Resource access control in a system-on-chip

A method for controlling access to a resource by a processor having an instruction set including a virtualization extension, the method comprising:

• executing a resource access instruction from the processor based upon the virtualization extension, the resource access instruction comprising a virtual address and a virtual machine identifier;
• translating the virtual address to a physical address based upon the virtual machine identifier, the physical address comprising an actual physical address for accessing the resource without further translation;
• looking-up a stored virtual machine identifier in an access control rule table based upon the physical address;
• and
• controlling access to the resource based upon a match between the virtual machine identifier stored in the access control rule table and the virtual machine identifier in the resource access instruction, wherein controlling access comprises granting access to the resource if there is no stored virtual machine identifier corresponding to the physical address.

An integrated circuit (IC) comprising:

• a network-on-chip;
• a resource coupled to the network-on-chip;
• at least one processor comprising a virtual address to physical address translation table and an instruction set including a virtualization extension, the execution of a resource access instruction by the at least one processor using the virtualization extension producing a virtual machine identifier stored in the virtual address to physical address translation table with a virtual address, the physical address comprising an actual physical address for accessing the resource without translation;
• a network interface coupling the at least one processor to the network-on-chip for accessing the resource;
• an access control rule table having an input to receive a physical address output by the virtual address to physical address translation table as a search key and a corresponding virtual machine identifier, each entry of the access control rule table including a virtual machine identifier;
• and
• access control logic coupled to an output of the access control rule table and configured to control access to the resource at a level of the network interface based on the output of the access control rule table and a match between the virtual machine identifier returned by the virtual address to physical address table and the virtual machine identifier input to the control rule table, wherein said access control logic is configured to control access by granting access to the resource if the access control rule table returns no entry.