Method and system for integrity protection for accelerator device firmware using virtualization-based security
US-2024354415-A1 · Oct 24, 2024 · US
US10025722B2 · US · B2
| Field | Value |
|---|---|
| Publication number | US-10025722-B2 |
| Application number | US-201514925646-A |
| Country | US |
| Kind code | B2 |
| Filing date | Oct 28, 2015 |
| Priority date | Oct 28, 2015 |
| Publication date | Jul 17, 2018 |
| Grant date | Jul 17, 2018 |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
Systems and computer program products to perform an operation comprising identifying, in a software page frame table by an operating system interrupt handler, a physical address of a memory page, wherein the physical address of the memory page is identified based on a virtual segment identifier (VSID) and a page number, wherein the VSID is specified in an interrupt received from a coherent accelerator and wherein the coherent accelerator generated the interrupt in response to a page fault associated with the memory page, and creating, by the operating system interrupt handler, a page table entry in a hardware page table associating the VSID and the page number with the physical address of the memory page, wherein creating the page table entry resolves the page fault.
Opening claim text (preview).
What is claimed is: 1. A system, comprising: a processor executing instructions of a first process, of a plurality of processes, wherein the first process is allocated a first segment table of a plurality of segment tables and a first effective address space of a plurality of effective address spaces; a host bridge field-programmable gate array (FPGA)-based accelerator; and a memory storing program code, which, when executed performs an operation comprising: receiving, by an operating system (OS) interrupt handler, an interrupt from the host bridge FPGA-based accelerator specifying a virtual segment identifier (VSID) and a virtual page number (VPN) of a global virtual address space, wherein the host bridge FPGA-based accelerator generated the interrupt in response to a page fault incurred by accessing a hardware page table using the VSID and the VPN, wherein the host bridge FPGA-based accelerator directly determines the VSID and VPN based on a mapping in the first segment table between a first effective address of the first effective address space and the VSID and VPN, wherein the first effective address is specified in one of the instructions of the first process, wherein the first process inherits the first effective address space by attaching to a first hardware context provided by the host bridge FPGA-based accelerator, wherein the first hardware context comprises a plurality of attributes comprising: (i) one of the plurality of effective address spaces, (ii) at least one interrupt source, (iii) a memory mapped input/output (I/O) range, and (iv) one of the plurality of segment tables, wherein the host bridge FPGA-based accelerator directly accesses the first effective address space via the first hardware context and without having to set up direct memory access (DMA) with a device driver and a kernel; identifying, in a software page frame table (SWPFT) by the OS interrupt handler, a physical address of a memory page based on the VSID and the VPN; and creating, by the OS interrupt handler, a page table entry in the hardware page table associating the VSID and the VPN with the physical address of the memory page, wherein creating the page table entry resolves the page fault. 2. The system of claim 1 , the operation further comprising, prior to identifying the physical address of the memory page: receiving, by the OS interrupt handler, a lock required to access the SWPFT; and identifying, by the OS interrupt handler, the VPN in a faulting effective address specified in the interrupt. 3. The system of claim 2 , the operation further comprising: prior to creating the page table entry and while holding the lock, determining by the OS interrupt handler, from the SWPFT, validating that a state of the memory page allows a translation for the memory page to be created. 4. The system of claim 2 , wherein identifying the physical address of the memory page in the SWPFT comprises: applying a first hash function to the VSID and the VPN to return a first hash value; and traversing a linked list associated with the first hash value to identify an element of the linked list which specifies an association between: (1) the VSID and the VPN, and (2) the physical address of the memory page, wherein the linked list is traversed by the OS interrupt handler while holding the lock. 5. The system of claim 1 , the operation further comprising: upon determining that the SWPFT does not include an indication of a mapping between: (1) the VSID and the VPN and (2) the physical address of the memory page, invoking an OS page fault handler to create the page table entry. 6. The system of claim 1 , wherein the SWPFT specifies an entry for each of a plurality of memory pages, wherein the hardware page table does not specify an entry for each of the plurality of memory pages, wherein the page fault is generated upon determining the hardware page table does not include an entry associating the VSID and the VPN with the physical address of the memory page. 7. A computer program product comprising: a non-transitory computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code executable by one or more computer processors to perform an operation comprising: executing, by a processor, instructions of a first process, of a plurality of processes, wherein the first process is allocated a first segment table of a plurality of segment tables and a first effective address space of a plurality of effective address spaces; receiving, by an operating system (OS) interrupt handler, an interrupt from a host bridge field-programmable gate array (FPGA)-based accelerator specifying a virtual segment identifier (VSID) and a virtual page number (VPN) of a global virtual address space, wherein the host bridge FPGA-based accelerator generated the interrupt in response to a page fault incurred by accessing a hardware page table using the VSID and the VPN, wherein the host bridge FPGA-based accelerator directly determines the VSID and VPN based on a mapping in the first segment table between a first effective address of the first effective address space and the VSID and VPN, wherein the first effective address is specified in one of the instructions of the first process, wherein the first process inherits the first effective address space by attaching to a first hardware context provided by the host bridge FPGA-based accelerator, wherein the first hardware context comprises a plurality of attributes comprising: (i) one of the plurality of effective address spaces, (ii) at least one interrupt source, (iii) a memory mapped input/output (I/O) range, and (iv) one of the plurality of segment tables, wherein the host bridge FPGA-based accelerator directly accesses the first effective address space via the first hardware context and without having to set up direct memory access (DMA) with a device driver and a kernel; identifying, in a software page frame table (SWPFT) by the OS interrupt handler, a physical address of a memory page based on the VSID and the VPN; and creating, by the OS interrupt handler, a page table entry in the hardware page table associating the VSID and the VPN with the physical address of the memory page, wherein creating the page table entry resolves the page fault. 8. The computer program product of claim 7 , the operation further comprising, prior to identifying the physical address of the memory page: receiving, by the OS interrupt handler, a lock required to access the SWPFT; and identifying, by the OS interrupt handler, the VPN in a faulting effective address specified in the interrupt. 9. The computer program product of claim 8 , the operation further comprising: prior to creating the page table entry and while holding the lock, determining by the OS interrupt handler, from the SWPFT, validating that a state of the memory page allows a translation for the memory page to be created. 10. The computer program product of claim 7 , wherein identifying the physical address of the memory page in the SWPFT comprises: applying a first hash function to the VSID and the VPN to return a first hash value; and traversing a linked list associated with the first hash value to identify an element of the linked list which specifies an association between: (1) the VSID and the VPN, and (2) the physical address of the memory page, wherein the linked list is traversed by the OS interrupt handler while holding the lock. 11. The computer program product of claim 7 , the operation further comprising: upon determining that the SWPFT does not include an indication of a mapping between: (1) the VSID and the VPN and (2) the physical address of the memory page, invoking an
Address translation · CPC title
using page tables, e.g. page table structures · CPC title
Virtual address space management · CPC title
Latency reduction · CPC title
with special data handling, e.g. priority of data or instructions, handling errors or pinning · CPC title
Related publications grouped by family.
Answers are generated from the same data shown on this page.