Resource allocation in a multi-processor system

A system includes a memory-mapped register (MMR) associated with a claim logic circuit, a claim field for the MMR, a first firewall for a first address region, and a second firewall for a second address region. The MMR is associated with an address in the first address region and an address in the second address region. The first firewall is configured to pass a first write request for an address in the first address region to the claim logic circuit associated with the MMR. The claim logic circuit associated with the MMR is configured to grant or deny the first write request based on the claim field for the MMR. Further, the second firewall is configured to receive a second write request for an address in the second address region and grant or deny the second write request based on a permission level associated with the second write request.

BACKGROUND

A system-on-a-chip (SOC) is used in industrial applications and automotive applications in which certain processes executed by the SOC are considered critical, while other processes executed by the SOC are considered non-critical. For example, in the automotive context, certain processes related to safety (e.g., a gauge display, audio notifications) are considered critical, other processes not related to safety are considered non-critical. An exemplary automotive SOC includes a safety processor and a general purpose processor, which historically have been separate devices, but which an SOC may integrate onto a single die. Various resources of the SOC thus may be shared between critical processes and non-critical processes.

SOCs use a series of memory-mapped registers (MMRs) to configure, control, or otherwise interact with various modules and sub-blocks, such as peripheral control blocks of the SOC. For example, an SOC processor writes data to an address that maps to a MMR, which, upon having that data written configures an element of a peripheral control block (e.g., clock selection, clock division, signal multiplexing, module behavior). With multiple processors or processes operating at the same time on the SOC, a non-critical process should not be able to overwrite or otherwise corrupt a MMR that is in use by a critical process.

SUMMARY

In accordance with at least one example of the disclosure, a system includes a memory-mapped register (MMR) associated with a claim logic circuit, a claim field for the MMR, a first firewall for a first address region, and a second firewall for a second address region. The MMR is associated with an address in the first address region and an address in the second address region. The first firewall is configured to pass a first write request for an address in the first address region to the claim logic circuit associated with the MMR. The claim logic circuit associated with the MMR is configured to grant or deny the first write request based on the claim field for the MMR. Further, the second firewall is configured to receive a second write request for an address in the second address region and grant or deny the second write request based on a permission level associated with the second write request.

In accordance with another example of the disclosure, a method includes receiving a first write request for an address in a first address region, where the address in the first address region is associated with a memory-mapped register (MMR). The method also includes granting the first write request based on a claim field associated with the first MMR and receiving a second write request for an address in a second address region, where the address in the second address region is associated with the MMR. The method further includes granting the second write request based on a permission level associated with the second write request.

DETAILED DESCRIPTION

Examples of the present disclosure address the foregoing problems by assigning multiple proxy addresses to at least some of the MMRs of the SOC. For example, a respective address in a first region of proxy addresses (Proxy0 region) and a respective address in a second region of proxy addresses (Proxy1 region) are mapped to or associated with the same MMR. A firewall is provided for each region of proxy addresses. A critical process or a critical processor attempts to write to a MMR by accessing its address in the Proxy1 region. Similarly, a non-critical process or a non-critical processor should attempt to write to a MMR by accessing its address in the Proxy0 region. Thus, the firewall for the Proxy1 region rejects any attempt by a non-critical process to write to a MMR by accessing its address in the Proxy1 region. The firewall for the Proxy1 region grants attempts by critical processes to write to MMRs by accessing its address in the Proxy1 region.

A claim register contains claim fields (e.g., a claim bit) for the MMRs, which indicate whether a particular MMR is currently claimed, or in use by, a critical process or a process having a sufficiently high permission level. Thus, when a critical process wishes to protect a particular MMR from non-critical process write access (or write access by a process having an insufficient permission level), it sets the claim bit or claim field associated with that MMR with a write access through the claim register's Proxy1 address. The critical process generates the write to the claim register to set the claim bit associated with the MMR independently (before or after) of writing to the MMR itself through either proxy address. However, Proxy0 write protection is only enforced when a claim bit or field is set. For example, when a non-critical process attempts to write to a MMR through the Proxy0 region, the request is denied if the claim bit is set (indicating that MMR is being used by a critical process), and the request is granted if the claim bit is not set. When a critical process no longer requires protected use of a MMR, it generates a write request via the Proxy1 region to the claim register to unset the claim bit associated with that MMR's address. In this way, critical processes are given exclusive write access to claimed or protected MMRs (having their claim bit set) while non-critical processes are unable to write to a claimed or protected MMR (having its claim bit set). Thus, any MMR may be dynamically write-protected by a critical process without requiring more complex protection schemes such as a hardware firewall for each individual MMR, which would consume additional area and increase programming complexity.

FIG. 1shows a portion of a SOC100in accordance with examples of this disclosure. The SOC includes processors102,104coupled to an address and data bus106. In this example, the processor102is a critical processor102that executes critical processes, such as safety-related processes in the context of an automotive application. The processor104is a non-critical processor104that executes non-critical processes, which are not safety-related processes in the context of an automotive application.

The SOC100also includes a MMR module112, which includes a plurality of MMRs120a-n. In some examples, the MMRs120a-nare contiguous in address space. The MMR module112also includes at least one claim register122, which in this case includes claim bits, where each claim bit is associated with one of the MMRs120a-n. The MMRs120a-nare coupled to one or more peripherals, such as peripheral124and peripheral126. Writing data to the MMRs120a-nmay cause miscellaneous control operations to be carried out with regard to the peripherals124,126. For example, writing data to the MMR120adetermines a clock source for use by the peripherals124,126, while writing data to the MMR120bdetermines a signal multiplexing behavior for the peripheral126. The scope of this disclosure is not limited to any particular set of MMR, peripheral, and other module behaviors. The MMR module112also includes claim logic circuits118a-n, each of which is associated with and coupled to one of the MMRs120a-n. The claim logic circuits118a-nare also coupled to the claim register122. Each claim logic circuit118a-nis configured to ascertain the status of its associated MMR's120a-nassociated claim bit (or claim field), for example in response to a write request directed to the associated MMR120a-n. The claim logic circuits118a-nare explained in further detail below.

The SOC100also includes a first firewall108and a second firewall110coupled to the address/data bus106. The first firewall108is associated with a first region of proxy addresses (e.g., Proxy0 region), while the second firewall110is associated with a second region of proxy addresses (e.g., Proxy1 region). As explained above, each MMR120a-nis associated with an address in the Proxy0 region and with an address in the Proxy1 region. For example, a particular MMR120amay be written to by generating a write request to an address in the Proxy0 region or by generating a write request to an address in the Proxy1 region, subject to the restrictions explained in further detail below.

The firewalls108,110are programmed in an application-specific manner to implement different permission levels (in one example, differentiating between a critical process and a non-critical process). For example, the firewall108may be initialized (e.g., using trusted firmware) to permit access by both the critical processor102and the non-critical processor104, while the firewall110is initialized to permit access by only the critical processor102. In this example, a permission threshold exists between the critical processor102and the non-critical processor104. Thus, the firewall110permits access (e.g., a write request) by a process having a permission level above the threshold (e.g., critical processor102) and denies access by a process having a permission level below the threshold (e.g., non-critical processor104). The firewall108permits access by both the critical processor102and the non-critical processor104. Although the example ofFIG. 1only includes two permission levels, additional permission levels may be implemented using additional firewalls and proxy address regions, as discussed in further detail below.

The critical processor102and the non-critical104processor are configured to generate write requests for the MMRs120a-n, for example to control operation of the peripherals124,126. A write request may include an address that corresponds to the MMR120a-nto be written to, data to be written to the MMR120a-n, and processor or process information (e.g., a processor ID). The processor or process information, for example, identifies the processor that originated the write request, or is information that could otherwise be associated with a permission level for the originator of the write request. In some examples, a permission level is inherently specified by identification of the originating processor, for example where the critical processor102has a higher permission level, and the non-critical processor104has a lower permission level.

In the example ofFIG. 1, the critical processor102is configured to access the MMRs120a-nthrough their Proxy1 region addresses. Similarly, the non-critical processor104is configured to access the MMRs120a-nthrough their Proxy0 region addresses. Thus, the Proxy1 firewall110is configured to grant write requests having a processor ID corresponding to the critical processor102. On the other hand, the Proxy1 firewall110is configured to deny write requests having a processor ID corresponding to the non-critical processor104.

The claim logic circuits118a-nserve as additional gatekeepers on the ability to write to the MMRs120a-n. The claim logic circuits118a-nare coupled to the Proxy0 region firewall108by a Proxy0 address decode114, and to the Proxy1 region firewall110by a Proxy1 address decode116. Thus, the claim logic circuits118a-nmay determine from which proxy region—Proxy0 or Proxy1—a write request originated. The Proxy1 region firewall110only allows write requests from the critical processor102, which are allowed to overwrite even an MMR120a-nthat is in use by the non-critical processor104. Thus, when a claim logic circuit118areceives a write request from the Proxy1 address decode116coupled to the Proxy1 region firewall110, the claim logic circuit118acarries out the write request and writes the data to its associated MMR120a. As explained above, if the critical process requires access to the MMR120ato be protected against writes by non-critical processor104or processes running on the non-critical processor104, the critical process generates a separate write to the claim register122to update the associated claim field or claim bit (Bit0, in this example) of the claim register122(e.g., by “setting” the bit to a ‘1’). In some examples, the critical processor102may execute multiple critical processes having the same permission level, and thus the Proxy1 region firewall110allows write requests from such critical processes and the claim logic circuit118acarries out write requests from such critical processes.

The Proxy0 region firewall108receives write requests from the non-critical processor104; however, since the Proxy0 region firewall108does not have insight to whether a MMR120a-nis in use by the critical processor102, the Proxy0 region firewall108passes write requests on to the Proxy0 address decode114. Thus, when a claim logic circuit118areceives a write request from the Proxy0 address decode114coupled to the Proxy0 region firewall108, the claim logic circuit118aaccesses the associated claim bit (Bit0, in this example) and determines whether Bit0is set. If Bit0is set, indicating that the MMR120ais in use by the critical processor102, the claim logic circuit118ablocks the write request from the non-critical processor104to the MMR120a. In some examples, the claim logic circuit118amay update one or more status registers (e.g., an error bit) to reflect the occurrence of an error as a result of blocking the write request from the non-critical processor104to the MMR120a. An interrupt may be triggered as a result of the update to the status registers and/or error bit, which may cause a notification to the non-critical processor104. However, if Bit0is not set, the claim logic circuit118acarries out the write request and writes the data to its associated MMR120a. Since writes to the claim register122are only permitted via the Proxy1 region firewall110(which would block a non-critical process write request) and the Proxy1 address decode116, non-critical processes are not able to set claim bits, although a non-critical process may read from the claim register122in some examples.

As a result of the foregoing scheme to limit access to the MMRs120a-n, a non-critical process that has become corrupted and attempts to access the MMRs120a-nthrough the Proxy1 address region will be blocked by the Proxy1 region firewall110because the processor ID will still indicate that the request is from the non-critical processor104. Further, the critical processor102is given write exclusivity over MMR120a-naccess in all cases, since its access is through the Proxy1 region firewall110, which the claim logic circuits118a-nallow in all cases. Finally, the non-critical processor104is unable to overwrite an MMR120a-nin use and protected by the critical processor102(for which the critical processor102has set the associated claim bit or field), since the claim bit or field will indicate that the MMR120a-nis in use by the critical processor102and the claim logic circuits118a-nwill not allow a request from the Proxy0 address decode114to overwrite an in-use and protected MMR120a-n.

FIG. 1illustrates an example with two permission levels (e.g., critical processor102and non-critical processor104). However, other examples of this disclosure extend the concepts described above with respect toFIG. 1to additional numbers of permission levels. For example, four permission levels are implemented by coupling first, second, third, and fourth firewalls to the address/data bus106. Each firewall is associated with a region of proxy addresses (e.g., Proxy0 region, Proxy1 region, Proxy2 region, and Proxy3 region). Similar to above, each MMR120a-nis associated with an address in each region. For example, a particular MMR120amay be written to by generating a write request to an address in the Proxy0 region, the Proxy1 region, the Proxy2 region, or the Proxy3 region, subject to the restrictions explained in further detail below.

For ease of reference, in this example there are four processors of differing permission levels—P0, P1, P2, and P3, with P3 being the highest permission level (e.g., critical processor102)—that may attempt to write to the MMRs120a-n. The P0 level processor is configured to address its write requests to the Proxy0 region addresses and firewall. The P1 level processor is configured to address its write requests to the Proxy1 region addresses and firewall. The P2 level processor is configured to address its write requests to the Proxy2 region addresses and firewall. The P3 level processor is configured to address its write requests to the Proxy3 region addresses and firewall.

Thus, the Proxy3 firewall is configured to grant write requests originating from the P3 level processor (e.g., above a permission threshold for the Proxy3 firewall). On the other hand, the Proxy3 firewall is configured to deny write requests originating from the P0-P2 level processors (e.g., below a permission threshold for the Proxy3 firewall). The Proxy2 firewall is configured to grant write requests originating from the P2 level processor (e.g., above a permission threshold for the Proxy2 firewall) and to deny write requests originating from the P0 and P1 level processors (e.g., below a permission threshold for the Proxy2 firewall). The Proxy1 firewall is configured to grant write requests originating from the P1 level processor (e.g., above a permission threshold for the Proxy1 firewall) and to deny write requests originating from the P0 level processor (e.g., below a permission threshold for the Proxy1 firewall). The Proxy0 region firewall does not have particular insight to whether a MMR120a-nis in use by a higher level processor, and thus the Proxy0 region firewall passes write requests from the P0 level processor on to the Proxy0 address decode.

As above, the claim logic circuits118a-nserve as additional gatekeepers on the ability to write to the MMRs120a-n. In this example, the claim logic circuits118a-nare coupled to the Proxy0 region firewall by a Proxy0 address decode, to the Proxy1 region firewall by a Proxy1 address decode, to the Proxy2 region firewall by a Proxy2 address decode, and to the Proxy3 region firewall by a Proxy3 address decode.

Similar to above, the Proxy3 region firewall only allows write requests from the P3 level, or critical processor102, which is allowed to overwrite even an MMR120a-nthat is in use by the P0-P2 level processors. Thus, when a claim logic circuit118areceives a write request from the Proxy3 address decode coupled to the Proxy3 region firewall, the claim logic circuit118acarries out the write request and writes the data to its associated MMR120a. If the P3 level processor requires protected access of the MMR120a(from the P0-P2 level processors), the P3 level processor generates a separate write to the claim register122to update the associated claim field of the claim register122(e.g., by “setting” the bit to a ‘11’). In some examples, the claim register122is doubled in length to accommodate two bits per claim field per MMR120a-n, while in other examples a second claim register (not shown for simplicity) is utilized, where a claim field comprises one bit from the first claim register and one bit from the second claim register. The scope of this disclosure is not limited to any particular implementation of the claim register and per-MMR claim fields.

The Proxy2 region firewall only allows write requests from the P2 level, which is allowed to overwrite an MMR120a-nthat is in use by the P0 and P1 level processors, but not that is in use by the P3 level processor. Thus, when a claim logic circuit118areceives a write request from the Proxy2 address decode coupled to the Proxy2 region firewall, the claim logic circuit118aaccesses the associated claim field and determines whether the claim field indicates the P3 level processor is using the MMR120a(e.g., being set to ‘11’). If the claim field indicates that the MMR120ais in use by the P3 level processor, the claim logic circuit118ablocks the write request from the P2 level processor. However, if the claim field is any value other than ‘11’, the claim logic circuit118acarries out the write request and writes the data to its associated MMR120a. In this example, if the P2 level processor requires protected access of the MMR120a(from the P0 or P1 level processors), the P2 level processor generates a separate write to the claim register122to update the associated claim field of the claim register122(e.g., by “setting” the bit to a ‘10’).

The Proxy1 region firewall only allows write requests from the P1 level, which is allowed to overwrite an MMR120a-nthat is in use by the P0 level processor, but not that is in use by the P2 or P3 level processors. Thus, when a claim logic circuit118areceives a write request from the Proxy1 address decode coupled to the Proxy1 region firewall, the claim logic circuit118aaccesses the associated claim field and determines whether the claim field indicates the P2 or P3 level processors are using the MMR120a(e.g., being set to ‘11’ or ‘10’). If the claim field indicates that the MMR120ais in use by the P2 or P3 level processors, the claim logic circuit118ablocks the write request from the P1 level processor. However, if the claim field is any value other than ‘11’ or ‘10’, the claim logic circuit118acarries out the write request and writes the data to its associated MMR120a. In this example, if the P1 level processor requires protected access of the MMR120a(from the P0 level processor), the P1 level processor generates a separate write to the claim register122to update the associated claim field of the claim register122(e.g., by “setting” the bit to a ‘01’).

The Proxy0 region firewall only allows write requests from the P0 level, which is not allowed to overwrite an MMR120a-nthat is in use by the P1-P3 level processors. Thus, when a claim logic circuit118areceives a write request from the Proxy1 address decode coupled to the Proxy1 region firewall, the claim logic circuit118aaccesses the associated claim field and determines whether the claim field indicates the P1-P3 level processors are using the MMR120a(e.g., being set to any value other than ‘00’). If the claim field indicates that the MMR120ais in use by the P1-P3 level processors, the claim logic circuit118ablocks the write request from the P0 level processor. However, if the claim field is ‘00’, the claim logic circuit118acarries out the write request and writes the data to its associated MMR120a.

Still further examples of this disclosure include additional permission levels, supported by extending the schemes described above. Further, the MMR module112ofFIG. 1may comprise one of multiple partitions of MMRs. For example, the MMR module112may be repeated as multiple partitions, with each partition having a Proxy0 region of addresses and a Proxy1 region of addresses (each with an associated firewall as an access point).

FIG. 2shows a flow chart of a method200in accordance with examples of this disclosure. The method200begins when a write request directed at an MMR is received at block202and it is determined whether the write request is directed to an address in a first address region (e.g., the Proxy0 address region) or to an address in a second address region (e.g., the Proxy1 address region). If the write request is directed to the Proxy1 address region, the method200continues in block204with determining whether a permission level associated with the originator (e.g., one of the processors102,104) the write request is above a permission threshold. For example, the critical processor102permission level is above the permission threshold, while the non-critical processor104permission level is below the permission threshold.

If the permission level associated with the originator is above the permission threshold, the method200continues in block208with granting the write request. In some cases, the sufficiently high-permission (e.g., having a permission level above the permission threshold) originator entity (e.g., the critical processor102) may require protected access to the MMR, and thus generates a separate write to the claim register122to update the associated claim field or bit to indicate that the sufficiently high-permission entity is protecting the MMR to which the write request was directed. As explained above, the sufficiently high-permission entity may generate the separate write request to the claim register122before or after generating the write request for a MMR.

Referring back to block202, if the write request is directed to the Proxy0 address region, the method200continues in block212with determining whether a claim field (e.g., a claim bit in this example) is set, which indicates that a higher-permission entity (e.g., the critical processor102) is using the associated MMR120. For example, if the critical processor102is using the MMR, the claim bit will be set. On the other hand, if the critical processor102is not using the MMR, the claim bit will not be set.

If the claim field or bit is set, the method200continues in block214with denying the write request. If the claim field or bit is not set, the method200continues in block215with granting the write request. Unlike the sufficiently high-permission entity above, a lower-permission entity (e.g., the non-critical processor104having a permission level below the permission threshold) write request to the claim register122is denied, although the lower-permission entity may read from the claim register in some examples.

FIG. 3shows a flow chart of another method300in accordance with examples of this disclosure. The method300pertains to updating the claim fields or claim bits of the claim register122. The method300begins in block302in which the claim register122receives a request to update a claim field or claim bit (depending on the particular implementation, as described above). Referring to the example ofFIG. 1, only the critical processor102is permitted to set a claim bit to protect a particular MMR120a-nfrom write access by the non-critical processor104. The method300continues in block304with determining whether the request to update the claim field or claim bit originates from a process having a sufficiently high permission. For example, since the critical processor102directs its requests to update the claim register122to the Proxy1 region firewall110, the claim register122receives such requests from the Proxy1 address decode116. The non-critical processor104directs its requests to the Proxy0 region firewall108(and the Proxy1 region firewall would block such requests), and thus the claim register122receives such requests from the Proxy0 address decode114. As a result, if the claim register122receives a request to update a claim field or claim bit from the Proxy0 address decode114, the method300continues to block308and the request is denied. However, if the claim register122receives a request to update a claim field or claim bit from the Proxy1 address decode116, the method300continues to block306and the request is granted and the claim field or claim bit is updated (e.g., set to a ‘1’ or cleared to a ‘0’ in the example ofFIG. 1).

In the foregoing discussion and in the claims, the terms “including” and “comprising” are used in an open-ended fashion, and thus should be interpreted to mean “including, but not limited to . . . .” Also, the term “couple” or “couples” is intended to mean either an indirect or direct connection. Thus, if a first device couples to a second device, that connection may be through a direct connection or through an indirect connection via other devices and connections. Similarly, a device that is coupled between a first component or location and a second component or location may be through a direct connection or through an indirect connection via other devices and connections. An element or feature that is “configured to” perform a task or function may be configured (e.g., programmed or structurally designed) at a time of manufacturing by a manufacturer to perform the function and/or may be configurable (or re-configurable) by a user after manufacturing to perform the function and/or other additional or alternative functions. The configuring may be through firmware and/or software programming of the device, through a construction and/or layout of hardware components and interconnections of the device, or a combination thereof. Additionally, uses of the phrases “ground” or similar in the foregoing discussion are intended to include a chassis ground, an Earth ground, a floating ground, a virtual ground, a digital ground, a common ground, and/or any other form of ground connection applicable to, or suitable for, the teachings of the present disclosure. Unless otherwise stated, “about,” “approximately,” or “substantially” preceding a value means+/−10 percent of the stated value.