Adaptive access control for hardware blocks

Patent metadata

Field	Value
Publication number	US-2016259750-A1
Application number	US-201514638669-A
Country	US
Kind code	A1
Filing date	Mar 4, 2015
Priority date	Mar 4, 2015
Publication date	Sep 8, 2016
Grant date	—

Abstract

System and method for providing adaptive access to a hardware block on a computer system. In one embodiment, a method includes receiving a first access request and a second access request with an access controller, wherein the second access request is received sequentially after the first access request, and the first access request includes a first master identification and the second access request includes a second master identification, determining if the second master identification is equal to the first master identification, providing access to the second access request if the second master identification is equal to the first master identification, wherein the first master identification is associated with one or more hardware block interface values, invalidating the one or more hardware block interface values associated with the first master identification if the second master identification is not equal to the first master identification, and associating the one or more hardware block interface values with the second master identification and a corresponding privilege.

First claim

1 . A method of providing adaptive access to a hardware block on a computer system, comprising:
receiving a first access request and a second access request with an access controller, wherein the second access request is received sequentially after the first access request, and the first access request includes a first master identification and the second access request includes a second master identification; determining if the second master identification is equal to the first master identification; providing access to the second access request if the second master identification is equal to the first master identification, wherein the first master identification is associated with one or more hardware block interface values; invalidating the one or more hardware block interface values associated with the first master identification if the second master identification is not equal to the first master identification; and associating the one or more hardware block interface values with the second master identification and a corresponding privilege.

2 . The method of claim 1 wherein the first access request and the second access request are received from a public bus in the computer system.

3 . The method of claim 1 wherein either or both the first master identification or the second master identification are associated with a hypervisor controlled interface.

4 . The method of claim 1 wherein the first access request and the second access request are received from one or more execution environments in a group consisting of a trust zone execution environment, a secure processor execution environment, a modem, and hypervisor execution environment.

5 . The method of claim 1 wherein the first master identification is a first virtual machine identification value and the second master identification is a second virtual machine identification value.

6 . A method of providing access to slave side memory resources based on an identity of a master side entity, comprising:
determining a current access owner; receiving a memory access command from the master side entity; processing the memory access command based on a domain mask associated with the master side entity if the master side entity is the current access owner; if the master side entity is not the current access owner, then
invalidating all existing keys;
determining the domain mask associated with the master side entity;
processing the memory access command based on the domain mask associated with the master side entity; and
setting the current access owner equal to the master side entity.

7 . The method of claim 6 wherein the master side entity is a hypervisor.

8 . The method of claim 7 wherein the memory access command includes a hypervisor machine identity (HVID) value.

9 . The method of claim 6 wherein the memory access command is received from a resource group of a Memory Protection Unit (MPU).

10 . The method of claim 6 wherein the memory access command includes a machine identity (MID) value.

11 . The method of claim 10 wherein determining the domain mask associated with the master side entity includes providing the MID value to one or more multiplexer modules and receiving a domain identification from the one or more multiplexer modules.

12 . A system for providing adaptive access to a hardware block on a computer system, comprising:
a memory unit for storing instructions; and a processor unit coupled to the memory unit and configured to:
receive a first access request and a second access request with an access controller, wherein the second access request is received sequentially after the first access request, and the first access request includes a first master identification and the second access request includes a second master identification;
determine if the second master identification is equal to the first master identification;
provide access to the second access request if the second master identification is equal to the first master identification, wherein the first master identification is associated with one or more hardware block interface values;
invalidate the one or more hardware block interface values associated with the first master identification if the second master identification is not equal to the first master identification; and
associate the one or more hardware block interface values with the second master identification and a corresponding privilege.

13 . The system of claim 12 wherein the first access request and the second access request are received from a public bus in the computer system.

14 . The system of claim 12 wherein either or both the first master identification or the second master identification are associated with a hypervisor controlled interface.

15 . The system of claim 12 wherein the first access request and the second access request are received from one or more execution environments in a group consisting of a trust zone execution environment, a secure processor execution environment, a modem, and hypervisor execution environment.

16 . The system of claim 12 wherein the first master identification is a first virtual machine identification value and the second master identification is a second virtual machine identification value.

17 . A system for providing access to slave side memory resources based on an identity of a master side entity, comprising:
a memory unit for storing instructions; and a processor unit coupled to the memory unit and configured to:
determine a current access owner;
receive a memory access command from the master side entity;
process the memory access command based on a domain mask associated with the master side entity if the master side entity is the current access owner;
if the master side entity is not the current access owner, then
invalidate all existing keys;
determine the domain mask associated with the master side entity;
process the memory access command based on the domain mask associated with the master side entity; and
set the current access owner equal to the master side entity.

18 . The system of claim 17 wherein the master side entity is a hypervisor.

19 . The system of claim 18 wherein the memory access command includes a hypervisor machine identity (HVID) value.

20 . The system of claim 17 wherein the memory access command is received from a resource group of a Memory Protection Unit (MPU).

21 . The system of claim 17 wherein the memory access command includes a machine identity (MID) value.

22 . The system of claim 21 wherein the processor unit is configure to provide the MID value to one or more multiplexer modules and receive a domain identification from the one or more multiplexer modules.

23 . An apparatus for providing adaptive access to a hardware block on a computer system, comprising:
means for receiving a first access request and a second access request with an access controller, wherein the second access request is received sequentially after the first access request, and the first access request includes a first master identification and the second access request includes a second master identification; means for determining if the second master identification is equal to the first master identification; means for providing access to the second access request if the second master identification is equal to the first master identification, wherein the first master identification is associated with one or mor

Assignees

• Qualcomm Inc

Inventors

• Keidar Ron
• Koyuncu Osman
• Batenburg Michael

Classifications

• G06F13/4068 Primary

  Electrical coupling · CPC title

• G06F2009/45579

  I/O management, e.g. providing access to device drivers or storage · CPC title

• G06F9/5077

  Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455) · CPC title

• G06F21/82

  Protecting input, output or interconnection devices · CPC title

• G06F13/40

  Bus structure {(for computer networks G06F15/163; for optical bus networks H04B10/25)} · CPC title