# US 10,769,076 B2 · Distributed address translation in a multi-node interconnect fabric > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,769,076 B2 - Document ID: US10769076B2 - Status: Granted - Kind: B2 - Application number: 16/198,649 - Filed: 2018-11-21 - Published: 2020-05-21 - Granted: 2020-09-08 - Earliest claimed: 2018-11-21 - Assignees: NVIDIA Corporation - Applicants: NVIDIA Corporation - Inventors: Samuel Hammond Duncan; Sanjeev Jain; Mark Douglas Hummel; Vyas Venkataraman; Olivier Giroux; Larry Robert Dennison; Alexander Toichi Ishii; Hemayet Hossain; Nir Haim Arad - Web page: https://patentgrep.com/patent/US10769076B2 ## CPC - G06F 12/1027: using associative or pseudo-associative address translation means, e.g. translation look-aside buffer [TLB] - G06F 12/1072: Decentralised address translation, e.g. in distributed shared memory systems - G06F 12/109: for multiple virtual address spaces, e.g. segmentation (G06F12/1036 takes precedence) - G06F 12/1491: {in a hierarchical protection system, e.g. privilege levels, memory rings} - G06F 12/1036: for multiple virtual address spaces, e.g. segmentation (G06F12/1045 takes precedence) - G06F 2212/1044: Space efficiency improvement - G06F 2212/1052: Security improvement - G06F 2212/151: Emulated environment, e.g. virtual machine - G06F 2212/154: Networked environment - G06F 2212/651: Multi-level translation tables - G06F 2212/656: Address space sharing - G06F 2212/657: Virtual address space management - G06F 2212/68: Details of translation look-aside buffer [TLB] - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Multiprocessor clusters in a virtualized environment conventionally fail to provide memory access security, which is frequently a requirement for efficient utilization in multi-client settings. Without adequate access security, a malicious process may access what might be confidential data that belongs to a different client sharing the multiprocessor cluster. Furthermore, an inadvertent programming error in the code for one client process may accidentally corrupt data that belongs to the different client. Neither scenario is acceptable. Embodiments of the present disclosure provide access security by enabling each processing node within a multiprocessor cluster to virtualize and manage local memory access and only process access requests possessing proper access credentials. In this way, different applications executing on a multiprocessor cluster may be isolated from each other while advantageously sharing the hardware resources of the multiprocessor cluster. ## Claims ### Claim 1 A method, comprising: exporting, by a destination node executing a process associated with an affiliation identifier, a first virtual address range into a first fabric linear address (FLA) range within a FLA space for sharing data residing in one or more local system physical memory pages within the destination, wherein the exporting is initiated by the process and the first FLA range is mapped by the destination node to the one or more local system physical memory pages comprising a local system physical address (SPA) space for a memory subsystem within the destination node; configuring, by a source node executing at least one other process that is associated with the affiliation identifier, one or more page table entries within a local translation lookaside buffer (TLB) to map a second virtual address range for the source node to the first FLA range, wherein the second virtual address range is mapped by one TLB entry with a size that is larger than a physical page size at the destination node; generating, by the source node, a memory access request comprising a virtual address (VA) within the second virtual address range that targets the data; mapping, by the source node, the VA to a FLA within the first FLA range that targets the data; composing, by the source node, a remote access request that includes the FLA; transmitting, by the source node, the remote access request to the destination node; mapping, by a second TLB within the destination node, the FLA to a guest physical address (GPA) that targets the data; and mapping, by the destination node, the GPA to a SPA that targets the data within the local SPA space. ### Claim 2 (depends on 1) The method of claim 1, wherein the remote access request includes the affiliation identifier. ### Claim 3 (depends on 2) The method of claim 2, wherein the remote access request is transmitted through a switching fabric coupled to the source node and the destination node. ### Claim 4 (depends on 3) The method of claim 3, wherein the switching fabric determines whether the remote access request is transmitted to the destination node based on the affiliation identifier and the FLA of the remote access request. ### Claim 5 (depends on 2) The method of claim 2, wherein mapping the VA to the FLA is performed by a first memory management unit within the source node. ### Claim 6 (depends on 2) The method of claim 2, wherein mapping the FLA to the GPA is performed by a first memory management unit within the destination node. ### Claim 7 (depends on 6) The method of claim 6, wherein mapping the FLA to the GPA includes determining whether the memory access request is allowed based on a the affiliation identifier and the FLA. ### Claim 8 (depends on 1) The method of claim 1, wherein mapping the GPA to the SPA is performed by a virtual memory management unit within the destination node. ### Claim 9 (depends on 1) The method of claim 1, further comprising accessing the data, located at the SPA, within the memory subsystem of the destination node. ### Claim 10 (depends on 1) The method of claim 1, wherein the second TLB within the destination node maps the first FLA range to one or more pages within a GPA space. ### Claim 11 (depends on 1) The method of claim 1, wherein the size is a power of two times larger than the physical page size at the destination node. ### Claim 12 (depends on 1) The method of claim 1, wherein page table entries within the local TLB include a field to indicate whether a VA maps to a local memory device or a remote memory device. ### Claim 13 (depends on 1) The method of claim 1, wherein, in response to receiving a notification that the first FLA range is exported, the at least one other process configures the one or more page table entries within the local TLB. ### Claim 14 (depends on 1) The method of claim 1, wherein the affiliation identifier comprises at least one of a privilege level or a security context. ### Claim 15 (depends on 14) The method of claim 14, where the security context indicates which of one or more specified functions or resources may be accessed by the process. ### Claim 16 A multiprocessor system, configured to: export, by a destination node executing a process associated with an affiliation identifier, a first virtual address range into a first fabric linear address (FLA) range within a FLA space for sharing data residing in one or more local system physical memory pages within the destination, wherein the exporting is initiated by the process and the first FLA range is mapped by the destination node to one or more local system physical memory pages comprising a local system physical address (SPA) space for a memory subsystem within the destination node; configure, by a source node executing at least one other process that is associated with the affiliation identifier, one or more page table entries within a local translation lookaside buffer (TLB) to map a second virtual address range for the source node to the first FLA range, wherein the second virtual address range is mapped by one TLB entry with a size that is larger than a physical page size at the destination node; generate, by the source node, a memory access request comprising a virtual address (VA) within the second virtual address range that targets the data; map, by the source node, the VA to a corresponding FLA within the first FLA range that targets the data; compose, by the source node, a remote access request that includes the FLA; transmit, by the source node, the remote access request to the destination node; map, by a second TLB within the destination node, the FLA to a corresponding guest physical address (GPA) that targets the data; and map, by the destination node, the GPA to a corresponding SPA that targets the data within the local SPA space. ### Claim 17 (depends on 16) The multiprocessor system of claim 16, further comprising a switching fabric, wherein the remote access request is transmitted through a switching fabric coupled to the source node and the destination node based on the affiliation identifier and the FLA of the access request. ### Claim 18 (depends on 16) The multiprocessor system of claim 16, wherein, in response to receiving a notification that the first FLA range is exported, the at least one other process configures the one or more page table entries within the local TLB. ### Claim 19 (depends on 16) The multiprocessor system of claim 16, wherein the second TLB within the destination node maps the first FLA range to one or more pages within a GPA space. ### Claim 20 A non-transitory, computer-readable storage medium storing instructions that, when executed by a multiprocessor system, cause the multiprocessor system to: export, by a destination node executing a process associated with an affiliation identifier, a first virtual address range into a first fabric linear address (FLA) range within a FLA space for sharing data residing in one or more local system physical memory pages within the destination, wherein the exporting is initiated by the process and the first FLA range is mapped by the destination node to one or more local system physical memory pages comprising a local system physical address (SPA) space for a memory subsystem within the destination node; configure, by a source node executing at least one other process that is associated with the affiliation identifier, one or more page table entries within a local translation lookaside buffer (TLB) to map a second virtual address range for the source node to the first FLA range, wherein the second virtual address range is mapped by one TLB entry with a size that is larger than a physical page size at the destination node; generate, by the source node, a memory access request comprising a virtual address (VA) within the second virtual address range that targets the data; map, by the source node, the VA to a corresponding FLA within the first FLA range that targets the data; compose, by the source node, a remote access request that includes the FLA; transmit, by the source node, the remote access request to the destination node; map, by the destination node, the FLA to a corresponding guest physical address (GPA) that targets the data; and map, by a second TLB within the destination node, the GPA to a corresponding SPA that targets the data within the local SPA space. ### Claim 21 A method, comprising: exporting, by a destination node executing a process associated with an affiliation identifier, a first virtual address range into a fabric linear address (FLA) range within a FLA space for sharing data residing in one or more local system physical memory pages within the destination, wherein the exporting is initiated by the process and the first FLA range is mapped by the destination node to one or more local system physical memory pages comprising a local system physical address (SPA) space for a memory subsystem within the destination node; configuring, by a source node executing at least one other process that is associated with the affiliation identifier, one or more page table entries within a local translation lookaside buffer (TLB) to map a second virtual address range for the source node to the first FLA range, wherein the second virtual address range is mapped by one TLB entry with a size that is larger than a physical page size at the destination node; generating, by the source node, a memory access request comprising a virtual address (VA) within the second virtual address range that targets the data; mapping, by the source node, the VA to a corresponding FLA within the first FLA range that targets the data; composing, by the source node, a remote access request that includes the FLA; transmitting, by the source node, the remote access request to the destination node; and mapping, by a second TLB within the destination node, the FLA to a corresponding SPA that targets the data within the local SPA space.