SoC Virtualization Access Control for DMA Memory Isolation

The patent segments the unified memory space into isolated regions for each virtual machine using memory protection units. Each virtual machine is assigned specific memory ranges that it can access, while other regions are protected from access. This segmentation allows multiple virtual machines to share IO devices while maintaining strict memory isolation, thus resolving the contradiction between device utilization efficiency and memory security.

The patent introduces an access control device as an intermediary between virtual machines and IO devices. This access control device receives memory access requests from virtual machines, checks whether the requested memory address falls within the virtual machine's authorized range, and permits or blocks access accordingly. This intermediary mechanism enables both memory isolation and efficient IO device sharing by automating access control without requiring complex coordination between virtual machines.

The patent implements self-service memory isolation by configuring memory protection units and access control devices with predefined memory ranges for each virtual machine. Once configured, these components automatically enforce memory isolation policies without requiring continuous intervention from the host processor or management software. The system self-manages access control decisions, reducing the operational complexity despite the presence of additional hardware components.