Secure address translation services using message authentication codes and invalidation tracking

A computer-implemented method, comprising:

• receiving a memory access request from a remote device via a host-to-device link, wherein the memory access request comprises a host physical address (HPA) that identifies a physical address within the memory pertaining to the memory access request and a first message authentication code (MAC);
• generating a second message authentication code (MAC) using the host physical address received with the memory access request and a private key associated with the remote device;
• and
• performing at least one of:
• allowing the memory access to proceed when the first MAC and the second MAC match and the HPA is not in an invalidation tracking table (ITT) maintained by the IOMMU, wherein a ternary content addressable memory (TCAM) is used to track one or more ranges of invalidated HPAs in the ITT;
• or
• blocking the memory operation when the first MAC and the second MAC do not match.

A non-transitory computer readable medium comprising instructions which, when executed by a processor, configure the processor to perform operations comprising:

• receiving a memory access request from a remote device via a host-to-device link, wherein the memory access request comprises a host physical address (HPA) that identifies a physical address within the memory pertaining to the memory access request and a first message authentication code (MAC);
• generating a second message authentication code (MAC) using the host physical address received with the memory access request and a private key associated with the remote device;
• and
• performing at least one of:
• allowing the memory access to proceed when the first MAC and the second MAC match and the HPA is not in an invalidation tracking table (ITT) maintained by the IOMMU, wherein the ITT is implemented as at least one of a direct mapped cache or a set associative cache which is split into multiple levels;
• or
• blocking the memory operation when the first MAC and the second MAC do not match.