# US 2024/0201874 A1 · Input-output memory management unit with memory protection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2024/0201874 A1 - Document ID: US20240201874A1 - Status: Published application - Kind: A1 - Application number: 18/540,739 - Filed: 2023-12-14 - Published: 2024-06-20 - Earliest claimed: 2022-12-14 - Assignees: Mediatek Inc. - Applicants: Mediatek Inc. - Inventors: Yu-Tien Chang; Lin-Ming Hsu; Chun-Ming Chou - Web page: https://patentgrep.com/patent/US20240201874A1 ## CPC - G06F 3/0622: {in relation to access} - G06F 3/0655: {Vertical data movement, i.e. input-output transfer; data movement between one or more hosts and one or more storage devices} - G06F 3/0673: {Single storage device} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system on chip includes a dynamic random access memory (DRAM) controller, a secure range (SR) permission checker, a plurality of intellectual property (IP) cores. The DRAM controller includes a SR table configured to store a start address, an end address, and enabled registers of each SR and an access identification (AID) permission table configured to store access permissions of SRs of each AID. The SR permission checker is embedded in the DRAM controller or a bus and linked to the SR table and the AID permission table, and configured to check the access permissions of the SRs according to the AID permission table. The plurality of IP cores linked to the DRAM controller, and comprising a translation lookaside buffer (TLB) comprising an input-output memory management unit (IOMMU) table or an input-output memory protection unit (IOMPU) table to store SR information. ## Claims ### Claim 1 A system on chip, comprising: a dynamic random access memory (DRAM) controller, comprising: a secure range (SR) table configured to store a start address, an end address, and enabled registers of each secure range; and an access identification (AID) permission table configured to store access permissions of secure ranges of each access identification; a secure range permission checker embedded in the dynamic random access memory (DRAM) controller or a bus and linked to the secure range (SR) table and the access identification (AID) permission table, and configured to check the access permissions of the secure ranges according to the access identification (AID) permission table; and a plurality of intellectual property (IP) cores linked to the dynamic random access memory (DRAM) controller, and comprising a translation lookaside buffer (TLB) comprising an input-output memory management unit (IOMMU) table or an input-output memory protection unit (IOMPU) table to store secure range information, each IP core being configured to access specific data in a DRAM according to the secure range information. ### Claim 2 (depends on 1) The system on chip of claim 1, wherein some of the intellectual property (IP) cores each comprise a translation lookaside buffer (TLB) comprising an input-output memory management unit (IOMMU) table. ### Claim 3 (depends on 1) The system on chip of claim 1, wherein some of the intellectual property (IP) cores each comprise a translation lookaside buffer (TLB) comprising an input-output memory protection unit (IOMPU) table. ### Claim 4 (depends on 1) The system on chip of claim 1, wherein the secure range permission checker is a memory protection unit (MPU). ### Claim 5 (depends on 1) The system on chip of claim 1, wherein when a virtual address pointed by the input-output memory management unit (IOMMU) table has a same physical address pointed by the input-output memory protection unit (IOMPU) table, the virtual address and the physical address direct to identical secure range information. ### Claim 6 (depends on 1) The system on chip of claim 1, wherein the input-output memory management unit (IOMMU) table is configured to store physical addresses corresponding to virtual addresses, and secure range information corresponding to the physical addresses. ### Claim 7 (depends on 1) The system on chip of claim 1, wherein the input-output memory protection unit (IOMPU) table is configured to store secure range information corresponding to the physical addresses. ### Claim 8 (depends on 1) The system of chip of claim 1, wherein the input-output memory management unit (IOMMU) table and the input-output memory protection unit (IOMPU) table are updated from the dynamic random access memory (DRAM). ### Claim 9 (depends on 1) The system of chip of claim 1, wherein the translation lookaside buffer comprises a level one cache and a level two cache. ### Claim 10 (depends on 9) The system of chip of claim 9, wherein the level one cache is corresponding to one of the plurality of intellectual property (IP) cores or shared by the plurality of intellectual property (IP) cores and the level two cache is shared by the plurality of intellectual property (IP) cores. ### Claim 11 A computing device, comprising: a plurality of intellectual property (IP) cores, each being represented by an access identification (AID); a dynamic random access memory (DRAM) with a management table configured to store secure range information corresponding to a physical address or a virtual address; and a secure range permission checker, embedded in a dynamic random access memory (DRAM) controller or a bus, configured to check access permissions of secure ranges according to the access identification (AID) and the secure range information obtained by the management table in accordance with a DRAM access request issued by the IP core, wherein the virtual address or the physical address is conveyed in the access request. ### Claim 12 (depends on 11) The computing device of claim 11, wherein some of the intellectual property (IP) cores each comprise a translation lookaside buffer (TLB) comprising an input-output memory management unit (IOMMU) table. ### Claim 13 (depends on 11) The computing device of claim 11, wherein some of the intellectual property (IP) cores each comprise a translation lookaside buffer (TLB) comprising an input-output memory protection unit (IOMPU) table. ### Claim 14 (depends on 11) The computing device of claim 11, wherein the secure range permission checker is a memory protection unit (MPU). ### Claim 15 (depends on 11) The computing device of claim 11, wherein more than one intellectual property (IP) core has a translation lookaside buffer (TLB) comprising an input-output memory management unit (IOMMU) table. ### Claim 16 (depends on 11) The computing device of claim 11, wherein more than one intellectual property (IP) core has a translation lookaside buffer (TLB) comprising an input-output memory protection unit (IOMPU) table. ### Claim 17 A method for controlling access permissions to a memory, comprising: issuing an access request with an address information to the memory by a master represented by an access identification; checking the address information is a virtual address or a physical address in a translation lookaside buffer (TLB); fetching a physical address and a first secure range information (SR_info) from an IOMMU table when the address information is the virtual address; and fetching the first secure range information (SR_info) from a IOMPU table when the address information is the physical address. ### Claim 18 (depends on 17) The method of claim 17, further comprising fetching a second secure range information (SR_info) according to the physical address. ### Claim 19 (depends on 18) The method of claim 18, further comprising controlling access permission according to the access identification and at least one of the first secure range information and the second secure range information. ### Claim 20 (depends on 18) The method of claim 18, wherein the first secure range information is a page based secure range information and the second secure range information is the region based secure range information.