Patent Description:
In many instruction execution systems, shared memory contents may be compromised by unauthorized access by a request to read or write data to the shared memory. These unauthorized accesses can undesirably corrupt the memory contents. <CIT> discloses a filter unit with an interface circuitry configured to intercept coherency protocol transactions exchanged between a master device including a first cache and an interconnect for managing coherency between the first cache and another cache or another master device. A filtering circuitry is provided to filter the coherency protocol transactions based on memory access permission data defining which regions of an address space the master device is allowed to access, wherein the filtering circuitry is placed between the master device and the interconnect.

The accompanying drawings provide visual representations, which will be used to more fully describe various representative embodiments and can be used by those skilled in the art to better understand the representative embodiments disclosed and their inherent advantages. In these drawings, like reference numerals identify corresponding elements.

While this disclosure is susceptible of embodiment in many different forms, there is shown in the drawings and will herein be described in detail specific embodiments, with the understanding that the present disclosure is to be considered as an example of the principles described and not intended to limit the disclosure to the specific embodiments shown and described. In the description below, like reference numerals are used to describe the same, similar or corresponding parts in the several views of the drawings.

In this document, relational terms such as first and second, top and bottom, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. The terms 'comprise', 'comprises,' 'comprising,' or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by 'comprises. a' does not, without more constraints, preclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

Reference throughout this document to 'one embodiment', 'certain embodiments', 'an embodiment' or similar terms means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present disclosure. Thus, the appearances of such phrases or in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments without limitation.

The term 'or' as used herein is to be interpreted as an inclusive or meaning any one or any combination. Therefore, 'A, B or C' means 'any of the following: A; B; C; A and B; A and C; B and C; A, B and C'. An exception to this definition will occur only when a combination of elements, functions, steps or acts are in some way inherently mutually exclusive.

For simplicity and clarity of illustration, reference numerals may be repeated among the figures to indicate corresponding or analogous elements. Numerous details are set forth to provide an understanding of the embodiments described herein. The embodiments may be practiced without these details. In other instances, well-known methods, procedures, and components have not been described in detail to avoid obscuring the embodiments described. The description is not to be considered as limited to the scope of the embodiments described herein.

Embodiments described herein show how shared memory contents can be protected from unauthorized accessors in a data processing network by using Read/Write permission per master per memory region.

In accordance with the present disclosure, there is provided an improved expedient for accessing shared memory while preventing unauthorized access.

<FIG> is a schematic of an example data processing network <NUM>. In this simple example, the network is configured as a 1x3 mesh CMN (coherent mesh network). The cross points (MXP) provide points of intersection in the data processing network and are responsible for routing the protocol packets of a message to the correct node based on the target node identifier. One example of a CMN is the Arm® CoreLink™ CMN-<NUM> Coherent Mesh Network, which is designed for intelligent connected systems across a wide range of applications including networking infrastructure, storage, server, HPC, automotive, and industrial solutions. The highly scalable mesh is optimized for Arm®v8-A processors and can be customized across a wide range of performance points. The data processing network may include a coherent interconnect such as, for example, the ARM® CMN family of products that are based on the ARM® AMBA®<NUM> CHI protocol (ARM® and AMBA® are registered trademarks of Arm Limited). The interconnect specification identifies devices in an interconnect as described below.

The network may include one or more requesting nodes that operate as request masters and initiate data transactions. Example requesting nodes are:.

The network may also include one or more home nodes that receive access requests from requesting nodes. Each home node serves as a point of coherence, and serialization, for a given set of memory addresses and may include a snoop filter for monitoring data transactions and maintaining a record of which data lines are stored at or owned by one or more nodes. When a memory access is received at a home node, a snoop request may be sent to nodes having copies of the accessed data in their local cache. Example home nodes include fully-coherent home nodes (HN-Fs) that service normal memory requests and I/O coherent home nodes (HN-Is) that are responsible for servicing I/O requests. Such nodes may contain cache memory and a snoop filter for efficient coherency resolution and hence send snoops when required. The cache memory is typically fast random access memory (RAM) that a processor can access more quickly than it can access regular RAM.

In addition, the data processing network includes one or more slave nodes that service requests from home nodes if the requests cannot be serviced locally in home nodes. Examples of slave nodes are a memory controller or a requesting node. Otherwise, requests are serviced by the home node that receives the request.

As shown in <FIG>, RNF (fully-coherent requesting node) <NUM> is operatively coupled to MXP (mesh cross-point) <NUM>. MXP <NUM> is operatively coupled to MXP <NUM> and MXP <NUM>. MXP <NUM> is operatively coupled to RNI (I/O coherent requesting node) <NUM> and HNF (fully-coherent home node) <NUM>. MXP <NUM> is operatively coupled to SNF (fully-coherent slave node) <NUM> and HND (home node) <NUM>. Requesting nodes <NUM>, <NUM> access data by sending a request to home nodes (HN-F/HN-I) <NUM>, <NUM>. Slave node <NUM> may be a dynamic memory controller (DMC), for example.

For read accesses, home node <NUM> looks up the incoming address in the cache memory and slave node <NUM>. If the address is available in the cache memory, the request will be serviced by providing the data. If the data is not available in the cache but is hit in slave node <NUM>, the home node <NUM> sends a snoop request to the RN-F <NUM> that contains the cache line and services the request. The snooped RN-F <NUM> can send the data back to home node <NUM> (so that the home node can service the request) or directly send the data to requesting node <NUM> in a process called DCT (Direct Cache Transfer) depending on the type of snoop request.

For write accesses from RN-F <NUM>, home node <NUM> checks if the request is for a partial write or full cache line write. Depending on the size of the request, the home node <NUM> may merge the request data along with memory data or snooped data. The merged data is either written back to memory (slave node) or may be filled into the cache based on the request attribute and if the cache was present in the home node.

If the request incurred any error in the home node for example, a cache access error or a snoop error, the home node will complete the request by responding with the error status and may optionally raise an interrupt so that the master node knows the access status.

A coherent network protocol, such as the AMBA®<NUM> CHI protocol, may specify various action requests:.

In a coherent network, various actions are performed to ensure that shared data is maintained in a coherent manner. For example, the actions may ensure that a node does not have an out-of-date copy of data. However, Read/Write accesses by unauthorized masters could lead to corrupting memory contents, and simple permission-based filtering does not address coherent systems where the unauthorized master could expose corrupt data in many different ways. Thus, in a protected memory system, some the desired actions - such as writing modified data back to a shared memory, may be not be permitted by a particular node. This has an impact on coherence maintenance.

The present disclosure is directed towards protecting memory in a coherent data processing network.

In one embodiment a request message from a first requesting node of the data processing network is received at a home node of the data processing network. The request message comprises an action request for data associated with a first address in a shared memory of the data processing network and one or more access permissions for the first requesting node for the first memory address. The request action may be for reading, writing or changing a coherence state of data associated with the first memory request, for example. The home node determines, from the one or more access permissions, if the requested action is permitted by the first requesting node. When the requested action is permitted by the first requesting node, data associated with the first memory address is accessed from a system cache, a local cache of a second requesting node of the data processing network or the shared memory in accordance with a coherency protocol. However, when the requested action is not permitted by the first requesting node, a response message is sent to the first requesting node without accessing the data associated with the first memory address.

Access permissions may be provided by using memory protection units (MPUs) located at cross-points of the data processing network. The MPUs have registers that are configurable to define access permissions for a request coupled to the network at the cross-point.

<FIG> illustrates system <NUM> with an example of a data processing network that incorporates memory protection units (MPUs). <FIG> shows master nodes RN-F <NUM>, RN-I <NUM>, mesh cross-points (MXP) <NUM>, <NUM>, <NUM>, home nodes HN-I <NUM>, HN-F <NUM>, slave node SN-F <NUM> and MPUs <NUM>, <NUM>. The system <NUM> of <FIG> may be a coherent mesh network, for example.

Each of the requesting node masters (RN-F <NUM> and RN-I <NUM>) in system <NUM> is coupled to the network interconnect via a Memory Protection Unit (MPUs <NUM> and <NUM>, respectively). The MPUs (<NUM>, <NUM>) contain configurable registers which are programmed with address regions and the corresponding Read/Write permissions as shown in <FIG>.

As stated above, the memory protection unit (MPU) <NUM>, <NUM> may be a computer hardware unit. The MPU may be implemented as part of the central processing unit (CPU), as part of an interconnect fabric, or as a separate hardware module or block. In some embodiments, the MPU is a trimmed-down version of memory management unit (MMU) that provides only memory protection support and may be implemented in low power processors that require only memory protection rather than other memory management features such as virtual memory management.

First requesting node <NUM> is coupled to the home node <NUM> via a first memory protection unit <NUM> of the data processing system <NUM>. First memory protection unit <NUM> receives an action request from the first requesting node <NUM>, determines the one or more access permissions assigned to the first requesting node dependent upon the first memory address, and augments the action request with the one or more access permissions for the first requesting node before sending it to home node <NUM>.

In an embodiment in accordance with the disclosure, the access permissions are stored in bits of the request that are unused in an existing architected interface, thereby enabling memory protection to be added to an existing messaging protocol. In another embodiment, an existing field (such as a transaction identifier field) in the request is extended to store the access permissions. In yet another embodiment, an additional field is added to the request to store the access permissions.

<FIG> illustrates an example <NUM> of memory protection unit (MPU) address regions and permissions. MPU region <NUM>, <NUM>(a), through MPU region N, <NUM>(n) (where 'n' is any suitable number), each have a read area <NUM>, write area <NUM>, start address <NUM> and end address <NUM>. The number of MPU regions is a design choice and any suitable number may be used. MPU region <NUM>, <NUM>(a), has associated read portion <NUM>(a), write portion <NUM>(a), start address <NUM>(a) and end address <NUM>(a). Similarly, MPU region N <NUM>(n) has associated read portion <NUM>(n), write portion <NUM>(n), start address <NUM>(n) and end address <NUM>(n).

When a requesting node (e.g. <NUM> shown in <FIG>) sends a request to a cross-point (e.g. <NUM> shown in <FIG>), the address from the request is looked up in the MPU against regions represented by the start address <NUM> and end address <NUM>. When a match is found, the corresponding Read and Write permission attributes for that region <NUM> are sent along with the request to the home node.

The MPU may also contain default Read/Write permissions if a region match is not found. The HN's then use the R/W permissions to allow access to memory contents.

A read request from a requesting node to a home node is intercepted by the MPU. The memory address to be read is looked-up in a table in the MPU to determine access permissions for the requesting node for the memory address. The MPU then augments the read request with the access permissions (APs) and forwards the augmented request to the home node. The flow is thus:
Requesting node → RN_Req → MPU Region lookup → RN _Req+APs → Home Node.

For snoop requests that a home node sends to a RN-F, the snoop address from the snoop request is looked up in the MPU. The snoop response is augmented with the access permissions and the augmented snoop response is sent back to the home node. The home node can then utilize the access permissions on the snoop response to make a decision. The flow is:
Home Node → HNF_Snp_request → MPU lookup → SnoopResponse + APs → Home Node.

The home node filters the snoop response based on the R/W access permissions.

<FIG> shows an example <NUM> of read/write request types with permitted access. A first requesting node, CPU <NUM>, is in communication with home node <NUM> and slave node <NUM>. In the example shown, slave node <NUM> is a dynamic memory controller (DMC).

A read request <NUM> is transmitted from CPU <NUM> to home node <NUM>, which performs permission filtering, cache or memory access <NUM>. In this example the CPU has read and write (R/W) access permission for the address and read request <NUM> is augmented with these permissions. The read request <NUM> is permitted and is transmitted to DMC <NUM>. In response to message <NUM>, data <NUM> is transmitted from DMC <NUM> to CPU <NUM>.

An acknowledgement <NUM> is transmitted from CPU <NUM> to home node <NUM>.

A write request <NUM> is sent from CPU <NUM> to home node <NUM>. In response, home node <NUM> will perform permission filtering, cache allocation or a memory write <NUM>. Before the memory write, a 'buffer ready' message <NUM> is sent from home node <NUM> to CPU <NUM> to indicate that the home node is ready to receive the data and has storage available for buffering the data. Data <NUM> is transmitted from CPU <NUM> to home node <NUM> and a write request <NUM> is transmitted from home node <NUM> to DMC <NUM>. A 'buffer ready' message <NUM> is sent from DMC <NUM> to home node <NUM>. Eventually, if this is a cache line victim, a memory write is performed <NUM> by the home node <NUM>. Data <NUM> is transmitted from home node <NUM> to DMC <NUM>.

Thus, in some embodiments, a home node responds to action requests in accordance with the augmented access permissions. In other words, the home node 'filters' the action request dependent upon the augmented access permissions. For example, when the action request comprises a read request and the one or more access permissions do not include read permission, the home node sends dummy data back to the first requesting node rather than servicing the request.

When the action request comprises a write request for modified data and the one or more access permissions do not include write permission, the home node discards the modified data and, optionally, invalidates the modified data at the first requesting node.

<FIG> depicts an example <NUM> of request filtering based on access permissions in accordance with various embodiments of the disclosure. The series of actions are shown by arrows that denote information flows between a CPU, home node and DMC. <FIG> illustrates a CPU timeline <NUM>, home node timeline <NUM> and DMC timeline <NUM>, where time increases from top to bottom. The flow of information may be generated by the hardware of the data processing network, by software executed on a processor, or by a combination thereof.

The requestor protection mechanism as shown in <FIG> protects good data from being sent to the CPU <NUM>. The first transaction is a read request <NUM> from the CPU. A read request <NUM> is transmitted from the CPU to the home node. Read request <NUM> is augmented with the access permissions (~R/~W). A permission filter of the home node determines from the access permissions that the read is not permitted so no cache or memory access is performed at <NUM>. Instead, dummy data <NUM> is transmitted from the home node to the CPU and an acknowledgement <NUM> is transmitted from the CPU back to the home node.

A second transaction is a write request <NUM>. A write request message <NUM>, augmented with the access permissions (~R/~W), is sent from the CPU to the home node. In response, home node <NUM> determines from the access permissions that the CPU does not have write permission and the request is dropped at <NUM>. Before the request is dropped, a 'buffer ready' message <NUM> is transmitted from the home node to the CPU and data <NUM> is transmitted from the CPU to the home node. Data <NUM> is dropped, however, since the requestor did not have write permission. Data <NUM> is not written to memory. Alternatively, the home node may send an error message to the CPU in the 'buffer ready' message <NUM>.

The apparatus and system operation of <FIG> shows that the requestor protection mechanism provides request filtering based on access permissions. These permissions include read permission, write permission and snoop permission.

Read permission: If the RN did not have read permission on a read request, the home node (HN) will not lookup internal cache or snoop any RN-F's that may have the cache line. The HN will respond to the request with zero data and an error status indicating that the read request encountered an MPU violation.

Write permission: If the RN did not have write permission, the HN will process the request but any dirty data from the RN is not updated to memory. The HN may indicate permission error on any completion responses when required.

Snoop permission: If an RN-F has to be snooped for coherency, the permissions on the snoop response are checked. If the snooped RN-F returns data, it will be filtered. A snoop response with dirty data will only be admitted of the RN-F had write permissions is shown in <FIG>.

When the action request comprises a read request for data and a copy of the requested data is stored in a local cache of a second requesting node, the home node may retrieve data from the second requesting node by sending a snoop message to the second requesting node and receiving a data response. The data response is augmented by the access permissions of the second requesting node. When the retrieved data is in a modified state, the home node proceeds depending upon the access permissions, as illustrated in <FIG> discussed below.

When the second requesting node has write permission for the modified data and the first requesting node does not have write permission for the modified data, the home node writes the modified data to the shared memory at the first memory address to change the modified data to clean data and sends the clean data to the first requesting node.

When the second requesting node has write permission for the modified data when the first requesting node has write permission for the modified data, the home node sends the modified data to the first requesting node.

When the second requesting node does not have write permission for the modified data, the home node retrieves clean data from the shared memory at the first memory address, sends the clean data to the first requesting node, and invalidates the data associated with the first memory address at the second requesting node.

<FIG> is a signal flow chart <NUM> of snooped central processing unit (CPU) filtering based on access permission. Snoop response with dirty data will only be admitted if the RN-F had Write permissions. Similarly, the clean data is only admitted if the RN-F had Read permission. If there was an MPU violation, the data is dropped. The home node will fetch data from DMC and service the request. As shown in <FIG>, the signal flow chart <NUM> for a read request transaction <NUM> is initiated by a first requesting node, CPU0. <FIG> further shows CPU0 timeline <NUM>(a), home node timeline <NUM>, a second requesting node (CPU1) timeline <NUM>(b) and DMC timeline <NUM>. A read request with read and write permission (R/W) <NUM> is transmitted from the first requesting node (CPU0) to the home node. The permission filter of the home node permits cache and/or memory access <NUM> since CPU0 has read permission. A snoop request <NUM> is transmitted from home node to the second requesting node (CPU1), which has been determined to have a copy of the requested data. CPU1 responds by returning modified or 'dirty' snoop data <NUM> to the home node. The snoop data is augmented by the (R/~W) access permissions of CPU1. Since CPU1 does not have write permission, the snoop data is dropped at <NUM> by the home node and a read request <NUM> is sent from the home node to the DMC to retrieve clean data. Clean data <NUM> is then transmitted from the DMC to CPU0 and an acknowledgement <NUM> is sent from CPU0 to the home node.

<FIG> illustrates another embodiment <NUM> in which the first requesting node (CPU0) has read permission but does not have write permission (R/~W). This expedient is an example of controlling 'clean' data versus 'dirty' (modified) data based on access permission, and shows CPU0 timeline <NUM>(a), home node timeline <NUM>, a second requesting node (CPU1) timeline <NUM>(b) and DMC timeline <NUM>. The home node in such cases writes the modified data to the DMC and provides clean data to the first requesting node. If the modified data was provided without DMC write, any subsequent evictions from the CPU would have been dropped (due to write permission filtering) thereby losing the modified data.

<FIG> further shows a read request transaction <NUM> initiated by first requesting node, CPU0. Read request <NUM>, which has read permission but not write permission (R/~W), is transmitted to home node. Since CPU0 has read permission, the permission filter of the home node permits cache and/or memory access <NUM>. A snoop request <NUM> is transmitted from the home node to second requesting node (CPU1). CPU1 transmits modified dirty data <NUM>, augmented with (R/W) permission, to home node <NUM>. Since the write is permitted, the home node sends write request <NUM> (with R/W permissions) to the DMC to initiate writing the modified data to memory <NUM>. 'Buffer ready' <NUM> signal is transmitted from DMC to home node and data <NUM> is then transmitted from home node to DMC to complete that write-back to memory and change the coherence state of the data from modified (dirty) to clean. The clean data <NUM> is transmitted from the home node to CPU0 and an acknowledgment <NUM> is transmitted from CPU0 to the home node.

When the action request comprises a request to invalidate data at the first address for which the first requesting node does not have write permission, and when a copy of the data is stored at a second requesting node, the home node retrieves the data associated with the first memory address from the second requesting node. When the retrieved data is in a modified coherence state, the home node writes the retrieved data to the shared memory at the first memory address to change the coherence state of the data associated with the first memory address from 'modified' to 'clean' and invalidates the data associated with the first memory address at the second requesting node.

<FIG> is a signal flow chart <NUM> of a method for invalidating request permission filtering. <FIG> shows CPU0 timeline <NUM>(a), home node timeline <NUM>, a second requesting node (CPU1) timeline <NUM>(b) and DMC timeline <NUM>. The invalidating transaction <NUM> is initiated by CPU0. A request to invalidate data stored at other nodes may be designated as a request to make the data unique. A 'make unique' request <NUM>, augmented with (R/~W) access permissions is transmitted to the home node. The permission filter at the home node converts the request to a 'clean-unique' request at <NUM>. A 'snoop-clean-invalid' request <NUM> is transmitted from the home node to CPU1. CPU1 transmits modified data <NUM>, augmented with (R/W) permissions, to the home node to provide snoop data <NUM>. Completion of the invalidation is sent in message <NUM> from the home node to CPU0 and an acknowledgment <NUM> is transmitted from CPU0 to the home node.

In order to prevent the modified data from being lost, the home node sends write request <NUM>, with (R/W) permissions, to the DMC. 'Buffer ready' <NUM> signal is transmitted from DMC to the home node and data <NUM> is then transmitted from the home node to DMC. Thus, the data is written back to the memory at <NUM>.

In an instance of invalidating request permission, requests that are invalidating types and have Read-only permission (e.g., ReadOnceMakeInvalid, MakeUnique, etc.) where the RN (requesting node) may receive the data or completion without data while invalidating memory contents from all downstream or peer cache, the home node will convert such requests to non-invasive type requests as shown in <FIG>. For example, MakeUnique request <NUM> is converted to CleanUnique request <NUM> and ReadOnceMakeInvalid (not labeled) is converted to ReadOnceCleanInvalid (not labeled). Such conversion ensures that existing dirty or modified data in the system is written to memory and completion does not corrupt any memory contents.

For CMOs, the home node will do similar conversion to a non-invasive type request if the requesting node had Read-Only permission. For example, MakeInvalid is converted to CleanInvalid. If the requesting node had no read or write permission, then the transaction is completed without updating the memory.

Another sequence is data-less request permission in which certain request types such as MakeUnique and CleanUnique have completions without data. If the CPU does not require a permission error notification (bus error), it can falsely transition to 'clean' status. Thus, clean data is data that is suitable for storing in coherent memory. This data is different than dirty data since it is valid, or clear, or acceptable. Subsequent snoops to this cache line could expose the bad data to other CPUs and memory locations. To avoid this, the home node follows the data-less request completion with Invalidating snoop requests (SnpMakeInvalid) to invalidate the cache line in the RN cache. This ensures that the CPU does not have the cache line in unique state.

<FIG> is a signal flow diagram <NUM> of a method for permission filtering of a write request, in accordance with various embodiments. In this connection, there is shown timeline <NUM> for a first request node (CPU0), timeline <NUM> for a home node (HN-F), timeline <NUM> for a second requesting node (CPU1). Access request <NUM> is a 'WriteClean' request to write back modified (dirty) data to the memory to change the status of the data from dirty to clean. However, access permissions augmented to the request indicate that CPU0 does not have write permission for the data address. On receipt of the request, the home node HN-F determines that CPU0 does not have write permission. The home node does not snoop CPU1 and does not write the data back to memory. The home node sends a completion message <NUM> back to CPU0, which indicates that the home node is ready to receive data. The CPU0 sends the data to the home node in message <NUM>. Thus, for time period <NUM>, CPU0 has 'bad' data that is modified (dirty) but cannot be written back to memory. Once the data is written back to the home node in message <NUM>, CPU0 changes the status of the data to 'clean'. However, the data is still 'bad'. The home node then sends invalidation message <NUM> to CPU0 to invalidate the data stored at CPU0. CPU0 acknowledges this in message <NUM>. Thus, for time period <NUM>, CPU0 shows the status of the data as 'clean', but in time period <NUM> the data is shown as invalid.

<FIG> is a signal flow diagram of a method for permission filtering of a read request in accordance with various embodiments of the disclosure. The flow diagram includes a timeline <NUM> for a first request node (CPU0), timeline <NUM> for a home node (HN-F), timeline <NUM> for a second requesting node (CPU1), and timeline <NUM> for a memory controller (DMC). Access request <NUM> from the first requesting node (CPU0) is a 'ReadShared' request to obtain a copy of data stored at the second requesting node (CPU1). Since CPU0 has read permission for memory address, the home node sends snoop message <NUM> to CPU1 for the data. The data at CPU1 in time period <NUM> is 'bad' in the sense that it is modified but cannot be cleaned by writing back to memory since CPU1 does not have write permission for the data. However, CPU1 returns the modified (dirty) data to the home node in snoop response <NUM>. The access permissions in snoop response <NUM> indicate to the home node that CPU1 does not have write permission and that the data is 'bad'. The home node sends read request <NUM> to the memory controller (DMC) for clean data. The clean data is sent in message <NUM> back the first requesting node (CPU0) and the data is acknowledged to the home node in message <NUM>. CPU0 now has good data, but CPU1 still has bad data. Accordingly, the home node sends invalidating message <NUM> to CPU1, which CPU1 acknowledges in response <NUM>. In this manner, 'bad' data at CPU1 is not passed to CPU0, from where it could be written back to memory, and the memory is protected.

<FIG> and <FIG> are a flow chart <NUM> of a method for filtering access permissions in accordance with embodiments of the disclosure. The method may be implemented in the hardware of a data processing network.

Referring to <FIG>, a new request from a first requesting node (RN-F or RN-I) is accessed at block <NUM> and address look-up in MPU inside MXP is performed at block <NUM>. The request is appended with R/W (read/write) permission at block <NUM>.

The home node (HN-F) receives the request and checks for permissions at block <NUM>. A determination is made whether the permissions are acceptable at decision block <NUM>. If the permissions are not acceptable, as depicted by the negative branch <NUM> from decision block <NUM>, an error response is sent at block <NUM> and the protocol flow is completed.

When the permissions are deemed acceptable, as depicted by the positive branch <NUM> from decision block <NUM>, a cache/snoop filter look-up is performed at block <NUM>. A determination is then made at decision block <NUM> as to whether snoops are required. If not, as depicted by the negative branch <NUM> from decision block <NUM>, flow continues to point 'A' and from there to decision block <NUM> in <FIG>.

Referring now to <FIG>, if a snoop to a slave node SN-F is not required, as depicted by the negative branch <NUM> from decision block <NUM>, the protocol flow is complete without error at block <NUM>.

If it is determined to go to SN-F, as depicted by the positive branch from decision block <NUM>, the request is sent to DMC at block <NUM> and a response is received from the DMC at block <NUM>. As stated above, the protocol flow is complete without error at block <NUM>.

Referring again to <FIG>, when a snoop is required as depicted by the positive branch <NUM> from decision block <NUM>, a snoop is sent at block <NUM> from the home node to a node (referred to as the 'snoopee') that is indicated in the snoop filter as having a copy of the data. The MXP intercepts the snoop request and performs snoop address look-up in MPU for snoopee permissions at block <NUM>. The MXP colors the snoop transaction identifier with MPU permissions and forwards the snoop request to snoopee at block <NUM>. The snoopee then processes the snoop request and sends a snoop response with colored transaction identifier at block <NUM>.

The MXP intercepts the snoop response and populates the MPU permission field from the colored transaction identifier at block <NUM> and flow continues to point 'B'.

Referring again to <FIG>, the home node (HN-F) receives the snoop response and checks for snoopee permissions at block <NUM>. A determination is made at decision block <NUM> as to whether the snoopee data can be used or consumed. If so, as depicted by the positive branch <NUM> from decision block <NUM>, the protocol flow is complete without error at block <NUM>.

If the snoopee data cannot be consumed, as depicted by the negative branch <NUM> from decision block <NUM>, determination is made at decision block <NUM> as to whether the request goes to the SN-F. If so, as depicted by the positive branch from decision block <NUM>, the request is sent to DMC at block <NUM>, a DMC response is received at block <NUM> and the protocol flow is complete without error at block <NUM>.

If the determination is made that the request does not go to SN-F, as depicted by the negative branch <NUM> from decision block <NUM>, an error response is sent and the protocol flow is completed at block <NUM>.

The snoop request received at the snoopee or second requesting node contains the memory address of the snooped data. This memory address can used in the MPU to determine access permissions. The snoop response does not, in general, include a memory address that may include a transaction identifier. In one embodiment, the access permissions are associated with a transaction identifier in MPU when a snoop request is received in order to augment the snoop response with access permissions. This may be done, for example, by storing a table in the MPU. The same transaction identifier in the snoop response is then used to identify the access permissions when a snoop response is received from the snoopee. In another embodiment, the access permissions are added to the transaction identifier message sent to the snoopee. Thus, the access permissions are stored in the request to the snoopee and returned in the response from the snoopee. For example, the number of transaction identifiers may be reduced by a factor of four and the access permissions stored in the two most significant bits of the transaction identifier. The transaction identifier is then said to be 'colored' by the access permissions. In this embodiment the memory protection unit intercepts the snoop message to the second requesting node, colors a transaction identifier in the snoop message with the one or more access permissions of the second requesting node to provide a colored snoop message and forwards the colored snoop message to the second requesting node. The memory protection unit then intercepts the snoop response from the second requesting node de-colors the transaction identifier in the snoop response and forwards the decolored snoop response, augmented with the one or more access permissions, to the home node.

In either embodiment, the home node sends a snoop message to the second requesting node or snoopee via the MPU and the second requesting node sends a snoop response comprising snooped data. The second memory protection unit augments the snoop response with one or more access permissions for the second requesting node. This is done by using the transaction identifier to lookup the access permissions or by reading the access permissions from the colored transaction identifier, for example. The home node receives the augmented snoop response and drops the snooped data when the one or more access permissions for the second requesting node indicate that the second requesting node does not have read permission for the snooped data. The home node also drops the snooped data when the snooped data is modified and one or more access permissions for the second requesting node indicate that the second requesting node does not have write permission for the modified data. In addition, the snooped data at the second requesting node may be invalidated when the snooped data is dropped by the home node when the coherency protocol allows the second requesting node to retain a copy of the first data.

When the snooped data is dropped by the home node, the home node retrieves clean data from the shared memory at the first memory address and sends it to the first requesting node.

<FIG> shows an apparatus <NUM> for filtering requests in accordance with an embodiment of the disclosure. The apparatus is used to determine whether to grant access to shared memory based on a permission access request or to deny a permission access request. The apparatus <NUM> includes CPU0 <NUM>(a), CPU0 <NUM>(n), module <NUM>(a), module <NUM>(n), cache <NUM>(a), cache <NUM>(n), node module <NUM> and DMC <NUM>. CPU<NUM> <NUM>(a) can be deemed a first processor or first CPU master, or CPU/IO. CPU1 <NUM>(n) can be deemed a second processor or second CPU master.

Coherent interconnect <NUM> includes crosspoints (MXPs) <NUM> and <NUM>, and home node HN-F <NUM>. The MXPs <NUM> and <NUM> each contain a memory protection unit (MPU) (<NUM> and <NUM> respectively).

CPU0 <NUM>(a) and CPU1 <NUM>(n) are in bi-directional communication with coherent interconnect <NUM> via links <NUM>, <NUM> and <NUM>, <NUM>, respectively. Coherent interconnect <NUM> is in bi-directional communication with DMC (memory controller) <NUM> via links <NUM>, <NUM>. The bi-directional communication may be a data communication bus, wire, set of wires, wireless channel or other suitable transmission medium that permits data to be transferred (transmitted and/or received) between the constituent components of apparatus <NUM>.

In operation, cache <NUM>(a) of CPU0 <NUM>(a) sends a data access request to MXP <NUM> of interconnect <NUM>, as shown by line <NUM>. The MPU at the cross-point <NUM> augments the request with access permissions.

MPU at cross-point <NUM> sends the request to home node (HN-F) <NUM> via line <NUM>. HN-F <NUM> sends a snoop request to CPU1 (<NUM>(n)) via MXP <NUM> on link <NUM>. The MPU at <NUM> colors the transaction identifier in the snoop request with the access permissions and forwards the snoop request to cache <NUM>(n) of CPU1 <NUM>(n) via line <NUM>.

Following the reception at cache <NUM>(n), a data response is sent from cache <NUM>(n) to the MPU at cross-point <NUM> via line <NUM>. The transaction identifier in the data response is decolored by the MPU and forwarded to HN-F <NUM> via line <NUM>. The HN-F module <NUM> transmits the data to DMC <NUM> via line <NUM>.

HN-F module <NUM> sends the data to MXP <NUM> via line <NUM>. MXP <NUM> forwards the data to cache <NUM>(a) of CPU0 <NUM>(a) via line <NUM>.

Thus, in various embodiments, an apparatus is provided comprising a plurality of cross-point switches, a home node and an interconnect. A cross-point switch comprises a first memory protection unit and provides an interface to a first requesting node, while the interconnect couples between the plurality of cross-point switches, the home node and a shared memory. The home node provides a point of coherency for access to the shared memory. The memory protection unit intercepts a message directed from the first requesting node to the home node, augments the intercepted message with one or more access permission of the first requesting node, and forwards the augmented message to the home node. The home node responds to the augmented message dependent upon the one or more access permissions.

A message received at a memory protection unit is associated with a first memory address in the shared memory and the memory protection unit is configured to look up the one or more access permissions in an address table of the first memory protection unit dependent upon the first memory address.

A memory protection unit at a second requesting node receives snoop messages from a home node, since the home node is configured to send snoop messages in response to access request from a first requesting node. The second requesting node sends a snoop response, containing snooped data, back to the home node responsive to the snoop message. The memory protection unit at the second requesting node intercepts the snoop response, augments the snoop response with one or more access permissions of the second requesting node and forwards the augmented snoop response to the home node. The home node is further configured to drop the snooped data when the one or more access permissions for the second requesting node indicate that the second requesting node does not have read permission for the snooped data and to drop the snooped data when the snooped data is modified and the one or more access permissions for the second requesting node indicate that the second requesting node does not have write permission for the modified data.

In addition, the home node retrieves clean data from the shared memory when the snooped data is dropped and forwards the clean data to the first requesting node.

When the message from the first requesting node comprises a read request for data associated with a first memory address in the shared memory and the one or more access permissions indicate that the first requesting node does not have read permission for the first memory address, the home node sends dummy data to the first requesting node. The home node may invalidate first data at the first requesting node when the message from the first requesting node comprises a write request for the first data and the one or more access permissions indicate that the first requesting node does not have write permission for the first memory address and the write request is of a type that allows the first requesting node to retain a copy of the first data. The home node may drop the write request when the one or more access permissions indicate that the first requesting node does not have write permission for the first memory address.

Access permissions in the snoop response may be obtained by coloring a transaction identifier received in a snoop request.

<FIG>show MPU coloring of a transaction identifier. A common transaction identifier is included in all messages that are part of the same transaction, such as messages passed along request links <NUM>, <NUM>, <NUM>, and <NUM>, and response links <NUM>, <NUM>, <NUM> and <NUM> illustrated in <FIG>, and enable responses to be associated with requests. In accordance with an embodiment, the transaction identifier may be restricted so that bits of the identifier may be used for access permissions.

<FIG> shows a register <NUM>, with bits <NUM>(a). (n) (where 'n' is any suitable number), for holding a transaction identifier. In this example, the register <NUM> has two bits <NUM>(a) and <NUM>(b) that are not used for the restricted transaction identifier. These may be filled with zeros, for example. This register status <NUM> corresponding to a snoop request described in <FIG> as snoop request <NUM> is transmitted from HN-F <NUM> to MXP <NUM>.

<FIG> depicts a register <NUM> with bits <NUM>(a). (n) (where 'n' is any suitable number). Register <NUM> has two bits <NUM>(a) and <NUM>(b) filled with R and W, respectively. This register status <NUM> corresponds to the snoop request described in <FIG> as snoop request <NUM> is transmitted from MXP <NUM> to cache <NUM>(n) of CPU1 <NUM>(n). The MPU in the MXP uses the address in the snoop request to retrieve the access permissions and populates the two unused bits, <NUM>(a) and <NUM>(b), in the transaction identifier field with the access permissions. The transaction identifier is said to be 'colored' by the access permissions.

<FIG> illustrates a register <NUM> with bits <NUM>(a). (n) (where 'n' is any suitable number). Register <NUM> has two bits <NUM>(a) and <NUM>(b) filled with R and W, respectively. This register status <NUM> corresponds to a transaction identifier transmitted from CPU1 <NUM>(n) to MXP <NUM> via link <NUM> in <FIG>. No changes are to the operation of CPU1 are required, since CPU returns the same transaction identifier (colored with the access permissions) as it receives.

<FIG> shows a register <NUM> with bits <NUM>(a). (n) (where 'n' is any suitable number). Register <NUM> has two bits <NUM>(a) and <NUM>(b) filled with zeros. Bits <NUM>(a) and <NUM>(b) are filled with R and W, respectively. This register <NUM> corresponds to a snoop response going to the home node. It shows that the R and W bits are not in the transaction identifier <NUM>. The access permissions, shown as bits <NUM>(a) and (b), are removed from the transaction identifier and replaced by zeros in the snoop response transmitted from MXP <NUM> to HN-F <NUM> via link <NUM> in <FIG>. The snoop response to the home node is augmented with the access permissions.

As used herein the term 'processor' may encompass or make use of programmable hardware such as: computers, microcontrollers, embedded microcontrollers, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), and complex programmable logic devices (CPLDs). These hardware examples may further be used in combination to achieve a desired functional controller module. Computers, microcontrollers and microprocessors may be programmed using languages such as assembly, C, C++, C#, or the like. FPGAs, ASICs and CPLDs are often programmed using hardware description languages (HDL) such as VHSIC hardware description language (VHDL) or Verilog that configure connections between internal hardware modules with lesser functionality on a programmable device.

The present disclosure has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus, systems and computer program products according to embodiments described herein. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented in hardware, or by executed computer program instructions, or a combination thereof.

As will be appreciated by one skilled in the art, the embodiments can be described as a system, method or computer program product. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a 'circuit,' 'module' or 'system.

Furthermore, the present disclosure may take the form of a non-transitory computer readable medium storing instructions of a hardware description language (HDL) (such as the VHSIC hardware description language (VHDL) or Verilog) that describe the apparatus or storing a netlist description the apparatus of claim. Such a description may be used, for example, to configure a field programmable gate array (FPGA), or similar configurable hardware, or used as input to a design tool for a custom integrated circuit.

Claim 1:
A method for memory protection in a data processing network, the method comprising:
at a first cross-point switch (<NUM>) of a plurality of cross-point switches of a coherent interconnect:
receiving, from a first requesting node coupled to the first cross-point switch (<NUM>), a request message including an action request for data associated with a first memory address in a shared memory, the first cross-point switch (<NUM>) including a first memory protection unit, wherein the coherent interconnect couples the plurality of cross-point switches, a home node and the shared memory;
receiving, by the first memory protection unit, the request message from the first requesting node;
determining, by the first memory protection unit, the one or more access permissions dependent upon the first memory address;
augmenting, by the first memory protection unit, the request message with the one or more access permissions for the first requesting node;
sending, from the first memory protection unit to the home node, the augmented request message; and
at the home node of the coherent interconnect:
determining, from the one or more access permissions of the augmented request message, if the requested action is permitted by the first requesting node;
when the requested action is permitted by the first requesting node, accessing the data associated with the first memory address from a system cache, a local cache of a second requesting node coupled to a second cross-point switch of the coherent interconnect or the shared memory in accordance with a coherency protocol; and
when the requested action is not permitted by the first requesting node, sending a response message to the first requesting node without accessing the data associated with the first memory address.