Access Control Save-Restore Engine

Abstract

Methods, systems, and apparatus for implementing a save-restore engine in a computing device, one of the apparatuses comprising a power manager configured to control power supplied to multiple power domains on the device, each power domain having a respective client device, each respective client device having a respective access control (AC) component configured to control which other components on the device can communicate with the respective client device, one of the apparatuses further comprising a save-restore engine (SRE) configured to save to a separate local memory configuration data of AC components located in a power domain affected by the power manager initiating a power collapse operation, the SRE configured to restore the configuration data of the AC components from the separate local memory when the power manager restores power to the power domains of the AC components.

Description

[Background technology]

[0001] The present disclosure relates to systems having integrated circuit devices.

[0002] A system-on-chip (SoC) is an integrated circuit that integrates various components of a computing device, including, for example, a central processing unit (CPU), memory, input / output ports, cellular radio, and secondary storage. In contrast to traditional motherboard-based PC architecture, where the motherboard houses and connects removable or replaceable components, an SoC integrates all these components onto a single integrated circuit. SoCs are typically used in mobile computing, edge computing, and embedded systems, such as smartphones, tablet computers, WiFi routers, and Internet of Things (IoT) devices.

[0003] An SoC can include one or more subsystems, and each subsystem can include multiple modules, e.g., client devices. For example, a module can include memory-mapped or I / O-mapped resources. The modules can be isolated from each other and can belong to different security realms, i.e., the system assumes that the devices do not trust each other. Each module can therefore be implemented with a device and configuration information that controls which other modules on the device can communicate with this module.

[0004] When an SoC or module loses its power and then regains power, for example because the device went to sleep, the configuration information about which modules can communicate with which other modules needs to be restored from a saved state in a secure manner. Summary of the Invention

[0005] This specification describes techniques for implementing a secure save-restore engine (SRE) for saving and restoring configuration data of components in a computing device during a power collapse event where the system powers down or turns off the components to conserve power. The SRE can utilize isolated local memory that is powered on during a power collapse event, thereby preventing compromised or untrusted code from modifying the saved configuration data. One use of the SRE is to save and restore configuration data of access control (AC) components or registers that govern which components of a system are allowed to communicate with which other components.

[0006] The subject matter described herein may be implemented in certain embodiments to achieve one or more of the following advantages: A save-restore engine (SRE) described herein may implement a more secure hardware-based state machine to perform save and restore of configuration data for components (e.g., AC components or other registers) within a computing device. The SRE is configured to use an isolated local memory having an always-on or standby power rail during a power collapse event. The local memory isolation protects the configuration data from access by untrusted components on the SoC. Additionally, the local memory isolation protects the local memory from compromised application software.

[0007] The techniques described herein provide several advantages over other mechanisms for saving and restoring configuration data. Compared to software-based and dynamic random access memory (DRAM)-based solutions, the techniques described herein execute much faster and consume much less power. For example, using a DRAM controller and DRAM physical layer for save-restore operations is relatively costly in terms of time and power consumption when waking up after a power collapse event.

[0008] The SRE can implement decentralized data packing and unpacking during the saving and restoring of configuration data of AC components or other registers. Each component to be saved can inform the SRE of the size of the data that needs to be saved in the first transaction of the save operation. Thus, each component to be saved can perform its local packing of data during the save process and its local unpacking during the restore process, which not only helps in efficient use of local memory but also reduces the time required for restore. Compared to software-based solutions or DRAM-based hardware solutions, the SRE-based approach can improve power usage efficiency, improve data protection of AC components or other registers, and eliminate the need for data integrity protection. The SRE can send a dedicated signal to the AC component or other register, which causes the AC component or other register to block any client transactions by the AC component or other register until the SRE completes the save or restore operation.

[0009] The techniques described herein can block access to local resources until the restoration of AC components or other registers is completed. Thus, the techniques described herein can prevent certain types of attacks that can occur with software-based solutions. For example, the techniques described herein can prevent other entities from maliciously obtaining information from protected resources during the period between the release of a reset command and the completion of the restoration of the configuration of the AC components or other registers.

[0010] The details of one or more embodiments of the subject matter of this specification are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the subject matter will become apparent from the description, drawings, and claims. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram of an exemplary computing device. [Diagram 2] FIG. 1 illustrates an example save-restore engine (SRE). [Diagram 3] 1 is a flow chart of an example process for saving configuration data. [Figure 4] 1 is a flow chart of an example process for restoring configuration data. [Diagram 5] FIG. 13 is an example generic save-restore widget. [Figure 6] FIG. 13 is an example save-restore widget of a third party access control component. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Like reference symbols and designations in the various drawings indicate like elements.

[0013] 1 is a diagram of an exemplary computing device 100. Computing device 100 can be a system-on-chip (SoC) device installed in a mobile device, such as a smartphone or tablet device. An SoC is an integrated circuit that includes each component of the system on a single silicon substrate, or on multiple dies interconnected using, for example, silicon interposers, stacked dies, or interconnect bridges.

[0014] Computing device 100 includes one or more subsystems, each of which may include one or more client devices. To improve operational integrity and data security, the system may be designed to isolate client devices from one another and operate such that the devices do not trust one another. To that end, each client device may have a respective access control (AC) component, configured to control which other components on computing device 100 may communicate with the client device or other client devices. Each client device may have other registers that need to be saved and restored during a power collapse.

[0015] An AC component can be implemented as a hardware security component that can manage security of transactions within a subsystem and provide isolation between resources within the subsystem, such as memory-mapped and IO-mapped components. Memory-mapped components are resources that an initiator, such as a CPU, can access by addressing the resource using a specific address in the system memory map. Examples of memory-mapped components include static random access memory (SRAM), dynamic random access memory (DRAM), and configuration registers. IO-mapped components are resources that are not explicitly memory-mapped. IO-mapped components can be accessed by an initiator using a special programming sequence that is customized for each IO-mapped component. Examples of IO-mapped components include first-in-first-out (FIFO) buffers, peripherals, such as Peripheral Component Interconnect Express (PCIE), Serial Peripheral Interface (SPI), etc. Examples of AC components within a computing device include a firewall, a realm allocator (RA), and a system-level memory management unit (SMMU). For example, FIG. 1 illustrates AC component 112, AC component 114, AC component 120, and third-party AC component .

[0016] When a subsystem is power gated, the computing device 100 may include multiple retention registers for retaining data of the AC components. For example, the SoC may include retention registers for control registers in the AC components, and the retention registers may be located on a power rail that is not power gated. However, during a power collapse event, the retention registers will also lose their contents. Thus, when the computing device 100 loses its power, e.g., when a power rail collapses, it may be desirable to preserve the data of the AC components or other registers (e.g., the status and configuration of the AC components) in some area on the computing device 100 that has active power, so that the AC components or other registers can be restored when the computing device 100 restores its power, e.g., when a power rail is powered back up.

[0017] Computing device 100 includes a save-restore engine (SRE) 102. SRE 102 is configured to save configuration data (e.g., status data and configuration data) of AC components (e.g., AC component 112) or other registers located in power domain 150 affected by a power collapse event to isolated local memory 106. SRE 102 is configured to restore the configuration data of the AC components or other registers from isolated local memory 106 when power of power domain 150 is restored.

[0018] A power domain is a collection of gates and devices powered by the same power and ground supplies. For example, AC component 112, AC component 114, and third party AC component 116 are in the same power domain 150. As another example, isolated local memory 106, SRE 102, AC table 104, and power manager 108 are in the same power domain 152, which is always powered on.

[0019] In some implementations, an AC component, such as a firewall, can include additional functionality to support SRE save and restore operations. For example, the AC component can include identification of an SRE save or restore request. Also, upon receiving a save or restore request, the AC component can lock system access to the AC component's configuration data during the save / restore operation.

[0020] In some implementations, the AC component can be configured with a mechanism for compressing configuration data stored in the isolated local memory. The configuration information that needs to be saved and restored can include highly compressible information. For example, to save storage space in the isolated local memory 106, a widget 118 (e.g., a compressed widget) can be expanded to compress the configuration information. As another example, the widget 118 can use an address map table to select important control registers in the AC component 116 that need to be saved. Thus, the amount of configuration data saved can be reduced.

[0021] In some implementations, a component may have multiple unused address locations between address locations that need to be saved or restored. These unused address locations may be avoided by skipping these locations when compressing the payload of a save / restore operation. In some implementations, a component may have multiple addresses that implement small amounts of data (e.g., less than 4 bytes of data) that need to be saved or restored. Thus, for a given transaction of a save / restore operation, data from multiple addresses may be combined into a single payload. In some implementations, an AC component may implement a custom compression or decompression method that is suitable for the AC component. Thus, the SRE 102 may be agnostic to the data structure of the configuration registers of the AC components involved in the save / restore operation. For example, the SRE mechanism may function like a plug operation, such as a plug connected to the system bus 110 and signal 122, a register operation, such as a register that creates an entry in an AC component table, and a regenerate operation.

[0022] Computing device 100 includes a power manager 108 configured to control power provided to multiple power domains on the device. For example, power manager 108 is configured to control power provided to AC component 112 and corresponding client devices of the AC component in power domain 150. Power manager 108 can issue a power collapse operation in power domain 150. Power manager 108 can restore power to power domain 150. In some implementations, during a power collapse event, power manager 108 can disable address remapper 128 in a subsystem of computing device 100. Address remapper 128 can provide different addresses to different components in computing device 100, for example, different addresses to different DRAMs. Disabling address remapper 128 can allow AC components to have static addresses through static mapping in a physical address space.

[0023] The power manager 108 can communicate with the SRE 102 to enable the SRE 102 to perform save and restore operations. For example, the power manager 108 can send a save request (e.g., “saveReq” 130) to the SRE 102 to initiate a save operation. The power manager 108 can send an AC component identification (e.g., “saveSswpid” 132) to the SRE 102 to identify the AC component whose configuration data needs to be saved. When the power manager 108 completes the save operation, it can receive a save response (e.g., “saveRdy” 134) from the SRE 102. The power manager 108 can send a restore request (e.g., “restoreReq” 138) to the SRE 102 to initiate a restore operation. The power manager 108 can send an AC component identification (e.g., “restoreSswpid” 140) to the SRE 102 to identify the AC component whose configuration data needs to be restored. Once the power manager 108 has completed the restore operation, it may receive a restore response (eg, “restoreRdy” 142 ) from the SRE 102 .

[0024] The computing device 100 includes an access control (AC) table 104. The AC table 104 defines one or more AC components within the computing device 100 that need to be preserved and / or restored during a power collapse event. The AC table 104 can be a hard-coded table, and each computing device 100 can have a corresponding AC table. The AC table 104 includes one or more entries corresponding to one or more AC components within the computing device 100, and each entry can be indexed using an identification of the respective AC component, which identifies the AC component within the computing device 100.

[0025] In some implementations, the fields of each entry may include a field indicating whether the associated AC component entry is valid and a field indicating a starting address of the associated AC component. During a save operation, the SRE may read configuration data for the AC component from a memory location starting at the starting address of the AC component. During a restore operation, the SRE may write configuration data to a memory location starting at the starting address of the AC component. In some implementations, a computing device may include multiple subsystems, and each subsystem may include one or more AC components. Each entry in AC table 104 may be indexed by an identification of the subsystem and an identification of the AC component within the subsystem.

[0026] The computing device 100 includes an isolated local memory 106. The isolated local memory 106 is accessible only to the SRE 102, is not memory mapped, and is not accessible to software. For example, the isolated local memory 106 can include a non-memory mapped pseudo dual port SRAM for storage and retention. As another example, the isolated local memory 106 can include a DRAM that can be used to save and restore configuration data of the AC components, and the system can protect the configuration data stored in the DRAM from potential tampering using encryption methods, such as authentication by encryption / decryption, anti-replay protection, etc. Thus, the isolated local memory 106 is protected from untrusted security components and / or transactions. The isolated local memory 106 is within the always-on power domain 152. During a power collapse event, the isolated local memory 106 can have power, and therefore does not lose the configuration data of the AC components stored in the isolated local memory 106. During a power collapse event, the SRE 102 can save the configuration data of each of the one or more AC components to the isolated local memory 106. When power is restored, the SRE 102 can restore the configuration data from the isolated local memory 106 to each of the one or more AC components.

[0027] After successfully saving the AC component's configuration data to isolated local memory 106, SRE 102 can be configured to send signal 122 to the AC component (e.g., AC component 112 and / or AC component 114). For example, signal 122 can indicate that a restore operation is pending for the AC component. This signal can put the AC component into a state where other components or transactions cannot access the AC component's configuration data until it completes the restore operation. In some implementations, signaling can be accomplished without a sideband hardware signal by SRE 102 writing to a special register in AC component 112 or AC component 114.

[0028] In some implementations, the SRE 102 can be configured to send a signal 122 to a widget 118 that is connected to a third-party AC component 116. For example, the signal 122 can indicate that a restore operation is pending for the third-party AC component 116. The signal can place the widget 118 in a state that prevents other components or transactions from accessing the configuration data of the third-party AC component 116 until the restore operation is completed.

[0029] Computing device 100 can include a system bus 110 that connects the components of computing device 100 in power domain 152 and the components of computing device 100 in power domain 150. SRE 102 can communicate with the AC components via system bus 110. Power manager 108 can communicate with the AC components via system bus 110. In some implementations, system bus 110 can communicate with a subsystem power management component 126 or 124, which communicates with the AC components. The subsystem power management component can ensure that the subsystem is unavailable before restoring the access control configuration of the AC components of the subsystem.

[0030] In some implementations, the computing device 100 can include a third-party AC component 116. The computing device can include a widget 118, which can be configured to implement a save restore tracker that tracks when a save or restore operation begins and ends. Because the third-party component may not be configured to interpret save or restore operations from the SRE 102, the widget 118 can help support the save and restore operations by identifying an SRE save or restore request, e.g., receiving a signal 122 from the SRE, and locking system access to the third-party AC component's configuration data during the save or restore operation.

[0031] 2 is a diagram of an example save-restore engine (SRE) 200, which may be an example implementation of SRE 102 of computing device 100 of FIG. 1. SRE 200 may accept save and / or restore requests from a power manager. SRE 200 may perform a save operation, which includes identifying an AC component listed in AC table 202 and saving configuration data from the AC component to isolated local memory 204. SRE 200 may perform a restore operation, which includes identifying an AC component listed in AC table 202 that is saved in isolated local memory 204 and restoring the configuration data of the AC component from isolated local memory 204 to the AC component.

[0032] SRE 200 may implement hardware-based state machines (e.g., save state machine 206 and restore state machine 208) to perform saving and restoring of configuration data for AC components. That is, the SRE does not have a software interface. Thus, the SRE may isolate isolated local memory 204 from system accesses generated from computing device transactions and / or components.

[0033] The SRE 200 may include a local table 210. The local table 210 may include a number of entries, each of which may correspond to an AC component in a computing device or a subsystem of a computing device. Each entry may be indexed by an identification of the AC component or an identification of the subsystem.

[0034] For each AC component, an entry in the local table 210 may include a first field (e.g., a VLD bit) that indicates whether the AC component was successfully saved to the isolated local memory 204. For example, each entry in the local table 210 may include a field (e.g., a 1-bit) that indicates whether the configuration data of the AC component of the subsystem was successfully saved to the isolated local memory. If the save operation completes successfully, the bit may be set to 1. If the save operation does not complete successfully (e.g., if an error occurs), the bit may be set to 0. If the restore operation completes successfully, the bit may be reset to 0. In some implementations, the bit may be set to 0 during a cold reset of the computing device.

[0035] For each AC component, the entry in the local table 210 may include a second field that indicates a starting address of the AC component in the isolated local memory 204 for performing save and restore operations. For example, the field may be 32-bit or 64-bit and may be set when performing a first save operation of the corresponding AC component. This field may be reset to 0 during a cold reset of the computing device.

[0036] In some implementations, an entry in the local table 210 may include a third field (e.g., a set bit) that indicates whether the AC component is mapped to the isolated local memory 204 for save and restore operations. For example, the field may be 1 bit and may be set upon performing a first save operation for the corresponding AC component. This field may be reset to 0 during a cold reset of the computing device.

[0037] In some implementations, SRE 200 can send signal 220 to the AC component during a save or restore operation. For example, local table 210 can send signal 220. Signal 220 can indicate to the AC component, for example to a firewall in the subsystem, that a save or restore operation is pending. In response to receiving signal 220, the AC component can enter a state where only SRE 200 can access the AC component. That is, the AC component can block access through its port by other components or transactions in the computing device.

[0038] The SRE 200 includes a hardware-based state machine to perform saving and restoring of configuration data of the AC components. The SRE 200 can include a save state machine 206 and a restore state machine 208. The save state machine 206 stores and updates status information (e.g., pointer and counter addresses) during a save operation. The save state machine 206 can interact with the power manager via a save interface 212. The save state machine 206 can access information from the local table 210 (e.g., from the respective entries associated with the AC components). For example, the save state machine 206 can obtain the starting address of the AC component in the isolated local memory 204. The save state machine 206 can write information to the local table 210 (e.g., to the respective entries associated with the AC component). For example, after allocating memory space for the AC component in the isolated local memory 204, the save state machine 206 can save the starting address of the AC component in the isolated local memory 204 to the local table 210. As another example, after a save operation is successful, the save state machine 206 can set a save success bit to one.

[0039] The save state machine 206 can save the configuration data of the AC component in the isolated local memory 204. The save state machine 206 can obtain information from the AC table 202. For example, the save state machine can verify whether the AC component is listed in the AC table 202 and can obtain the starting address of the AC component from the AC table 202. The save state machine 206 can interact with the system bus through an interface. For example, the save state machine 206 can interact with the system bus through an Advanced eXtensible Interface (AXI) read channel 216 to read the configuration data of the AC component. The AXI read interface can support a single read with a data width of a predetermined number of bits, such as 32 bits or 64 bits.

[0040] The restore state machine 208 stores and updates status information (e.g., addresses of pointers and counters) during a restore operation. The restore state machine 208 can interact with the power manager via a restore interface 214. The restore state machine 208 can access information from the local table 210 (e.g., from the respective entries associated with the AC components). For example, the restore state machine 208 can obtain the starting address of the AC component in the isolated local memory 204. The restore state machine 208 can write information to the local table 210 (e.g., to the respective entries associated with the AC components). For example, after a restore operation is successful, the save state machine 206 can set a save success bit to 0.

[0041] The restore state machine 208 can restore the configuration data of the AC component from the isolated local memory 204. The restore state machine 208 can obtain information from the AC table 202. For example, the restore state machine can verify whether the AC component is listed in the AC table 202 and can obtain the starting address of the AC component from the AC table 202. The restore state machine 208 can interact with the system bus through an interface. For example, the restore state machine 208 can interact with the system bus through an Advanced eXtensible Interface (AXI) write channel 218 to write the configuration data of the AC component. The AXI write interface can support a single write with a data width of a predetermined number of bits, such as 32 bits or 64 bits.

[0042] 3 is a flow chart of an example process 300 for storing configuration data of an AC component. For convenience, process 300 is described as being performed by a system that includes an SRE in a computing device, such as SRE 102 in computing device 100 of FIG. 1. The system may include the components described with reference to FIG. 1, including one or more AC components, a power manager, a separate local memory, an AC table, or some combination thereof.

[0043] The system may receive a save request and an identification of an AC component from a power manager 302. For example, the power manager may issue a save request (e.g., a saveReq 130 signal) to an SRE and provide the identification (ID) of the AC component or provide it along with the identification of the subsystem to be saved (e.g., a saveSswrpid 132 signal).

[0044] The system may determine whether the identity of the AC component is defined in an AC table (304). Upon receiving the save request, the SRE may verify whether the requested AC component is defined in an AC table that defines the AC component, e.g., by ID. If the system determines that the identity of the AC component is not defined in the AC table, the system may issue an error response (306). For example, if the SRE cannot find the requested AC component in the AC table, the SRE may respond with an error response (e.g., a saveResp136 signal) to the power manager.

[0045] In some implementations, when multiple save requests are received within a period of time or at the same time, the SRE can queue the multiple save requests received from the power manager. The SRE can send a response message (e.g., a saveResp136 signal) to the power manager. The response message can include the ID of the AC component being queued or can include it along with the identification of the subsystem being saved.

[0046] If the system determines that the identity of the AC component is defined in the AC table, the starting address of the AC component can be obtained from the AC table (308). That is, if the requested AC component is in the AC table, the SRE can load the starting address indicated in the AC table. For example, the SRE can include a pointer to access the AC component, and the SRE can set the pointer to the starting address of the AC component.

[0047] In some implementations, the SRE may receive a save request from a power manager to save multiple AC components of a subsystem in a computing device. The SRE may receive an ID of a subsystem wrapper from the power manager. The SRE may use the ID of the subsystem wrapper to obtain a starting address for each AC component represented in the AC table. For example, the SRE may set its read pointer to the starting address of a first AC component (e.g., component 0) of the multiple AC components to access the AC component. After finishing saving the configuration data of the first AC component, the SRE may move the read pointer to the starting address of the next AC component.

[0048] The system may determine whether memory space for an AC component has been allocated in an isolated local memory (310). The SRE may check whether an initial allocation of memory space for the requested AC component has been made in an isolated local memory connected to the SRE. The SRE may check the SRE's local table 210. For example, the SRE may check a one-bit SET field of an entry in the local table 210 to determine whether the initial allocation has been made. The bit may be set when a first save operation of the corresponding AC component is performed.

[0049] If the system determines that the memory space has not been allocated, then the memory space for the AC component may be allocated (312). For example, if no allocation has been made, e.g., the first time the AC component is being saved, the SRE may create an allocation for the AC component using an unmapped address location in local memory. The SRE may then update its local table to save the starting address of the AC component in the separate local memory.

[0050] After allocating the memory space, or if the system determines that the memory space has been allocated, the system may read the AC component's configuration data from the AC component (314). If the allocation has occurred, the SRE may read an address (e.g., a starting address) associated with the AC component from a local table 210 of the SRE. The starting address field of the entry in the local table may be set when a first save operation of the corresponding AC component is performed. For example, the SRE may include a save state machine 206, which includes a read pointer for the AC component and a write pointer for the separate local memory. The SRE may set the read pointer to the starting address of the AC component and may set the write pointer to the starting address of the AC component in the separate local memory.

[0051] In some implementations, the SRE can send an initial read operation to the AC component along with a signal indicating a save operation to the AC component. After receiving the initial read operation, the AC component can determine that it has initiated the save operation and can block any further access to its configuration data from transactions other than the SRE. For example, the AC component can block any further access to the configuration data unless the access is from the SRE.

[0052] In some implementations, after receiving an initial read operation from the SRE, the AC component can provide the size of the configuration data that needs to be saved to the separate location memory. For example, the AC component can provide the SRE with the maximum number of reads that need to be completed during the save operation. The SRE can write the size of the configuration data to a separate local memory, e.g., a first portion (e.g., 1 byte) of the memory allocated to the AC component. After writing the size information, the SRE can increment the value of a pointer so that the pointer can point to the next portion of the allocated memory.

[0053] The system may write the configuration data for the AC component to the separate local memory (316). After setting the read and write pointers (and after the initial reading and writing of the size information), the SRE may successively read portions of the configuration data from the AC component and successively write the portions to the separate memory until the size of the configuration data is reached. For example, the SRE may increment a read pointer for the AC component to read from the AC component. The SRE may increment a write pointer for the separate local memory.

[0054] In some implementations, the SRE may include a read counter that counts the number of reads that the SRE completes during the save operation. If the value of the read counter is less than the size of the configuration data (e.g., the maximum number of reads), the SRE may continue to read the next portion of the configuration data. If the value of the read counter is not less than the size of the configuration data, the system may determine that the save operation completed successfully.

[0055] The system may send a save completion response to the power manager (318). If the SRE successfully completes the save operation of the AC component, the SRE may send a save completion response (e.g., a saveRdy 134 signal) to the power manager. If the SRE receives an error from the AC component, the SRE may report the error back to the power manager (e.g., a saveResp 136 signal) and the SRE may stop the save operation.

[0056] In some implementations, the SRE must save multiple AC components of the subsystem in a separate local memory. When the save operation of the current AC component is complete, the SRE can save the next component in the subsystem's AC table. This process continues until all valid components in the subsystem's AC table are saved. Once all AC components of the subsystem are saved, the SRE can respond to the power manager with a save complete response.

[0057] In some implementations, the power manager can send a sequence of identifications corresponding to multiple AC components that need to be saved. The SRE can process the sequence of identifications in parallel and save the configuration data of the multiple AC components in parallel. Thus, the system can improve the efficiency of the save operation and enhance performance.

[0058] After receiving the save complete response, the power manager can proceed with the power collapse of the subsystem or AC component. In some implementations, after completing the save operation, the SRE can set a field in its local table (e.g., the VLD bit) to 1 to indicate that the AC component was successfully saved to the isolated local memory.

[0059] In some implementations, after successfully completing the save operation, the SRE can send a signal 122 to a subsystem or AC component. For example, the signal (e.g., a signal value equal to 1) can indicate that a restore operation is pending for the AC component. This signal can put the AC component into a state where other components or transactions cannot access the AC component's configuration data until it completes the restore operation. For example, after receiving the signal, the AC component can block any client transactions until it completes the AC component's restore operation, unless the transaction is from an SRE. In some implementations, the signal 122 is not driven to an AC component that covers subsystem power management, so that the power manager can perform a power-on sequence.

[0060] In some implementations, the example process 300 may be used to save configuration data for other types of components or for computing devices that require save / restore, where one or more components are not security-related AC components. In some implementations, the components may be memory-mapped components within an SoC. In some implementations, the components may be IO-mapped components within an SoC. In some implementations, the components may include one or more registers within a computing device. That is, the save-restore engine (SRE) is a general-purpose save / restore engine, and the techniques described herein are not specific to security-related AC components.

[0061] Figure 4 is a flow chart of an example process 400 for restoring configuration data. For convenience, process 400 is described as being performed by a system that includes an SRE in a computing device, such as SRE 102 in computing device 100 of Figure 1. The system may include the components described with reference to Figure 1, including one or more AC components, a power manager, a separate local memory, an AC table, or some combination thereof.

[0062] During a power restore event, the power manager may first restore the power rails before sending a restore request to the SRE and may communicate to a subsystem power management component in the restoring subsystem to release the reset of the AC components. The power system may also communicate to a bus (e.g., system bus 110) that is connected to the AC components. The address remapper 128 may be held in a reset or disabled state so that the AC components may have static addresses in the physical address space. Because signal 122 from the SRE is on, the AC components may block access to the AC components' configuration data from any other transactions or components.

[0063] The system may receive a restore request from a power manager and an identification (ID) of an AC component (402). For example, after completing a power-up sequence of the AC components and buses, the power manager may issue a restore request (e.g., restoreReq 138 signal) to an SRE and may provide an ID (e.g., restoreSswrpid 140 signal) of the AC component to be restored. The power manager may wait until it receives a completion response or an error response from the SRE.

[0064] The system may determine whether the identity is defined in an AC table (404). For example, upon receiving a restore request, the SRE may verify whether the requested AC component or a subsystem of the AC component is defined in an AC table that defines the AC component. If the system determines that the identity is not defined in the AC table, the system may issue an error response (406).

[0065] In some implementations, the system can use a digital fingerprint of the configuration data to protect the configuration data from possible tampering while stored in the isolated local memory. When storing the configuration data of the AC component in the isolated local memory, the system can calculate a digital fingerprint (e.g., a checksum or cryptographic hash) of the configuration data. The digital fingerprint can be calculated and stored during a save operation. When the system performs a restore operation, it can calculate a digital fingerprint of the configuration data restored from the isolated local memory. The system can compare the digital fingerprint of the restored configuration data and the digital fingerprint calculated during the save operation. If the two digital fingerprints do not match, the system can generate a system error and abort the restore operation. If the two digital fingerprints match, the system can determine that the configuration data of the AC component has not been tampered with while stored in the isolated local memory.

[0066] If the system determines that the identification is defined in the AC table, it may determine whether the AC component has been previously stored in the isolated local memory (408). For example, the SRE may determine whether the AC component has been previously stored by checking the VLD bit of the AC component's corresponding entry in the SRE's local table. If the system determines that the AC component has not been previously stored in the isolated local memory, the system may issue an error response (406). For example, if the VLD bit indicates that the AC component has not been previously stored in the isolated local memory, the SRE may send an error response to the power manager.

[0067] If the system determines that the AC component was previously stored in the separate local memory, the system may obtain the starting address of the AC component from the AC table (410). For example, if the VLD bit indicates that the AC component was previously stored in the separate local memory, the SRE may read the starting address of the AC component indicated in the AC table. In some implementations, the SRE receives a restore request to restore multiple AC components in a subsystem and an ID of the subsystem. The SRE may read the starting address of the subsystem indicated in the AC table. The SRE may include a write pointer, and the SRE may set the write pointer to the first AC component (e.g., component 0) with the starting address of the subsystem. After the SRE finishes writing the first AC component, the SRE may move the write pointer to point to the next AC component in the subsystem.

[0068] The system may obtain 412 a starting address of the configuration data for the AC component stored in the separate local memory. For example, the SRE may load the starting address of the configuration data stored in the separate local memory from its local table. The SRE may include a read pointer for accessing the separate local memory for restore, and the SRE may set the read pointer to the starting address. In some implementations, the SRE may include a restore state machine 208, and the restore state machine 208 may store the read pointer and the write pointer.

[0069] The system may read the configuration data for the AC component from the isolated local memory (414). For example, the system may read the configuration data for the AC component using a read pointer that points to the configuration data stored in the isolated local memory. The system may write the configuration data for the AC component (416). In some implementations, after setting the write pointer to the AC component and setting the read pointer to a starting address of the configuration data in the isolated local memory, the SRE may issue an initial read to obtain size information for the configuration data for the AC component stored in the isolated local memory. For example, the SRE may obtain a maximum number of writes that the SRE must complete during a restore operation. The system may successively read portions of the configuration data from the isolated local memory and successively write the portions to the AC component until the size of the configuration data is reached. For example, the SRE may read the configuration data from the isolated local memory and write the configuration data to the AC component along with a signal indicating that this communication is from the SRE. This process may be repeated across all portions of the AC component as indicated by the AC component's size information.

[0070] In some implementations, after writing a first portion of the configuration data to the AC component, a signal can place the AC component in a state in which only the SRE can access the AC component. For example, after the first write, the AC component can identify that a restore operation has begun, and the AC component can block any attempts to access its configuration data from other components or transactions. Upon completing the restore of the AC component, the AC component can unlock access to its configuration data from other components or transactions.

[0071] In some implementations, if during restore, a write operation to an AC component results in an error response, the restore operation can be considered to have failed. The SRE can issue an error response (e.g., a restoreResp 144 signal) to the power manager. In some implementations, in this scenario, the power manager can decide to perform a cold reboot of the computing device.

[0072] In some implementations, if multiple restore requests are received within a period of time or at the same time, the SRE can queue the multiple restore requests received from the power manager. The SRE can send a response message (e.g., a restoreResp 144 signal) to the power manager. The response message can include the ID of the AC component being queued or can include it along with the identification of the subsystem being preserved.

[0073] In some implementations, the SRE may include a write counter that counts the number of writes that the SRE completes during the restore operation. If the value of the write counter is less than the size of the configuration data stored in the separate location memory (e.g., the maximum number of writes), the SRE may continue to write the next portion of the configuration data to the AC component. If the value of the write counter is not less than the size of the configuration data stored in the separate local memory, the system may determine that the restore operation completes successfully.

[0074] The system may send a restore completion response (e.g., a restoreRdy142 signal) to the power manager (418). In some implementations, the SRE may need to restore multiple AC components in a subsystem. The SRE may sequentially restore the configuration data for each AC component identified in the AC table of the subsystem. After all AC components of the subsystem are successfully restored, the system may send a restore completion response to the power manager.

[0075] In some implementations, the power manager can send a sequence of identifications corresponding to multiple AC components that need to be restored. The SRE can process the sequence of identifications in parallel and restore the configuration data of the multiple AC components in parallel. Thus, the system can improve the efficiency of the restore operation and enhance its performance.

[0076] In some implementations, after the restore completes successfully, the SRE may invalidate a field (e.g., the VLD bit) in its local table to indicate that the AC component will no longer be stored in the isolated local memory. For example, the SRE may set the VLD bit of the corresponding entry in the local table to 0.

[0077] In some implementations, the SRE can send a restored signal 122 to a subsystem or AC component. For example, the signal can indicate completion of the restore operation of the AC component. This signal can cause the AC component to authorize access from other components or transactions. For example, after setting the signal to 0, the AC component (e.g., a firewall) can be in a state where transactions are allowed through the firewall with appropriate authorization checks based on the firewall's restored configuration data. In some implementations, upon successful completion of the restore operation by the SRE, the power manager can release the remainder of the subsystem from a reset status of functional operation, thereby completing the power restore of the subsystem.

[0078] In some implementations, the example process 400 can be used to restore configuration data of other types of components or computing devices requiring save / restore, where one or more components are not security-related AC components. In some implementations, the components can be memory-mapped components within an SoC. In some implementations, the components can be IO-mapped components within an SoC. In some implementations, the components can include one or more registers within a computing device. That is, the save-restore engine (SRE) is a general-purpose save / restore engine, and the techniques described herein are not specific to security-related AC components.

[0079] 5 is a diagram of an example generic save-restore widget 500. In some implementations, a computing device may include a generic module or client device having a respective generic AC component (e.g., SMMU). Because it may be difficult or impossible to adapt the AC component to support SRE save and restore operations, a widget, such as generic save-restore widget 500, may be included on the computing device 100 to help support SRE save and restore operations.

[0080] The widget can include a save restore tracker 502 that tracks when a save or restore operation begins and ends. The save restore tracker 502 can identify a save or restore request from an SRE. For example, the save restore tracker 502 can identify the start of a save or restore operation when an SRE accesses a first location of an AC component.

[0081] The restore tracker 502 can put the generic AC component into a state where only the SRE and the widget 500 can access the generic AC component. For example, the restore tracker 502 can disable system access to the AC component's configuration data during a save / restore operation from other components or transactions. Thus, the tracker 502 can prevent the system from changing the state of the generic AC component during the operation.

[0082] After the save operation completes successfully, tracker 502 can enable the AC component to a state in which the configuration data of the AC component cannot be accessed by other components or transactions until the AC component is successfully restored. For example, the SRE can send a signal 504, such as signal 122 in FIG. 1, to save restore tracker 502 to identify completion of the restore operation of the AC component or a subsystem of the AC component.

[0083] The widget 500 can be configured to send size information of the configuration data of the generic AC component to the SRE. For example, the widget can calculate size information for a save operation and send the size information to the SRE during a first read of the save operation.

[0084] 6 is a diagram of an example save-restore widget 600 for a third-party access control (AC) component. For example, the save-restore widget 600 can be the widget 118 of the third-party AC component 116 of FIG.

[0085] The computing device may include a third-party AC component. For example, the third-party component may be a third-party IP vendor (e.g., SMMU) that includes a transaction control unit (TCU) and a transaction buffer unit (TBU). The computing device may include a widget 600 that may be configured to implement a save restore tracker 602 that tracks when a save or restore operation begins and ends. For example, the save restore tracker 602 may identify a save or restore request from an SRE. The start of a save / restore operation may be identified by a signal indicating that an access is from an SRE when an access is made to a first location of the TCU / TBU component.

[0086] In some implementations, the widget 600 can be configured to send a signal to the third-party AC component, which can place the third-party component in a state where only the SRE and the widget 600 can access the third-party AC component until the SRE completes saving or restoring the third-party AC component. For example, after identifying a save or restore request, the tracker can lock system access to the SMMU's configuration data during the save / restore operation. The tracker 602 can disable any access originating from a non-SRE initiator when the save or restore operation is initiated. Thus, the tracker 602 can prevent the system from modifying the third-party component's configuration data (e.g., including state data) during the save / restore operation.

[0087] After the save operation completes successfully, tracker 602 can enable the AC component to a state in which the configuration data of the AC component cannot be accessed by other components or transactions until the AC component is successfully restored. For example, the SRE can send a signal 604, such as signal 122 in FIG. 1, to save restore tracker 602 to identify completion of the restore operation of the AC component or a subsystem of the AC component.

[0088] The widget 600 can be configured to send size information of the configuration data of the third-party AC component to the SRE. For example, the widget can calculate size information for a save operation and send the size information to the SRE during a first read of the save operation.

[0089] In some implementations, the widget 600 can include an address map table for each module in the third-party AC component. For example, the widget 600 can include an address map table for the TCU (e.g., address map table 606) and an address map table for each TBU (e.g., address map tables 608, 610...612). The address map tables can convert input addresses to per-module addresses (e.g., TCU / TBU addresses) in the third-party AC component during save / restore operations. In some implementations, the widget 600 can be configured to perform provisioning of a mechanism for compressing payloads saved by the SRE to the isolated local memory.

[0090] For example, the widget 600 can use an address map table to select important control registers in the TCU / TBU that need to be saved, thus reducing the amount of configuration data saved.

[0091] The subject matter embodiments and actions and operations described herein may be implemented in digital electronic circuitry, tangibly embodied computer software or firmware, computer hardware, or one or more combinations thereof, including the structures disclosed herein and structural equivalents thereof. The subject matter embodiments described herein may be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transitory storage medium that are executed by or control the operation of a data processing device. Alternatively, or in addition, the program instructions may be encoded on an artificially generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal that is generated to encode information to be transmitted to a suitable receiving device for execution by the data processing device. The computer storage medium may be, or may be a part of, a machine-readable storage device, a machine-readable storage substrate, a random access memory device, or a serial access memory device, or one or more combinations thereof. The computer storage medium is not a propagating signal.

[0092] The processing components described herein refer to data processing hardware and encompass any kind of apparatus, device, and machine for data processing, including, by way of example, a programmable processor, a microprocessor, a computer, or multiple processors or multiple computers. An apparatus may also be or further include special purpose logic circuitry (e.g., a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC)). An apparatus may optionally include, in addition to hardware, code that creates an execution environment for a computer program (e.g., code that constitutes a processor firmware, a protocol stack, or one or more combinations thereof).

[0093] A computer program (which may also be called or expressed as a program, software, software application, app, module, software module, engine, script, or code) may be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages, and a computer program may be deployed in any form, such as as a stand-alone program or as a module, component, engine, subroutine, or other unit suitable for execution in a computing environment, which may include one or more computers interconnected by a data communications network in one or more locations.

[0094] A computer program may, but need not, correspond to a file in a file system: a computer program may be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files that store one or more modules, subprograms, or portions of code).

[0095] In addition to the above embodiments, the following embodiments are also innovative.

[0096] Embodiment 1 is a device, the device comprising: a power manager configured to control power supplied to a plurality of power domains on the device, each power domain having a respective client device, each respective client device having a respective access control (AC) component, the respective AC component configured to control which other components on the device can communicate with the respective client device, the device further comprising: A save-restore engine (SRE) configured to save configuration data of AC components located in a power domain affected by the power manager initiating a power collapse operation to a separate local memory, and when the power manager restores the power to the power domain of the AC component, the SRE is configured to restore the configuration data of the AC component from the separate local memory.

[0097] A second embodiment is the device of the first embodiment, wherein the SRE performs the following on the AC component: a first field indicating whether the AC component was successfully stored in the separate local memory; a second field indicating a starting address within the separate local memory for performing the save and restore operations; The local table includes:

[0098] Embodiment 3 is the device of embodiment 1, Storing the configuration data of the AC component in the separate local memory includes: receiving, by the SRE, a storage request from the power manager and an identification of the AC component; determining, by the SRE, that the identity is defined in an access control table that defines the AC component; reading, by the SRE, the configuration data of the AC component from the AC component; writing, by the SRE, the configuration data of the AC component to the separate local memory; Includes.

[0099] Embodiment 4 is the device of embodiment 3, Storing the configuration data of the AC component in the separate local memory includes: responsive to determining that the identity is defined in the access control table, obtaining, by the SRE, from the access control table, a starting address of the AC component; determining, by the SRE, whether memory space for the AC component is allocated in the isolated local memory; in response to determining that the memory space of the AC component is unallocated, allocating the memory space of the AC component using unmapped address locations in the separate local memory; Includes.

[0100] Embodiment 5 is the device of embodiment 3, Saving the configuration data of the AC component includes transmitting, by the SRE, a save completion response to the power manager.

[0101] Embodiment 6 is the device of embodiment 1, The SRE is configured to transmit a signal to the AC component while storing the configuration data of the AC component in the separate local memory; The signal places the AC component in a state where only the SRE can access the AC component.

[0102] Embodiment 7 is the device of embodiment 1, Restoring the configuration data of the AC component from the separate local memory includes: receiving, by the SRE, a restore request from the power manager and an identification of the AC component; determining, by the SRE, that the identity is defined in an access control table that defines the AC component; reading, by the SRE, the configuration data of the AC component from the separate local memory; writing said configuration data to said AC component; Includes.

[0103] Embodiment 8 is the device of embodiment 7, Restoring the configuration data of the AC component from the separate local memory includes: responsive to determining that the identity is defined in the access control table; determining, by the SRE, that the AC component was previously stored in the isolated local memory; in response, obtaining, by the SRE, a starting address of the AC component from the access control table; obtaining, by the SRE, a starting address of the configuration data of the AC component stored in the separate local memory; Includes.

[0104] Embodiment 9 is the device of embodiment 7, Restoring the configuration data of the AC component includes sending, by the SRE, a restore completion response to the power manager.

[0105] A tenth embodiment is the device of the first embodiment, The SRE is configured to send a signal to the AC component while restoring the configuration data of the AC component to the isolated local memory; The signal places the AC component in a state where only the SRE can access the AC component.

[0106] Embodiment 11 is the device of embodiment 1, The above AC components are third-party AC components, The device further includes a widget configured to implement a save / restore tracker that tracks when the save or restore operation begins and ends.

[0107] Embodiment 12 is the device of embodiment 11, The widget is configured to send a signal to the third-party AC component; The signal places the third party AC component in a state where it is accessible only to the SRE and the widget until the SRE has completed saving or restoring the third party AC component.

[0108] Embodiment 13 is the device of embodiment 1, Storing the configuration data of the AC component in the separate local memory includes: obtaining from the AC component and by the SRE a size of the configuration data that needs to be stored in the separate local memory; writing, by the SRE, the size of the configuration data into the separate local memory; Successively reading portions of the configuration data from the AC component and writing the portions to the separate local memory until the size of the configuration data is reached; Includes.

[0109] Embodiment 14 is the device of embodiment 1, Restoring the configuration data of the AC component from the separate local memory includes: obtaining a size of the configuration data that needs to be restored from the separate local memory and by the SRE; successively reading portions of the configuration data from the separate local memory and writing the portions to the AC component until the size of the configuration data is reached; Includes.

[0110] Embodiment 15 is the device of embodiment 1, The SREs mentioned above are: storing in the separate local memory a first digital fingerprint of the configuration data of the stored AC component; obtaining a second digital fingerprint of the configuration data of the AC component restored from the isolated local memory; determining whether the configuration data stored in the isolated local memory has been tampered with based at least on comparing the first digital fingerprint and the second digital fingerprint; It is configured as follows.

[0111] Embodiment 16 is the device of embodiment 1, the separate local memory includes dynamic random access memory (DRAM); the SRE is configured to store the configuration data of the AC component in the DRAM; The SRE uses cryptographic methods to protect the configuration data from tampering.

[0112] Embodiment 17 is a method comprising: receiving, by a save-restore engine (SRE), a save request from a power manager and an identification of an access control (AC) component; obtaining a start address of the AC component from an AC table by the SRE; reading, by the SRE, configuration data of the AC component from the AC component; writing, by the SRE, the configuration data of the AC component to a separate local memory; sending, by the SRE, a save completion response to the power manager; Includes.

[0113]

[0021] Embodiment 18 is one or more non-transitory storage media encoded with instructions, The instructions, when executed by a save-restore engine (SRE) of a computing device, receiving a storage request from a power manager and an identification of an access control (AC) component; obtaining a start address of said AC component from an AC table; reading configuration data of the AC component from the AC component; writing said configuration data of said AC component to a separate local memory; sending a save complete response to said power manager; The SRE performs the following operations:

[0114] Embodiment 19 is receiving, by a save-restore engine (SRE), a restore request from a power manager and an identification of an access control (AC) component; obtaining a start address of the AC component from an AC table by the SRE; reading, by the SRE, configuration data of the AC component from a separate local memory; writing said configuration data to said AC component by said SRE; sending, by the SRE, a restore completion response to the power manager; The method includes:

[0115]

[0023] Embodiment 20 is one or more non-transitory storage media encoded with instructions, The instructions, when executed by a save-restore engine (SRE) of a computing device, receiving a restore request from a power manager and an identification of an access control (AC) component; obtaining a start address of said AC component from an AC table; Reading configuration data of the AC component from a separate local memory; writing said configuration data to said AC component; sending a restore completion response to said power manager; The SRE performs the following operations:

[0116] Although the present specification contains many specific implementation details, these should not be construed as limitations on the scope of any invention or what is or may be claimed, but rather as descriptions of features that may be specific to certain embodiments of a particular invention. Certain features described in the context of separate embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features of the invention described in the context of a single embodiment may also be provided in multiple embodiments separately or in any suitable subcombination. Furthermore, even if features may be described above as functioning in a particular combination and originally claimed as such, one or more features from the claimed combination may in some cases be deleted from the combination, and the claims may be directed to subcombinations or variations of the subcombinations.

[0117] Similarly, although operations are illustrated in the figures and described in the claims in a particular order, this should not be understood as requiring that such operations be performed in the particular order or sequential order shown, or that all of the operations shown be performed, to achieve desirable results. In certain situations, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the above embodiments should not be construed as requiring such separation in all embodiments, and the program components and systems described may typically be integrated into a single software product or packaged into multiple software products.

[0118] Specific embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. For example, the actions recited in the claims may be performed in a different order and still produce desirable results. As an example, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to produce desirable results. In some cases, multitasking and parallel processing may be advantageous.

Claims

1. A device, comprising: a power manager configured to control power supplied to a plurality of power domains on the device; Each power domain has a respective client device, each respective client device having a respective access control (AC) component configured to control which other components on the device can communicate with the respective client device, the devices further comprising: A device comprising: a save-restore engine (SRE) configured to save configuration data of AC components located in a power domain affected by the power manager initiating a power collapse operation to a separate local memory, and when the power manager restores the power to the power domain of the AC component, the SRE is configured to restore the configuration data of the AC component from the separate local memory.

2. The SRE may further include, for the AC component: a first field indicating whether the AC component is successfully stored in the separate local memory; a second field indicating a starting address within the separate local memory for performing the save and restore operations; The device of claim 1 , further comprising a local table having:

3. Storing the configuration data of the AC component in the separate local memory comprises: receiving, by the SRE, a storage request from the power manager and an identification of the AC component; determining, by the SRE, that the identity is defined in an access control table that defines the AC component; reading, by the SRE, the configuration data of the AC component from the AC component; writing, by the SRE, the configuration data of the AC component to the separate local memory; The device of claim 1 , comprising:

4. Storing the configuration data of the AC component in the separate local memory comprises: responsive to determining that the identity is defined in the access control table, obtaining, by the SRE, from the access control table, a starting address of the AC component; determining, by the SRE, whether memory space for the AC component has been allocated in the isolated local memory; in response to determining that the memory space of the AC component is unallocated, allocating the memory space of the AC component using unmapped address locations in the isolated local memory; The device of claim 3 , comprising:

5. The device of claim 3 , wherein saving the configuration data of the AC component includes sending, by the SRE, a save completion response to the power manager.

6. The SRE is configured to transmit a signal to the AC component while storing the configuration data of the AC component in the separate local memory; The device of claim 1 , wherein the signal places the AC component in a state in which only the SRE has access to the AC component.

7. Restoring the configuration data of the AC component from the separate local memory includes: receiving, by the SRE, a restore request from the power manager and an identification of the AC component; determining, by the SRE, that the identity is defined in an access control table that defines the AC component; reading, by the SRE, the configuration data of the AC component from the separate local memory; writing the configuration data to the AC component; The device of claim 1 , comprising:

8. Restoring the configuration data of the AC component from the separate local memory includes: In response to determining that the identity is defined in the access control table, determining, by the SRE, that the AC component has been previously stored in the separate local memory; in response, obtaining, by the SRE, a starting address of the AC component from the access control table; obtaining, by the SRE, a starting address of the configuration data of the AC component stored in the separate local memory; The device of claim 7 , comprising:

9. The device of claim 7 , wherein restoring the configuration data of the AC component includes sending, by the SRE, a restore completion response to the power manager.

10. The SRE is configured to send a signal to the AC component during the restoration of the configuration data of the AC component to the separate local memory; The device of claim 1 , wherein the signal places the AC component in a state in which only the SRE has access to the AC component.

11. the AC component is a third-party AC component; The device of claim 1 , further comprising a widget configured to implement a save / restore tracker that tracks when the save or restore operation begins and ends.

12. The widget is configured to send a signal to the third-party AC component; The device of claim 11 , wherein the signal places the third party AC component in a state in which the third party AC component is accessible only to the SRE and the widget until the SRE completes saving or restoring the third party AC component.

13. Storing the configuration data of the AC component in the separate local memory comprises: obtaining from the AC component and by the SRE a size of the configuration data that needs to be stored in the separate local memory; writing, by the SRE, the size of the configuration data into the separate local memory; successively reading portions of the configuration data from the AC component and writing the portions to the separate local memory until the size of the configuration data is reached; The device of claim 1 , comprising:

14. Restoring the configuration data of the AC component from the separate local memory includes: Obtaining a size of the configuration data that needs to be restored from the separate local memory and by the SRE; successively reading portions of the configuration data from the separate local memory and writing the portions to the AC component until the size of the configuration data is reached; The device of claim 1 , comprising:

15. The SRE is storing in the separate local memory a first digital fingerprint of the configuration data of the stored AC component; obtaining a second digital fingerprint of the configuration data of the AC component restored from the separate local memory; determining whether the configuration data stored in the isolated local memory has been tampered with based at least on comparing the first digital fingerprint and the second digital fingerprint. The device of claim 1 configured to:

16. the separate local memory includes dynamic random access memory (DRAM); the SRE is configured to store the configuration data of the AC component in the DRAM; The device of claim 1 , wherein the SRE uses encryption methods to protect the configuration data from tampering.

17. receiving, by a save-restore engine (SRE), a save request from a power manager and an identification of an access control (AC) component; obtaining a start address of the AC component from an AC table by the SRE; reading, by the SRE, configuration data of the AC component from the AC component; writing, by the SRE, the configuration data of the AC component to a separate local memory; sending, by the SRE, a save complete response to the power manager; A method comprising:

18. one or more non-transitory storage media encoded with instructions, The instructions, when executed by a save-restore engine (SRE) of a computing device, receiving a storage request from a power manager and an identification of an access control (AC) component; obtaining a start address of the AC component from an AC table; reading configuration data of the AC component from the AC component; writing the configuration data of the AC component to a separate local memory; sending a save complete response to the power manager; One or more non-transitory storage media that cause the SRE to perform operations including:

19. receiving, by a save-restore engine (SRE), a restore request from a power manager and an identification of an access control (AC) component; obtaining a start address of the AC component from an AC table by the SRE; reading, by the SRE, configuration data of the AC component from a separate local memory; writing, by the SRE, the configuration data to the AC component; sending, by the SRE, a restore completion response to the power manager; A method comprising:

20. one or more non-transitory storage media encoded with instructions, The instructions, when executed by a save-restore engine (SRE) of a computing device, receiving a restore request from a power manager and an identification of an access control (AC) component; obtaining a start address of the AC component from an AC table; Reading configuration data of the AC component from a separate local memory; writing the configuration data to the AC component; sending a restore complete response to the power manager; One or more non-transitory storage media that cause the SRE to perform operations including:

Images