] In some aspects, method 500 also includes sharing access to one or more memory regions among a plurality of memory regions allocated for a first processing domain associated with at least one second processor with the receiving third processor.

[0113] In some respects, method 500 also includes sharing access to one or more memory regions among a plurality of memory regions allocated for the lending third processor with the receiving third processor.

[0114] In some aspects, method 500 also includes requesting a second processing domain associated with at least one second processor to relinquish access to one or more memory regions among a plurality of memory regions.

[0115] In some aspects, method 500 also includes receiving a notification from a second processing domain associated with at least one second processor that the second processing domain has relinquished access to one or more memory regions among a plurality of memory regions.

[0116] In some respects, method 500 also includes requesting the borrowing third processor to relinquish access to one or more memory regions among a plurality of memory regions.

[0117] In some aspects, method 500 also includes receiving notification from the borrowing third processor that the borrowing third processor has relinquished access to one or more memory regions among a plurality of memory regions.

[0118] In some respects, method 500 also includes requesting the receiving third processor to relinquish access to one or more memory regions among a plurality of memory regions.

[0119] In some aspects, method 500 also includes receiving a notification from the receiving third processor that the receiving third processor has relinquished access to one or more memory regions among a plurality of memory regions.

[0120] In some aspects, method 500 also includes receiving partitioning information from one or more devices to partition the memory associated with at least one second processor based on at least one of physical address or translation.

[0121] In some aspects, method 500 further includes receiving partitioning information to partition memory associated with at least one second processor based on two or more memory partitioning mechanisms. A first memory partitioning mechanism among the two or more memory partitioning mechanisms may indicate partitioning of memory based on physical addresses, and a second memory partitioning mechanism among the two or more memory partitioning mechanisms may indicate partitioning of memory based on physical addresses and translations.

[0122] It should be noted that Figure 5 This is merely one example of a method, and other methods conforming to this disclosure, including fewer, additional, or alternative steps, are possible.

[0123] Example Terms

[0124] Specific implementation examples are described in the following numbered clauses: Clause 1: A method executed by a first processor, the method comprising: partitioning memory associated with at least one second processor to create a plurality of memory regions; and assigning one or more of the plurality of memory regions to at least one of: each of one or more processing domains associated with the at least one second processor or each of one or more third processors.

[0125] Clause 2: The method according to Clause 1, wherein the first processor, the at least one second processor and the one or more third processors have at least one of the following: different performance characteristics or different security characteristics.

[0126] Clause 3: The method according to any one of Clauses 1 to 2, wherein each of the one or more processing domains is associated with a supervisory component or function.

[0127] Clause 4: The method according to any one of Clauses 1 to 3, wherein the partitioning includes partitioning the memory based on a memory partitioning mechanism associated with the first processor.

[0128] Clause 5: The method according to Clause 4 further includes receiving partitioning information from one or more devices to partition the memory associated with the at least one second processor based on at least one of physical address or translation.

[0129] Clause 6: The method according to Clause 4 further includes receiving partitioning information to partition the memory associated with the at least one second processor based on two or more memory partitioning mechanisms, wherein a first memory partitioning mechanism of the two or more memory partitioning mechanisms indicates partitioning the memory based on physical addresses, and a second memory partitioning mechanism of the two or more memory partitioning mechanisms indicates partitioning the memory based on the physical addresses and translations.

[0130] Clause 7: The method according to any one of Clauses 1 to 6, wherein the allocation includes transferring ownership of one or more memory regions of the plurality of memory regions to be allocated for a first processing domain associated with the at least one second processor to a second processing domain associated with the at least one second processor.

[0131] Clause 8: The method according to any one of Clauses 1 to 7, wherein the allocation includes transferring ownership of one or more memory regions of the plurality of memory regions to be allocated for a first processing domain associated with the at least one second processor to a processing domain associated with a third processor.

[0132] Clause 9: The method according to any one of Clauses 1 to 8, wherein the allocation includes transferring ownership of one or more memory regions of the plurality of memory regions to be allocated for the donor third processor to the recipient third processor.

[0133] Clause 10: The method according to any one of Clauses 1 to 9, wherein the allocation includes transferring access rights to one or more memory regions of the plurality of memory regions allocated for a first processing domain associated with the at least one second processor to a second processing domain associated with the at least one second processor.

[0134] Clause 11: The method according to Clause 10 further includes: requesting a second processing domain associated with the at least one second processor to relinquish the access rights to one or more memory regions in the plurality of memory regions; and receiving from the second processing domain associated with the at least one second processor a notification that the second processing domain has relinquished the access rights to one or more memory regions in the plurality of memory regions.

[0135] Clause 12: The method according to any one of Clauses 1 to 11, wherein the allocation includes transferring access rights to one or more memory regions of the plurality of memory regions allocated for a first processing domain associated with the at least one second processor to a processing domain associated with a third processor.

[0136] Clause 13: The method according to Clause 12 further includes: requesting the processing domain associated with the third processor to relinquish the access rights to one or more memory regions among the plurality of memory regions; and receiving from the processing domain associated with the third processor a notification that the processing domain associated with the third processor has relinquished the access rights to one or more memory regions among the plurality of memory regions.

[0137] Clause 14: The method according to any one of Clauses 1 to 13, wherein: the allocation includes transferring access rights to one or more memory regions of the plurality of memory regions allocated for the lending third processor to the borrowing third processor; requesting the borrowing third processor to relinquish the access rights to the one or more memory regions of the plurality of memory regions; and receiving from the borrowing third processor a notification that the borrowing third processor has relinquished the access rights to the one or more memory regions of the plurality of memory regions.

[0138] Clause 15: The method according to any one of Clauses 1 to 14, wherein: the allocation includes sharing with a second processing domain associated with the at least one second processor access rights allocated for one or more memory regions in the plurality of memory regions associated with the first processing domain associated with the at least one second processor; requesting the second processing domain associated with the at least one second processor to relinquish the access rights to the one or more memory regions in the plurality of memory regions; and receiving from the second processing domain associated with the at least one second processor a notification that the second processing domain has relinquished the access rights to the one or more memory regions in the plurality of memory regions.

[0139] Clause 16: The method according to any one of Clauses 1 to 15, wherein: the allocation includes sharing with a second processing domain associated with a third processor the allocation of access rights to one or more memory regions in the plurality of memory regions of a first processing domain associated with the at least one second processor; requesting the second processing domain associated with the third processor to relinquish the access rights to the one or more memory regions in the plurality of memory regions; and receiving from the second processing domain associated with the third processor a notification that the second processing domain has relinquished the access rights to the one or more memory regions in the plurality of memory regions.

[0140] Clause 17: The method according to any one of Clauses 1 to 16, wherein the allocation includes sharing access rights with the receiving third processor to one or more of the plurality of memory regions allocated for the lending third processor.

[0141] Clause 18: The method according to Clause 17 further includes: requesting the receiving third processor to relinquish the access rights to one or more of the plurality of memory regions; and receiving from the receiving third processor a notification that the receiving third processor has relinquished the access rights to one or more of the plurality of memory regions.

[0142] Clause 19: An apparatus comprising: at least one memory including instructions; and one or more processors configured individually or in any combination to execute the instructions and cause the apparatus to perform the method according to any one of Clauses 1 to 18.

[0143] Clause 20: An apparatus comprising components for performing the method according to any one of Clauses 1 to 18.

[0144] Clause 21: A non-transitory computer-readable medium comprising executable instructions that, when executed by one or more processors of a device, cause the device to perform a method according to any one of Clauses 1 to 18.

[0145] Clause 22: A computer program product embodied on a computer-readable storage medium, the computer-readable storage medium including code for performing the method according to any one of Clauses 1 to 18.

[0146] Additional Notes

[0147] The foregoing description is provided to enable any person skilled in the art to practice the various aspects described herein. The examples discussed herein do not limit the scope, applicability, or aspects set forth in the claims. Various modifications to these aspects will be apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects. For example, the function and arrangement of the elements discussed may be changed without departing from the scope of this disclosure. Various processes or components may be omitted, substituted, or added as appropriate in various examples. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Furthermore, features described with respect to some examples may be combined in others. For example, any number of aspects set forth herein may be used to implement an apparatus or practice. Moreover, the scope of this disclosure is intended to cover such apparatuses or methods practiced using other structures, functionalities, or structures and functionalities that complement or replace the various aspects of this disclosure set forth herein. It should be understood that any aspect of the disclosure herein may be embodied by one or more elements of the claims.

[0148] As used herein, the term “exemplary” means “serving as an example, instance, or illustration.” Any aspect described as “exemplary” in this document is not necessarily to be construed as preferred or superior to other aspects.

[0149] As used in this article, the phrase “at least one of” in a list of items refers to any combination of these items, including a single member. For example, “at least one of a, b, or c” is intended to cover a, b, c, ab, ac, bc, and abc, as well as any combination with multiple identical elements (e.g., aa, aaa, aab, aac, abb, acc, bb, bbb, bbc, cc, and ccc, or any other ordering of a, b, and c).

[0150] The methods disclosed herein include one or more steps or actions for implementing the methods. The steps and / or actions of the methods may be interchanged without departing from the scope of the claims. In other words, unless a specific order of steps or actions is specified, the order and / or use of a particular step and / or action may be modified without departing from the scope of the claims. Furthermore, the various operations of the methods described above may be performed by any suitable component capable of performing the corresponding function. This component may include various hardware and / or software components and / or modules, including but not limited to circuits, application-specific integrated circuits (ASICs), or processors. Generally, where the operations illustrated in the figures are present, those operations may have corresponding components with similar numbering plus functional components.

[0151] The following claims are not intended to be limited to the aspects shown herein, but should be given the full scope consistent with the language of the claims. Within the claims, unless specifically stated otherwise, reference to the singular form of an element is not intended to mean “one and only one,” but rather “one or more.” Unless specifically stated otherwise, the term “some” refers to one or more. No element of any claim should be interpreted in accordance with 35 USC § 112(f) unless the element is expressly referred to by the phrase “for a component of,” or, in the case of a method claim, by the phrase “for a step of.” All structural and functional equivalents of the elements throughout the various aspects described herein that are known to a person of ordinary skill in the art, or will be known later, are expressly incorporated herein by reference and are intended to be covered by the claims. Moreover, nothing disclosed herein is intended to be offered to the public, whether or not such disclosure is explicitly stated in the claims.

Claims

1. A method performed by a first processor, the method comprising: The memory associated with at least one second processor is partitioned to create multiple memory regions; as well as One or more memory regions of the plurality of memory regions are assigned to at least one of the following: each of one or more processing domains associated with the at least one second processor or each of one or more third processors.

2. The method according to claim 1, wherein the first processor, the at least one second processor, and the one or more third processors have at least one of the following: different performance characteristics or different security characteristics.

3. The method of claim 1, wherein each of the one or more processing domains is associated with a supervisory component or function.

4. The method of claim 1, wherein the partitioning includes partitioning the memory based on a memory partitioning mechanism associated with the first processor.

5. The method of claim 4, further comprising receiving partitioning information from one or more devices to partition the memory associated with the at least one second processor based on at least one of physical address or translation.

6. The method of claim 4, further comprising receiving partitioning information to partition the memory associated with the at least one second processor based on two or more memory partitioning mechanisms, wherein a first memory partitioning mechanism of the two or more memory partitioning mechanisms indicates partitioning the memory based on physical addresses, and a second memory partitioning mechanism of the two or more memory partitioning mechanisms indicates partitioning the memory based on the physical addresses and translations.

7. The method of claim 1, wherein the allocation includes transferring ownership of one or more memory regions of the plurality of memory regions to be allocated for a first processing domain associated with the at least one second processor to a second processing domain associated with the at least one second processor.

8. The method of claim 1, wherein the allocation includes transferring ownership of one or more memory regions in the plurality of memory regions to be allocated for a first processing domain associated with the at least one second processor to a processing domain associated with a third processor.

9. The method of claim 1, wherein the allocation includes transferring ownership of one or more memory regions of the plurality of memory regions to be allocated for the donor third processor to the recipient third processor.

10. The method of claim 1, wherein the allocation includes transferring access rights to one or more memory regions of the plurality of memory regions that would be allocated for a first processing domain associated with the at least one second processor to a second processing domain associated with the at least one second processor.

11. The method according to claim 10, further comprising: The request is made to the second processing domain associated with the at least one second processor to relinquish the access rights to one or more memory regions among the plurality of memory regions; as well as Receive a notification from the second processing domain associated with the at least one second processor that the second processing domain has relinquished access to one or more of the plurality of memory regions.

12. The method of claim 1, wherein the allocation includes transferring access rights to one or more memory regions of the plurality of memory regions allocated for a first processing domain associated with the at least one second processor to a processing domain associated with a third processor.

13. The method according to claim 12, further comprising: The processing domain associated with the third processor is requested to relinquish the access rights to one or more of the plurality of memory regions. as well as Receive a notification from the processing domain associated with the third processor that the processing domain associated with the third processor has relinquished access to one or more of the plurality of memory regions.

14. The method according to claim 1, wherein: The allocation includes transferring access rights to one or more memory regions of the plurality of memory regions that are allocated to the third processor of the borrower to the third processor of the borrower. The borrower's third processor is requested to relinquish its access rights to one or more of the plurality of memory regions. as well as The borrower receives a notification from the borrower third processor that the borrower third processor has relinquished access to one or more of the plurality of memory regions.

15. The method according to claim 1, wherein: The allocation includes sharing access rights with a second processing domain associated with the at least one second processor for one or more memory regions in the plurality of memory regions of the first processing domain associated with the at least one second processor; The request is made to the second processing domain associated with the at least one second processor to relinquish the access rights to one or more memory regions among the plurality of memory regions; as well as Receive a notification from the second processing domain associated with the at least one second processor that the second processing domain has relinquished access to one or more of the plurality of memory regions.

16. The method according to claim 1, wherein: The allocation includes sharing access rights with a second processing domain associated with a third processor for one or more memory regions in the plurality of memory regions of the first processing domain associated with the at least one second processor; The request is made to the second processing domain associated with the third processor to relinquish the access rights to one or more of the plurality of memory regions; as well as The second processing domain associated with the third processor receives a notification that the second processing domain has relinquished access to one or more of the plurality of memory regions.

17. The method of claim 1, wherein the allocation includes access rights to one or more memory regions allocated to the lender third processor among the plurality of memory regions.

18. The method according to claim 17, further comprising: The receiving third processor is requested to relinquish its access rights to one or more of the plurality of memory regions. as well as The receiving third processor receives a notification that it has relinquished access to one or more of the plurality of memory regions.

19. An apparatus comprising: Memory, the memory including instructions; and One or more first processors, wherein the one or more first processors are individually or in any combination configured to execute the instructions and enable the device: The memory associated with at least one second processor is partitioned to create multiple memory regions; as well as One or more memory regions of the plurality of memory regions are assigned to at least one of the following: each of one or more processing domains associated with the at least one second processor or each of one or more third processors.

20. A non-transitory computer-readable medium including instructions that, when executed by one or more first processors, cause the one or more first processors to perform a method, the method comprising: The memory associated with at least one second processor is partitioned to create multiple memory regions; as well as One or more memory regions of the plurality of memory regions are assigned to at least one of the following: each of one or more processing domains associated with the at least one second processor or each of one or more third processors.

Images