Storing secure state information in translation lookaside buffer cache lines

• US 10,452,566 B2
• Filed: 10/02/2015
• Issued: 10/22/2019
• Est. Priority Date: 10/02/2015
• Status: Active Grant

• Current Assignee: NVIDIA Corporation
• Original Assignee: NVIDIA Corporation
• Inventors: Molnar, Steven E., Deming, James Leroy, Woodmansee, Michael A.
• Primary Examiner(s): Lane, John A
• Application Number:
  US14/874,244
• Publication Number:
  US 20170097896A1
• Time in Patent Office: 1,481 Days
• CPC Class Codes: G06F 12/145 the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices

Abstract

One embodiment of the present invention includes a memory management unit (MMU) that is configured to efficiently process requests to access memory that includes protected regions. Upon receiving an initial request via a virtual address (VA), the MMU translates the VA to a physical address (PA) based on page table entries (PTEs) and gates the response based on page-specific secure state information. To thwart software-based attempts to illicitly access the protected regions, the secure state information is not stored in page tables. However, to expedite subsequent requests, after the MMU identifies the PTE and the corresponding secure state information, the MMU stores both the PTE and the secure state information as a cache line in a translation lookaside buffer. Advantageously, the disclosed embodiments protect data in the protected regions from security risks associated with software-based protection schemes without incurring the performance degradation associated with hardware-based “carve-out” memory protection schemes.

Claims

1. A system configured to manage access requests to protected regions of memory, the system comprising:

a system-on-chip that includes a plurality of processing units and a first memory, wherein;

the first memory includes a page table having a plurality of page table entries; and

a first parallel processing unit is included in the plurality of the processing units, wherein the first parallel processing unit includes an internal memory and a memory management unit, and wherein the memory management unit is coupled to the first memory and configured to;

receive a first request to translate a first virtual memory address to a first physical memory address;

select a first page table entry included in the plurality of page table entries based on the first virtual memory address;

translate the first virtual memory address to the first physical memory address based on the first page table entry;

determine first secure state information based on the first physical memory address;

store the first page table entry and the first secure state information in a first data cache line included in a first translation lookaside buffer associated with a first client, wherein the first secure state information originates from the internal memory and specifies at least one client authorized to access the first physical memory address; and

generate a first memory access response based on the first page table entry and the first secure state information.

2. The system of claim 1, wherein the first request is received from the first client, and generating the first memory access response comprises determining that the first client is authorized to access data stored at a location specified by the first physical memory address based on the first secure state information.

3. The system of claim 2, wherein generating the first memory access response further comprises transmitting a response to the first client, wherein the response includes the first physical memory address.

4. The system of claim 2, wherein the first secure state information indicates that the first physical memory address specifies a location that is not included in the protected regions of memory.

5. The system of claim 1, wherein the first request is received from the first client, and generating the first memory access response comprises determining that the first client is not authorized to access data stored at a location specified by the first physical memory address based on the first secure state information.

6. The system of claim 1, wherein generating the first memory access response comprises:

determining whether the first request is authorized to access data stored at a location specified by the first physical memory address based on the first secure state information; and

if the first request is authorized, then producing a response that indicates a success state;

or

if the first request is not authorized, then producing a response that indicates a failure state.

7. The system of claim 1, wherein the memory management unit is further configured to:

receive a second request to translate a second virtual memory address to a second physical memory address;

select, based on the second virtual memory address, a second data cache line included in the first translation lookaside buffer that includes a second page table entry and second secure state information; and

generate a second memory access response based on the second page table entry and the second secure state information.

8. The system of claim 1, wherein the memory management unit is further configured to:

receive a second request to translate a second virtual memory address to a second physical memory address, wherein the second request is received from a second client;

select, based on the second virtual memory address, a second cache line included in a second translation lookaside buffer that is associated with the second client, wherein the second cache line includes a second page table entry and second secure state information; and

generate a second memory access response based on the second page table entry and the second secure state information.

9. The system of claim 1, wherein the memory comprises a local memory.

10. The system of claim 1, wherein the memory comprises a system memory.

19. The system of claim 1, wherein the first secure state information originates from the internal memory that is not accessible by an operating system of the system.

20. The system of claim 1, wherein the first secure state information originates from the internal memory that is not accessible by a software application that issues one or more commands to control the first parallel processing unit.

21. The system of claim 1, wherein the memory management unit determines the first secure state information without use of the first memory.

22. The system of claim 1, wherein the first memory is external to the first parallel processing unit.

23. The system of claim 1, wherein the plurality of processing units comprises the first parallel processing unit and a central processing unit.

24. The system of claim 1, wherein the plurality of processing units comprises the first parallel processing unit and a second parallel processing unit.

11. A method for managing access requests to protected regions of memory, the method comprising:

receiving a first request to translate a first virtual memory address to a first physical memory address;

selecting a first page table entry included in a page table having a plurality of page table entries based on the first virtual memory address, the page table being stored to a first memory coupled to a memory management unit of a first parallel processing unit;

translating the first virtual memory address to the first physical memory address based on the first page table entry;

determining first secure state information based on the first physical memory address;

storing the first page table entry and the first secure state information in a first data cache line included in a first translation lookaside buffer associated with a first client, wherein a system-on-chip includes a plurality of processing units and the first memory and the first parallel processing unit is included in the plurality of the processing units, wherein the first parallel processing unit further comprises an internal memory, wherein the first secure state information originates from the internal memory of the first parallel processing unit and specifies at least one client authorized to access the first physical memory address, and

generating a first memory access response based on the first page table entry and the first secure state information.

12. The method of claim 11, wherein the first request is received from the first client, and generating the first memory access response comprises determining that the first client is authorized to access data stored at a location specified by the first physical memory address based on the first secure state information.

13. The method of claim 12, wherein generating the first memory access response further comprises transmitting a response to the first client, wherein the response includes the first physical memory address.

14. The method of claim 12, wherein the first secure state information indicates that the first physical memory address specifies a location that is not included in the protected regions of memory.

15. The method of claim 11, wherein the first request is received from the first client, and generating the first memory access response comprises determining that the first client is not authorized to access data stored at a location specified by the first physical memory address based on the first secure state information.

16. The method of claim 11, wherein generating the first memory access response comprises:

determining whether the first request is authorized to access data stored at a location specified by the first physical memory address based on the first secure state information; and

if the first request is authorized, then producing a response that indicates a success state;

or

if the first request is not authorized, then producing a response that indicates a failure state.

17. The method of claim 11, further comprising:

receiving a second request to translate a second virtual memory address to a second physical memory address;

selecting, based on the second virtual memory address, a second data cache line included in the first translation lookaside buffer that includes a second page table entry and second secure state information; and

generating a second memory access response based on the second page table entry and the second secure state information.

18. The method of claim 11, wherein determining the first secure state information comprises:

determining a first page included in the protected regions of memory based on the first physical memory address; and

retrieving secure state information that is associated with the first page.