Patent Application
20190012271
Various aspects of the present disclosure relate to system memory management units and, more particularly, to methods, apparatuses, and systems for enforcing memory access control policies while major components of the system memory management unit is offline.
A system memory management unit (SMMU) is a computer hardware unit that, among other things, provides memory virtualization and also memory access permission control. Thus, an SMMU performs translation of virtual memory addresses to physical addresses and enforces memory access control policies for various clients attempting to access memory of the system.
A distributed SMMU includes many different components. For example, an SMMU may include a large translation lookaside buffer (TLB) that is shared among various clients of the system. Such a shared TLB may be known as a “macro-TLB.” Generally, a TLB is a memory cache that is used to reduce the time taken to access a user memory location by storing recent translations of virtual memory to physical memory. A client or process may first access the TLB to obtain the virtual memory to physical memory address translation in order to save time. If the translation is not found at the TLB (i.e., a TLB miss), then a page walker circuit of the SMMU must perform a page walk of the memory page tables to determine the translation.
Current distributed SMMUs may include a plurality of smaller, localized TLBs (known as “micro-TLBs”) in addition to the macro-TLB. The micro-TLBs may be distributed across the system and may be limited in providing memory access control to specific clients. In such systems, the micro-TLBs must remain in communication with other components of the SMMU, including the macro-TLB and the page walker circuit, in order to correctly operate and enforce memory access control policies to the clients and memory circuits they serve. Thus, if the macro-TLB and/or page walker circuit of the SMMU goes offline (e.g., low power state, sleep mode, turned OFF, etc.), then the localized micro-TLBs will not receive any translation lookaside buffer maintenance operations from the macro-TLB and page walker circuit, which may hamper or inhibit the micro-TLBs from enforcing memory access control policies for the clients they serve. Consequently, power hungry components like the macro-TLB and the page walker circuit, which may consume 5 to 10 times the power of a micro-TLB, must remain powered ON and operational in order for a micro-TLB to perform its functions.
There is a need for SMMUs that have micro-TLBs which may remain fully functional and enforce memory access control policies even if other components of the SMMU, such as the macro-TLB and page walker circuits, are inaccessible (e.g., offline). Methods, apparatuses, and systems are described herein that provide SMMUs having such micro-TLBs that remain fully functional while the rest of the system and SMMU may go offline.
One feature provides an apparatus comprising a memory circuit storing an executable program associated with a client, a system memory-management unit (SMMU) adapted to enforce memory access control policies for the memory circuit, the SMMU including a plurality of micro-translation lookaside buffers (micro-TLBs), a macro-translation lookaside buffer (macro-TLB), and a page walker circuit, the plurality of micro-TLBs including a first micro-TLB that enforces memory access control policies for the client, and a processing circuit communicatively coupled to the memory circuit and the SMMU, the processing circuit adapted to load memory address translations associated with the executable program into the first micro-TLB, and initiate isolation mode for the first micro-TLB to cause communications between the first micro-TLB and the macro-TLB and between the first micro-TLB and the page walker circuit to be severed, the first micro-TLB to continue to enforce memory access control policies for the client while in isolation mode.
According to one aspect, the macro-TLB and the page walker circuit enter a lower power state while the first micro-TLB is in isolation mode. According to another aspect, the memory address translations loaded into the first micro-TLB provide a mapping between virtual memory addresses and physical memory addresses of the memory circuit. According to yet another aspect, the first micro-TLB includes a register that stores a client identifier that identifies the client and defines a memory aperture of the first memory circuit that the client is authorized to access.
According to one aspect, the first micro-TLB determines that each memory address translation associated with the executable program being loaded into the first micro-TLB includes an identifier that matches the client identifier stored at the register of the first micro-TLB before allowing the memory address translation to be loaded and locked into the first micro-TLB. According to another aspect, the executable program is stored at the memory aperture of the first memory circuit. According to yet another aspect, the apparatus further comprises a hypervisor adapted to associate the client identifier to the client and write the client identifier to the register.
According to one aspect, the first micro-TLB invalidates non-locked memory address translations stored at the first micro-TLB prior to entering isolation mode. According to another aspect, the processing circuit is further adapted to cease isolation mode for the first micro-TLB causing the first micro-TLB to exit isolation mode and reestablish communications with the macro-TLB and the page walker circuit. According to yet another aspect, the first micro-TLB invalidates all memory address translations stored at the first micro-TLB upon exiting isolation mode and reestablishing communications with the macro-TLB and the page walker circuit.
According to one aspect, the processing circuit ceases isolation mode after the first micro-TLB reports a fault caused by the client attempting to access a memory region of the memory circuit that the client is unauthorized to access. According to another aspect, the processing circuit is further adapted to initiate a lower power mode for the micro-TLB, and wherein the macro-TLB and the page walker circuit remain in a lower power state while the micro-TLB is in the lower power mode. According to yet another aspect, the apparatus further comprises a hypervisor adapted to authenticate the executable program stored at the first memory circuit during a boot process and configure page tables that map to a memory aperture of the first memory circuit where the executable program is stored.
According to one aspect, the first micro-TLB continuing to enforce memory access control policies for the client while in isolation mode includes receiving at the first micro-TLB a memory access request from the client that includes a client identifier identifying the client, the request indicating a memory region of the memory circuit the client desires access to, determining at the first micro-TLB that the client identifier provided by the client in the memory access request matches a stored client identifier value at the micro-TLB associated with the memory region of the memory circuit the client desires access to, and providing the client a memory address translation associated with the memory region of the memory circuit the client desires access to. According to yet another aspect, the apparatus further comprises a local master circuit adapted to reprogram the first micro-TLB while in isolation mode.
Another feature provides a method comprising enforcing memory access control policies for a memory circuit with a system memory-management unit (SMMU) that includes a macro-translation lookaside buffer (macro-TLB), a page walker circuit, and a plurality of micro-translation lookaside buffers (micro-TLBs), the memory circuit storing an executable program associated with a client, enforcing memory access control policies for the client with a first micro-TLB of the plurality of micro-TLBs, loading memory address translations for the executable program into the first micro-TLB, and initiating isolation mode for the first micro-TLB causing communications between the first micro-TLB and the macro-TLB and between the first micro-TLB and the page walker circuit to be severed, the first micro-TLB continuing to enforce memory access control policies for the client while in isolation mode. According to one aspect, the method further comprises ceasing isolation mode for the first micro-TLB causing the first micro-TLB to exit isolation mode and reestablish communications with the macro-TLB and the page walker circuit.
Another feature provides an apparatus comprising means for enforcing memory access control policies for a memory circuit with a system memory-management unit (SMMU) that includes a macro-translation lookaside buffer (macro-TLB), a page walker circuit, and a plurality of micro-translation lookaside buffers (micro-TLBs), the memory circuit storing an executable program associated with a client, means for enforcing memory access control policies for the client with a first micro-TLB of the plurality of micro-TLBs, means for loading memory address translations for the executable program into the first micro-TLB, and means for initiating isolation mode for the first micro-TLB causing communications between the first micro-TLB and the macro-TLB and between the first micro-TLB and the page walker circuit to be severed, the first micro-TLB continuing to enforce memory access control policies for the client while in isolation mode. According to one aspect, the apparatus further comprises means for ceasing isolation mode for the first micro-TLB causing the first micro-TLB to exit isolation mode and reestablish communications with the macro-TLB and the page walker circuit, the first micro-TLB invalidating all memory address translations stored at the first micro-TLB upon exiting isolation mode.
Another feature provides a non-transitory computer-readable storage medium having instructions stored thereon, which when executed by at least one processor causes the processor to enforce memory access control policies for a memory circuit with a system memory-management unit (SMMU) that includes a macro-translation lookaside buffer (macro-TLB), a page walker circuit, and a plurality of micro-translation lookaside buffers (micro-TLBs), the memory circuit storing an executable program associated with a client at the memory circuit, enforce memory access control policies for the client with a first micro-TLB of the plurality of micro-TLBs, load memory address translations for the executable program into the first micro-TLB, and initiate isolation mode for the first micro-TLB to cause communications between the first micro-TLB and the macro-TLB and between the first micro-TLB and the page walker circuit to be severed, the first micro-TLB to continue to enforce memory access control policies for the client while in isolation mode.
In the following description, specific details are given to provide a thorough understanding of the various aspects of the disclosure. However, it will be understood by one of ordinary skill in the art that the aspects may be practiced without these specific details. For example, circuits may be shown in block diagrams in order to avoid obscuring the aspects in unnecessary detail. In other instances, well-known circuits, structures and techniques may not be shown in detail in order not to obscure the aspects of the disclosure.
The word “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any implementation or aspect described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects of the disclosure. Likewise, an aspect is an implementation or example. Reference in the specification to “an aspect,” “one aspect,” “some aspects,” “various aspects,” or “other aspects” means that a particular feature, structure, or characteristic described in connection with the aspects is included in at least some aspects, but not necessarily all aspects, of the present techniques. The various appearances of “an aspect,” “one aspect,” or “some aspects” are not necessarily all referring to the same aspects. Elements or aspects from an aspect can be combined with elements or aspects of another aspect.
In the following description and claims, the term “coupled” may mean that two or more elements are in direct physical or electrical contact. However, “coupled” may also mean that two or more elements are not in direct contact with each other, but yet still co-operate or interact with each other. In the following description and claims, the term “lower power state” means a state where the device or circuit operating in such a state is consuming less power than it ordinarily would while fully powered and ON. Thus, a lower power state includes states commonly known as “sleep mode” and “low power mode,” and also a “power OFF” state.
Not all components, features, structures, characteristics, etc. described and illustrated herein need be included in a particular aspect or aspects. If the specification states a component, feature, structure, or characteristic “may”, “might”, “can” or “could” be included, for example, that particular component, feature, structure, or characteristic is not required to be included. If the specification or claim refers to “a” or “an” element, that does not mean there is only one of the element. If the specification or claims refer to “an additional” element, that does not preclude there being more than one of the additional element.
It is to be noted that, although some aspects have been described in reference to particular implementations, other implementations are possible according to some aspects. Additionally, the arrangement and/or order of circuit elements or other features illustrated in the drawings and/or described herein need not be arranged in the particular way illustrated and described. Many other arrangements are possible according to some aspects.
In each figure, the elements in some cases may each have a same reference number or a different reference number to suggest that the elements represented could be different and/or similar. However, an element may be flexible enough to have different implementations and work with some or all of the systems shown or described herein. The various elements shown in the figures may be the same or different. Which one is referred to as a first element and which is called a second element is arbitrary.
According to one aspect, the device 100, including its clients 102a-102n, SMMU 104, memory circuit 106, CPU 108, resources 110-114, and/or bus 122, may be based on a reduced instruction set computing (RISC) architecture. In some RISC architectures, a micro-TLB may be known as “translation buffer unit” and a macro-TLB in combination with a page walker may be known as a “translation control unit.” According to another aspect, the device 100, including its clients 102a-102n, SMMU 104, memory circuit 106, CPU 108, resources 110-114, and/or bus 122, may be a system-on-chip (SoC) or system-on-module (SoM).
A client 102a-102n may generally be any subsystem of the device 100 that needs some amount of memory 106. Some non-limiting, non-exclusive examples of a client include a digital signal processor (DSP), a co-processor, a hardware accelerator, direct memory access (DMA) controllers, audio system controllers, sensor controllers, touchscreen controllers, graphics processing unit, network processing unit, numerical processing unit, and input/output interfaces (e.g., peripheral component interconnect (PCI), PCI-E, universal serial bus (USB), etc.).
A resource 110, 112, 114 may be a hardware resource component of the device 100 that a client 102a-102n needs or desires access to. Examples of resources include various sensors, speakers, displays, input/output devices (e.g., PCI, PCI-E, USB, etc.), memory circuits, caches, configuration spaces, etc. For example, client A 102a may be a DSP that periodically requires device temperature information obtained by resource X 110, which may be a thermometer. In order to carry out its processes, the DSP (e.g., client A 102a) may also need to execute a program image stored at the memory circuit 106.
Each micro-TLB 116a-116n may be associated with and serve one or more clients 102a-102n by allowing access and enforcing memory access control policies for its clients 102a-102n. For example, micro-TLB A 116a may be associated with and serve client A 102a, micro-TLB B 116b may be associated with and serve client B 102b, and so on. Thus, micro-TLB A 116a, for example, may enforce access control policies of a portion of the memory circuit 106 (e.g., a specific aperture of the memory circuit 106) for client A 102a. Micro-TLB B 116b, for example, may enforce access control policies of a portion of the memory circuit 106 (e.g., a specific aperture of the memory circuit 106) for client B 102b, and so on.
The macro-TLB 118 and page walker circuit 120 is shared among all the clients 102a-102n via the plurality of micro-TLBs 116a-116n. For example, a TLB miss at a local micro-TLB 116a may cause a page walk to be performed by the page walker circuit 120 in order to obtain the memory address translation needed by a given client (e.g., client A 102a). Generally, the macro-TLB 118 and page walker circuit 120 are online (e.g., fully powered ON), operational, and in communication with the plurality of micro-TLBs 116a-116n.
According to one aspect, one or more clients 102a-102n may execute programs stored at the memory circuit 106 and may access one or more resources 110, 112, 114 while the rest of the SMMU 104, such as the macro-TLB 118 and page walker circuit 120, enters a lower power state. For example, client A 102a may access the memory circuit 106 and resource X 110 while much of the SMMU 104 (e.g., macro-TLB 118 and page walker circuit 120) is in a lower power state. Thus, micro-TLB A 116a may remain online and enforce access control policies and provide memory address translations for client A 102a despite the micro-TLB A 116a having severed communication with the rest of the SMMU 104 (e.g., macro-TLB 118 and page walker circuit 120) and being unable to receive maintenance operations and updates from the macro-TLB 118 and/or page walker circuit 120. Micro-TLBs 116a-116n that remain operational by enforcing memory access control policies for their respective clients while the macro-TLB 118 and/or page walker circuit 120 are in a lower power state (e.g., communications severed) are herein referred to as being in an “isolation state.” This allows the rest of the system, including the macro-TLB 118 and page walker circuit 120, the ability to enter a lower power state while memory access control policies are still enforced for the clients that remain active.
As described in part above, prior to any loading of a micro-TLB by a client, the hypervisor 300 may generate and assign a C-ID value for a client, which defines the memory aperture the client may access. Thus, prior to loading the micro-TLB 116a with memory address translations by the client 102a, the hypervisor 300 will have assigned 504 C-IDA (client identifier for client A) to the client 102a. The hypervisor 300 will have also written 506 the C-IDA value to a register 508 of the micro-TLB 116a, and associated 510 the memory aperture (e.g., aperture L) with the C-ID (e.g., C-IDA).
As the client 102a begins loading memory address translations in preparation for going into isolation mode, the micro-TLB 116a checks the C-ID value associated with each memory address translation being loaded against the C-ID value stored at its register 508 to make sure the two values match. If the C-ID values match, which in the example shown is C-IDA for client A 102a, then the micro-TLB 116a allows the translation to be loaded and locked into the micro-TLB 116a. As shown in
Referring to
Despite being unable to communicate with the macro-TLB 118 and page walker 120 and receive updates, the micro-TLB 116a enforces memory access control policies for the client 102a and provides needed memory address translations for the client 102a. The micro-TLB 116a is able to do so because all memory address translation entries at the micro-TLB 116a were loaded and locked during the loading phase when each entry was checked to ensure that it had a C-ID value that matched the C-ID value assigned by the hypervisor 300 and stored at the micro-TLB's register 508 (see
As shown in
While loading is underway, the client may decide for various reasons to abort the load and thus the system transitions to the ISOLATION ABORT state 908. Any entries loaded prior to aborting may be invalidated (e.g., flushed) before returning to the ALL ON state 904.
After loading is complete, all non-locked entries in the micro-TLB may be invalidated (e.g., flushed) and the system may transition to the ISOLATION state 910. In isolation mode the micro-TLB enforces access control policies for the client while communications between the micro-TLB and the rest of the system, including the macro-TLB and page walker circuit, have been severed. During this time the rest of the system, including the macro-TLB and page walker circuit, may enter a lower power state to save power for the underlying device.
Optionally, while in isolation mode, the client may choose to enter a lower power state itself. In such a case, the system transitions from the ISOLATION state 910 to the ISOLATION lower power mode (LPM) state 912. In the ISOLATION LPM state 912, the micro-TLB, the client, and/or resources used by the client may enter a lower power state. The client may then choose to exit its lower power state and return back to the ISOLATION state 910.
While in the ISOLATION state 910 the system may transition to an ISOLATION ERROR state 914 when a fault is reported. For example, this may happen if and when a client attempts to access a memory address that fails to have a corresponding memory address translation entry stored at the micro-TLB. Another example of when the system transitions to the ISOLATION ERROR state 912 is if and when the client attempts to gain access to memory regions that it is unauthorized to access by, for example, providing a C-ID value that fails to match the C-ID value associated with the translation entry stored at the micro-TLB. In either case the micro-TLB may respond by reporting a fault.
Once the system is at the ISOLATION ERROR state 914, the system may either clear the fault and go back to ISOLATION state 910 or exit isolation mode and enter the ISOLATION EXIT state 916. The client itself may also cease/exit isolation mode causing the system to transition from the ISOLATION state 910 to the ISOLATION EXIT state 916. Upon exiting isolation mode, all entries at the micro-TLB are invalidated. The system then transitions from the ISOLATION EXIT state to the ALL ON state 904.
Referring to
Referring to
Among other things, the wireless communication interface 1102 may allow the device 1100 to communicate wirelessly with wireless devices and networks. The memory circuit 1104 may include one or more volatile memory circuits and/or non-volatile memory circuits. Thus, the memory circuit 1104 may include DRAM, SRAM, MRAM, EEPROM, flash memory, etc. The memory circuit 1104 may store one or more executable program images associated with one or more clients. The memory circuit 1104 may also store instructions and data that may be executed by the processing circuit 1108. The I/O devices/circuits 1106 may include one or more keyboards, mice, displays, touchscreen displays, printers, fingerprint scanners, and any other input and/or output devices.
The processing circuit 1108 (e.g., processor, central processing unit (CPU), application processing unit (APU), etc.), which may comprise one or more processing circuits, may execute instructions stored at the memory circuit 1104 and/or instructions stored at another computer-readable storage medium (e.g., hard disk drive, optical disk drive, solid-state drive, etc.) communicatively coupled to the device 1100. The processing circuit 1108 may perform any one of the steps and/or processes described herein including those described with respect to
One or more of the components, steps, features, and/or functions illustrated in
Also, it is noted that the aspects of the present disclosure may be described as a process that is depicted as a flowchart, a flow diagram, a structure diagram, or a block diagram. Although a flowchart may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations may be re-arranged. A process is terminated when its operations are completed. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination corresponds to a return of the function to the calling function or the main function.
Moreover, a storage medium may represent one or more devices for storing data, including read-only memory (ROM), random access memory (RAM), magnetic disk storage mediums, optical storage mediums, flash memory devices and/or other machine-readable mediums and, processor-readable mediums, and/or computer-readable mediums for storing information. The terms “machine-readable medium”, “computer-readable medium”, and/or “processor-readable medium” may include, but are not limited to non-transitory mediums such as portable or fixed storage devices, optical storage devices, and various other mediums capable of storing or containing instruction(s) and/or data. Thus, the various methods described herein may be fully or partially implemented by instructions and/or data that may be stored in a “machine-readable medium”, “computer-readable medium”, and/or “processor-readable medium” and executed by one or more processors, machines and/or devices.
Furthermore, aspects of the disclosure may be implemented by hardware, software, firmware, middleware, microcode, or any combination thereof. When implemented in software, firmware, middleware or microcode, the program code or code segments to perform the necessary tasks may be stored in a machine-readable medium such as a storage medium or other storage(s). A processor may perform the necessary tasks. A code segment may represent a procedure, a function, a subprogram, a program, a routine, a subroutine, a module, a software package, a class, or any combination of instructions, data structures, or program statements. A code segment may be coupled to another code segment or a hardware circuit by passing and/or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc. may be passed, forwarded, or transmitted via any suitable means including memory sharing, message passing, token passing, network transmission, etc.
The various illustrative logical blocks, modules, circuits, elements, and/or components described in connection with the examples disclosed herein may be implemented or performed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic component, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing components, e.g., a combination of a DSP and a microprocessor, a number of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. As just one example the processing circuit 1108 of
The methods or algorithms described in connection with the examples disclosed herein may be embodied directly in hardware, in a software module executable by a processor, or in a combination of both, in the form of processing unit, programming instructions, or other directions, and may be contained in a single device or distributed across multiple devices. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. A storage medium may be coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor.
Those of skill in the art would further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the aspects disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system.
The various features of the invention described herein can be implemented in different systems without departing from the invention. It should be noted that the foregoing aspects of the disclosure are merely examples and are not to be construed as limiting the invention. The description of the aspects of the present disclosure is intended to be illustrative, and not to limit the scope of the claims. As such, the present teachings can be readily applied to other types of apparatuses and many alternatives, modifications, and variations will be apparent to those skilled in the art.
