Method and apparatus for controlling memory processing

Abstract

A method and apparatus for controlling memory processing in a processing system including a cache shared among a plurality of processing units, wherein the cache includes a plurality of cache portions, is provided. The method includes obtaining first information related to an allocation of a first memory portion of a memory to a first application, an allocation of a first processing unit of the plurality of processing units to the first application, and an association between a first cache portion of the plurality of cache portions and the first processing unit. The method further includes reconfiguring a mapping configuration based on the obtained first information and controlling a provision of first data associated with the first application from the first memory portion to the first cache portion using the reconfigured mapping configuration.

Description

Technical Field

[0001] The proposed technology relates to methods and apparatus for controlling memory processing in a processing system. Furthermore, computer programs and computer program products are also provided herein. Background Technology

[0002] For great simplification, a computer system includes one or more processing units (PUs) such as a central processing unit (CPU) connected to memory. When a processor includes two or more independent PUs, the PUs are often referred to as "cores" and the processor is called a multi-core processor. The PUs fetch instructions and data from a specific repository on the processor chip called cache memory, or simply "cache." Caches include very fast static random access memory (static RAM or SRAM), which is an expensive resource but enables fast access to stored information. To address cost issues, the memory of a computer system is organized in a hierarchical structure, additionally including cheaper but slower memory such as dynamic RAM (DRAM), often referred to as main memory, and non-volatile memory and / or local storage devices, often referred to as secondary storage. In modern processors, caches are also implemented in a hierarchical manner, such as Level 1 cache (L1), Level 2 cache (L2), and Level 3 cache (L3), also known as the final level cache (LLC). L1 and L2 caches are dedicated to each core, while LLC is often shared among all PU cores. The processor stores recently used data in a cache to reduce data access time. When the requested data is not available in any level of cache, the data will be loaded from main memory into the PU cache.

[0003] In some processor architectures, the LLC is divided into multiple parts called slices. The PU and all LLC slices are interconnected, for example, via a bidirectional ring bus or mesh structure, and thus all PUs can access all slices. In many cases, an algorithm is applied to the physical address of a main memory location, or a portion of that physical address, to determine which slice caches the main memory location; that is, in which slice a copy of the instructions or data stored in main memory is placed. For example, when requested data is found in DRAM, multiple bits of the physical address can be used as input to a hash function, and the function's output defines which slice in the LLC the data is copied to. The function that performs slice selection can be called a slice selection function. The PU can then access and retrieve the desired instructions or data from the selected slice using the interconnect.

[0004] Cloud systems used for storing data and performing computing tasks have evolved rapidly over the past few years. Cloud service providers strive to optimize the utilization of available hardware resources, such as CPUs and memory, by using intelligent schemes to allocate the resources necessary to meet customer needs. For example, creating appropriate virtual machines (VMs) for a task may require allocating a specified number of processing units, a specified memory capacity, and other resources. This allocation must be based on factors such as their location, capacity, and access attributes, and must be coordinated with the resource allocation of other VMs in the cloud environment. Summary of the Invention

[0005] While the resource allocation process described above provides advantageous resource utilization, it can lead to security issues when resources are shared within the system. As mentioned above, having a shared cache layer among a group of processing units can occasionally cause PUs to run different applications, access data from the same portion of the cache, such as slices of LLC, making the system vulnerable to security attacks.

[0006] It has been further recognized that the slice selection process described above does not take into account, for example, the difference in access time between PU and LLC slices due to different physical distances between PU and different LLC slices.

[0007] The purpose of the embodiments described herein is to solve or at least mitigate at least some of the problems described above.

[0008] According to a first aspect, a method for controlling memory processing in a processing system is provided, the processing system including a cache shared among a plurality of processing units, wherein the cache includes a plurality of cache portions. The method includes obtaining first information relating to: allocating a first memory portion of memory to a first application, allocating a first processing unit among the plurality of processing units to the first application, and the association between a first cache portion and a first processing unit among the plurality of cache portions. The method further includes reconfiguring a mapping configuration based on the obtained first information, and further includes using the reconfigured mapping configuration to control the provision of first data associated with the first application from the first memory portion to the first cache portion.

[0009] According to a second aspect, there is provided an apparatus for controlling memory processing in a processing system, the processing system including a cache shared among a plurality of processing units, wherein the cache includes a plurality of cache portions. The apparatus is configured to obtain first information relating to: allocating a first memory portion of memory to a first application, allocating a first processing unit among the plurality of processing units to the first application, and the association between a first cache portion and a first processing unit among the plurality of cache portions. The apparatus is further configured to reconfigure a mapping configuration based on the obtained first information, and is further configured to use the reconfigured mapping configuration to control the provision of first data associated with the first application from the first memory portion to the first cache portion.

[0010] According to a third aspect, a computer program including instructions is provided, which, when executed by at least one processor, cause at least one processor to perform the method of the first aspect.

[0011] According to a fourth aspect, a computer program product is provided, the computer program product comprising a computer-readable medium having a computer program according to a third aspect stored thereon.

[0012] The embodiments described herein provide methods and apparatus for reducing vulnerability to security attacks in processing systems with shared resources.

[0013] The embodiments described herein provide methods and apparatus for using resources in a more efficient manner.

[0014] Other objects, features, and advantages of the appended embodiments will become apparent from the detailed disclosure below, the appended dependent claims, and the accompanying drawings.

[0015] Generally, unless otherwise expressly defined herein, all terms used in the claims are to be interpreted according to their ordinary meaning in the art. Unless otherwise expressly stated, all references to "a / an / the element, device, component, apparatus, module, step, etc." are to be openly interpreted as referring to at least one instance of said element, device, component, apparatus, module, step, etc. Unless expressly stated otherwise, the steps of any method disclosed herein need not be performed in the exact order disclosed. Attached Figure Description

[0016] The inventive concept will now be described with reference to the accompanying drawings and examples, wherein:

[0017] Figure 1 It is a schematic block diagram illustrating a multi-core processing system;

[0018] Figure 2It is a schematic block diagram illustrating the components of a multi-core processing system;

[0019] Figure 3 This is a schematic block diagram illustrating a processing system according to embodiments herein;

[0020] Figure 4a and Figure 4b This is a flowchart of a method according to an embodiment in this document;

[0021] Figure 5 A schematic block diagram illustrating a processing system and method according to embodiments herein is shown;

[0022] Figure 6 This is a flowchart of a method according to an embodiment in this document;

[0023] Figure 7 This is a flowchart of a method according to an embodiment in this document;

[0024] Figure 8 This is a schematic block diagram illustrating the processing system and method according to the embodiments herein;

[0025] Figure 9 These are schematic block diagrams illustrating an apparatus according to embodiments described herein;

[0026] Figure 10 These are schematic block diagrams illustrating an apparatus according to embodiments described herein;

[0027] Figure 11 These are schematic block diagrams illustrating apparatuses according to embodiments herein; and

[0028] Figure 12 This is a schematic block diagram illustrating a computer implementation of a device according to embodiments herein. Detailed Implementation

[0029] The inventive concept will now be described more fully below with reference to the accompanying drawings, in which certain embodiments of the inventive concept are illustrated. However, the inventive concept can be embodied in many different forms, and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided by way of example so that this disclosure will be exhaustive and complete, and these embodiments will fully convey the scope of the inventive concept to those skilled in the art. Throughout the description, the same reference numerals refer to the same elements. Any step or feature illustrated by dashed lines should be considered optional.

[0030] The techniques disclosed herein relate to methods and apparatus suitable for controlling memory processing in a processing system comprising a processor, which includes a plurality of processing units or so-called “cores,” and the processor is therefore commonly referred to as a multi-core processor. Processing units (PUs) and cores are used interchangeably herein. If a program is suited to such parallel computation of the instructions contained therein, an application running in such a multi-core processing system can utilize more than one of the cores to increase the speed of execution of its program code. As mentioned above, the memory resources of a processing system are most often arranged in memory hierarchies, ranging from small-capacity but fast memories easily accessible to processing units to large-capacity storage devices that are significantly slower and have long access times to the data and instructions stored therein.

[0031] Figure 1 An exemplary multi-core processing system in which the embodiments described herein can be applied is illustrated schematically. The processing system includes a processor as a multi-core processor, which includes multiple processing units, including core-1, core-2, and up to a plurality of m cores in this example, so that the set of cores ends with core-m. Figure 1 The memory hierarchy as described previously is further illustrated. In this example, the system has a three-level cache structure, including a Level 1 cache and a Level 2 cache, which are dedicated to individual cores and not shared with other cores of the processor. Therefore, core-1 is connected to the L1 and L2 caches of structure L1 / 2-1, core-2 is connected to the L1 and L2 caches of L1 / 2-2, and so on, up to core-m, which is therefore connected to the L1 and L2 caches of L1 / 2-m. Further illustrated is the slice of the shared cache layer, which in this example is the L3 cache of the cache structure and can also be represented as the Last Level Cache (LLC) because it is the highest level in the three-level cache structure. After this, the shared cache is referred to as the cache or shared cache. The cache includes LLC slice-1, LLC slice-2, and so on, up to n LLC slices, i.e., LLC slice-n. The cache slices are accessible to all cores via an interconnect (e.g., a ring bus or mesh structure) and, as mentioned, are shared among m cores. It is worth noting that m and n can have the same or different values. The number of slices can, for example, exceed the number of processor cores.

[0032] Below, the hierarchical cache structure is typically referred to as main memory, which includes a relatively large amount of volatile memory, and is subsequently referred to as main memory. The memory hierarchy in this example ends with secondary memory, which typically includes one or more hard disk drives (HDDs) and / or solid-state drives (SSDs), and is therefore a non-volatile memory type. Figure 1 This further illustrates the relative latency for accessing data and instructions at different levels within the memory hierarchy.

[0033] Figure 2 The components of an exemplary processing system 1, in which embodiments of the present document can be applied, are schematically illustrated. Server 5 is constructed including multiple CPU sockets 7; 8 and a main memory 30, which may primarily be DRAM. CPU sockets 7 include multiple cores: CPU core 1, CPU core 2, ..., CPU core m. Each core has dedicated L1 and L2 caches. All cores in CPU sockets 7 share a final level cache LLC, which is accessed via an interconnect (e.g., a ring bus or mesh structure). The LLC includes different slices: slice 1, slice 2, ..., slice n. A memory management unit (MMU) is responsible for translating virtual memory addresses into physical memory addresses. A slice selection function 40 is responsible for mapping different portions of memory 30 to different slices. Memory 30 can be divided into several physical or logical portions: memory 1, ..., memory p. An operating system (OS) 80 runs on server 5, which can host different applications: application 1, application 2, etc. Applications can be pinned to use only one core in the system, but can be moved, i.e., migrated from one core to another, if determined by the system. Applications can also run on several cores as described above. Scheduler function 70 is responsible for determining which core each application should run on. Memory allocation function 60 is the entity responsible for allocating memory from available physical memory to applications when they request it. Memory Management Controller (MMC) 35 is a management entity that can provide information such as memory status and layout.

[0034] As noted above, improvements are needed to address the system's vulnerability to security attacks. Access time between the PU and cache slices also needs to be considered.

[0035] It has been recognized that access times for fetching data from cache portions can vary due to differences in physical distance, such as between processing units and different parts of a shared cache across different LLC slices. Therefore, depending on which cache portion the required data is loaded into (i.e., copied from memory), the time required to fetch data can be shorter or longer for a specific core. Information about these differences in access times can be used to optimize the system.

[0036] The time required for a processing unit to fetch data from a specific cache section can be determined by measurement. Therefore, the access time between a PU and one or more cache sections can be determined. Such measurements can also be performed on multiple or even all PUs in the processing system. As an example, measurements can be performed at system startup. Alternatively or additionally, such measurements can be performed at some point (or intervals) during the startup and operation of the processing system. Thus, the association between a processing unit and a cache section can be created or determined, for example, by including a process that performs access time measurements.

[0037] It can be further noted that the association between the processing unit and the cache portion can change during runtime. As an example, the association can change in a scenario where both the first LLC slice and the second LLC slice are preferred for core 1. At some point, the first LLC slice is associated with core 1. Suppose that for another core, such as core 2, the only preferred LLC slice is also the first LLC slice. In the case where core 2, for example, starts running a high-priority application, for instance, it must access application-related data at high rates, then the association of core 1 to the first LLC slice can change to the second LLC slice, and conversely, core 2 is associated with the first LLC slice.

[0038] In some systems, portions of memory, such as blocks, are allocated to applications that can also be processes at initialization time and can be expanded later if needed by allocating more memory. However, such systems are difficult to optimize when the behavior of an application changes at runtime, such as when it migrates from one core to another.

[0039] Figure 3 An exemplary and simplified processing system is schematically illustrated to illustrate some aspects of the techniques presented herein. The exemplary processing system 1 includes a processor 10, which includes a first processing unit 11 and a second processing unit 12. The processing system further includes a cache 20 shared by the first processing unit 11 and the second processing unit 12. In other words, the cache 20 is shared between the first processing unit 11 and the second processing unit 12, so both units can read and write data to the cache 20. The cache 20 also includes a first cache portion 21 associated with the first processing unit 11 and a second cache portion 22 associated with the second processing unit 12. This association can, for example, mean that the first processing unit 11 at least primarily fetches (i.e., reads) data and instructions from the first cache portion 21 for execution. Figure 3In the diagram, this relationship is illustrated by a dashed arrow between cache section-1 21 and PU-1 11. Similarly, dashed arrows indicate the relationship between cache section-2 22 and PU-2 12. The memory 30 of the processing system 1 includes memory section-1 31, memory section-2 32, and memory section-3 33. The diagram schematically illustrates that a first application 410 is running on PU-1 11, and further illustrates, as indicated by the arrows, that the first data 510 required by PU-1 11 for executing the program of application-1 410 has been copied from memory section-1 31 in memory 30 to the first cache section 21. Similarly, the diagram illustrates that a second application 420 is running on PU-2 12, and the second data 520 required by PU-2 12 for executing the program of application-2 420 has been copied from memory section-3 33 in memory 30 to the second cache section 22. The latter arrow therefore suggests that the selection process is used to choose which cache section the data is copied from memory to.

[0040] In this context, the data also includes, for example, instructions or other data necessary for running the application on the processing unit and may therefore be included in the first data 510 and the second data 520.

[0041] As used in this article, "cache section" refers to a portion of cache 20, such as one or more LLC slices; however, they do not necessarily have to be adjacent to each other.

[0042] Figure 4a and Figure 4b Embodiments according to those described herein and will now be further referenced Figure 3 To explain this method. First, let's turn to... Figure 4a This document describes a method for controlling memory processing in a processing system 1. The processing system 1 includes a cache 20 shared among multiple processing units, and the cache 20 includes multiple cache portions. The method includes obtaining first information (S240) relating to: allocating a first memory portion 31 of memory 30 to a first application 410, allocating a first processing unit 11 among the multiple processing units to the first application 410, and the association between the first cache portion 21 and the first processing unit 11 among the multiple cache portions. The method further includes reconfiguring a mapping configuration (S260) based on the obtained first information (S240), and the method further includes using the reconfigured mapping configuration to control (S270) the provision of first data 510 associated with the first application 410 from the first memory portion 31 to the first cache portion 21.

[0043] Control S270 may, by way of example, include providing a mapping configuration, or the specific information contained therein, to another entity that performs the copying of data from memory 10 to cache 20. Alternatively, the apparatus interacting with processing system 1 may directly apply the mapping configuration to provide data to a selected cache section.

[0044] The mapping configuration may include, for example, a set of rules for providing data stored in memory 30 to cache 20.

[0045] In some embodiments, the method may further include creating a mapping relationship between the first memory portion 31 and the first cache portion 21 based on the obtained first information in S240, and reconfiguring it in S260 based on the created mapping relationship in S250.

[0046] In some embodiments, such as Figure 4b As described herein, the method may further include obtaining second information in step S210, which relates to allocating a second memory portion 33 of memory 30 to a second application 420 and allocating a second processing unit 12 of a plurality of processing units to the second application 420. Based on the obtained second information in step S210, a mapping configuration in step S220 is generated. The method further includes using the generated mapping configuration in step S220 to control step S230 to provide second data 520 associated with the second application 420 from the second memory portion 33 to the first cache portion 21 of cache 20. The method may further include using a reconfigured mapping configuration in step S260 to control step S280 to provide second data 520 associated with the second application 420 from the second memory portion 33 to the second cache portion 22 of a plurality of cache portions. Therefore, by using the reconfigured mapping configuration, data associated with the second application will no longer be copied to the first cache portion, but instead will be copied to the second cache portion. Thus, the first cache portion can be made available to the first application in this manner. This could be because the first application has a higher priority than the second application, and by copying its requested data to the first cache instead of, for example, the second cache, the first application can experience less latency. Another reason could be that reconfiguration provides system optimization.

[0047] In some embodiments, the first processing unit 11 is assigned to the first virtual machine.

[0048] According to some embodiments, the second processing unit 12 is assigned to the second virtual machine.

[0049] According to some embodiments of the method, the reconfigured S260 mapping configuration will provide at least one processing unit 11; 12 with exclusive rights to access one or more cache portions 21; 22. As an example, by providing such exclusive rights, application priority can be ensured. Such exclusive rights can alternatively or additionally be used to enhance security between applications running on different PUs and / or between VMs that have been allocated one or more PUs.

[0050] Furthermore, according to some embodiments, the reconfigured S260 mapping configuration will provide the first processing unit 11 with exclusive rights to at least access the first cache portion 21.

[0051] The method may further include clearing the first cache portion 21 of S265 according to some embodiments. Such clearing of the cache portion further ensures that data is not intentionally shared between applications and / or VMs.

[0052] The means of interacting with the processing system as described herein can be a component of the processing system. Alternatively, the means can be separate from the processing system and interact with entities or components of the processing system to control memory processing of the processing system. The means may include one or more of the slice selection function and slice selection function configuration manager as described herein.

[0053] According to some aspects herein, apparatus and methods are provided for implementing dynamic and programmable slice selection functionality, thereby bringing additional flexibility for LLC-aware data placement to a given process or application running on a system. According to some embodiments, an entity referred to herein as a slice selection functionality configuration manager is provided, which is responsible for configuring the dynamic slice selection functionality.

[0054] Figure 5 Components and methods of an exemplary processing system and apparatus for controlling memory processing, according to some aspects thereof, are illustrated schematically. A new entity or functionality, referred to herein as a slice selection function configuration manager 50, is provided. This entity is responsible for runtime management and configuration of the slice selection function 40. Thus, the slice selection function 40 is thereby able to select memory as needed. Figure 5 Different parts of the memory, illustrated by DRAM 30, are mapped to different slices.

[0055] The slice selection configuration manager function 50 can be implemented as a node in the HW of, for example, a field-programmable gate array (FPGA), or the slice selection configuration manager function 50 can be implemented in software, for example, as part of the memory allocation function 60 of OS 80, or the slice selection configuration manager function 50 can be implemented partly in the HW and partly in the software.

[0056] As described above, the device may include one or more of the slice selection functionality and slice selection configuration manager as described herein. Reference will now be made to... Figure 5 The schematic processing system shown in the figure illustrates an exemplary method for describing the interaction between components / functions.

[0057] During the application initialization phase, the following can be executed: Figure 5 The following steps are shown below. As described above, application 410 initially requests memory in order to be able to run on the system. This request will be handled by memory allocation function 60. Memory allocation function 60 reserves memory from the available physical memory in the system (step S1). In this example, the allocated physical memory is in Figure 5 Part A, referred to as DRAM 30, can be used by the memory allocation function 60 to find the appropriate portion of DRAM 30 using various algorithms, such as the Buddy algorithm.

[0058] The memory allocation function 60 notifies the slice selection function configuration manager 50 about this new assignment. This information includes, for example, which portion of memory is assigned to which application and on which core the application is running. In this exemplary approach, it is assumed that the application is running on core 1. This can be achieved by, for example... Figure 5 The memory allocation function 60 shown in the figure provides such information (step S2), but such information can be provided by another entity in the system.

[0059] Upon receiving information from the memory allocation function 60, the slice selection function configuration manager 50 determines how the memory allocated for a given application should be mapped to one or more different LLC slices. The slice selection function configuration manager 50 may also consider additional information during its decision phase, such as information about the physical memory layout and contention at the physical interface between DRAM 30 and LLC 20, which can be received from MMC 35 (step S3).

[0060] Slice selection configuration manager 50 configures dynamic slice selection function 40 such that (one or more) desired memory portions can be mapped to (one or more) correct LLC slices (step S4). In this exemplary method, it is assumed that slice selection configuration manager 50 configures dynamic slice selection function 40 to map portion A from DRAM 30 to LLC slice 1 20-1.

[0061] From this perspective, when an application requests access to its memory portion, the data will be loaded into the correct LLC slice according to the configuration above. In this example, when the application requests data from portion A in DRAM 30, the data will therefore be loaded into LLC slice 120-1.

[0062] Figure 6 Some embodiments are shown in this document and further referenced. Figure 5 The flowchart for the initialization phase of a demonstrative application.

[0063] S10: Application memory request. The memory allocation function 60 receives a memory request from the application and allocates a portion of the memory to the application.

[0064] S20: Notify the slice selection function configuration manager about memory assignment. For example, through memory allocation function 60, the slice selection function configuration manager 50 receives a notification about a new memory assignment for the application.

[0065] S30: The slice selection function configuration manager 50 may optionally receive further information from another entity (such as from MMC 35), such as information about the physical memory layout and contention on the physical interface between memory 30 and shared cache 20.

[0066] S40: Slice selection function configuration manager 50 determines the mapping between memory portions and LLC slices (e.g., portion A and slice 1) based on the received information.

[0067] S50: Slice selection function configuration manager 50 configures slice selection function 40 according to the mapping from S40.

[0068] The example above illustrates how data can be controlled to be provided from the memory section to the cache section.

[0069] As described above, the mapping configuration is a means of controlling the provision of data from the memory portion to the cache portion, including, for example, a set of rules for providing data stored in memory 30 to cache 20.

[0070] For the reasons described herein, mapping configurations may not remain static. Launching a new application on a processing system may require new mappings between the memory and cache portions, as shown in the previous examples. Mappings and their configurations may be reconfigured for reasons such as the need to optimize system performance during runtime, the need to acquire new applications(s) with higher or lower priority, or for security reasons.

[0071] Refer again Figure 5 The following example illustrates runtime optimization. This example therefore focuses on how memory mapping optimization and tuning can be performed at runtime. Consider the previous example where a portion A from DRAM is mapped to LLC slice 1. During runtime, an application using portion A from physical memory may move from core 1 to, for example, core number m. In this case, the previous mapping between portion A in DRAM and LLC slice 1 is no longer valid.

[0072] In this scenario, the slice selection configuration manager 50 receives a notification about the new settings, namely, that a given application is being moved to a new core. This information can be provided by the scheduler function 70 (step S5) or by another entity in the processing system 1.

[0073] The slice selection function configuration manager 50 may also consider additional information, such as information about the physical memory layout and contention on the physical interface between DRAM and LLC (optional step S3). Finally, the slice selection function configuration manager 50 determines and configures the slice selection function 40 such that (one or more) desired memory portions are mapped to (one or more) correct LLC slices, for example, DRAM portion A is mapped to LLC slice n (step S4).

[0074] Figure 7 A flowchart illustrating exemplary runtime optimization is shown. Further references are available. Figure 5 .

[0075] S100: Notify the slice selection function configuration manager 50 of new settings, such as a given application being moved to a different core. This information can be received from the scheduler function 70.

[0076] S200: As an option, the slice selection function configuration manager 50 can receive further information from another entity, such as MMC 35.

[0077] S300: The slice selection function configuration manager 50 determines the mapping between the memory portion and the LLC slice based on the received information. Therefore, it may be necessary to reconfigure the mapping configuration based on the received information.

[0078] S400: At this point, assess whether reconfiguration is required. If reconfiguration is required, the process continues at S600. Otherwise, it stops at step S500.

[0079] S500: No further action taken. Waiting.

[0080] S600: Slice Selection Configuration Manager 50 reconfigures the dynamic slice selection function.

[0081] Therefore, it is possible to control the flow of data from the memory section to the cache section.

[0082] Figure 8 The components and methods of exemplary processing systems and apparatuses, which can be used to provide isolation between entities in a system, are illustrated schematically according to some embodiments herein.

[0083] To utilize physical resources more effectively, most of the IT industry today relies on virtualized environments and deploys its services on top of third-party cloud providers. To this end, cloud providers use firmware or software called hypervisors or virtual machine monitors (VMMs) to manage physical resources and support multi-tenancy. However, using shared physical resources introduces unintended security challenges that can become problematic for security-critical applications. While considerable effort has been made to address these challenges by restricting VM access to non-privileged resources such as DRAM and disk, shared resources and shared caches at the CPU core still make virtualized environments vulnerable to cache attacks such as Meltdown and Spectre.

[0084] Therefore, embodiments of virtualized environments are provided to mitigate cache attacks by completely isolating virtual machines (VMs) within the cache level.

[0085] The implementation includes two main entities:

[0086] 1) Slice selection function configuration manager 50 - which can be the same entity as described above.

[0087] 2) A new entity referred to in this paper as the “isolation manager” ensures isolation in LLCs between different virtual machines by restricting each virtual machine’s access to a subset of LLC slices.

[0088] Figure 8 The structure of this solution is shown. The isolation manager utilizes the slice selection functionality configured in the manager 50, as previously described herein.

[0089] The isolation manager can be implemented either in software (e.g., as part of a management program), in hardware (e.g., an FPGA), or partly in hardware and partly in software. The responsibilities of this entity include, but are not limited to:

[0090] 1. Obtain the configuration of different VMs from the system's management program or another entity - for example, the size of the memory for each VM, and the physical memory address assigned to the VM if it needs to be isolated (step S60).

[0091] 2. Make a decision about how different VMs should be isolated. For example, two VMs may need to have a shared LLC slice so that they can communicate with each other through this shared channel (step S70).

[0092] 3. Notify the slice selection function configuration manager 50 of its decision (step S80), so that the slice selection function configuration manager 50 can apply this decision to the dynamic slice selection function 40 (step S90).

[0093] 4. Track configuration changes over time - optimize system configuration at runtime.

[0094] By performing the aforementioned tasks, the isolation manager can thus restrict VM access to only one or a few LLC slices. In doing so, the LLC becomes a dedicated resource for the VM, which enhances security by completely isolating the VM within the cache level.

[0095] Figure 9 This is a schematic block diagram illustrating an example of a processor-memory based device 610. In this particular example, device 610 includes a processor 611 and a memory 612, the memory 612 including instructions executable by the processor 611, whereby the processor operates to perform the steps of the methods described herein.

[0096] Optionally, device 610 may also include communication circuitry 613. Communication circuitry 613 may include functions for wired and / or wireless communication with, for example, other devices and / or systems in a network. In a particular example, communication circuitry 613 may be based on a circuitry system for communication with one or more other nodes / devices, including transmitting and / or receiving information. Communication circuitry 613 may be interconnected to processor 611 and / or memory 612. By way of example, communication circuitry 613 may include any of the following: receiver, transmitter, transceiver, input / output (I / O) circuitry system, one or more input ports and / or one or more output ports.

[0097] Figure 10 This is a schematic block diagram illustrating another example of a hardware circuit system-based device 710 according to an embodiment. Examples of suitable hardware (HW) circuit systems include one or more appropriately configured or potentially reconfigurable electronic circuit systems, such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or any other hardware logic such as discrete logic gates and / or flip-flops based on interconnects to perform dedicated functions in conjunction with suitable registers (Reg) and / or memory cells (Mem).

[0098] Figure 11This is a schematic block diagram illustrating yet another example of a device 810 based on a combination of one or more processors 811-1, 811-2 and hardware circuitry 813-1, 813-2 in conjunction with one or more suitable memory units 182. Device 810 includes one or more processors 811-1, 811-2, a memory 812 containing storage devices for software and data, and one or more units of hardware circuitry 813-1, 813-2 such as an ASIC and / or FPGA. Therefore, overall functionality is partitioned between the programmed software (SW) executed on one or more processors 811-1, 811-2 and one or more pre-configured or potentially reconfigurable hardware circuitry 813-1, 813-2 such as an ASIC and / or FPGA. The actual hardware-software partitioning can be determined by the system designer based on multiple factors including processing speed, implementation cost, and other requirements.

[0099] Alternatively, or as an addition, at least some of the steps, functions, processes, modules and / or blocks described herein may be implemented in software such as for a computer program executed by a suitable processing circuitry system such as one or more processors or processing units.

[0100] When executed by one or more processors, the one or more flowcharts presented herein can therefore be considered as one or more computer flowcharts. The corresponding device can be defined as a group of functional modules, where each step executed by the processor corresponds to a functional module. In this case, the functional module is implemented as a computer program that runs on the processor.

[0101] Examples of processing circuitry systems include, but are not limited to, one or more microprocessors, one or more digital signal processors (DSPs), one or more central processing units (CPUs), video acceleration hardware, and / or any suitable programmable logic circuitry system such as one or more field-programmable gate arrays (FPGAs) or one or more programmable logic controllers (PLCs).

[0102] It should also be understood that it may be possible to reuse the general processing capabilities of any conventional device or unit in which the proposed technology is implemented. For example, it may also be possible to reuse existing software by reprogramming it or by adding new software components.

[0103] Figure 12This is a schematic diagram illustrating an example of a computer implementation of the apparatus 910 according to an embodiment. In this particular example, at least some of the steps, functions, processes, modules, and / or blocks described herein are implemented in computer programs 913; 916, which are loaded into memory 912 for execution by a processing circuitry system including one or more processors 911. The processors 911 and memory 912 are interconnected to enable proper software execution. Optional input / output devices 914 may also be interconnected to the processors 911 and / or memory 912 to enable input and / or output of related data such as input parameters and / or output parameters as a result.

[0104] The processing circuitry system, including one or more processors 911, is thus configured to perform well-defined processing tasks, such as those described herein, when executing the computer program 913.

[0105] The term “processor” should be interpreted in a general sense as any system or apparatus capable of executing program code or computer program instructions to perform a particular processing, determination or computation task.

[0106] The processing circuitry system is not necessarily dedicated to performing only the steps, functions, processes, and / or blocks described above, but can also perform other tasks.

[0107] The proposed technology also provides a carrier including a computer program, wherein the carrier is one of electronic signals, optical signals, electromagnetic signals, magnetic signals, electrical signals, radio signals, microwave signals, or a computer-readable storage medium.

[0108] By way of example, software or computer programs 913; 916 can be implemented as computer program products, which are typically carried or stored on computer-readable media 912; 915, particularly non-volatile media. Computer-readable media may include one or more removable or non-removable memory devices, including but not limited to read-only memory (ROM), random access memory (RAM), optical disc (CD), digital versatile optical disc (DVD), Blu-ray disc, universal serial bus (USB) memory, hard disk drive (HDD) storage devices, flash memory, magnetic tape, or any other conventional memory device. The computer program can thus be loaded into the operating memory of a computer or equivalent processing device for execution by the processing circuitry therein.

[0109] When executed by one or more processors, the one or more flowcharts presented herein can be considered as one or more computer flowcharts. The corresponding device can be defined as a group of functional modules, where each step executed by the processor corresponds to a functional module. In this case, the functional module is implemented as a computer program that runs on the processor.

[0110] Computer programs residing in memory can therefore be organized into appropriate functional modules configured to perform at least a portion of the steps and / or tasks described herein when executed by a processor.

Claims

1. A method for controlling memory processing in a processing system (1), the processing system (1) including a cache (20) shared among a plurality of processing units, wherein the cache is a last-level cache and includes a plurality of cache portions, The method includes: (S240) Obtain first information, which relates to the following: - Allocate the first memory portion (31) of the memory (30) to the first application (410). - Assign the first processing unit (11) of the plurality of processing units to the first application (410), and - The association between the first cache portion (21) and the first processing unit (11) in the plurality of cache portions; Based on the first information obtained (S240), the mapping configuration is reconfigured (S260); as well as Using the reconfigured mapping configuration, the control (S270) provides the first data (510) associated with the first application (410) from the first memory section (31) to the first cache section (21). The reconfigured mapping configuration will provide the first processing unit (11) with exclusive rights to at least access the first cache portion (21).

2. The method according to claim 1, wherein, The mapping configuration includes a set of rules for providing data stored in the memory (30) to the cache (20).

3. The method according to claim 1, further comprising: Based on the first information obtained (S240), a mapping relationship is created (S250) between the first memory portion (31) and the first cache portion (21), wherein the reconfiguration (S260) is based on the mapping relationship created (S250).

4. The method of claim 1, further comprising: (S210) Obtain second information, which relates to the following: - Allocate the second memory portion (33) of the memory (30) to the second application (420), and - Assign the second processing unit (12) of the plurality of processing units to the second application (420). Based on the second information obtained (S210), the mapping configuration described in (S220) is generated; and Using the mapping configuration generated (S220), the control (S230) provides the second data (520) associated with the second application (420) from the second memory portion (33) to the first cache portion (21) of the cache (20).

5. The method of claim 4, further comprising: Using the reconfigured (S260) mapping configuration, the control (S280) provides the second data (520) associated with the second application (420) from the second memory portion (33) to the second cache portion (22) of the plurality of cache portions.

6. The method according to any one of claims 1-4, wherein, The first processing unit (11) is assigned to the first virtual machine.

7. The method according to claim 4, wherein, The second processing unit (12) is assigned to the second virtual machine.

8. The method according to any one of claims 1-4, further comprising: Clear (S265) the first cache portion (21).

9. An apparatus for controlling memory processing in a processing system (1), the processing system (1) including a cache (20) shared among a plurality of processing units, wherein the cache is a last-level cache and includes a plurality of cache portions, the apparatus being configured to: Obtain first information, which relates to the following: - Allocate the first memory portion (31) of the memory (30) to the first application (410). - Assign the first processing unit (11) of the plurality of processing units to the first application (410), and - The association between the first cache portion (21) and the first processing unit (11) in the plurality of cache portions; Based on the first information obtained, reconfigure the mapping configuration; and Using the reconfigured mapping configuration, control is used to provide the first data (510) associated with the first application (410) from the first memory section (31) to the first cache section (21). in, The reconfigured mapping configuration will provide the first processing unit (11) with exclusive rights to at least access the first cache portion (21).

10. The apparatus according to claim 9, wherein, The mapping configuration includes a set of rules for providing data stored in the memory (30) to the cache (20).

11. The apparatus according to claim 9, further configured as follows: Based on the first information obtained, a mapping relationship is created between the first memory portion (31) and the first cache portion (21), wherein the reconfiguration is based on the created mapping relationship.

12. The apparatus according to claim 9, further configured as follows: Obtain second information, which relates to the following: - Allocate the second memory portion (33) of the memory (30) to the second application (420), and - Assign the second processing unit (12) of the plurality of processing units to the second application (420). Based on the obtained second information, the mapping configuration is generated; and Using the generated mapping configuration, control is used to provide the second data (520) associated with the second application (420) from the second memory portion (33) to the first cache portion (21) of the cache (20).

13. The apparatus according to claim 12, further configured as follows: Using the reconfigured mapping configuration, control is used to provide second data (520) associated with the second application (420) from the second memory portion (33) to the second cache portion (22) of the plurality of cache portions.

14. The apparatus according to any one of claims 9-13, wherein, The first processing unit (11) is assigned to the first virtual machine.

15. The apparatus according to claim 12, wherein, The second processing unit (12) is assigned to the second virtual machine.

16. The apparatus according to any one of claims 9-13, further configured as follows: Clear the first cache portion (21).

17. A computer program product comprising instructions that, when executed by at least one processor, cause the at least one processor to perform the method according to any one of claims 1-8.

18. A computer-readable medium having instructions stored thereon, the instructions causing the at least one processor, when executed, to perform the method according to any one of claims 1-8.

Images