Techniques to provide access protection to shared virtual memory
AssigneeIntel Corporation
InventorANNA TRIKALINOU
Life of this patent
Estimating the term…
Abstract
Various embodiments are generally directed to techniques for shared virtual memory (SVM) access protection, such as by performing a security check whenever a write request arrives from an SVM device, for instance. Some embodiments are particularly directed to an input/output memory management unit (IOMMU) that prevents an SVM device from modifying a code page with a memory transaction request by generating an access request fault and/or a translation completion with read-only access in response to the memory transaction request.
Claims25
An apparatus for control flow protection, the apparatus comprising:
- a memory;
- and
- logic for an input/output memory management unit (IOMMU), at least a portion of the logic implemented in circuitry coupled to the memory, the logic to:
- receive a memory access request from a shared virtual memory (SVM) device, the memory access request comprising a type of a plurality of types of memory access requests;
- identify a translation entry associated with the memory access request in a cache, the translation entry comprising a permission set;
- perform the memory access request when the permission set allows the type of the memory access request;
- and
- generate an access request fault when the permission set restricts the type of the memory access request.
At least one non-transitory computer-readable medium comprising a set of instructions that, in response to being executed by a processor circuit, cause the processor circuit to:
- receive a memory transaction request from a shared virtual memory (SVM) device at an input/output memory management unit (IOMMU), the memory transaction request comprising an address associated with a memory page in an SVM utilized by the SVM device;
- determine the memory transaction request includes a translation request and is associated with a write request;
- identify whether the memory page associated with the memory transaction request is executable;
- generate a translation completion with read and write access when the memory page associated with the memory transaction request is not executable;
- and
- generate a translation completion with read-only access when the memory page associated with the memory transaction request is executable.
The at least one non-transitory computer-readable medium of claim 16, comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to identify whether the memory page associated with the memory transaction request is executable based on the IOMMU cache.
A computer-implemented method, comprising:
- receiving a memory transaction request from a shared virtual memory (SVM) device at an input/output memory management unit (IOMMU), the memory transaction request comprising an address associated with a memory page in an SVM utilized by the SVM device;
- determining the memory transaction request includes a translation request and is associated with a write request;
- identifying whether the memory page associated with the memory transaction request is executable;
- generating a translation completion with read and write access when the memory page associated with the memory transaction request is not executable;
- and
- generating a translation completion with read-only access when the memory page associated with the memory transaction request is executable.
Dependencies are inferred from the claim text.