SYSTEM-ON-CHIP WITH AT LEAST ONE SECURE IOMMU

Description

[0001] The invention relates to a system on a chip, or SoC, comprising at least one unit for managing access to the processor's shared memory by system peripherals.

[0002] The invention applies to processors equipped with interfaces for master peripherals (i.e., peripherals capable of making requests to the processor's memory) on the interconnection device of the system-on-a-chip elements, such as a communication bus, a network-on-chip (NoC), or an interconnection network. The present invention ensures that the memory protection mechanism typically deployed on processors with master peripherals is not exploited as a hidden communication channel between the peripherals.

[0003] As illustrated on the [ Fig.1 Modern systems-on-a-chip (SoCs) equipped with processors offer the ability to extend system functionality with master peripherals (PERs) that utilize the same type of communication interface or interconnect device (INT) as the processor core(s) to interact with the system, particularly with main memory (MM). To prevent PERs from freely accessing all system memory space, processors equipped with at least one C core and possibly, or even often, at least one memory management unit (MMU) place these peripherals behind a memory protection mechanism.

[0004] The component implementing this mechanism is usually called the processor's shared memory access management unit by peripherals or IOMMU for "Input-Output memory management unit" in English, but can sometimes also be called SMMU for "System Memory Management Unit" in English, or VT for "Virtualization Technology" in English.

[0005] The IOMMU unit for managing access to the processor's shared memory by PER devices to the system is the counterpart, for devices, of the MMU memory management unit for the processor core(s) (C).

[0006] The sharing of a main memory MM is described in an I / OPT page table for PER devices and in the MMUPT memory management unit page table for processes running on the C core(s). These IOPT and MMUPT tables are stored in main memory MM.

[0007] The IOMMU, which manages access to the processor's shared memory by PER devices, includes a Translation Lookaside Buffer (TLB), where each entry or line corresponds to a translation of a virtual address from a device to a physical address destined for the system. The IOMMU also includes a Logic circuit associated with the TLB. The IOMMU may also include a Page Table Walker (PTW) module for autonomously updating (i.e., without processor intervention) the TLB.

[0008] The operating system (OS) configures the IOMMU to define the system memory areas that the various devices attached to the IOMMU can access. As with the MMU (Memory Management Unit), translations can be performed between system physical addresses (SPAs) and device addresses (IOVAs), which are called virtual addresses. Other services can be provided by the IOMMU, but these need not be described for the purposes of this invention.

[0009] To configure access to the shared memory provided by the IOMMU, the operating system uses the IOPT input / output page table, in which it defines access rights and translations for the various devices. This table is stored in system memory (typically DRAM). To speed up access to this table, the IOMMU implements a buffer, TLB, in which the most frequently used entries are stored.

[0010] Thanks to the IOMMU unit, the operating system can limit the system memory areas that peripherals can access, share a virtual address space between a process and a device, and guarantee the integrity and confidentiality of data from different applications and devices on the system. This also ensures that two devices for which the operating system has defined disjoint memory areas cannot communicate with each other.

[0011] Unfortunately, devices can exploit the IOMMU's TLB buffer to learn what data another device is manipulating (side-channel attack) or to exchange data with each other (covert-channel attack). This can be achieved using approaches also employed for cryptographic attacks via a secondary channel that utilizes translation buffer synchronization (TLBleed) or a hardware vulnerability in branch prediction such as Spectre or Meltdown.

[0012] The papers "Secure TLBs," by Shuwen Deng, Wenjie Xiong, and Jakub Szefer, published in the Proceedings of the 46th International Symposium on Computer Architecture (ISCA), 2019, and US20200151111 A1, illustrate such state-of-the-art systems-on-a-chip. Publication US 2014 / 181461 A1 discloses an input / output memory management unit that includes access and usage bit fields for each virtual page referenced within the unit.

[0013] As explained previously, the IOMMU does not protect against side-channel or covert-channel attacks by malicious devices. Implementations exist that aim to mitigate these types of attacks, but do not directly address them, as they were developed for reasons other than security, such as performance. For example, multiple IOMMUs can be deployed in a system-on-a-chip, such as IOMMU A and IOMMU B. This prevents a device connected to IOMMU A from exploiting weaknesses in IOMMU A to transfer non-shared data (a covert-channel attack) to a device connected to IOMMU B because the IOMMUs are not shared. Taking this solution to its extreme by placing an IOMMU in front of every device would present several problems: This is not applicable to external devices (those exposing a connector on the system-on-a-chip, such as PCI / PCI-Express devices) because multiple devices can be connected to the same connector. Such a deployment significantly increases the required surface area on the system-on-a-chip, thereby increasing its cost and power consumption.

[0014] A solution like the one proposed for MMU memory management units, as described in the documents cited above, could be implemented on the IOMMU. However, in the case of added randomness in the processing time of a memory request (see the article "Secure TLBs," Proceedings of the 46th International Symposium on Computer Architecture (ISCA), 2019), no use case allows for performance equivalent to an unprotected IOMMU. Indeed, adding missing translations present in the TLB buffer degrades performance in terms of latency and throughput. This type of defense significantly degrades I / O performance even when only one device is performing memory transactions, without significantly reducing the throughput of the hidden channel. This is because an attacker can use error-correcting code for potentially faulty transmitted bits.Furthermore, partitioning techniques for the TLB buffer or the IOMMU unit also fail to achieve native performance. When few devices utilize the IOMMU unit, the hardware is underutilized, and the situation ultimately becomes similar to the use case where one IOMMU unit is attached to each device.

[0015] State-of-the-art solutions at the Memory Management Unit (MMU) level are ineffective against covert channel attacks because an attacker can bypass them. Furthermore, they are not optimized for the memory traffic generated by a peripheral device.

[0016] One aim of the invention is to overcome the problems mentioned above, and in particular to limit this type of attack on the IOMMU management unit of access to the processor's shared memory by peripherals.

[0017] According to one aspect of the invention, a system-on-a-chip is proposed comprising: a processor with at least one core; a shared main memory with an input / output page table; a system element interconnection device; and at least one unit for managing access to the processor's shared memory by system devices configured to address requests to the processor, comprising: a translation buffer with, for each entry corresponding to a translation of a virtual page into a physical page enabling the translation of transactions from devices to the system, an additional reservation bit representing a reservation state or not of a translation entry of the buffer for a device;and a logic circuit associated with the translation buffer, configured to manage the reservation bit so as to avoid replacing a translation input of the buffer corresponding to a translation when the line reservation bit has a value corresponding to a reserved state, and configured to sporadically, at bounded inter-arrival distances, reset all reservation bits of the buffer inputs to the unreserved state.

[0018] A sporadic event with bounded inter-arrival distance is understood to be a repetitive event for which a minimum and a maximum bound are defined for the duration separating two occurrences of the event.

[0019] According to one embodiment, the logic circuit is configured, when a translation requested by a memory request from a device is present in the buffer memory, to translate the address and transfer it to the shared main memory, and test if the reservation bit of the input corresponds to a non-reservation, in which case the logic circuit reserves the input for said device.

[0020] In one embodiment, the logic circuit is configured, when a translation requested by a memory request from a device is absent in the buffer memory, to search for it in the input / output page table using a current page pointer module for the tables, and if the translation is not obtained in the input / output page table, to raise an interrupt to the corresponding core.

[0021] According to one embodiment, the logic circuit is configured, in case of obtaining the translation in the input / output page table, to search for the presence of an invalid entry in the buffer memory, and in case of the presence of an invalid entry in the buffer memory, to allocate the invalid entry from the buffer memory to said translation and write it there.

[0022] When the software controlling the unit, typically the operating system, revokes access to certain memory areas for a device, it removes the address translation from the memory I / O page table. It also sends a translation invalidation command to the device access management unit. When the device access management unit invalidates an entry, it invalidates the TLB buffer entry, making any further access to the data impossible.

[0023] In one embodiment, the logic circuit is configured, when the translation is obtained in the input / output page table, to search for the presence of an invalid entry in the buffer, and when there is no invalid entry in the buffer, to search for the presence of an unreserved entry whose reservation bit corresponds to a non-reservation in the buffer, and when there is an unreserved entry in the buffer, to allocate the unreserved entry in the buffer to said translation and write it there.

[0024] According to one embodiment, the logic circuit is configured, in case of obtaining the translation in the input / output page table, to search for the presence of an invalid entry in the buffer, and in case of absence of an invalid entry in the buffer, to search for the presence of an unreserved entry whose reservation bit corresponds to a non-reservation in the buffer, and in case of absence of an unreserved entry in the buffer, to search for the presence of a reserved entry whose reservation bit corresponds to a reservation in the buffer whose transaction is being processed, to allocate the reserved entry whose transaction is being processed to said translation and write it there.

[0025] According to one embodiment, the system-on-chip shared memory device access management unit is configured to be reserved for devices not predefined as trusted.

[0026] In one embodiment, the processor is also equipped with at least one memory management unit, and a memory management unit page table.

[0027] The invention will be better understood upon examination of some embodiments described by way of non-limiting examples and illustrated by the accompanying drawings in which the figures: [ Fig.1 ] schematically illustrates a system-on-a-chip comprising a processor and at least one unit for managing access to the processor's shared memory by peripherals, according to the prior art; [ Fig.2 ] schematically illustrates a system-on-a-chip comprising a processor and at least one unit for managing access to the processor's shared memory by peripherals, according to one aspect of the invention; [ Fig.3 ] schematically illustrates the inputs to a buffer memory of the system-on-chip of the [ Fig.2 ], according to one aspect of the invention; [ Fig.4 ] schematically illustrates the operation of the system-on-chip of the [ Fig.2 ], according to one aspect of the invention; [ Fig.5 ] schematically illustrates the positive outcome of test 3 of the [ Fig.4 ], according to one aspect of the invention; [ Fig.6 ] schematically illustrates the negative outcome of test 3 of the [ Fig.4 ], according to one aspect of the invention; [ Fig.7 ] schematically illustrates the positive outcome of test 7 of the [ Fig.4 ], according to one aspect of the invention; [ Fig.8 ] schematically illustrates the positive outcome of test 9 of the [ Fig.4 ], according to one aspect of the invention; [ Fig.9 ] schematically illustrates the positive outcome of test 11 of the [ Fig.4 ], according to one aspect of the invention; [ Fig.10 ] schematically illustrates the negative outcome of test 11 of the [ Fig.4 ], according to one aspect of the invention; [ Fig.11 ] schematically illustrates a system-on-a-chip comprising a processor and at least one unit for managing access to the processor's shared memory by peripherals, according to one aspect of the invention, and at least one state-of-the-art unit for managing access to the processor's shared memory by peripherals; [ Fig.12 ] schematically illustrates a system-on-a-chip comprising a processor and at least one unit for managing access to the processor's shared memory by peripherals, coupled to a peripheral bus controller, according to one aspect of the invention.

[0028] Across all figures, elements with identical references are similar.

[0029] There [ Fig.2 [This schematically represents, according to one aspect of the invention, a system-on-a-chip comprising:] a processor with at least one C core and at least one MMU memory management unit; a shared MM main memory, for example with an IOPT input / output page table and an MMUPT memory management unit page table; an INT interconnect device for the system elements; and at least one IOMMU for managing access from PER devices to the system-on-chip's shared memory, configured to address requests to the processor, comprising: a translation TLB buffer with, for each entry corresponding to a translation of a virtual page into a physical page for translating transactions from PER devices to the system, an additional Res reservation bit representing whether or not a translation entry in the TLB buffer is reserved for a device;and a Logic circuit associated with the translation TLB buffer, configured to manage the Res reservation bit so as to avoid replacing a translation input of the TLB buffer corresponding to a translation when the Res reservation bit of the line has a value corresponding to a reserved state, and configured to sporadically, at bounded inter-arrival distances, reset all reservation bits of the TLB buffer inputs to the unreserved state.

[0030] The invention consists of a policy for replacing TLB buffer inputs for an IOMMU unit. This policy dynamically allocates TLB buffer inputs to a device for a time interval, and then reallocates them when that time interval has elapsed.

[0031] The main advantage of the present invention is to reduce or prevent the exploitation of the hidden channel that two devices can set up while maintaining performance very close to the nominal performance of a conventional IOMMU unit.

[0032] There [ Fig.3 ] schematically represents the inputs of a buffer memory of the system-on-chip of the [ Fig.2 ], according to one aspect of the invention.

[0033] Compared to a state-of-the-art TLB buffer, the TLB buffer of the invention is such that one of its inputs includes, in addition to the other fields, a field corresponding to a Res reservation bit.

[0034] Thus, an entry in the TLB buffer memory includes the following fields: devicelD: identifier used by the IOMMU unit to identify the device(s) to which the translation applies; Virtual address: virtual address of the page base used by the devices; Physical address: physical address of the page base used to route device requests into memory; R: bit indicating whether or not the corresponding device is allowed to read the page (virtual or physical); W: bit indicating whether or not the corresponding device is allowed to write the page (virtual or physical); Res: bit indicating whether or not the entry is reserved for the corresponding device (devicelD).

[0035] The base of the page refers to the address marking the beginning of a memory area of ​​predefined size.

[0036] The operating principle of protection against side-channel attacks is to limit the possibility of two devices creating access collisions at the TLB buffer level of the IOMMU unit.

[0037] To achieve this, each entry in the TLB buffer is assigned to a device for a specific period. The contents of a TLB buffer entry associated with a device can only be replaced by other translations belonging to that same device, thereby limiting the possibility of access collisions at the TLB buffer level.

[0038] The added Res reservation bit is not accessible outside the IOMMU unit (e.g., by a device or by the operating system running on a core), and indicates whether an entry in the TLB buffer is reserved or not.

[0039] There [ Fig.4 ] schematically represents the operation of the system-on-chip of the [ Fig.2 ], according to one aspect of the invention, or in other words the method of translating a memory transaction 1 implemented by the Logic circuit.

[0040] When a memory transaction 1 is received by the IOMMU unit, as illustrated in the [ Fig.5 The TLB buffer is scanned to find the translation of the virtual address to a physical address. The example uses a single-input TLB buffer, and the figures show the first TLB arrays before translation and the second TLB arrays after translation.

[0041] If a translation is found in the TLB buffer (positive output of test 2) and its input is reserved (positive output of test 3), the virtual address is translated into a physical address and transferred to main memory, as shown in the [ Fig.5 ].

[0042] The second and third tables of the [ Fig.5 ] are identical because the translation is found in the TLB buffer, so there is no need to replace the TLB input.

[0043] If the input that enabled the translation of the transaction is not reserved (negative output of test 3), i.e., whose Res reservation bit indicates non-reservation, then the IOMMU unit reserves it for the corresponding device, as shown in the [ Fig.6 ], by setting the Res reservation bit to reserved.

[0044] When the translation is not in the TLB buffer (negative output of test 2), the IOMMU unit scans the IOPT page table to find the translation (test 5), using a current pointer PTW module, which can be implemented in hardware or software.

[0045] If no translation is found in the IOPT page table (negative output of test 5), then the OMMU unit raises an interrupt 6 (page fault) to core C, as illustrated in the [ Fig.4 ].

[0046] If the IOMMU unit finds the translation in the IOPT page table (positive output of test 5), it evaluates several successive conditions to choose the entry to replace in the TLB buffer memory, as follows.

[0047] The entry is then chosen in the following order of priority: an invalid input (positive output of test 7), which is allocated 8, as illustrated on the [ Fig.7 ]. a re-allocable input (positive output of test 9 following negative output of test 7), which is re-allocated 10, until the end of the period, as illustrated in the [ Fig.8 ]. an already allocated input (positive output of test 11 following negative output of test 9), as illustrated on the [ Fig.9 (replacing an entry already belonging to the device whose transaction is being processed). No TLB entries are available for reallocation, so no reallocation is necessary.

[0048] In all three cases 8, 10 and positive test 11 output, a backup 12 of the IOPT input / output page table is performed, and an input reservation is made for the device performing the transaction.

[0049] If none of the conditions are met (negative output of test 11), the transaction is translated and transmitted to main memory (MM) without saving the translation in the TLB buffer, as illustrated in the [ Fig.10 ].

[0050] Finally, the continuation of memory transaction 13 is performed.

[0051] This input allocation mechanism is complemented by a mechanism for reallocating (or re-allocation) the TLB buffer inputs. This mechanism is sporadic, with a bounded inter-arrival distance, and consists of resetting all the bits or Res fields of the TLB buffer, resetting them to zero (in the case where 0 means unreserved or 1 means reserved), thereby removing the reservations of all TLB buffer inputs.

[0052] However, entries whose reservation has been removed are not invalidated, and therefore a device can reuse an unreserved entry without suffering a TLB miss. Furthermore, it is impossible for a device belonging to another device to distinguish between retrieving an invalid entry and retrieving an entry previously allocated to another device. Entries are sporadically re-allocated to prevent devices from synchronizing with the TLB entry reallocation period to reimplement the attack at a lower rate (the exchange rate would become the reallocation rate instead of the IOMMU's request processing rate).

[0053] The present invention significantly reduces access collisions between two devices at the IOMMU TLB buffer level, as the devices are no longer able to eject translations from other devices from the TLB buffer outside of input reallocation periods. Consequently, the throughput of the hidden channel is limited, rendering it unusable.

[0054] The present invention also makes it possible to maintain performance close to the native performance of a conventional IOMMU unit for typical device access. Therefore, devices can be classified into two categories: Network devices receive data from outside the system, which is transmitted in a burst (a relatively short data sequence sent at maximum speed during the window allotted to the sender) via memory writes. Packets leaving the system are retrieved via a burst of reads and then transmitted out of the system. Transactions are highly localized because they are always destined for the receive buffer or the kernel's transmit buffer. Computing accelerators load the computational operands from main memory via a burst of reads. The data is then processed by confining execution to the device's internal memory. Finally, the output data is transmitted to main memory via a burst of writes.

[0055] These two types of devices perform memory accesses that generally have high locality, meaning the virtual addresses of the memory accesses are close to each other. They differ in the regularity of their accesses: network device accesses are fairly sporadic, while accelerator accesses are periodic and regular. Therefore, it is highly unlikely that a device could use all the entries of a TLB buffer in a short period of time. It is also highly unlikely that a device would reserve an entire TLB buffer because the data that devices manipulate often has high locality. Therefore, several devices can operate in parallel without interference from the TLB buffer entry allocation system. Only malicious accesses will be affected by this mechanism.

[0056] Therefore, the present invention for replacing the inputs of a TLB buffer memory allows for: Reduce the attack surface from side-channel attacks. Side-channel attacks use the time it takes the IOMMU to translate a memory transaction to exchange information. Maintain nominal performance when device memory accesses do not reserve an entire TLB buffer. Avoid starvation, meaning all device requests will be served. If a device cannot obtain entries in the TLB buffer, its requests are translated without being cached. Therefore, performance degradation can occur without starvation.

[0057] At a minimum, a system-on-a-chip with master (internal or external) but untrusted peripherals must contain an IOMMU according to the invention, resilient to side-channel or hidden-channel attacks. All master peripherals (trusted or untrusted) must be connected to the rest of the system through this IOMMU.

[0058] If surface area and cost constraints are not severely limited, the system-on-chip can contain two IOMMU units, one resilient to attacks according to the invention, and one traditional (i.e., non-resilient), as illustrated in the [ Fig.11 On the traditional IOMMU, trusted internal master devices can be connected. All other (non-master) devices must be connected to the resilient IOMMU unit according to the invention.

[0059] All external devices, whether trusted or not, must be connected to the resilient IOMMU unit. This is because any external device (e.g., a device connected to a PCI / PCI-Express slot) can be easily replaced with a malicious one.

[0060] This implementation with a traditional IOMMU and a resilient IOMMU can allow trusted internal peripherals on the traditional IOMMU unit to avoid the slight performance degradation that the resilient IOMMU unit can cause.

[0061] This embodiment, combining the traditional IOMMU and the resilient IOMMU according to the invention, can be scaled up according to the space and cost constraints of the system-on-chip for performance reasons, for example, with two traditional IOMMUs and one resilient IOMMU according to the invention, or with one traditional IOMMU and three resilient IOMMUs. However, only trusted internal peripherals should be connected to the traditional IOMMUs. Preferably, multiple translation TLB buffers are used within a single large IOMMU, rather than multiple IOMMUs.

[0062] In some cases, again for performance reasons, the resilient IOMMU unit according to the invention can be tightly coupled to a peripheral bus controller, such as the root controller of a PCI / PCI-Express bus, as illustrated in the [ Fig.12 ].

[0063] The invention is intended to be used in the IOMMU units of systems on chip for which master peripherals (e.g. encryption accelerator, network interface, GPUs, TPUs, neural network, ...) are used, and particularly when the peripherals are developed by third parties and these handle sensitive data.

[0064] The invention applies to systems with external peripherals (e.g., network cards, graphics cards, etc.), but also to systems with internal peripherals (i.e., peripherals integrated into the system-on-a-chip). For example, when a RISC-V-based system-on-a-chip is developed using peripherals implemented by a third party. These peripherals can be difficult to verify because their IP blocks (for "Intellectual Property") are closed (no access to their design) and / or complex. Placing these peripherals behind an IOMMU unit incorporating the present invention ensures that they cannot perform side-channel or hidden-channel attacks. This also avoids more expensive solutions such as placing a different IOMMU unit in front of each peripheral.

Claims

1. System-on-chip comprising: - a processor provided with at least one core (C); - a shared main memory (MM) provided with an input / output page table (IOPT); - a device (INT) for interconnecting elements of the system; and - at least one unit (IOMMU) for managing peripheral (PER) access to the shared memory of the system-on-chip, configured to send requests to the processor, comprising: - a translation lookaside buffer (TLB) provided, for each entry corresponding to a translation of a virtual page to a physical page enabling the translation of transactions from the peripherals (PER) to the system, with an additional reservation bit (Res) representative of a reserved or unreserved state of a translation entry in the lookaside buffer (TLB) for a peripheral; and - a logic circuit (Logic) associated with the translation lookaside buffer (TLB), configured to manage the reservation bit (Res) so as to avoid replacing a translation entry in the lookaside buffer (TLB) corresponding to a translation when the reservation bit (Res) of the row has a value corresponding to a reserved state, and configured, sporadically at a bounded interarrival distance, to reset all of the reservation bits of the entries in the lookaside buffer (TLB) to the unreserved state.

2. System according to claim 1, wherein the logic circuit (Logic) is configured, when a translation requested by a memory request (1) of a peripheral is present (2) in the lookaside buffer (TLB), to translate the address and transfer it to the shared main memory (MM), and test (3) if the reservation bit (Res) of the entry corresponds to a non-reservation, in which case, the logic circuit (Logic) reserves the entry for said peripheral.

3. System according to claim 2, wherein the logic circuit (Logic) is configured, when a translation requested by a memory request of a peripheral is absent in the lookaside buffer (TLB), to search for it in the input / output page table (IOPT) by means of a page table walk (PTW) module, and in case of not obtaining the translation in the input / output page table (IOPT), to raise an interruption to the corresponding core (C).

4. System according to claim 3, wherein the logic circuit (Logic) is configured, in case of obtaining the translation in the input / output page table (IOPT), to search for the presence of an invalid entry in the lookaside buffer (TLB), and in case of presence of an invalid entry in the lookaside buffer (TLB), to allocate the invalid entry in the lookaside buffer (TLB) to said translation and write it there.

5. System according to claim 3 or 4, wherein, the logic circuit (Logic) is configured, in case of obtaining the translation in the input / output page table (IOPT), to search for the presence of an invalid entry in the lookaside buffer (TLB), and in case of absence of an invalid entry in the lookaside buffer (TLB), to search for the presence of a non-reserved entry, the reservation bit (Res) of which corresponds to a non-reservation in the lookaside buffer (TLB), and in case of presence of a non-reserved entry in the lookaside buffer (TLB), to allocate the non-reserved entry in the lookaside buffer (TLB) to said translation and write it there.

6. System according to any one of claims 3 to 5, wherein, the logic circuit (Logic) is configured, in case of obtaining the translation in the input / output page table (IOPT), to search for the presence of an invalid entry in the lookaside buffer (TLB), and in case of absence of an invalid entry in the lookaside buffer (TLB), to search for the presence of a non-reserved entry, the reservation bit (Res) of which corresponds to a non-reservation in the lookaside buffer (TLB), and in case of absence of a non-reserved entry in the lookaside buffer (TLB), to search for the presence of a reserved entry, the reservation bit (Res) of which corresponds to a reservation in the lookaside buffer (TLB), the transaction of which is being processed, to allocate the reserved entry, the transaction of which is being processed, to said translation and write it there.

7. System according to any one of the preceding claims, wherein the unit (IOMMU) for managing peripheral (PER) access to the shared memory of the system-on-chip is configured to be reserved at peripherals not being predefined as trustworthy.

8. System according to any one of the preceding claims, wherein the processor is also provided with at least one memory management unit (MMU), and a memory management unit page table (MMUPT).