Patent ID: 12229065

DETAILED DESCRIPTION

A DMA system includes two or more DMA engines that facilitate transfers of data through a shared memory. The DMA engines may operate independently of each other and with different throughputs. A data flow control module controls data flow through the shared memory by tracking status information of data blocks in the shared memory. The data flow control module updates the status information in response to read and write operations to indicate whether each block includes valid data that has not yet been read or if the block has been read and is available for writing. The data flow control module shares the status information with the DMA engines via a side-channel interface to enable the DMA engines to determine which block to write to or read from.

FIG.1is an example embodiment of a DMA system100in which multiple DMA engines110,120access a shared memory130. The DMA engines110,120include special-purpose logic for performing memory operations (e.g., such as read and write operations) independently of an external host processor (not shown). Thus, the DMA engines110,120can facilitate reading of the input stream152(e.g., from an external memory) and writing of the output stream154(e.g., to an external memory) without consuming processing resources of an external host processor once the transfer is initiated. The DMA engines110,120may include an external control interface (not shown) to receive commands for initiating a transfer of a set of data blocks and for the DMA engines110,120to signal completion of the transfer. Examples of computing systems that incorporate a DMA system100are described in further detail below with respect toFIGS.5-6.

The illustrated embodiment includes a write DMA engine110and a read DMA engine120. The write DMA engine110facilitates writing of an input stream152(comprising a sequence of data blocks) to the shared memory130via DMA operations. The read DMA engine120reads from the shared memory130via DMA operations to generate an output stream154. The read DMA engine120may be configured to read the same data blocks written to the shared memory by the write DMA engine110. InFIG.1, the distinction between the write DMA engine110and the read DMA engine120is based on their respective functions with respect to the input stream152and output stream154. In some embodiments, the write DMA engine110and the read DMA engine120may comprise identical DMA engines that are each capable of performing both read and write operations with respect to different data streams. For example, the same DMA engine may switch between performing read and write operations or may perform read and write operations concurrently with respect to different data streams.

The data flow control module140tracks a state of a set of memory blocks in the shared memory130to indicate whether each block is “valid” or “empty.” Here, a “valid” state of a block indicates that the block contains data written from the write DMA engine110that has not yet been read by the read DMA engine120. In contrast, an “empty” state of a block indicates that the data has already been read by the read DMA engine120and can therefore be overwritten without data loss. The data flow control module140communicates with the write DMA engine110and the read DMA engine120via respective side channels160to update the state of a block after each write and read operation. For example, the data flow control module140changes the state of a block to valid following the write DMA engine110writing to the block and changes the state of the block to empty following the read DMA engine120reading from the block. The data flow control module140also reports the block states to the write DMA engine110and the read DMA engine120via the respective side channels160. The data flow control module140may report the states after each state change or in response to a query from the write DMA engine110or the read DMA engine120.

The write DMA engine110and read DMA engine120determine which blocks in the shared memory130to write to and read from based on the block states obtained from the data flow control module140. For example, when the write DMA engine110receives a new data block in the input stream152, it selects an empty block, writes the new data block to the empty block, and sends an update to the data flow control module140to cause the block state to be updated to a valid state. The read DMA engine120detects when a valid block is available in the shared memory130based on the status information from the data flow control module140, reads the valid block into the output stream154, and then send an update to the data flow control module140to cause the block state to be updated to an empty state. Updates between the data flow control module140and the DMA engines110,120may occur after each individual state change of a block, or a batch update may occur after state changes for a set of blocks. For example, the write DMA engine110may write a set of blocks to the shared memory130and then provide a single update to the data flow control module140.

In the described embodiment, the input stream152and the output stream154may have different data rates. Furthermore, the write DMA engine110and the read DMA engine120may operate with different throughputs. The write DMA engine110and the read DMA engine120may operate asynchronously and independently of each other apart from the shared state information managed by the data flow control module140.

In an embodiment, the shared memory130may comprise one more ring buffers for storing data blocks. Here, the data flow control module140may track the block states of a ring buffer using FIFO-like read and write pointers. During write operations, the write DMA engine110writes to a block of the ring buffer indicated by the current write pointer. The write DMA engine110then issues a push signal to the data flow control module140that indicates that it is writing (validating) the block of data associated with the current write pointer and the write pointer is then circularly incremented. Independently, during read operations, the read DMA engine120reads from a block of the ring buffer indicated by the current read pointer. The read DMA engine120then issues a pop signal to the data flow control module140indicating that it is reading (emptying) a block of data from the current read pointer and the read pointer is then circularly incremented. The current read and write pointers can be communicated to the write DMA engine110and the read DMA engine120after each update to track the state of each block in the ring buffer. For example, the set of data blocks from the read pointer to the write pointer in the incrementing direction (i.e., data blocks that have been written to but have not yet been read) are valid data blocks while the set of data blocks from the write pointer to the read pointer in the incrementing direction (i.e., data blocks that have been read and have not yet been re-written to) represent empty data blocks.

In another embodiment, the data flow control module140tracks the block states of a ring buffer or other buffer as a bit vector with each bit corresponding to a block of the shared memory and indicating its state (e.g., 0=empty, 1=valid, or vice versa). Here, the write DMA engine110may determine which block to write to by circularly incrementing a write pointer until it finds an empty block. Similarly, the read DMA engine120may determine which block to read from by circularly incrementing a read pointer until it finds a valid block. In other embodiments, block selection logic in the write DMA engine110and the read DMA engine120may determine which block to write to or read from respectively based on a different protocol that does not necessarily utilize write and read pointers. In yet further embodiments, external control signals (e.g., from a host processor) may determine how the write DMA engine110selects which empty block it writes to for a given input block of the input stream152and how the read DMA engine120prioritizes reads from different valid blocks to generate the output stream154.

The shared memory130may include a single buffer or may include multiple different buffers. If the shared memory130includes multiple different buffers, the data flow control module140may independently track the block states for each buffer using any of the techniques described above.

The write DMA engine110may facilitate transfer of multiple independent input streams152and the read DMA engine120may facilitate transfer of multiple independent output streams154. Each stream can map to a single buffer in a one-to-one manner, multiple different input or output streams can share the same buffer, or a single stream can switch between multiple different buffers. In an embodiment, the data flow control module140may control a dynamic mapping of different data streams to different buffers in the shared memory130. For example, the data flow control module140may assign the write DMA engine110to write the input stream152to a first buffer in the shared memory130for a first time period, and then may switch the assignment of the input stream152to a second buffer during a second time period. Similarly, the data flow control module140may assign the read DMA engine120to read the output stream154from a first buffer in the shared memory130for a first time period, and then may switch the assignment of the output stream154to a second buffer during a second time period.

The data flow control module140can also dynamically allocate the size of the buffers and the locations of the buffers in the shared memory130. Here, the allocation may be based on signals received from an external processor (not shown) or may be based on characteristics of the input stream152and output stream154.

In an embodiment, the data flow control module140may be accessed by an external processor (not shown) outside the DMA engines110,120. Here, the external processor may obtain the state information tracked by the data flow control module140to facilitate control of the DMA engines110,120or to control other operations of a host system.

FIG.2illustrates another example embodiment of a DMA system200in which multiple DMA engines210,220access a shared memory230. In this embodiment, a transport DMA engine210performs DMA transfers between a host device250and a shared memory230and a processing DMA engine220performs transfers between a processing device260and the shared memory230. In operation, the host device250provides an ingress stream252that is transferred through the DMA engines210,220and shared memory230to a processing device260. The processing device260transforms the ingress stream252to generate an egress stream254, which is transferred back through the DMA engines210,220and shared memory230to the host device250. In an example application, the processing device260may comprise a cryptography engine for encrypting or decrypting the ingress stream252to generate the egress stream254. In other embodiments, the processing device260may perform a different transformation to generate the egress stream254from the ingress stream252. In further embodiments, the egress stream254is not necessarily derived from the ingress stream252. For example, the ingress stream252and egress stream254may instead be independent data streams undergoing unidirectional transfers from the host device250to the processing device260or vice versa.

In the illustrated example embodiment, the shared memory230includes a separate ingress buffer232associated with the ingress stream252and an egress buffer234associated with the egress stream254. In an ingress data path, a write DMA engine212of the transport DMA engine210writes blocks of the ingress stream252to the ingress buffer232and a read DMA engine222of the processing DMA engine220reads blocks of the ingress stream252from the ingress buffer232. Similarly, in an egress data path, a write DMA engine224of the processing DMA engine220writes blocks of the egress stream254to the egress buffer234and a read DMA engine214of the transport DMA engine210reads blocks of the egress stream254from the egress buffer234.

The data flow control module240maintains the states of the data blocks of the ingress buffer232in an ingress buffer state register242and maintains the states of the data blocks of the egress buffer234in an egress buffer state register244. In the same manner described above, the data flow control module240updates the states in the respective registers242,244in response to read and write operations performed by the respective DMA engines210,220and communicates the states to the respective DMA engines210,220to enable them to determine which blocks are empty and may be written to and which blocks have valid data for reading.

FIG.3illustrates another embodiment of a DMA system300. This embodiment includes a set of N DMA engines310(where N is an integer ≥1), a shared memory330having a set of M buffers (where M is an integer ≥1), and a data flow control module340for maintaining the block states of each of the M buffers332. The DMA engines310can each perform write operations to a specified buffer332, read operations from a specified buffer332, or both. Here, the data flow control module340can dynamically control assignment of DMA engines310to buffers332. The data flow control module340furthermore communicates with the DMA engines310to track the states of the blocks in each buffer332and to provide the state information to the DMA engines310.

FIG.4illustrates an example embodiment of a process performed by a data flow control module340for tracking state of a specified data block of a shared memory330. The data flow control module340sends402state information to the DMA engines310indicating a state of the data block in the shared memory330. For example, the state information may initially indicate that the block is empty and available for writing. Following a write operation to the block, the data flow control module340receives404a write status update signal indicating that a write operation was performed to the specified block of a buffer332in the shared memory330. In response to the write status update signal, the data flow control module340sets406the state of specified block to a valid state. The data flow control module340sends408updated state information to the DMA engines310indicating the state update. At a later time, the data flow control module340receives410a read status update signal indicating that a read operation was performed from the specified block of the buffer332in the shared memory330. The data flow control module sets412the state of the specified block to an empty state. The process may repeat414through any number of write and read cycles for the specified block.

The same general process may be performed to track each block of a buffer332in the shared memory330. In some embodiments, the steps for sending the block information402,408may provide updates for all blocks concurrently. In other embodiments, the data flow control module340may send block information associated with only a single block (e.g., the block that was updated) or a limited set of blocks.

FIG.5illustrates an example embodiment of a computing system500that incorporates a DMA system514with autonomous flow control according to the embodiments described above. The computing system500comprises a host device520and a root of trust (RoT) device510coupled by an external bus530. The external bus530may comprise, for example, a peripheral component interconnect express (PCIe) bus or other interconnect bus for transferring data and commands between the host device520and the RoT device510.

The host device520may comprise, for example, a workstation, a server, a single-board computer, or other computing device. The host device520may store data in encrypted form (i.e., ciphertext data) and/or in unencrypted form (i.e., plaintext data).

The RoT device510performs encryption or decryption functions associated with data from the host device520. For example, the RoT device510may receive plaintext data from the host device510(via the external bus530), encrypt the plaintext data to generate ciphertext data, and provide the ciphertext data to the host device520via the external bus530. Furthermore, the RoT device510may receive ciphertext data from the host device520(via the external bus530), decrypt the ciphertext data to generate plaintext data, and provide the plaintext data back to the host device520via the external bus530. In other embodiments, the RoT device510may perform other transformations on data from the host device520that are not necessarily encryption or decryption of the data. Furthermore, in some embodiments, the RoT device510may facilitate unidirectional transfers from the host device520to the RoT device510or vice versa without necessarily performing transformations of the data.

The RoT device510comprises an RoT memory (MEMR)516and an RoT system-on-chip (SoC)550. The RoT memory516may comprise one or more DRAM devices or other types of memory. The RoT SoC550performs encryption and decryption functions on data in the RoT memory516. The RoT SoC550comprises a DMA system514, a cryptographic engine512, and an RoT core540that includes an RoT processor (CPUR)502.

The DMA system514manages DMA operations of the RoT device510based on commands received from the RoT core540via an RoT system bus542. The DMA system514may include multiple DMA engines, a shared memory, and a data flow control module that operate according to any of the embodiments described above to transfer data between the host device520and the RoT device510. For example, in one embodiment, the DMA system514operates according to the DMA system200ofFIG.2, where the host device510corresponds to the host device520and the RoT Core540, cryptography engine512, and RoT memory516correspond to the processing device260. Alternatively, the DMA system514may correspond to the DMA system300ofFIG.3to facilitate transfer of multiple data streams from the host device520and/or other external devices. In other embodiments where the DMA system514is used for unidirectional transfers, the DMA system514may correspond to the DMA system100ofFIG.1.

The cryptographic engine512performs encryption and decryption of data in the RoT memory516based on one or more cryptographic keys obtained from the RoT core540. For example, to perform encryption, the cryptographic engine512obtains plaintext data from the RoT memory516, encrypts the plaintext data to generate ciphertext data based on the one or more cryptographic keys, and writes the ciphertext back to the RoT memory516. To perform decryption, the cryptographic engine512obtains ciphertext data from the RoT memory516, decrypts the ciphertext data to generate plaintext data based on one or more cryptographic keys, and writes the plaintext data back to the RoT memory516.

The RoT processor502comprises a general-purpose processor or a special-purpose processor for controlling the cryptographic engine512and the DMA engine514. The RoT processor502may furthermore perform actions such as generating and/or delivering one or more cryptographic keys to the cryptographic engine512. In an embodiment, the RoT core140is isolated from the rest of the RoT device510by an isolated control plane.

In an example embodiment, the RoT device510may comprise a printed circuit board that supports the RoT memory516and the RoT SoC550. The RoT SoC550may be implemented using a field programmable gate array (FPGA) or may comprise an application-specific integrated circuit (ASIC) device. In other embodiments, one or more components of the RoT SoC550may be implemented in software or firmware. For example, functions of the RoT SoC550described herein may be implemented based on the RoT processor502executing instructions stored to a non-transitory computer-readable storage medium.

FIG.6illustrates another example embodiment of a computing system600that incorporates a DMA system614with autonomous flow control according to the embodiments described above. The computing system600comprises the DMA system614, a memory616, and a processor602, all coupled by a bus642.

The processor602may comprise a general-purpose processor or a special-purpose processor specifically configured for graphics processing, security function processing, cryptographic processing, or other special-purpose computer functions. The memory616may comprise one or more DRAM devices or other types of general or special-purpose memory.

The DMA system614manages DMA operations of the computing device600based on command received from the processor602to transfer data to the memory616from an external system and to transfer data from the memory616to an external system620. As described above, the DMA system614may include multiple DMA engines, a shared memory, and a data flow control module that operate according to any of the embodiments described above (e.g., inFIGS.1-3) to perform DMA operations with automated flow control during transfers between the memory616and the external system620.

In the example computer systems500,600ofFIGS.5-6, the DMA systems514,614include logic for accessing the memories516,616and performing memory operations independently of the processors502,602. For example, the processor502,602may send a command to the DMA system514,614to initiate a DMA transfer, after which the DMA system514,614independently executes the while the processor502,602may perform other operations in parallel. Upon completing the transfer, the DMA system514,614may assert an interrupt signal to indicate to the processor502,602that the operations are completed.

In various embodiments, the DMA systems100,200,300,514,614described herein may be embodied in one or more standalone integrated circuits or chips such as an application specific integrated circuit (ASIC) or field programmable gate array (FPGA). Furthermore, the DMA systems100,200,300,514,614may be incorporated into one or more integrated circuits or chips that include other components (such as those illustrated inFIGS.5-6) for performing general purpose computing functions, or special purpose functions such as graphics processing, security (e.g., encryption, decryption, or other cryptographic functions), or other specialized computing functions.

Upon reading this disclosure, those of ordinary skill in the art will appreciate still alternative structural and functional designs and processes for the described embodiments, through the disclosed principles of the present disclosure. Thus, while embodiments and applications of the present disclosure have been illustrated and described, it is to be understood that the disclosure is not limited to the precise construction and components disclosed herein. Various modifications, changes and variations which will be apparent to those skilled in the art may be made in the arrangement, operation and details of the method and apparatus of the present disclosure herein without departing from the scope of the disclosure as defined in the appended claims.