TWI844963B - System and method for controling access to a physical address space - Google Patents

Abstract

A system operative to control access to a physical address (PA) space, comprising: a plurality of processing circuits executing a plurality of virtual machines (VMs), a given region of the PA space is dedicated to addressing the VMs; a plurality of system resources addressable within the PA space; a plurality of memory management units (MMUs) coupled to corresponding processing circuits, a given MMU is operative to translate a virtual address indicated in an access request into a requested PA according to a configurable setting of the given MMU; and a plurality of memory protection units (MPUs), a given MPU, is operative to grant or deny the request based on information in a permission filter indicating whether the requested PA is accessible to a requesting VM executed on the requesting processing circuit.

Description

System and method for controlling access to physical address space

The present invention relates to a computing system for protecting the memory of the computing system, and more particularly to a computing system for providing memory protection using a hardware virtual machine.

A hypervisor enables multiple operating systems to run concurrently on a single physical machine. These operating systems, called "guest operating systems", can include multiple instances of an operating system as well as different operating systems. Multiple virtual machines (VMs) can run on a hypervisor. Each VM runs a guest operating system to manage resource allocation to the VM. A hypervisor typically uses a memory management unit (MMU) to support address translation and memory protection for the VM. In a multiprocessor system, each processor core can have its own MMU.

The MMU is responsible for translating virtual addresses into physical addresses. The MMU may include one or more Translation Look-aside Buffers (TLBs) to store the mapping between virtual addresses and their corresponding physical addresses. Some MMUs provide a two-stage memory translation mechanism. Every memory access from an application running on a VM undergoes two levels of translation in the MMU. The guest operating system configures a first-level translation table that maps virtual addresses to intermediate physical addresses. The virtual machine monitor configures a second-level translation table that maps intermediate physical addresses to physical addresses. Therefore, the two-stage translation enables the virtual machine monitor to control the guest's view of memory and limit the physical memory that the guest can access.

MMU hardware can be complex and expensive. Management of the MMU often requires highly complex software and can negatively impact memory usage and performance. Furthermore, in a shared memory environment where multiple devices can access the same memory location, the complexity is greatly increased and security can be compromised. Therefore, there is a need to develop a low-complexity and low-overhead memory protection scheme for virtual machine systems.

The present invention provides a system and method for controlling access to a physical address space, which can provide a low-complexity access control solution.

In one embodiment, the present invention provides a system for controlling access to a physical address (PA) space, comprising: a plurality of processing circuits executing a plurality of virtual machines, wherein a given region of the physical address space is dedicated to addressing the plurality of virtual machines; a plurality of system resources addressed by the physical address space; a plurality of memory management units (MMUs) coupled to corresponding processing circuits, wherein a given MMU is used to control access to a given region of the physical address space based on the given region of the virtual machines; The MMU is configured to convert a virtual address indicated in an access request from a request processing circuit into a requested physical address; and a plurality of memory protection units (MPUs), wherein a given MPU coupled to a target system resource assigned with the requested physical address is used to allow or deny the access request based on information in a permission filter indicating whether a requesting VM running on the request processing circuit can access the requested physical address.

In another embodiment, a method for controlling access to a physical address (PA) space is performed by a system including a plurality of processing circuits and a plurality of system resources, the method comprising: receiving a request for access to a virtual address from a request processing circuit, wherein the request processing circuit executes a requesting virtual machine, wherein a given region of the physical address space is dedicated to addressing a plurality of virtual machines executing in the system; A given memory management unit (MMU) of a processing circuit converts the virtual address into a requested physical address accessible to the request processing circuit according to a configuration setting of the given MMU; and the request is allowed or denied by a given MPU coupled to a target system resource assigned with the requested physical address according to information in a permission filter indicating whether a requesting VM running on the request processing circuit can access the requested physical address.

Certain terms are used in the specification and patent application to refer to specific components. A person with ordinary knowledge in the relevant technical field should understand that hardware manufacturers may use different terms to refer to the same component. This specification and patent application do not use differences in names as a way to distinguish components, but use differences in the functions of components as the criterion for distinction. The terms "include" and "including" mentioned throughout the specification and patent application are open-ended terms and should be interpreted as "including but not limited to". "Substantially" or "approximately" means that within an acceptable error range, a person with ordinary knowledge in the relevant technical field can solve the technical problem within a certain error range and basically achieve the technical effect. In addition, the term "coupled" or "coupled" herein includes any direct and indirect electrical connection means. Therefore, if the text describes a first device coupled to a second device, it means that the first device can be directly electrically connected to the second device, or indirectly electrically connected to the second device through other devices or connection means. The following is a preferred method for implementing the present invention, the purpose of which is to illustrate the spirit of the present invention and not to limit the scope of protection of the present invention. The scope of protection of the present invention shall be determined by the scope of the attached patent application.

The following description is the expected best embodiment of the present invention. These descriptions are used to illustrate the general principles of the present invention and should not be used to limit the present invention. The scope of protection of the present invention should be determined based on the scope of the patent application of the present invention.

An embodiment of the present invention provides an access control mechanism that uses a combination of a two-level MMU and a memory protection unit (MPU) to control access to a physical address (PA) space. The system uses hardware such as registers to configure a predetermined number of virtual machines (VMs) and a given PA space area dedicated to addressing VMs. These VMs are referred to herein as hardware VMs or simply VMs. Each VM is assigned a specific PA block or segment and can be configured with specific domain permissions. VM provides a low-complexity alternative or supplement to traditional MMU-performed access control. VM also combines the advantages of the host-side access control performed by the MMU and the target-side access control performed by the MPU.

In one embodiment, the MMU manager manages the configuration of the second-level MMU; for example, configuring the host's access rights to the physical address (i.e., configuring which host has the right to access which physical address). In addition, the hardware VM manager manages the configuration of the MPU (more specifically, the corresponding permission filter); for example, configuring the VM's access rights to the physical address (i.e., configuring which VM has the right to access which physical address). In one embodiment, any of the access controls to the second-level MMU or the MPU can be enabled or disabled.

FIG. 1 is a block diagram illustrating a system 100 according to an embodiment. The system 100 includes a plurality of masters, such as 110 a, 110 b, 110 c, etc., which are collectively referred to as masters. In this document, a master is a hardware component that initiates a request to access target system resources (such as memory, peripherals, etc.). Examples of a master include, but are not limited to, one or more of the following processing circuits: a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a multimedia processor, an artificial intelligence (AI) processing unit (APU), a direct memory access (DMA) control, and/or other general and/or dedicated processing circuits.

In one embodiment, the host may be part of a system-on-a-chip (SoC) platform. It is understood that the embodiment of FIG. 1 is simplified for illustrative purposes. In a specific implementation, additional hardware components may be included, and some components shown in FIG. 1 may be omitted.

In one embodiment, the host has access to a target system resource (e.g., memory 120). Memory 120 may be system memory or main memory of system 100. Memory 120 may include random access memory (RAM) devices, such as dynamic random access memory (DRAM) devices, flash memory devices, and/or other volatile or non-volatile memories. The host may access memory 120 via bus 180 or other forms of interconnection. Access to memory 120 is performed under the control of memory interface controller 125. In one embodiment, the host is used to execute instructions stored in the memory 120 to run applications and perform system activities.

In one embodiment, the host has access to target system resources (e.g., peripherals 140), which may also be referred to as input/output (I/O) devices, such as keyboards, speakers, microphones, displays, cameras, etc. Peripherals 140 may be accessed through a bus 180 or other form of interconnection under the control of a peripheral interface controller 145. Peripherals 140 may include I/O devices and may be memory mapped. For example, peripheral interface controller 145 may include or control a device controller mapped to a physical address range within which I/O data speeds, formats, etc. are communicated between the host and the device controller.

In one embodiment, each host uses a memory management unit (MMU) to perform two-level address translation. A portion of the MMU may be referred to as a system SMMU. Therefore, it should be understood that the MMU shown or described herein may include one or more SMMUs.

The first-level MMU 115 converts the virtual address (VA) space into the intermediate physical address (IPA) space, and the second-level MMU 116 converts the IPA space into the physical address (PA) space where all system resources (e.g., memory 120 and peripherals 140) can be addressed. The mapping of the VA space to the IPA space (i.e., the first-level MMU 115) is controlled by the guest operating system running on the VM (e.g., VM 130a, 130b, 130c, etc.), and the mapping of the IPA space to the PA space (i.e., the second-level MMU 116) is controlled by the virtual machine monitor 240 or the host operating system for managing the hardware resources of the system 100. The virtual machine monitor 240 may run on the host operating system. Alternatively, the virtual machine monitor 240 may be part of the host operating system. In one embodiment, multiple hosts may share the same MMU, for example, multiple DMA controllers may share the same SMMU to perform data transfer between devices in the system 100.

In one embodiment, each second-level MMU 116 provides host-side access control according to a configurable setting that specifies the host's access rights to pages (e.g., 4K-byte blocks) in the PA space, that is, which host can access which page in the PA space. The configurable setting is managed by the second-level MMU manager 241 in the virtual machine monitor 240. In one embodiment, the virtual machine monitor 240 includes a PA checker 242 that verifies the validity of the requested PA in the access request. If the requested PA passes the verification, the access request is passed to the target-side access control.

Target-side access control is performed by an MPU, such as MPU 127 and MPU 147 in FIG. 1 . Memory interface control 125 includes MPU 127, which is a hardware circuit including a local memory for storing access permission information for each VM (regarding the PA space). Access permission information can be stored in a data structure called permission filter 126. MPU 127 can also store a mapping relationship (e.g., an allocation relationship) between a VM and a host. Different hosts can be mapped to the same VM (i.e., a shared VM) or different VMs. In one embodiment, the permission filter 126 stores an indication indicating one or more address ranges for the corresponding VM and host, wherein the one or more address ranges contain physical addresses accessible to the VM and the host to which the VM is assigned. For each address range, the permission filter 126 may indicate the access rights, such as read, write, execute, etc. The address range may be a fixed-size address block or a configurable-size address segment. The MPU 127 grants or denies access requests to the physical address based on the information stored in the corresponding permission filter 126.

In one embodiment, the peripheral interface controller 145 includes an MPU 147, which performs functions similar to those of the MPU 127. The MPU 147 uses the permission filter 146 to store access permission information for the VM and the host, and the access permission is about the area in the PA space of the controller allocated to the peripheral device 140. The MPUs 127 and 147 together with the permission filters 126 and 127 provide target-side protection by limiting the physical memory and memory-mapped resources accessible to the VM. This hardware-based memory protection mechanism has low complexity and low overhead. The MPUs 127 and 147 and the permission filters 126 and 127 can be configured by the hardware VM manager 251 in the virtual machine monitor 240. In one embodiment, the mapping relationship between each VM and the corresponding PA area, block or segment is stored in the hardware VM setting 252. For example, in the example of FIG5 , the virtual address assigned to the VM is mapped to the extended PA area 520 (for example, the virtual address assigned to VM0 is mapped to R0 in the extended PA area 520), and the address for addressing system resources (for example, the memory 120, the peripheral device 140, etc.) is located in the physical address space 510, so the hardware VM setting 252 stores the mapping relationship between the VM and the PA block/segment by storing the mapping relationship between the extended PA area 520 and the block/segment in the physical address space 510.

FIG. 2 is a diagram illustrating a process 200 according to one embodiment, the process 200 including multi-level address mapping in response to an access request. Initially, a host identified by a host identification (Master_ID) sends an access request to its MMU, the access request identifying a requested virtual address (VA). As described in conjunction with FIG. 1 , the first-level MMU 115 converts the VA to an intermediate physical address (IPA) (step 201), and the second-level MMU 116 converts the IPA to a physical address (PA) (e.g., converts the IPA to a physical address in the physical address space 510 of FIG. 5) (step 202). The PA checker 242 verifies that the host allows access to the PA (step 203). The virtual machine monitor 240 identifies the VM_ID for the VM assigned with the PA from the hardware VM setting 252 ( FIG. 1 ), and transmits the access request identifying the PA, Master_ID, and VM_ID to the MPU 127 (step 204 ). For example, in step 204 , the virtual machine monitor 240 can find the VM and the VM_ID of the corresponding VM corresponding to the physical address converted by the second-level MMU 116 from the mapping relationship between the VM and the corresponding PA area, block, or segment stored in the hardware VM setting 252 . The MPU 127 allows or denies the access request based on the information stored in the permission filter 126 (step 205 ).

FIG3 is a diagram illustrating management of memory protection according to one embodiment. In this embodiment, the second-level MMU manager 241 manages and configures address translation performed by the second-level MMU 116 and the PA checker 242 regarding the PA address that each host is allowed to access. In this embodiment, the host includes but is not limited to a CPU, a GPU, an APU, and a multimedia processor. Each host executes a VM, and different hosts execute different VMs. The memory protection provided by the second-level MMU 116 and the PA checker 242 can be further enhanced by the hardware VM manager 251, which manages and configures the hardware VM settings 252, the MPU 127, and the permission filter 126. The hardware VM manager 251 also manages any additional MPUs and permission filters in the system, which are not shown in the examples of Figures 3 and 4 for simplicity of illustration. The MPU (and corresponding permission filter) provides hardware-based memory isolation to prevent each host from accessing VMs assigned to other hosts. In one embodiment, both the MMU and the MPU are used to provide hardware-based memory isolation to further enhance the security of the system.

The hardware VM settings 252 stores the mapping between VM and PA blocks/segments. The hardware VM settings 252 also stores the mapping between the host and the VM. Therefore, after the PA verifier 242 verifies that a requesting host (e.g., CPU) is allowed to access the PA in the access request, the MPU 127 performs further verification and the permission filter 126 determines whether the VM running on the requesting host (e.g., CPU VM) is allowed to access the PA.

In one embodiment, the PA block size in each VM (e.g., the PA block size in the extended PA region 520) is larger than the page size used by the second-level MMU 116. For example, the PA block size may be configured as 2 megabytes (2MB), 1 gigabyte (1GB), etc. The page size used by the second-level MMU 116 may be 4 kilobytes (4KB). Managing access control with a small page size (e.g., 4KB) generates a large amount of overhead and degrades system performance. Therefore, in some embodiments, access control performed by the second-level MMU 116 may be disabled to improve system performance. In these embodiments, memory protection may be provided by the MPU and the permission filter.

FIG4 is a diagram illustrating a configuration 450 for the second-level MMU manager 241 and the hardware VM manager 251 according to one embodiment. FIG4 adds the configuration 450 to the diagram of FIG3 . The virtual machine monitor 240 may use the configuration 450 to instruct the second-level MMU manager 241 to enable or disable host-side access control performed by the second-level MMU 116. Similarly, the virtual machine monitor 240 may use the configuration 450 to instruct the hardware VM manager 251 to enable or disable target-side access control performed by the MPU 127 and the permission filter 116. Therefore, there are three alternatives with respect to access control. (1) Disable the second-level MMU 116, and enable the MPU 127 and the permission filter 126. (2) Enable second-stage MMU 116, disable MPU 127 and admission filter 126. (3) Enable second-stage MMU 116, MPU 127, and admission filter 126. For example, when the system runs at low performance and the PA block size used by MPU 127 is larger than the 4KB size used by second-stage MMU 116, virtual machine monitor 240 can disable access control performed by second-stage MMU 116 to improve system performance.

In one embodiment, the virtual machine monitor 240 analyzes the requested PA addresses to identify access patterns. For example, when all requested PA addresses from the host fall within the restricted address access, the virtual machine monitor 240 can enable the corresponding MPU and permission filter to restrict access to the address range. The restricted address access can be configured to be used by a single host, shared by multiple hosts at the same time, or used by multiple hosts in a time-division multiplexing manner.

Referring again to FIG. 1 , the host 100 supports a plurality of VMs 130. Each VM 130 runs a guest operating system for managing VA space and managing IPA space allocation for applications. The virtual machine monitor 240 manages the VMs 130, for example, managing the scheduling of hardware resources for the VMs 130. The virtual machine monitor 240 manages the mapping between the IPA space and the extended PA space for the VMs 130. As shown in FIG. 5 , the extended PA space 550 is the PA space 510 for addressing system resources (e.g., memory 120, peripherals 140, etc.) plus the extended PA area 520 allocated to the VMs 130. The expanded PA region 520 is remapped to a continuous PA address space (located in the PA space 510 ) dedicated to addressing the VM 130 .

5 is a diagram illustrating address mapping between VM and PA space according to one embodiment. In the second-level MMU translation, the virtual address assigned to the VM is mapped to the extended PA region 520 (that is, the physical address in the extended PA region 520 is used as the virtual address of the VM). For example, the virtual address assigned to VM0 is mapped to R0 (the extended PA region 520 assigned to VM0). In the example including four VMs, each VM is allocated an extended PA region, and different VMs are allocated different extended PA regions. All extended PA regions 520 are non-overlapping and have the same size. The extended PA region 520 is outside the PA space 510; the PA space 510 and the extended PA region 520 are collectively referred to as the extended PA space 550. It will be appreciated that the memory protection mechanism described here is applicable to any number of VMs.

All extended PA regions 520 are remapped to remapped PA regions 530 in the PA space 510. The remapped PA regions 530 are dedicated to addressing VMs. The remapping is implemented by hardware. In one embodiment, different extended PA regions 520 have different offset values relative to the remapped PA regions 530. The offset value is also referred to as a base address offset. For example, the extended PA region (R0) assigned to VM0 has an offset (S0) relative to the remapped PA region; more specifically, the base address of R0 is offset by S0 from the base address of the remapped PA region 530. The extended PA region assigned to VM1 has an offset (S1) relative to the remapped PA region 530, where S1 = S0 + the size of R0. The offsets of the extended PA regions allocated to VM2 and VM3 can be calculated similarly. Taking R0 as an example, remapping R0 to the remapped PA region 530 is to shift each address in R0 by S0. The remapping of other extended PA regions can be calculated similarly.

In one embodiment, the expanded PA region 520 allocated to a VM may not be immediately adjacent to the PA space 510; or, the expanded PA region 520 allocated to a VM may be immediately adjacent to the PA space 510. As shown in FIG5 , in one embodiment, the expanded PA regions 520 allocated to different VMs may be continuous in the expanded PA space 550; or, the expanded PA regions 520 allocated to different VMs may be discontinuous in the expanded PA space 550. In one embodiment, the base address and/or size of each expanded PA region 520 may be configurable.

Allocating the extended PA region 520 to the VM allows the system to use different page sizes (or block sizes) for the guest operating system and the host operating system. Assume that VM0-VM3 run on multiple instances of the guest operating system in the computing system. The guest operating system may use a first page size for virtual memory management. The host operating system of the computer system may use a second page size (or block size) that is larger than the first page size for virtual memory management. A larger page size may reduce the overhead of host system operations. In other words, a smaller page size may be more suitable for VM operations. The MMU of each processor may perform address translation by using the second page size for host system operations and the first page size for VM operations.

FIG6 is a diagram illustrating VM memory protection according to one embodiment. In this embodiment, four VMs (VM0-VM3) are allocated with extended PA regions (e.g., R0, R1, R2, and R3, respectively). The four extended PA regions have the same size (e.g., K bytes) and do not overlap. The base address offsets of the four VMs are represented as S0, S1, S2, and S3, respectively. All four extended PA regions are mapped to one remapped PA region.

Within each expanded PA area, the virtual machine monitor or host operating system can allocate one or more address blocks and/or address segments (located in the physical address space 510) to the corresponding VM. The size of the block can be fixed (for example, the size of each block is 2MB), and the address segment can be configurable. In the embodiment of Figure 6, VM0 is allocated address block D0, VM1 is allocated address blocks D11 and D12, VM2 is allocated address block D2, and VM3 is allocated address segment D3. When R0-R3 are mapped to the remapped PA area, all allocated address blocks or segments do not overlap with each other. In one embodiment, each address segment can be individually switched on (i.e., activated) or switched off (i.e., deactivated) for allocation.

Also referring to FIG. 1 , the memory interface controller 125 may receive a request from a requesting VM (e.g., VM0) for access to a requested address in the PA space (i.e., one or more address blocks and/or address segments in the physical address space 510). Based on the request and the hardware VM settings 252, the domain ID (also referred to as the VM ID) of the requesting VM is identified as VM0. The MPU 127 checks the permission filter 126 of the identified VM ID to determine whether the request should be allowed or denied. The permission filter 126 associates VM0 with a list of address blocks and/or address segments that VM0 is allowed or denied access to. The permission filter 126 may also associate VM0 with the host on which VM0 is running. The description in conjunction with FIG. 5 and FIG. 6 is applicable to access control regarding the memory 120 and the peripheral device 140 in FIG. 1 .

FIG7 is a flow chart illustrating a method 700 for controlling access to a PA space according to one embodiment. In one embodiment, the method 700 may be performed by a system (e.g., system 100 in FIG1 ) that includes a plurality of processing circuits and a plurality of system resources addressable within a PA space (e.g., PA space 510). The processing circuits may include one or more processors and one or more direct memory access (DMA) controllers. The system resources may include one or more memory devices and one or more peripheral devices of the system.

The method 700 begins at step 710, in which the system receives a request from a request processing circuit to access a virtual address. The request processing circuit executes the requesting VM, wherein a given region (e.g., 530) in a PA space (e.g., PA space 510) is dedicated to addressing VMs executing in the system. At step 720, a given MMU coupled to the request processing circuit converts the virtual address into a requested PA accessible to the request processing circuit according to a configurable setting of the given MMU. At step 730, a given MPU coupled to the target system resource to which the requested PA is allocated grants or denies the request based on information in a permission filter indicating whether the requested PA is accessible to a requesting VM executing on a request processing circuit.

In one embodiment, the system includes a plurality of MMUs and a plurality of MPUs. Each MMU includes a first-level MMU and a second-level MMU. The second-level MMU is used to perform host-side access control on the corresponding processing circuit and can be configured to be disabled. Each MPU is used to perform target-side access control on the corresponding system resources and can be configured to be disabled. The second-level MMU uses a page size to perform host-side access control, and the MPU uses a block size larger than a page size to perform target-side access control.

In one embodiment, information in the admission filter used by a given MPU associates a requesting VM with an address in a given region of the PA space accessible to the requesting VM. The address may be indicated by one or more address blocks of the same block size, one or more address segments of configurable size, or a combination of one or more address blocks and one or more address segments.

In one embodiment, the information in the permission filter used by a given MPU can be configured to include only addresses that the request processing circuit is authorized to access. In one embodiment, the system is configured to execute a plurality of VMs, wherein the total number of VMs and a given region in the PA space are preconfigured in the hardware.

The operations of the flowchart of FIG. 7 have been described with reference to the exemplary embodiment of FIG. 1 . However, it should be understood that the operations of the flowchart of FIG. 7 may be performed by other embodiments of the present invention other than the embodiment of FIG. 1 , and that the embodiment of FIG. 1 may perform operations different from those discussed with reference to the flowchart. Although the flowchart of FIG. 7 shows a particular order of operations performed by certain embodiments of the present invention, it should be understood that such an order is exemplary (e.g., alternative embodiments may perform operations in a different order, combine certain operations, overlap certain operations, etc.).

Various functional components or blocks have been described herein. As will be understood by those skilled in the art, the functional blocks will preferably be implemented by circuits (special purpose or general purpose circuits that operate under the control of one or more processors and coded instructions), which typically include transistors configured to control the operation of the circuits according to the functions and operations described herein.

Although the present invention is disclosed as above with the preferred embodiments, it is not intended to limit the scope of the present invention. Any person with ordinary knowledge in the relevant technical field can make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be determined by the scope of the patent application.

100: System 240: Virtual Machine Monitor 241: Second Level MMU Manager 242: PA Verifier 252: Hardware VM Settings 251: Hardware VM Manager 110a,110b,110c: Baseband Processing Device 115: First Level MMU 116: Second Level MMU 130a,130b,130c,130: VM 180: Bus 125: Memory Interface Controller 126,146: Permission Filter 127,147: MPU 120: Memory 145: Peripheral Interface Controller 140: Peripheral Devices 200: Process 201,202,203,204,205,710,720,730:Steps 510:PA space 530:Remapped PA area 520:Expanded PA area 550:Expanded PA space 700:Method

FIG. 1 is a block diagram illustrating a system 100 according to one embodiment. FIG. 2 is a diagram illustrating a process 200 according to one embodiment. FIG. 3 is a diagram illustrating managing memory protection according to one embodiment. FIG. 4 is a diagram illustrating a configuration 450 for a second-level MMU manager 241 and a hardware VM manager 251 according to one embodiment. FIG. 5 is a diagram illustrating address mapping between VM and PA space according to one embodiment. FIG. 6 is a diagram illustrating VM memory protection according to one embodiment. FIG. 7 is a flow chart illustrating a method 700 for controlling access to PA space according to one embodiment.

100:System

240:Virtual machine monitor

241: Second level MMU manager

242:PA tester

252:Hardware VM settings

251:Hardware VM Manager

110a, 110b, 110c: Baseband processing equipment

115: First level MMU

116: Second level MMU

130a,130b,130c:VM

180: Bus

125:Memory interface controller

126,146:Permit filter

127,147:MPU

120: Memory

145:Peripheral interface controller

140: Peripheral equipment

Claims (18)

A system for controlling access to a physical address space, comprising: a plurality of processing circuits executing a plurality of virtual machines, wherein a given region of the physical address space is dedicated to addressing the plurality of virtual machines; a plurality of system resources addressed by the physical address space; a plurality of memory management units coupled to the corresponding processing circuits, wherein a given memory management unit is used to convert a virtual address indicated in an access request from a requesting processing circuit into a requested physical address according to a configuration setting of the given memory management unit; and a plurality of memory protection units, wherein the memory protection units are coupled to a target system resource allocated with the requested physical address. The given memory protection unit of the source is used to allow or deny the access request according to the information in the permission filter indicating whether the requesting virtual machine running on the request processing circuit can access the requested physical address, wherein the target system resource is one of the plurality of system resources, and the given memory protection unit is one of the plurality of memory protection units; wherein each memory management unit includes a first-level memory management unit and a second-level memory management unit, the second-level memory management unit is used to perform host-side access control using a page size, and the given memory protection unit uses a block size larger than the page size to perform target-side access control. A system for controlling access to a physical address space as described in claim 1, wherein each memory management unit includes a first-level memory management unit and a second-level memory management unit, the second-level memory management unit is used to perform host-side access control on the corresponding processing circuit, and the second memory management unit can be selectively disabled. A system for controlling access to a physical address space as described in claim 1, wherein each memory protection unit is used to perform target-side access control on at least one of the plurality of system resources, and each of the memory protection units can be selectively disabled. A system for controlling access to a physical address space as described in claim 1, wherein the information in the permission filter used by the given memory protection unit associates the requesting virtual machine with an address of a given area in the physical address space accessible by the requesting virtual machine. A system for controlling access to a physical address space as described in claim 4, wherein the address is indicated by one or more address blocks having the same block size, one or more address segments having a configurable size, or a combination of one or more address blocks and one or more address segments. A system for controlling access to a physical address space as described in claim 1, wherein the information in the permission filter used by the given memory protection unit is configured to include only addresses that the request processing circuit is authorized to access. A system for controlling access to a physical address space as described in claim 1, wherein the total number of virtual machines and the given area in the physical address space are preconfigured in hardware. A system for controlling access to a physical address space as described in claim 1, wherein the plurality of processing circuits include one or more processors and one or more direct memory access controllers. A system for controlling access to a physical address space as described in claim 1, wherein the one or more system resources include one or more memories and one or more peripheral devices. A method for controlling access to a physical address space, performed by a system including a plurality of processing circuits and a plurality of system resources, the method comprising: receiving a request for access to a virtual address from a request processing circuit, wherein the request processing circuit executes a requesting virtual machine, wherein a given region of the physical address space is dedicated to addressing a plurality of virtual machines executed in the system; converting the virtual address into a requested physical address accessible to the request processing circuit by a given memory management unit coupled to the request processing circuit according to a configuration setting of the given memory management unit; and A given memory protection unit having a target system resource of the requested physical address allows or denies the request based on information in a permission filter indicating whether a requesting virtual machine running on the request processing circuit can access the requested physical address, wherein the target system resource is one of the plurality of system resources; wherein each memory management unit includes a first-level memory management unit and a second-level memory management unit, the second-level memory management unit is used to perform host-side access control using a page size, and the given memory protection unit uses a block size larger than the page size to perform target-side access control. A method for controlling access to a physical address space as described in claim 10, wherein each memory management unit includes a first-level memory management unit and a second-level memory management unit, and the method further includes: enabling or disabling the host-side access control performed by the second-level memory management unit on the request processing circuit. The method for controlling access to a physical address space as described in claim 10 further comprises: enabling or disabling target-side access control performed by the given memory protection unit on the system resource. A method for controlling access to a physical address space as described in claim 10, wherein the information in the permission filter used by the given memory protection unit associates the requesting virtual machine with an address of a given area in the physical address space accessible by the requesting virtual machine. A method for controlling access to a physical address space as described in claim 13, wherein the address is indicated by one or more address blocks having the same block size, one or more address segments having a configurable size, or a combination of one or more address blocks and one or more address segments. A method for controlling access to a physical address space as described in claim 10, wherein the information in the permission filter used by the given memory protection unit is configured to include only addresses that the request processing circuit is authorized to access. A method for controlling access to a physical address space as described in claim 10, wherein the total number of virtual machines and the given area in the physical address space are preconfigured in hardware. A method for controlling access to a physical address space as described in claim 10, wherein the plurality of processing circuits include one or more processors and one or more direct memory access controllers. A method for controlling access to a physical address space as described in claim 10, wherein the one or more system resources include one or more memories and one or more peripheral devices.