Error management in system on a chip with securely partitioned memory space

Patent metadata

Field	Value
Publication number	US-12517841-B2
Application number	US-202218579134-A
Country	US
Kind code	B2
Filing date	Jun 6, 2022
Priority date	Jul 13, 2021
Publication date	Jan 6, 2026
Grant date	Jan 6, 2026

Abstract

Systems and methods are disclosed for error management in a system on a chip with a securely partitioned memory space. For example, an integrated circuit (e.g., a processor) for executing instructions includes a world identifier checker circuitry configured to check memory requests for one or more memory mapped resources that are received via the bus that have been tagged with a world identifier to determine whether to allow or reject access based on the tagged world identifier; a world identifier checker circuitry configured to compare the tagged world identifier to a world list for a resource that specifies which world identifiers supported by the integrated circuit are authorized for access to the resource; and a data store configured to store world error data, including the tagged world identifier of a memory request that has been rejected by the world identifier checker circuitry.

First claim

What is claimed is:

1 . An integrated circuit for executing instructions comprising:
a processor core configured to execute instructions; a first data store configured to store a first world identifier; a world identifier marker circuitry configured to tag memory requests transmitted on a bus of the integrated circuit by the processor core with the first world identifier; a world identifier checker circuitry configured to check memory requests for one or more memory mapped resources that are received via the bus that have been tagged with a world identifier to determine whether to allow or reject access based on the tagged world identifier; a second data store configured to store a world list for a resource that specifies which world identifiers supported by the integrated circuit are authorized for access to the resource, wherein the world identifier checker circuitry is configured to compare the tagged world identifier to the world list; and a third data store configured to store world error data, including the tagged world identifier of a memory request that has been rejected by the world identifier checker circuitry.

2 . The integrated circuit of claim 1 , in which the world error data stored in the third data store includes an address of the memory request that has been rejected by the world identifier checker circuitry.

3 . The integrated circuit of claim 1 , in which the world error data stored in the third data store includes an access mode of the memory request that has been rejected by the world identifier checker circuitry.

4 . The integrated circuit of claim 1 , in which the third data store includes an acknowledgement bit field that indicates whether world error data stored in the third data store has been read by an interrupt handling routine.

5 . The integrated circuit of claim 4 , in which the world identifier checker circuitry is configured to prevent writing of world error data to the third data store responsive to rejection of a new memory request when the acknowledgement bit field indicates that current contents of the third data store have not been read yet.

6 . The integrated circuit of claim 1 , in which access to the third data store is restricted to a trusted world processor core.

7 . The integrated circuit of claim 1 , in which the world identifier checker circuitry is configured to:
responsive to the rejection of the memory request for the resource, source an interrupt signal; and responsive to the rejection of the memory request for the resource, send a denied message via the bus in response to the memory request.

8 . The integrated circuit of claim 7 , in which a trusted world processor core is configured to receive the interrupt signal.

9 . The integrated circuit of claim 7 , in which access to the third data store is restricted to a trusted world processor core, and the processor core is configured to:
responsive to receiving the denied message, send a request to the trusted world processor core for information stored in the third data store.

10 . The integrated circuit of claim 1 , in which the third data store is part of the world identifier checker circuitry.

11 . A method comprising:
receiving, via a bus from a processor core, a memory request for a memory mapped resource, wherein the memory request is tagged with a first world identifier; comparing the first world identifier from the memory request to a world list associated with the memory mapped resource, wherein the world list specifies which world identifiers supported by an integrated circuit are authorized for access to the resource; based on the comparison of the first world identifier with the world list, determining whether to allow or reject access to the resource for the memory request; and responsive to rejection of access to the resource for the memory request, storing world error data in a data store, wherein the world error data includes the first world identifier from the memory request and an address of the memory request.

12 . The method of claim 11 , comprising:
responsive to the rejection of the memory request for the resource, sourcing an interrupt signal; and responsive to the rejection of the memory request for the resource, sending a denied message via the bus in response to the memory request.

13 . The method of claim 12 , in which a trusted world processor core is configured to receive the interrupt signal.

14 . The method of claim 12 , in which access to the data store is restricted to a trusted world processor core, and comprising:
responsive to receiving the denied message, sending a request to the trusted world processor core for information stored in the data store.

15 . The method of claim 11 , in which the world error data stored in the data store includes an access mode of the memory request.

16 . The method of claim 11 , in which the data store includes an acknowledgement bit field that indicates whether world error data stored in the data store has been read by an interrupt handling routine.

17 . The method of claim 16 , comprising:
preventing writing of world error data to the data store responsive to rejection of a new memory request when the acknowledgement bit field indicates that current contents of the data store have not been read yet.

18 . The method of claim 11 , in which access to the data store is restricted to a trusted world processor core.

19 . A method comprising:
transmitting, via a bus from a processor core, a memory request for a memory mapped resource, wherein the memory request is tagged with a first world identifier; receiving, via the bus at the processor core, a denied message in response to the memory request; and responsive to receiving the denied message, sending a request from the processor core to a trusted world processor core for information stored in a data store, wherein data store stores world error data for the memory request and access to the data store is restricted to the trusted world processor core.

Assignees

• Sifive Inc

Inventors

• Asanovic Krste
• Loisel Yann
• Ingalls John
• Mukherjee Shubhendu Sekhar

Classifications

• G06F21/74

  operating in dual or compartmented mode, i.e. at least one secure mode · CPC title

• G06F2212/1032

  Reliability improvement, data loss prevention, degraded operation etc · CPC title

• G06F2212/1052

  Security improvement · CPC title

• G06F12/1491

  in a hierarchical protection system, e.g. privilege levels, memory rings · CPC title

• G06F12/1441

  for a range · CPC title