Hardware virtual machine for controlling access to physical memory space

A method for controlling access to a physical address (PA) space in

• a system that includes a plurality of processing circuits and a plurality of system resources, comprising:
• receiving a request from a requesting processing circuit for accessing a virtual address, wherein the requesting processing circuit executes a requesting virtual machine (VM), and wherein a given region of the PA space is pre-configured in hardware to dedicate to addressing VMs executed in the system, and a total number of the VMs is pre-configured in the hardware;
• translating, by a given memory management unit (MMU) coupled to the requesting processing circuit, the virtual address into a requested PA that is accessible to the requesting processing circuit according to a configurable setting of the given MMU;
• and
• granting or denying, by a given memory protection unit (MPU) coupled to a target system resource allocated with the requested PA, the request based on information in a permission filter indicating whether the requested PA is accessible to the requesting VM executed on the requesting processing circuit.

A system operative to control access to a physical address (PA) space, comprising:

• a plurality of processing circuits executing a plurality of virtual machines (VMs), a given region of the PA space is dedicated to addressing the VMs;
• a plurality of system resources addressable within the PA space;
• a plurality of memory management units (MMUs) coupled to corresponding processing circuits, wherein a given MMU is operative to translate a virtual address indicated in an access request from a requesting processing circuit into a requested PA that is accessible by the requesting processing circuit according to a configurable setting of the given MMU;
• and
• a plurality of memory protection units (MPUs), wherein a given MPU, which is coupled to a target system resource allocated with the requested PA, is operative to grant or deny the request based on information in a permission filter indicating whether the requested PA is accessible to a requesting VM executed on the requesting processing circuit,
• wherein each MMU includes a first-stage MMU and a second-stage MMU, the second-stage MMU is operative to perform master-side access control using a page size and the MPU is operative to perform target-side access control using a block size greater than the page size.