Data transmission method, device, equipment, medium and product

Abstract

The invention relates to the technical field of communication, and discloses a data transmission method, device and equipment, a medium and a product, the method is executed by a target switch, and the target switch comprises a cascade port and at least two data ports; the at least two data ports are respectively connected with a first terminal and a second terminal; the cascade port is used for communicating with the root complex; the method comprises the following steps: acquiring a point-to-point verification request sent by a first terminal; the point-to-point verification request comprises key control information of first data to be transmitted; the first data is data sent by the first terminal to the second terminal; if the target switch triggers the access control service process, forwarding the point-to-point verification request through a cascade port; and obtaining a return result for the point-to-point verification request through the cascade port, and controlling the sending of the first data according to the return result. According to the invention, the data transmission efficiency can be improved while the data transmission security is ensured.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a data transmission method, device, equipment, medium and product. Background Art

[0002] The ACS (Access Control Services) function is an important mechanism defined by the PCIe (Peripheral Component Interconnect Express, a high-speed serial computer expansion bus standard) protocol, which is used to manage and control access rights between multiple devices to ensure the security and stability of the system.

[0003] In the related art, to ensure security, the ACS forces data flows to be checked by the input and output memory management unit of the RC (Root Complex), but this will increase the load of the root complex, cause data congestion, and affect the overall performance of the system.

[0004] In view of this, a data transmission method that ensures security and increases transmission efficiency is needed. Summary of the invention

[0005] In view of this, the present invention provides a data transmission method, which can increase data transmission efficiency while ensuring data transmission security.

[0006] In a first aspect, the present invention provides a data transmission method, which is executed by a target switch, the target switch includes a cascade port and at least two data ports; the at least two data ports are respectively connected to a first terminal and a second terminal; the cascade port is used to communicate with a root complex; the method includes: obtaining a point-to-point verification request sent by the first terminal; the point-to-point verification request includes key control information of first data to be transmitted; the first data is data sent by the first terminal to the second terminal; if the target switch triggers an access control service process, the point-to-point verification request is forwarded through the cascade port; the return result for the point-to-point verification request is obtained through the cascade port, and the sending of the first data is controlled according to the return result.

[0007] In this embodiment, the target switch can communicate with the terminal and the root complex, and after obtaining the point-to-point verification request containing the key control information of the first data, it determines whether to trigger the access control service process. And when the access control service process is triggered by itself, the point-to-point verification request is forwarded through the cascade port, and the return result of the point-to-point verification request is received. According to the return result, it can be determined whether to send the first data, thereby controlling the sending of the first data. The above scheme can directly perform point-to-point verification according to the key control information of the first data, and control the sending of the first data according to the return result of the point-to-point verification request. Compared with performing point-to-point verification according to the first data, the amount of transmitted data can be reduced, thereby reducing transmission delay and increasing transmission efficiency.

[0008] In an optional implementation, obtaining a return result for a point-to-point verification request through a cascade port and controlling the sending of first data based on the return result includes: obtaining a first return result generated by a root complex through a cascade port; and controlling the sending of first data based on the first return result.

[0009] In this embodiment, the point-to-point verification request containing key control information is sent to the root complex, and the sending of the first data is controlled according to the first return result generated by the root complex. The security of the first data can be checked, thereby improving the security of data transmission.

[0010] In an optional implementation, according to the first return result, controlling the sending of the first data includes: when the first return result is allowed, allowing the first terminal to send the first data to the second terminal through the target switch; when the first return result is prohibited, prohibiting the first terminal from sending the first data to the second terminal through the target switch.

[0011] In this implementation, the sending of the first data is controlled according to the first returned result, so as to improve the security of data transmission and the stability of the system.

[0012] In an optional embodiment, obtaining a return result for a point-to-point verification request through a cascade port includes: obtaining a second return result through the cascade port; the second return result is that the first switch receives the point-to-point verification request and does not trigger an access control service process; the first switch is a switch in a cascade link between a target switch and a root complex; the second return result is used to instruct the first terminal to send the first data to the second terminal through the target switch.

[0013] In this embodiment, in the cascade link between the target switch and the root complex, the first switch generates a second return result after receiving the point-to-point verification request without triggering the access control service process to instruct the first terminal to send the first data to the second terminal through the target switch. The point-to-point verification request containing key control information does not require additional checks and address conversions, which can reduce delays in the data transmission process and improve data transmission efficiency.

[0014] In an optional implementation, the method further includes: if the target switch does not trigger the access control service process, sending the first data to the second terminal.

[0015] In this implementation, when the target switch does not trigger the access control service process, the first data is directly sent to the second terminal without additional checks and address conversions, which can reduce the delay in the transmission process and improve the efficiency of data transmission.

[0016] In an optional implementation, the key control information includes at least one of a data address, a data length, a data address type, a cache consistency flag, a process address space identification number, a memory access request identification, and a persistent memory area identification.

[0017] In this embodiment, the key control information includes at least one of a data address, a data length, a data address type, a cache consistency flag, a process address space identification number, a memory access request identification, and a persistent memory region identification. The security of the first data can be verified to prevent illegal or malicious access requests to improve security.

[0018] In a second aspect, the present invention provides a data transmission device, which includes: an acquisition module, used to acquire a point-to-point verification request sent by a first terminal; the point-to-point verification request includes key control information of first data to be transmitted; the first data is data sent by the first terminal to the second terminal; a forwarding module, used to forward the point-to-point verification request through a cascade port if the target switch triggers an access control service process; a control module, used to obtain a return result for the point-to-point verification request through the cascade port, and control the sending of the first data according to the return result.

[0019] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the data transmission method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0020] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the data transmission method of the first aspect or any corresponding embodiment thereof.

[0021] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the data transmission method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 is a flow chart of a data transmission method according to an embodiment of the present invention;

[0024] Figure 2 is a flow chart of another data transmission method according to an embodiment of the present invention;

[0025] Figure 3 is a flow chart of another data transmission method according to an embodiment of the present invention;

[0026] Figure 4 is a flow chart of another data transmission method according to an embodiment of the present invention;

[0027] Figure 5 is a flow chart of another data transmission method according to an embodiment of the present invention;

[0028] Figure 6 Schematic diagram of data transmission according to a data transmission method according to an embodiment of the present invention

[0029] Figure 7 is a structural block diagram of a data transmission device according to an embodiment of the present invention;

[0030] Figure 8 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0032] The P2P (Peer-to-Peer) function can significantly improve the efficiency and performance of data transmission, and is therefore widely used in high-performance computing, data centers, and virtualized environments.

[0033] ACS can prohibit P2P communication between devices, forcing all data flows to be checked in the input and output memory management unit of the root complex to improve the security of information transmission. However, this will increase the load on the root complex, and when the processing capacity of the input and output memory management unit is limited, it will become a system bottleneck and cause congestion in the data compartment. In addition, the P2P request redirection function and P2P completion redirection function of ACS will be affected by the ordering rules of PCIe transactions, reducing transmission efficiency.

[0034] In addition, the longer the data transmission path is and the more devices it passes through, the greater the transmission delay will be, which in turn affects the data transmission efficiency.

[0035] The embodiment of the present invention provides a data transmission method, which can reduce the data length of the point-to-point verification request by generating a point-to-point verification request containing key control information in the transmission data, thereby reducing the transmission delay and improving the transmission efficiency. In addition, when the switch triggers the access control service process, the point-to-point verification request can be transmitted to the input and output memory management unit of the root complex for inspection, thereby ensuring the security of data transmission.

[0036] According to an embodiment of the present invention, a data transmission method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0037] In this embodiment, a data transmission method is provided. The method is executed by a target switch. The target switch includes a cascade port and at least two data ports. The at least two data ports are respectively connected to a first terminal and a second terminal. The cascade port is used to communicate with a root complex. Figure 1 is a flow chart of a method according to an embodiment of the present invention, such as Figure 1 As shown, the process includes the following steps:

[0038] Step S101, obtaining a point-to-point verification request sent by a first terminal; the point-to-point verification request includes key control information of first data to be transmitted; the first data is data sent by the first terminal to the second terminal.

[0039] Before obtaining the point-to-point verification request sent by the first terminal, it is necessary to initialize the first terminal, the second terminal, and all devices on the cascade link between the target switch and the root complex. The initialization process includes reading the register of the device, determining whether the device supports the point-to-point request function, and enabling the point-to-point verification request function of all devices if all devices support the point-to-point verification request function to ensure the execution of subsequent steps.

[0040] The key control information of the first data may include the source address, target address, protocol type, port number, version number, data length, etc. of the first data. After determining the content included in the key control information, the first terminal may extract the key control information according to the data structure of the first data to generate a point-to-point verification request containing the key control information. Then the first terminal sends the point-to-point verification request to the target switch.

[0041] The selection of key control information can be determined by the staff according to different application environments.

[0042] After receiving the point-to-point verification request sent by the first terminal, the target switch will first determine whether the access control service process is triggered. If the target switch does not trigger the access control service process, the first terminal can directly send the first data to the target switch, and the target switch forwards the first data to the second terminal.

[0043] Step S102: If the target switch triggers the access control service process, the point-to-point authentication request is forwarded through the cascade port.

[0044] After the target switch triggers the access control service process, it will forward the point-to-point verification request to the next device on the communication path through the cascade port. The next device may be a switch or a root complex. The communication path includes the cascade links from the target switch to all devices in the root complex and between devices, where the cascade links are cascade links between switches or cascade links between switches and the root complex. After the next device receives the point-to-point verification request, it needs to determine whether it triggers the access control service process.

[0045] In the case that the next device does not trigger the access control service process, a return result can be directly generated and forwarded along the cascade link between the current device and the target switch. The return result can be a successful request or a failed request. In an actual application, if the device does not trigger the access control service process, the return result is a successful request, so that the first data can be sent directly to the second terminal through the target switch without being checked in the input and output memory management unit in the root complex, thereby improving the efficiency of data transmission. In another actual application, if the device does not trigger the access control service process, the return result is a failed request, and the first data cannot be sent to the second terminal through the target switch, thereby improving the security of data transmission.

[0046] When the next device is a root complex and the access control service process is triggered, the input / output memory management unit in the root complex performs security verification on the key control information in the point-to-point verification request, generates a return result based on the security verification result, and sends the return result to the target switch along the cascade link between the root complex and the target switch to control the sending of the first data.

[0047] In the case where the next device is a switch and the access control service process is triggered, the point-to-point authentication request needs to be forwarded to the next device along the cascade link and the above steps are repeated.

[0048] Step S103: obtaining a return result for the point-to-point verification request through the cascade port, and controlling the sending of the first data according to the return result.

[0049] When the return result is that sending is allowed, the first terminal sends the first data to the target switch. The target switch determines the data port corresponding to the second terminal according to the target address in the first data, and forwards the first data to the data port corresponding to the second terminal.

[0050] If the result returned is "forbidden to send", the first terminal cannot transmit the first document to the second terminal through the target switch. However, an alarm can be issued to indicate an error and remind the staff to handle it.

[0051] In an actual application, the message length of the point-to-point verification request is 24 bytes, and the message length of the return result of the point-to-point verification request is 16 bytes. When the target switch is directly connected to the terminal and the root complex, the data transmission delay is similar to the transmission delay without the access control service process, which is about half of the access control service process. The data transmission efficiency is similar to the transmission efficiency without the access control service process, and the transmission efficiency is related to the payload size of the first data. The congestion avoidance effect is significant.

[0052] The data transmission method provided in this embodiment is that the target switch can communicate with the terminal and the root complex, and after obtaining the point-to-point verification request containing the key control information of the first data, it determines whether to trigger the access control service process. And when the access control service process is triggered by itself, the point-to-point verification request is forwarded through the cascade port, and the return result of the point-to-point verification request is received. According to the return result, it can be determined whether to send the first data, thereby controlling the sending of the first data. The above scheme can directly perform point-to-point verification according to the key control information of the first data, and control the sending of the first data according to the return result of the point-to-point verification request. Compared with performing point-to-point verification according to the first data, the amount of transmitted data can be reduced, thereby reducing transmission delay and increasing transmission efficiency.

[0053] In this embodiment, a data transmission method is provided. The method is executed by a target switch. The target switch includes a cascade port and at least two data ports. The at least two data ports are respectively connected to a first terminal and a second terminal. The cascade port is used to communicate with a root complex. Figure 2 is a flow chart of a data transmission method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0054] Step S201, obtaining a point-to-point verification request sent by a first terminal; the point-to-point verification request includes key control information of first data to be transmitted; the first data is data sent by the first terminal to the second terminal.

[0055] For details, please see Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0056] In some optional implementations, the key control information includes at least one of a data address, a data length, a data address type, a cache consistency flag, a process address space identification number, a memory access request identification, and a persistent memory area identification.

[0057] The data structure of the first data may be obtained first, and then the data address, data length, address type of the data, and cache consistency flag of the first data may be obtained according to the data structure.

[0058] The process address space identification number, the memory access request identification number and the persistent memory region identification information can be obtained by directly accessing the hardware register in the first terminal. The process address space identification number is used to distinguish the address spaces of unused processes or virtual machines. The memory access request identification number is used to indicate whether the request comes from a valid requester. The persistent memory region identification information is used to indicate whether there is a persistent memory region on the device.

[0059] The key control information includes at least one of a data address, a data length, a data address type, a cache consistency flag, a process address space identification number, a memory access request identification, and a persistent memory region identification. The security of the first data can be verified to prevent illegal or malicious access requests to improve security.

[0060] Step S202: If the target switch triggers the access control service process, the point-to-point authentication request is forwarded through the cascade port.

[0061] For details, please see Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0062] Step S203: obtaining a return result for the point-to-point verification request through the cascade port, and controlling the sending of the first data according to the return result.

[0063] Specifically, the above step S203 includes:

[0064] Step S2031: Acquire a first return result generated by the root complex through the cascade port.

[0065] The root complex includes a root port, and the cascade port of the target switch is connected to the root port of the root complex to communicate with the root complex. After the root port of the root complex receives the point-to-point authentication request forwarded by the cascade port, it will first determine whether it triggers the access control service process.

[0066] In the case where the root complex does not trigger the access control service process, the root complex directly generates a first return result through the root port. In an actual application, in the case where the root complex does not trigger the access control service process, the first return result is a successful request, so that the first data can be sent directly to the second terminal through the target switch without being checked in the input and output memory management unit in the root complex, thereby improving the efficiency of data transmission. In another actual application, in the case where the root complex does not trigger the access control service process, the first return result is a failed request, and the first data cannot be sent to the second terminal through the target switch, thereby improving the security of data transmission.

[0067] In the case where the root complex triggers the access control service process, the input and output memory management unit in the root complex verifies the key control information contained in the point-to-point verification request. In the case of successful verification, the first return result generated is a successful request. In the case of failed verification, the first return result generated is a failed request. After generating the first return result, the root complex sends the first return result to the target switch through the root port.

[0068] The verification of key control information can be determined based on the content included in the key control information.

[0069] Step S2032: Control the sending of the first data according to the first returned result.

[0070] After receiving the first return result, the first return result may be parsed to determine whether the first data can be sent. If the first return result indicates that the request is successful, the first terminal may send the first data to the second terminal through the target switch. If the first return result indicates that the request fails, the first terminal cannot send the first data, but may display an error message or try to resend the point-to-point verification request to the target switch.

[0071] In some optional implementations, the above step S2032 includes:

[0072] Step a1: when the first returned result is allowed, the first terminal is allowed to send the first data to the second terminal through the target switch.

[0073] When the first return result is allowed, the first terminal can send the first data to the second terminal through the target switch. The target switch needs to first determine the data addresses of the first terminal and the second terminal and the data ports they are connected to respectively. And associate the data address with the data port. Among them, the type of the data address can be determined according to the communication protocol of the first terminal and the second terminal. In an actual application, the data address is a MAC address.

[0074] When the target switch receives the first data sent by the first terminal, it will first check the source data address of the first data, and determine the data port corresponding to the target data address according to the target data address in the first data, where the target data address is the data address of the second terminal, and then forward the first data to the data port corresponding to the target data address to complete the transmission of the first data.

[0075] Step a2: when the first returned result is prohibited, prohibiting the first terminal from sending the first data to the second terminal through the target switch.

[0076] When the first return result is prohibited, the first data may be non-compliant, contain attack information, etc. The first terminal cannot send the first data to the second terminal through the target switch. The first terminal can send an alarm to the staff to complete the transmission of the first data as soon as possible.

[0077] Controlling the sending of the first data according to the first returned result can improve the security of data transmission and improve the stability of the system.

[0078] The data transmission method provided in this embodiment sends a point-to-point verification request containing key control information to the root complex, and controls the sending of the first data according to the first return result generated by the root complex. The security of the first data can be verified, thereby improving the security of data transmission.

[0079] In this embodiment, a data transmission method is provided. The method is executed by a target switch. The target switch includes a cascade port and at least two data ports. The at least two data ports are respectively connected to a first terminal and a second terminal. The cascade port is used to communicate with a root complex. Figure 3 is a flow chart of a data transmission method according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0080] Step S301, obtaining a point-to-point verification request sent by a first terminal; the point-to-point verification request includes key control information of first data to be transmitted; the first data is data sent by the first terminal to the second terminal.

[0081] For details, please see Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0082] Step S302: If the target switch triggers the access control service process, the point-to-point authentication request is forwarded through the cascade port.

[0083] For details, please see Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0084] Step S303: obtaining a return result for the point-to-point verification request through the cascade port, and controlling the sending of the first data according to the return result.

[0085] Specifically, the above step S303 includes:

[0086] Step S3031, obtaining a second return result through the cascade port; the second return result is that the first switch receives a point-to-point verification request and does not trigger the generation of an access control service process; the first switch is a switch in a cascade link between a target switch and a root complex; the second return result is used to indicate that the first terminal sends the first data to the second terminal through the target switch.

[0087] There are several switches in the cascade link between the target switch and the root complex, and the target switch forwards the point-to-point verification request to the switch connected to its cascade port. After receiving the point-to-point verification request, the switch determines whether it triggers the access control service process. If the current switch does not trigger the access control service process, the current switch is used as the first switch to generate a second return result to control the sending of the first data.

[0088] When the current switch triggers the access control service process, the point-to-point verification request will be forwarded along the cascade link to the next switch or the root complex connected to the current switch. If the current switch is connected to the root complex in the cascade link between the target switch and the root complex, the return result of the root complex can be obtained. If the current switch is still connected to a switch in the cascade link between the target switch and the root complex, the next switch needs to repeat the judgment of whether it triggers the access control service process after receiving the point-to-point verification request, and execute the above steps according to the judgment result to obtain the second return result.

[0089] Step S3032: Control the sending of the first data according to the second returned result.

[0090] The second return result is used to indicate that the first terminal sends the first data to the second terminal through the target switch. After obtaining the second return result, the target switch needs to first determine the data addresses of the first terminal and the second terminal and the data ports to which they are respectively connected. Then the data address is associated with the connected data port and stored in the data address table in the target switch.

[0091] When the target switch receives the first data sent by the first terminal, it will first check the source data address of the first data, and determine the data port corresponding to the target data address according to the target data address in the first data, where the target data address is the data address of the second terminal, and then forward the first data to the data port corresponding to the target data address to complete the transmission of the first data.

[0092] In the data transmission method provided by this embodiment, the first switch is in the cascade link between the target switch and the root complex. After receiving the point-to-point verification request, the first switch generates a second return result without triggering the access control service process to instruct the first terminal to send the first data to the second terminal through the target switch. The point-to-point verification request containing key control information does not require additional checks and address conversions, which can reduce delays in the data transmission process and improve data transmission efficiency.

[0093] In this embodiment, a data transmission method is provided. The method is executed by a target switch. The target switch includes a cascade port and at least two data ports. The at least two data ports are respectively connected to a first terminal and a second terminal. The cascade port is used to communicate with a root complex. Figure 4 is a flow chart of a data transmission method according to an embodiment of the present invention. Figure 4 As shown, the process includes the following steps:

[0094] Step S401, obtaining a point-to-point verification request sent by a first terminal; the point-to-point verification request includes key control information of first data to be transmitted; the first data is data sent by the first terminal to the second terminal.

[0095] For details, please see Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0096] Step S402: The target switch does not trigger the access control service process and sends the first data to the second terminal.

[0097] When the target switch does not trigger the access control service process, it is necessary to first determine the data addresses of the first terminal and the second terminal and the data ports to which they are respectively connected. When the target switch receives the first data sent by the first terminal, it first checks the source data address of the first data, and determines the data port corresponding to the target data address according to the target data address in the first data. The target data address is the data address of the second terminal, and then the first data is forwarded to the data port corresponding to the target data address to complete the transmission of the first data.

[0098] The data transmission method provided in this embodiment directly sends the first data to the second terminal without performing additional checks and address conversion when the target is exchanged and the access control service process is not triggered, which can reduce the delay in the transmission process and improve the efficiency of data transmission.

[0099] In this embodiment, a data transmission method is provided, wherein a switch (SW) includes a cascade port and at least two data ports. In some optional implementations, the cascade port is an upstream port (UP) in the switch, and the data port is a downstream port (DP) in the switch. At least two downstream ports are respectively connected to a first terminal (EP) and a second terminal; the upstream port is used to communicate with a root complex. The root complex includes an IOMMU (Input / Output Memory Management Unit) and an RP (Root Port).

[0100] Figure 5 is a flow chart of a data transmission method according to an embodiment of the present invention. Figure 5 As shown, when the EP (Endpoint) is preparing to transmit the first data with another terminal through P2P communication, it will first send a P2P ValidationRequest (point-to-point verification request) to the SW DP (Switch Downstream Port), wherein the P2P Validation Request only includes the key control information required for the first data to process the ACS in the IOMMU. At this time, the data volume of the P2P Validation Request will be smaller than the first data.

[0101] After receiving the P2P Validation Request, the SW DP will determine whether it triggers the ACS. If it does not, the SW DP will reply with a P2P Validation Response. If the ACS is triggered, the SWUP (Switch Upstream Port) will forward the P2P Validation Request on the link, where the link is the link for the switch to communicate with the root complex. If the link peer device is still the SW, it will repeat the determination of whether it triggers the ACS, and repeat the above steps according to the triggering result.

[0102] If the link peer device is RP, it is determined whether RP triggers ACS. If ACS is not triggered, RP replies with P2P Validation Response. If ACS is triggered, RP forwards P2P Validation Request to IOMMU, which processes P2P Validation Request and generates P2P Validation Response.

[0103] After receiving the P2P Validation Response, the EP will parse the P2P Validation Response. If P2P communication is not allowed, the EP cannot send the corresponding data. If P2P communication is allowed, the EP will then send a memory request (Memory Request) corresponding to the data.

[0104] In this embodiment, a data transmission method is provided. Figure 6 is a schematic diagram of a data transmission flow according to an embodiment of the present invention. Figure 6As shown, the root complex includes memory, PCIe components and CPU (Central Processing Unit) connected in sequence. Among them, the PCIe component includes a host bridge, a root port and several input and output memory management units (IOMMU). The host bridge connects the PCIe component and the CPU. The root port is connected to the upstream port (Upstream Port) of the terminal (Endpoint) or the switch (Switch). The switch includes an upstream port and at least two downstream ports (Downstream Port) for connecting to the terminal.

[0105] like Figure 6 As shown, the terminal on the lower right side needs to transmit data to the terminal on the lower left side. As shown by the solid arrow, the terminal on the lower right side can directly send data to the terminal on the lower left side, but this will reduce the security of data transmission. Therefore, as shown by the dotted arrow, before the terminal on the lower right side sends the first data, it is necessary to send a point-to-point verification request with a smaller amount of data to the switch. After receiving the point-to-point verification request, the downstream port of the switch forwards it to the root port of the root complex through the upstream port. The root port then sends the point-to-point verification request to the input and output memory management unit for security check. After the input and output memory management unit performs the security check, it will return the point-to-point verification reply to the terminal that sent the point-to-point verification request. If the security check passes, the data will be sent to the terminal on the lower left side as shown by the solid arrow. If the security check fails, data transmission will not be performed.

[0106] In this embodiment, a data transmission device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0107] This embodiment provides a data transmission device, such as Figure 7 As shown, including:

[0108] The acquisition module 501 is used to acquire a point-to-point verification request sent by the first terminal; the point-to-point verification request includes key control information of first data to be transmitted; the first data is data sent by the first terminal to the second terminal;

[0109] The forwarding module 502 is used to forward the point-to-point authentication request through the cascade port if the target switch triggers the access control service process;

[0110] The control module 503 is used to obtain the return result of the point-to-point verification request through the cascade port, and control the sending of the first data according to the return result.

[0111] In some optional implementations, the data transmission device further includes a direct sending module 504:

[0112] The sending module 504 is configured to send the first data to the second terminal if the target switch does not trigger the access control service process.

[0113] In some optional implementations, the forwarding module 502 includes:

[0114] The first return result obtaining unit is used to obtain the first return result generated by the root complex through the cascade port.

[0115] The first control unit is used to control the sending of the first data according to the first returned result.

[0116] In some optional embodiments, the first control unit includes:

[0117] A first permission-to-send subunit, configured to allow the first terminal to send the first data to the second terminal through the target switch when the first returned result is permission;

[0118] The first prohibition sending subunit is used to prohibit the first terminal from sending the first data to the second terminal through the target switch when the first returned result is prohibition.

[0119] In some optional implementations, the forwarding module 502 further includes:

[0120] The second return result acquisition unit is used to obtain the second return result through the cascade port; the second return result is generated when the first switch receives the point-to-point verification request and does not trigger the access control service process; the first switch is a switch in the cascade link between the target switch and the root complex; the second return result is used to instruct the first terminal to send the first data to the second terminal through the target switch.

[0121] In some optional implementations, the key control information includes at least one of a data address, a data length, a data address type, a cache consistency flag, a process address space identification number, a memory access request identification, and a persistent memory area identification.

[0122] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0123] The data transmission device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0124] The embodiment of the present invention also provides a computer device having the above Figure 7 The data transmission device shown.

[0125] See also Figure 8 , Figure 8 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 8 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display GUI graphical information or CLI command line interface on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 8 A processor 10 is taken as an example.

[0126] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0127] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0128] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0129] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0130] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 8 The example of connecting through bus is taken in the following.

[0131] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0132] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0133] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0134] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A data transmission method, characterized in that: The method is performed by a target switch, the target switch comprising a cascade port and at least two data ports; The at least two data ports are connected to the first terminal and the second terminal respectively; the cascade port is used to communicate with the root complex; the method comprises: Acquire a point-to-point verification request sent by a first terminal; the point-to-point verification request includes key control information of first data to be transmitted; the first data is data sent by the first terminal to the second terminal; If the target switch triggers the access control service process, the point-to-point authentication request is forwarded through the cascade port; The return result of the point-to-point verification request is obtained through the cascade port, and the sending of the first data is controlled according to the return result.

2. The method according to claim 1, characterized in that The obtaining, through the cascade port, a return result for the point-to-point verification request, and controlling the sending of the first data according to the return result comprises: Acquire a first return result generated by the root complex through the cascade port; The sending of the first data is controlled according to the first returned result.

3. The method according to claim 2, characterized in that The controlling the sending of the first data according to the first returned result includes: When the first returned result is allowed, allowing the first terminal to send the first data to the second terminal through the target switch; When the first returned result is prohibited, the first terminal is prohibited from sending the first data to the second terminal through the target switch.

4. The method according to claim 1, characterized in that: The obtaining, through the cascade port, a return result for the point-to-point authentication request comprises: A second return result is obtained through the cascade port; the second return result is generated when the first switch receives a point-to-point verification request and does not trigger an access control service process; the first switch is a switch in a cascade link between the target switch and the root complex; the second return result is used to instruct the first terminal to send the first data to the second terminal through the target switch.

5. The method according to claim 1, characterized in that The method further comprises: If the target switch does not trigger the access control service process, the first data is sent to the second terminal.

6. The method according to any one of claims 1 to 5, characterized in that: The key control information includes at least one of a data address, a data length, a data address type, a cache consistency flag, a process address space identification number, a memory access request identification, and a persistent memory area identification.

7. A data transmission device, characterized in that: The device comprises: An acquisition module, configured to acquire a point-to-point verification request sent by a first terminal; the point-to-point verification request includes key control information of first data to be transmitted; the first data is data sent by the first terminal to the second terminal; A forwarding module, configured to forward the point-to-point authentication request through a cascade port if the target switch triggers an access control service process; The control module is used to obtain a return result for the point-to-point verification request through the cascade port, and control the sending of the first data according to the return result.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the data transmission method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the data transmission method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, wherein the computer instructions are used to cause a computer to execute the data transmission method according to any one of claims 1 to 6.

Images