Method and system for integrity protection for accelerator device firmware using virtualization-based security
US-2024354415-A1 · Oct 24, 2024 · US
US2021064539A1 · US · A1
| Field | Value |
|---|---|
| Publication number | US-2021064539-A1 |
| Application number | US-202016874997-A |
| Country | US |
| Kind code | A1 |
| Filing date | May 15, 2020 |
| Priority date | Sep 4, 2019 |
| Publication date | Mar 4, 2021 |
| Grant date | — |
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
What the patent document calls the invention.
A short plain-language summary of the technical disclosure.
Who owns or filed the patent and who is credited as inventor.
Filing, priority, publication, and grant dates set the timeline.
The legal scope of protection — read this for what is actually claimed.
Technology tags used to group this patent with similar filings.
Prior art links and similar publications in this corpus.
Official abstract text for this publication.
A system and method for efficiently transferring address mappings and data access permissions corresponding to the address mappings. A computing system includes at least one processor and memory for storing a page table. In response to receiving a memory access operation comprising a first address, the address translation unit is configured to identify a data access permission based on a permission index corresponding to the first address, and access data stored in a memory location of the memory identified by a second address in a manner defined by the retrieved data access permission. The address translation unit is configured to access a table to identify the data access permission, and is configured to determine the permission index and the second address based on the first address. A single permission index may correspond to different permissions for different entities within the system.
Opening claim text (preview).
1 . An apparatus comprising: an address translation unit; and a memory; wherein in response to receiving a memory access operation comprising a first address, the address translation unit is configured to: identify a data access permission based on a permission index corresponding to the first address; and access data stored in a memory location of the memory identified by a second address in a manner defined by the retrieved data access permission; wherein the permission index and an address mapping between the first address and the second address are shared by the apparatus and an external processing unit, wherein the external processing unit uses a different data access permission than the identified data access permission. 2 . The apparatus as recited in claim 1 , wherein the address translation unit is configured to access a table to identify the data access permission, and wherein the address translation unit is further configured to determine the permission index and the second address based on the first address. 3 . The apparatus as recited in claim 2 , wherein the address translation unit is further configured to distinguish among a plurality of types of data access permissions for the same permission index based on an operating mode of the apparatus. 4 . The apparatus as recited in claim 2 , wherein the address translation unit is further configured to distinguish among a plurality of types of data access permissions for the same permission index using an exception level of the apparatus. 5 . (canceled) 6 . The apparatus as recited in claim 1 , wherein the data access permission of the apparatus does not comprise execute permission and the data access permission of the external processing unit does comprise execute permission. 7 . The apparatus as recited in claim 1 , wherein a copy of each of the permission index and the address mapping between the first address and the second address is stored in a shared page table in external memory. 8 . A method, comprising: receiving a memory access operation comprising a first address targeting a memory; and in response to receiving the memory access operation: identifying, by an address translation unit, a data access permission based on a permission index corresponding to the first address; and accessing, by the address translation unit, data stored in a memory location of the memory identified by a second address in a manner defined by the retrieved data access permissions; wherein the permission index and an address mapping between the first address and the second address are shared by the apparatus and an external processing unit, wherein the external processing unit uses a different data access permission than the identified data access permission. 9 . The method as recited in claim 8 , further comprising the address translation unit: accessing a table to identify the data access permission; and determining the permission index and the second address based on the first address. 10 . The method as recited in claim 9 , further comprising distinguishing among a plurality of data access permissions for the same permission index based on an operating mode of the apparatus. 11 . The method as recited in claim 9 , further comprising distinguishing among a plurality of data access permissions for the same permission index based on an exception level of the apparatus. 12 . (canceled) 13 . The method as recited in claim 8 , wherein the data access permission of the apparatus does not comprise an execute permission and the data access permission of the external processing unit does comprise an execute permission. 14 . The method as recited in claim 8 , wherein a copy of each of the permission index and the address mapping between the first address and the second address is stored in a shared page table in external memory. 15 . A non-transitory computer readable storage medium storing program instructions, wherein the program instructions are executable by a processor to: receive a memory access operation comprising a first address targeting a memory; and in response to receiving the memory access operation: identify a data access permission based on a permission index corresponding to the first address; and access data stored in a memory location of the memory identified by a second address in a manner defined by the retrieved data access permission; wherein the permission index and an address mapping between the first address and the second address are shared by the apparatus and an external processing unit, wherein the external processing unit uses a different data access permission than the identified data access permission. 16 . The non-transitory computer readable storage medium as recited in claim 15 , wherein the program instructions are executable by a processor to access a table to identify the data access permission, and wherein the address translation unit is further configured to determine the permission index and the second address based on the first address. 17 . The non-transitory computer readable storage medium as recited in claim 16 , wherein the program instructions are executable by a processor to distinguish among a plurality of data access permissions for the same permission index based on an operating mode of the apparatus. 18 . The non-transitory computer readable storage medium as recited in claim 16 , wherein the program instructions are executable by a processor to distinguish among a plurality of types of data access permissions for the same permission index based on an exception level of the apparatus. 19 . (canceled) 20 . The non-transitory computer readable storage medium as recited in claim 15 , wherein a copy of each of the permission index and the address mapping between the first address and the second address is stored in a shared page table in external memory.
Energy efficient computing, e.g. low power processors, power management or thermal management · CPC title
in a virtual system, e.g. with translation means · CPC title
for multiple virtual address spaces, e.g. segmentation (G06F12/1045 takes precedence) · CPC title
using page tables, e.g. page table structures · CPC title
by checking the subject access rights · CPC title
Related publications grouped by family.
Answers are generated from the same data shown on this page.