Qualcomm Incorporated

Ati Technologies Inc.

Advanced Micro Devices Corporation

Broadcom Corporation

Ati Research, Inc.

Ati International Srl

Azzedine Touzni

Thomas Zeng

Xiaoqiang Ma

Samir N Hulyalkar

Yanru Li

Yihong Qi

Feng Huang

Dexter Tamio Chun

Christopher H Strolle

Piyush Chunilal Patel

Thomas J Endres

Raul Alejandro Casas

Ravikiran Rajagopal

Raúl Alejandro Casas

Philip T Mueller, Jr

Stephen L Biracree

Phil J Bostley

Haosong Fu

Raghuram Behara

Ajay Bhaskaran

Yan Li

Tzung Ren Tzeng

Yunjun Zhang

Thomas Andrew Sartorius

Andrew E Youtz

Moinul H Khan

Jason P Adams

Suhail Jalil

Amit Gil

Subbarao Palacharla

Brian Kelley

Assaf Shacham

Alain Artieri

Dhamim Packer Ali

Sudeep Ravi Kottilingal

Samuel Reichgott

Samar Asbe

Erez Tsidon

Ramesh Ramaswamy

Satyaki Mukherjee

David E Lewis

William Torzewski

Mark Hryszko

Mamta Desai

Ashutosh Shrivastava

Yiwen Yu

Gillyoung Jung

John J Zygmaniak

Supat Wongwirawat

Louis Giannini

Thomas M Zeng

Samuel H Reichgott

Philip Mueller

Ravi Rajagopal

Yiaoqiang Ma

System and methods for booting a system-on-chip (SOC) in an enhanced memory mode are described herein. In one aspect, an enhanced memory mode indicator may be read to create a trusted channel to a non-volatile random-access memory (NVRAM). The NVRAM may be logically connected to the SOC. In an aspect, the NVRAM may be secured prior to the creation of the trusted channel. Once the secure channel to NVRAM has been created, the SOC may operate in an enhanced memory mode. Prior to the SOC powering down, the system may store an indicator operable to enable a subsequent boot of the SOC in the power saving mode. The SOC may be operable to switch between the power saving mode and a normal mode depending on the operational requirements of the portable computing device in which the SOC is implemented.

System and method for booting within a heterogeneous memory environment

Exemplary features pertain to establishing an Exclusive Execution Environment domain that Trusted Execution Zone components are forbidden to access. In one example, a system-on-a-chip (SoC) is equipped with a Reduced Instruction Set Computing (RISC) processor along with an application DSP (ADSP) and/or Graphics Processing Unit (GPU), where the ADSP and/or GPU is configured to provide and enforce the Exclusive Execution Environment domain. By forbidding access to Trusted Execution Zone components, security can be enhanced, especially within minimally-equipped devices that do not have the resources to implement a full Trust Execution Environment, such as low-power devices associated with the Internet of Things (IoT). Among other features, the systems and methods described herein allow application clients to build exclusive execution environments and claim exclusive access to buffer objects and hardware resource groups. Method and apparatus examples are provided.

Exclusive execution environment within a system-on-a-chip computing system

Various additional and alternative aspects are described herein. In some aspects, the present disclosure provides a method of operating a system-on-chip (SoC). The method includes selecting a CPU core of a plurality of CPU cores of the SoC to boot the SoC based on information indicative of the quality of the plurality of CPU cores stored on the SoC. The method includes running boot code on the selected CPU.

Selectable boot CPU

Systems and methods are disclosed for managing memory access for low-power use cases of a system on chip. One such method comprises booting a system on chip (SoC) comprising a plurality of SoC processing devices. A trusted channel is created to a secure non-volatile random access memory (NVRAM). The method determines a power-saving software program to be executed on the SoC by one of the plurality of SoC processing devices. A software image associated with the power-saving software program is loaded to the secure NVRAM. In response to loading the software image to the secure NVRAM, each of the plurality of SoC processing devices except the one executing the software image from the secure NVRAM are powered down.

Memory access management for low-power use cases of a system on chip via secure non-volatile random access memory

In the various aspects, virtualization techniques may be used to improve performance and reduce the amount of power consumed by selectively enabling a hypervisor operating on a computing device during sandbox sessions. In the various aspects, a high-level operating system may allocate memory such that its intermediate physical addresses are equal to the physical addresses. When the hypervisor is disabled, the hypervisor may suspend second stage translations from intermediate physical addresses to physical addresses. During a sandbox session, the hypervisor may be enabled and resume performing second stage translations.

Algorithm and apparatus to deploy virtual machine monitor on demand

Aspects include computing devices, systems, and methods for implementing a cache maintenance or status operation for a component cache of a system cache. A computing device may generate a component cache configuration table, assign at least one component cache indicator of a component cache to a master of the component cache, and map at least one control register to the component cache indicator by a centralized control entity. The computing device may store the component cache indicator such that the component cache indicator is accessible by the master of the component cache for discovering a virtualized view of the system cache and issuing a cache maintenance or status command for the component cache bypassing the centralized control entity. The computing device may receive the cache maintenance or status command by a control register associated with a cache maintenance or status command and the component cache bypassing the centralized control entity.

Method and apparatus for virtualized control of a shared system cache

Systems for a method for monolithic workload scheduling in a portable computing device ('PCD') having a hypervisor are disclosed. An exemplary method comprises instantiating a primary virtual machine at a first exception level, wherein the primary virtual machine comprises a monolithic scheduler configured to allocate workloads within and between one or more guest virtual machines in response to one or more interrupts, instantiating a secure virtual machine at the first exception level and instantiating one or more guest virtual machines at the first exception level as well. When an interrupt is received at a hypervisor associated with a second exception level, the interrupt is forwarded to the monolithic scheduler along with hardware usage state data and guest virtual machine usage state data. The monolithic scheduler may, in turn, generate one or more context switches which may comprise at least one intra-VM context switch and at least one inter-VM context switch.

System and method for monolithic scheduling in a portable computing device using a hypervisor

Systems, methods, and computer programs are disclosed for providing secure access control to a graphics processing unit (GPU). One system includes a GPU, a plurality GPU programming interfaces, and a command processor. Each GPU programming interface is dynamically assigned to a different one of a plurality of security zones. Each GPU programming interface is configured to receive work orders issued by one or more applications associated with the corresponding security zone. The work orders comprise instructions to be executed by the GPU. The command processor is in communication with the plurality of GPU programming interfaces. The command processor is configured to control execution of the work orders received by the plurality of GPU programming interfaces using separate secure memory regions. Each secure memory region is allocated to one of the plurality of security zones.

System and method for providing secure access control to a graphics processing unit

Efficient techniques using a multi-port shared non-volatile memory are described that reduce latency in memory accesses from dedicated function specific processors, such as a modem control processor. The modem processor preempts a host processor that is accessing data from a multi-port shared non-volatile memory flash device allowing the modem processor to quickly access data in the flash device. The preemption process uses a doorbell interrupt initiated by a processor that seeks access and interrupts the processor being preempted. After preemption, the host processor may resume or restart the data access. Access control by the processors utilizes a hardware semaphore atomic control mechanism. Power control of the shared non-volatile memory modules includes at least one inactivity timer to indicate when a supply voltage to the shared non-volatile memory modules can be safely reduced or turned off. Power may be restarted by any of the processors sharing the memory, allowing fast access to the data.

Dual host embedded shared device controller

Aspects include apparatuses and methods for secure, fast and normal virtual interrupt direct assignment managing secure and non-secure, virtual and physical interrupts by processor having a plurality of execution environments, including a trusted (secure) and a non-secure execution environment. An interrupt controller may identify a security group value for an interrupt and direct secure interrupts to the trusted execution environment. The interrupt controller may identify a direct assignment value for the non-secure interrupts indicating whether the non-secure interrupt is owned by a high level operating system (HLOS) Guest or a virtual machine manager (VMM), and whether it is a fast or a normal virtual interrupt. The interrupt controller may direct the HLOS Guest owned interrupt to the HLOS Guest while bypassing the VMM. When the HLOS Guest in unavailable, the interrupt may be directed to the VMM to attempt to pass the interrupt to the HLOS Guest until successful.

Secure, fast and normal virtual interrupt direct assignment in a virtualized interrupt controller in a mobile system-on-chip

A security apparatus and method are provided for performing a security algorithm that prevents unauthorized access to contents of a physical address (PA) that have been loaded into a storage element of the computer system as a result of performing a prediction algorithm during a hardware table walk that uses a predictor to predict a PA based on a virtual address (VA). When the predictor is enabled, it might be possible for a person with knowledge of the system to configure the predictor to cause contents stored at a PA of a secure portion of the main memory to be loaded into a register in the TLB. In this way, a person who should not have access to contents stored in secure portions of the main memory could indirectly gain unauthorized access to those contents. The apparatus and method prevent such unauthorized access to the contents by masking the contents under certain conditions.

Method and apparatus for preventing unauthorized access to contents of a register under certain conditions when performing a hardware table walk (HWTW)

A first processor and a second processor are configured to communicate secure inter-processor communications (IPCs) with each other. The first processor effects secure IPCs and non-secure IPCs using a first memory management unit (MMU) to route the secure and non-secure IPCs via a memory system. The first MMU accesses a first page table stored in the memory system to route the secure IPCs and accesses a second page table stored in the memory system to route the non-secure IPCs. The second processor effects at least secure IPCs using a second MMU to route the secure IPCs via the memory system. The second MMU accesses the second page table to route the secure IPCs.

Distributed dynamic memory management unit (MMU)-based secure inter-processor communication

A wireless mobile device includes a graphic processing unit (GPU) that has a system memory management unit (MMU) for saving and restoring system MMU translation contexts. The system MMU is coupled to a memory and the GPU. The system MMU includes a set of hardware resources. The hardware resources may be context banks, with each of the context banks having a set of hardware registers. The system MMU also includes a hardware controller that is configured to restore a hardware resource associated with an access stream of content issued by an execution thread of the GPU. The associated hardware resource may be restored from the memory into a physical hardware resource when the hardware resource associated with the access stream of content is not stored within one of the hardware resources.

Method and apparatus to save and restore system memory management unit (MMU) contexts

In the various aspects, virtualization techniques may be used to improve performance and reduce the amount of power consumed by translating virtual memory addresses into physical addresses on a computing system having hybrid memory. In a first stage of memory translation, an operating system translates virtual addresses to intermediate physical addresses. In a second stage of memory translation, a chip or virtualization software translates the intermediate physical address to physical addresses based on the characteristics of the physical memory and the characteristics of the processes associated with the physical memory.

Methods, systems and devices for hybrid memory management

Growing community of inventors

Algonquin, IL, United States of America

Azzedine Touzni