Protected regions management of memory
Apparatuses and methods related to managing regions of memory are described. Managing regions can include verifying whether an access command is authorized to access a particular region of a memory array, which may have some regions that have rules or restrictions governing access (e.g., so-called “protected regions”). The authorization can be verified utilizing a key and a memory address corresponding to the access command. If an access command is authorized to access a region, then a row of the memory array corresponding to the access command can be activated. If an access command is not authorized to access the region, then a row of the memory array corresponding to the access command may not be activated.
1. An apparatus, comprising:
a host configured to host a plurality of virtual machines (VMs) via a plurality of processors; and
a memory resource, comprising an array of memory cells, external to the host and coupled to the host, via a physical interface comprising a plurality of buses where the host and the memory resource are implemented on separate integrated circuits, and shared by the plurality of VMs;
wherein the memory resource comprises a plurality of regions each allocated to respective ones of the plurality of VMs and each having a respective key associated therewith, and wherein a respective address space of each region is unique relative to the other regions of the plurality of regions;
wherein the memory resource is configured to:
receive an access command from one of the plurality of VMs and a key associated with the received access command;
compare, at the memory resource, the key associated with the received access command to a key associated with one region of the plurality of regions by accessing a register of the memory resource that can be written to by the host but cannot be accessed by the host, wherein each of the plurality of VMs is uniquely associated with only the respective key associated with the one region of the plurality of regions;
allow access to the one region of the plurality based at least in part on determining that the key associated with the received access command matches the key associated with the one region of the plurality of regions by modifying a mode register corresponding to the one region from a locked mode to an unlocked mode; and
prevent access based at least in part on determining that the key associated with the received access command does not match the key associated with the one region of the plurality of regions.
2. The apparatus of claim 1 , wherein the host is further configured to host a hypervisor and wherein the hypervisor is configured to assign a plurality of keys corresponding to the plurality of regions to the plurality of VMs.
3. The apparatus of claim 2 , wherein the hypervisor is configured to assign the plurality of regions and the plurality of keys to the plurality of VMs at startup.
4. The apparatus of claim 2 , wherein the hypervisor is configured to assign the plurality of regions and the plurality of keys to the plurality of VMs responsive to a creation of the plurality of VMs.
5. The apparatus of claim 2 , wherein the hypervisor is configured to assign the plurality of regions and the plurality of keys to the plurality of VMs utilizing a command that initializes a security mode provided to the memory resource.
6. The apparatus of claim 1 , wherein the plurality of VMs are configured to generate and store a plurality of keys corresponding to the plurality of regions in the memory resource.
7. A method, comprising:
receiving, at a memory resource, an access command from one of a plurality of virtual machines (VMs) hosted by a host via a plurality of processors and a key associated with the received access command,
wherein the memory resource is shared by the plurality of VMs,
wherein the memory resource comprises a plurality of regions each allocated to respective ones of the plurality of VMs and each having a respective key associated therewith,
wherein a respective address space of each region is unique relative to the other regions of the plurality of regions,
wherein the memory resource comprises an array of memory cells and is external to and coupled to the host via a physical interface comprising a plurality of buses, and
wherein the host and the memory resource are implemented on separate integrated circuits;
comparing, at the memory resource, the key associated with the received access command to a key associated with one region of the plurality of regions by accessing a register of the memory resource that can be written to by the host but cannot be accessed by the host, wherein each of the plurality of VMs is uniquely associated with only the respective key associated with the one region of the plurality of;
allowing, at the memory resource, access to the one region of the plurality based at least in part on determining that the key associated with the received access command matches the key associated with the one region of the plurality of regions by modifying a mode register corresponding to the one region from a locked mode to an unlocked mode; and
preventing, at the memory resource, access based at least in part on determining that the key associated with the received access command does not match the key associated with the one region of the plurality of regions.