Address management method and device, electronic equipment and storage medium
By using security tags for decryption processing and identity verification, combined with input/output translation backup buffers and page tables, and dynamically configuring page tables, the problems of single security policies and high latency in IOMMU address management are solved, thereby improving both security and efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-26
- Publication Date
- 2026-04-07
AI Technical Summary
Existing technologies such as IOMMU have a single security strategy for address management, which makes it difficult to defend against complex abnormal behaviors, and the physical address translation latency is high, resulting in a performance bottleneck.
The security tag and access tag of the memory access request are obtained by decryption, and identity and permission verification is performed. Address mapping is performed using input/output translation back buffer and page table, page table size and structure are dynamically configured, and abnormal device behavior is monitored.
It achieves fine-grained access control, ensures physical memory access security, improves address mapping efficiency, reduces physical address translation latency, and breaks through performance bottlenecks.
Smart Images
Figure CN121807741A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of cloud computing and virtualization, and particularly relates to an address management method and device, electronic equipment and storage medium. BACKGROUND
[0002] In modern high-performance computing systems, an Input / Output Memory Management Unit (IOMMU) is usually relied on to provide security isolation guarantees for cloud users, and therefore the physical address management manner of the IOMMU has become the focus of the industry.
[0003] In the prior art, after an IOMMU obtains a memory access request issued by a peripheral device, the IOMMU obtains an Input / Output Virtual Address (IOVA) and an operation type in the request, translates the virtual address into a system physical address (PA) through a multi-level page table, and then accesses the physical memory of the system through the physical address, thereby completing the Direct Memory Access (DMA) of the peripheral device.
[0004] However, such an address acquisition manner has a single security policy and only relies on coarse-grained access control (for example, domain isolation), which is difficult to prevent complex abnormal behaviors; at the same time, the physical address conversion has a high delay and has a performance bottleneck of address conversion. SUMMARY
[0005] The present application provides an address management method and device, electronic equipment and storage medium to solve the problem of a single security policy and high physical address conversion delay.
[0006] According to another aspect of the present application, an address management method is provided, applied to an Input / Output Memory Management Unit, comprising:
[0007] In response to obtaining a memory access request issued by a target peripheral device, the memory access request is decrypted to obtain a security tag and an access tag of the memory access request; wherein the security tag includes a device identifier, a process identifier and an encryption key;
[0008] If it is determined that the security tag passes identity verification and the access tag passes permission verification, it is determined whether there is address mapping information of the memory access request in an Input / Output Translation Lookaside Buffer; wherein the address mapping information in the Input / Output Translation Lookaside Buffer is related to address access frequency and peripheral device type;
[0009] if it is determined that the address mapping information of the memory access request exists in the input / output translation lookaside buffer, obtaining the corresponding physical address through the input / output translation lookaside buffer;
[0010] if it is determined that the address mapping information of the memory access request does not exist in the input / output translation lookaside buffer, obtaining the corresponding physical address through a page table.
[0011] Before obtaining the memory access request issued by the target external device, the method further comprises: configuring a dynamic page table size according to the access locality feature and the data throughput feature, and selecting a matching page table structure according to the dynamic page table size, so as to generate a page table according to the page table structure.
[0012] After the decryption processing of the memory access request, the method further comprises: obtaining a page table type matched by the memory access request, and loading a corresponding page table according to the page table type; wherein the page table type comprises a tree-shaped page table and a hash page table.
[0013] The input / output translation lookaside buffer comprises a fixed region and a shared region; the address management method further comprises: according to the access timeliness of different device types, configuring the fixed region for a specified external device, and according to the access frequency, dynamically configuring the shared region for a specific external device.
[0014] The address management method further comprises: in response to detecting a memory migration event, obtaining a corresponding migration address, and updating the corresponding address mapping information in the page table according to the migration address; in response to detecting a memory expansion event, obtaining a corresponding expansion address, and updating the corresponding address mapping information in the page table according to the expansion address.
[0015] The address management method further comprises: obtaining an address entropy value of each external device according to a physical address range of each memory access request of the external device; obtaining a burst length of each external device according to a data block size of each memory access request of the external device; and obtaining an abnormal external device in each external device according to the address entropy value, the burst length and the access frequency of each external device.
[0016] According to another aspect of the present application, an address management device applied to an input / output memory management unit is provided, comprising:
[0017] A tag information obtaining module is configured to, in response to obtaining a memory access request issued by an external device, perform decryption processing on the memory access request to obtain a security tag and an access tag of the memory access request; wherein the security tag comprises a device identifier, a process identifier and an encryption key.
[0018] The address mapping obtaining module is configured to: if it is determined that the security tag passes the identity check and the access tag passes the permission check, determine whether the address mapping information of the memory access request exists in an input / output translation lookaside buffer; wherein the address mapping information in the input / output translation lookaside buffer is related to address access frequency and external device type.
[0019] The physical address obtaining module is configured to: if it is determined that the address mapping information of the memory access request exists in the input / output translation lookaside buffer, obtain the corresponding physical address through the input / output translation lookaside buffer.
[0020] The page table information obtaining module is configured to: if it is determined that the address mapping information of the memory access request does not exist in the input / output translation lookaside buffer, obtain the corresponding physical address through a page table.
[0021] According to another aspect of the present application, an electronic device is provided, which comprises at least one processor and a memory connected with the at least one processor in communication; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the address management method according to any of the embodiments of the present application.
[0022] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to execute the address management method according to any of the embodiments of the present application when the computer instructions are executed by the processor.
[0023] According to another aspect of the present application, a computer program product is provided, which comprises a computer program for enabling a processor to execute the address management method according to any of the embodiments of the present application when the computer program is executed by the processor.
[0024] The technical solution of the embodiments of the present application, after obtaining the security tag and the access tag of the memory access request issued by the target external device, if it is determined that the request passes the identity check and the permission check, and the address mapping information of the request exists in the input / output translation lookaside buffer, the corresponding physical address is obtained through the input / output translation lookaside buffer; thus, not only the memory access request is comprehensively checked through the security tag and the access tag, the fine-grained access control is realized, and the access safety of the physical memory is ensured, but also the address mapping information obtaining efficiency is improved through the input / output translation lookaside buffer, the delay time of the physical address conversion is reduced, and the performance bottleneck of the address conversion process is broken. If the address mapping information of the request does not exist in the input / output translation lookaside buffer, the corresponding physical address is obtained through the page table, and the complete conversion of all physical addresses in the physical memory is ensured.
[0025] It should be understood that the matters described in this detailed description are intended to be illustrative and are not intended to limit or restrict the scope of the embodiments of the present application. Other features of the present application will become apparent to those skilled in the art upon a reading of the following specification. BRIEF DESCRIPTION OF DRAWINGS
[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.
[0027] Figure 1 is a flow chart of an address management method according to the first embodiment of the present application;
[0028] Figure 2 is a schematic diagram of an application scenario of an input / output memory management unit according to the first embodiment of the present application;
[0029] Figure 3 is a flow chart of another address management method according to the second embodiment of the present application;
[0030] Figure 4 is a flow chart of still another address management method according to the third embodiment of the present application;
[0031] Figure 5 is a structural schematic diagram of an address management device according to the fourth embodiment of the present application;
[0032] Figure 6 is a structural schematic diagram of an electronic device implementing the address management method of the present application. DETAILED DESCRIPTION
[0033] In order to make the technical personnel in the art better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, but not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.
[0034] It should be noted that the terms "first", "second", and the like in the description and in the claims of the present application and in the above-described drawings are intended to distinguish similar objects and not necessarily describe a particular chronological or sequential order. It should be understood that the data thus used can be interchanged, where appropriate, so that the embodiments of the application described herein can be practiced in other than the illustrated or described order. Furthermore, the terms "comprise" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, processes, methods, systems, products, or devices that include a list of steps or units not necessarily limited to those clearly listed, but can include other steps or units not clearly listed or inherent to such processes, methods, products, or devices.
[0035] Embodiment one
[0036] Figure 1 is a flowchart of an address management method provided by Embodiment one of the present application. The present embodiment can be applied to the case where identity verification and permission verification are respectively completed based on a security tag and an access tag, and physical address conversion is completed through an input / output translation lookaside buffer. The method can be executed by an address management device in any embodiment of the present application. The address management device can be implemented in the form of hardware and / or software. The address management device can be configured in an input / output memory management unit, which can be configured in an electronic device. As shown in Figure 1 the method comprises:
[0037] S101, in response to obtaining a memory access request issued by a target external device, decrypting the memory access request to obtain a security tag and an access tag of the memory access request; wherein the security tag comprises a device identifier, a process identifier, and an encryption key.
[0038] An IOMMU is a hardware unit in a computer system for managing and mapping device direct memory access physical addresses, as shown in Figure 2 which is connected to each external device of the computer system at one end, and is connected to a memory through a bus at the other end; at the same time, a memory management unit (MMU) in the computer system is connected to each central processing unit (CPU) at one end, and is connected to the memory through a bus at the other end.
[0039] Since the external device encrypts the memory access request itself when sending the memory access request, the IOMMU decrypts the memory access request after obtaining the memory access request. Thus, even if the physical memory is stolen, the content cannot be restored, ensuring the security of the request content. Meanwhile, the IOMMU is configured with a security coprocessor running independently of the main CPU. When each external device is first connected, the security coprocessor allocates a unique device identifier (DeviceID) for each external device, a process identifier of the process to which the external device belongs (process identifier), and an encryption key. The three pieces of information form the security label of the external device. In addition, all memory access requests carry an access label, which records the physical memory page that the request wants to access.
[0040] In particular, the encryption key can be generated based on the device identifier, the process identifier, and the carrier identifier, where the carrier identifier represents the container identifier or the virtual machine identifier to which the external device is connected. The virtual machine can be directly connected to the external device through a hypervisor. The container can be mounted with the external device through the host. When the external device is migrated, the corresponding encryption key is also changed synchronously, so that the old encryption key before migration is invalid, thereby ensuring the security of the access of the external device.
[0041] For example, when the external device is a graphics processing unit (GPU), the security label of the GPU when running in container A1 includes device identifier B, process identifier C, and carrier identifier D1, where the carrier identifier D1 is generated based on container A1, device identifier B, and process identifier C. After the GPU is migrated to container A2, the security label of the GPU is updated to device identifier B, process identifier C, and carrier identifier D2, where the carrier identifier D2 is generated based on container A2, device identifier B, and process identifier C.
[0042] S102, if it is determined that the security label passes the identity check and the access label passes the permission check, it is determined whether the address mapping information of the memory access request exists in the input / output translation lookaside buffer; where the address mapping information in the input / output translation lookaside buffer is related to the address access frequency and the type of the external device.
[0043] If the device identity, process identity and encryption key of the memory access request are all verified, it indicates that the security label of the memory access request passes the identity verification; if any of the device identity, process identity and encryption key of the memory access request fails to pass the verification, it indicates that the security label of the memory access request fails to pass the identity verification; if the current external device has the access permission of the physical memory page in the access label that it wants to access, it indicates that the access label of the memory access request passes the permission verification; if the current external device does not have the access permission of the physical memory page in the access label that it wants to access, it indicates that the access label of the memory access request fails to pass the permission verification.
[0044] For example, for a network card, only its access to the buffer page is allowed, and access to other memory pages is prohibited; if the physical memory page that the network card wants to access in the access label of the memory access request is a buffer page, it indicates that the access label of the memory access request passes the permission verification; if the physical memory page that the network card wants to access in the access label of the memory access request is a non-buffer page, it indicates that the access label of the memory access request fails to pass the permission verification. Accordingly, the identity verification and the permission verification are respectively completed based on the security label and the access label.
[0045] The Input / Output Translation Lookaside Buffer (IOTLB) is a cache used to accelerate the mapping of virtual addresses to physical addresses. Compared with the traditional page table query method, the access speed of the page table located in the main memory is slow, and therefore the system call overhead of address translation can be reduced, the traversal delay of the page table can be reduced, the efficiency of obtaining the physical address can be improved, and in particular, the Input / Output (I / O) response speed under burst traffic can be improved by using the IOTLB.
[0046] The access trajectory of each memory access request can be obtained by a machine learning model or a heuristic algorithm (for example, Markov chain, access sequence pattern recognition), high-frequency virtual addresses can be extracted therefrom, or the access frequency of each virtual address can be counted to directly obtain high-frequency virtual addresses according to the access frequency of each virtual address, and the mapping relationship between the high-frequency virtual addresses and the corresponding physical addresses is stored in the IOTLB, so as to ensure the fast conversion processing of the high-frequency virtual addresses and improve the utilization efficiency of the storage resources of the IOTLB; wherein the high-frequency virtual addresses can be high-frequency virtual addresses in a specified time period in the past.
[0047] Meanwhile, different types of external devices have different requirements for communication real-time, for example, base station network cards and industrial control cards have higher real-time requirements, and other types of devices have lower real-time requirements. Therefore, different priorities can be set for different types of devices with different real-time requirements according to the types of the devices, and then the virtual addresses accessed by the external devices with higher priorities are used as high-priority virtual addresses, so as to store the mapping relationship between the high-priority virtual addresses and corresponding physical addresses in the IOTLB.
[0048] The address access frequency and the type of the external device can also be configured with different weights, and the sum of the product of the address access frequency and the type of the external device of each virtual address and the respective corresponding weight is used as the storage score of the virtual address. The address mapping information corresponding to the virtual address with a higher storage score is stored in the IOTLB. In this way, the address mapping information is classified and stored, that is, the address mapping information with higher address access frequency and higher priority of the type of the external device is stored in the IOTLB.
[0049] S103, if it is determined that the address mapping information of the memory access request exists in the input / output translation lookaside buffer, the corresponding physical address is obtained through the input / output translation lookaside buffer.
[0050] If the address mapping information of the current memory access request exists in the IOTLB, the corresponding physical address can be obtained through the IOTLB, thereby reducing the system call overhead of address translation, reducing the traversal delay of the page table, and improving the efficiency of obtaining the physical address.
[0051] S104, if it is determined that the address mapping information of the memory access request does not exist in the input / output translation lookaside buffer, the corresponding physical address is obtained through the page table.
[0052] If the address mapping information of the current memory access request does not exist in the IOTLB, the corresponding physical address is obtained through the page table, thereby ensuring complete acquisition of all physical addresses.
[0053] Optionally, in the embodiment of the application, the input / output translation lookaside buffer includes a fixed area and a shared area; and the address management method further includes: according to the access timeliness of different types of devices, configuring the fixed area for specified external devices, and according to the access frequency, dynamically configuring the shared area for specific external devices.
[0054] Specifically, the IOTLB can be divided into a fixed region and a shared region, the fixed region is reserved for devices with higher time effectiveness requirements, that is, devices of higher priority, to avoid jitter phenomenon caused by competition behavior, and the shared region is for common devices with lower priority, for the common devices, address mapping information corresponding to high-frequency virtual addresses is stored based on the access frequency of each virtual address, thereby ensuring the use of the IOTLB by devices with higher priority and avoiding jitter phenomenon caused by competition behavior, and ensuring the rapid conversion processing of high-frequency virtual addresses through the calculation of high-frequency virtual addresses.
[0055] Optionally, in the embodiment of the application, the address management method further comprises: in response to detecting a memory migration event, obtaining a corresponding migration address, and updating corresponding address mapping information in the page table according to the migration address; and in response to detecting a memory expansion event, obtaining a corresponding expansion address, and updating corresponding address mapping information in the page table according to the expansion address.
[0056] Specifically, in the process of virtual machine migration, container dynamic adjustment and hot-plug memory, the IOMMU actively senses the change of the physical memory, for example, by detecting a migration event, and reconstructs the correct physical address mapping by using metadata (for example, a virtual machine context bound to an external device), thereby updating the address mapping information without interrupting the memory access request of the external device, realizing the updating of the address mapping information without restarting the device driver, and improving the timeliness of the updating of the address mapping information. When the virtual machine or the container is online expanded, the IOMMU ensures that the new memory can be accessed by the pass-through device by including the new physical region into the input-output address translation system, thereby realizing the hot expansion of the physical memory.
[0057] The technical scheme of the embodiment of the application, after obtaining the security label and the access label of the memory access request sent by the target external device, if it is determined that the request passes the identity verification and the permission verification, and the address mapping information of the request exists in the input-output translation lookaside buffer, the corresponding physical address is obtained through the input-output translation lookaside buffer; thereby not only the memory access request is comprehensively verified through the security label and the access label, realizing fine-grained access control and ensuring the access safety of the physical memory, but also the address mapping information is obtained through the input-output translation lookaside buffer, improving the efficiency of obtaining the address mapping information and reducing the delay time of the physical address conversion, thereby breaking the performance bottleneck of the address conversion process. If the address mapping information of the request does not exist in the input-output translation lookaside buffer, the corresponding physical address is obtained through the page table, thereby ensuring the complete conversion of all physical addresses in the physical memory.
[0058] Embodiment two
[0059] Figure 3 is a flowchart of an address management method provided by Embodiment Two of the present application. The present embodiment is related to the above-mentioned embodiments in that constant transmission is completed through an iterative transmission mode, as shown in Figure 3 The method comprises the following steps.
[0060] S201, configuring a dynamic page table size according to an access locality feature and a data throughput feature, and selecting a matching page table structure according to the dynamic page table size, to generate a page table according to the page table structure.
[0061] The page table size refers to the size of the memory page used in the address translation process. When the page table size is small (for example, a small page of 4KB), a multi-level page table is needed to manage address translation, which results in a large number of page table entries, a high probability of IOTLB miss, and an increase in address translation overhead, but has a finer-grained memory allocation method and a low-fragmentation feature.
[0062] When the page table size is large (for example, a large page of 2MB or 1GB), the performance can be optimized by reducing the number of page table entries. For example, a 1GB large page can map the entire buffer to a few page table entries, significantly reducing the IOTLB miss rate and improving the DMA operation efficiency, but at the same time, it has a high-fragmentation feature while reducing the page table level and memory usage.
[0063] The access locality feature includes spatial locality and temporal locality. The spatial locality is reflected in the continuous access of the concentrated area of the memory by the memory access request (for example, array traversal), at which time the large page can be configured to reduce the IOTLB miss phenomenon and improve the address translation efficiency. The temporal locality is reflected in repeated access to the same memory (for example, loop code), at which time the small page can be configured to reduce the number of fragments.
[0064] The data throughput feature includes a high-throughput scenario and a random access scenario. For the high-throughput scenario, the large page can be configured to improve the transmission efficiency of the continuous data block and reduce the occurrence of miss interrupt phenomenon. For the random access scenario, the small page can be configured to optimize the cache utilization rate and reduce the fragmentation delay. Thus, by dynamically adjusting the page table size, the memory access efficiency can be optimized at runtime, avoiding the IOTLB pressure caused by the traditional fixed page structure, and at the same time solving the problem of excessive external fragmentation.
[0065] S202, in response to obtaining a memory access request issued by a target external device, performing decryption processing on the memory access request to obtain a security tag and an access tag of the memory access request; wherein the security tag includes a device identifier, a process identifier, and an encryption key.
[0066] Optionally, in the embodiment of the present application, after the memory access request is decrypted, the method further comprises: obtaining a page table type matched with the memory access request, and loading a corresponding page table according to the page table type; wherein the page table type comprises a tree-shaped page table and a hash page table.
[0067] Specifically, the tree-shaped page table, i.e., the multi-level page table, splits the virtual address into multiple fields, and each level corresponds to a level of the page table, which corresponds to a form of the small page in the above technical solution; the hash page table is a form of the large page in the above technical solution, which uses a hash function to convert a virtual page number into a hash table index and directly finds a corresponding physical memory page number (Page Frame Number, PDF), and accordingly, the page table can be pre-configured as a hybrid page table structure.
[0068] After obtaining the memory access request, the virtual address of the memory access request is parsed, and the virtual address can be divided into a high bit (indicating a page number) and a low bit (indicating an intra-page offset); wherein if corresponding to a small page mode (i.e., a tree-shaped page table), multiple page table indexes are contained in the high bit; if corresponding to a large page mode, multiple index bits in the high bit are fixed as 0; thus, by judging whether the number of index bits being 0 in the high bit of the memory access request is a preset number threshold, if greater than or equal to the preset number threshold, it indicates a large page mode, and if less than or equal to the preset number threshold, it indicates a small page mode.
[0069] The above hybrid page table structure takes into account the fine-grained management of the conventional small page and the high throughput requirement of the large page, uses a tree-shaped page table (4KB small page) for the conventional memory (for example, a code segment and a data segment of a user process) to ensure memory utilization, and uses a hash page table (2MB / 4MB large page) for the large page memory (for example, a cache area of a database and a Guest memory of virtualization) to improve access speed, thereby greatly improving the configuration flexibility of the page table.
[0070] S203, if it is determined that the security tag passes the identity check and the access tag passes the permission check, it is judged whether there is address mapping information of the memory access request in an input / output translation lookaside buffer; wherein the address mapping information in the input / output translation lookaside buffer is related to address access frequency and external device type.
[0071] S204, if it is determined that there is address mapping information of the memory access request in the input / output translation lookaside buffer, a corresponding physical address is obtained through the input / output translation lookaside buffer.
[0072] S205, if it is determined that there is no address mapping information of the memory access request in the input / output translation lookaside buffer, a corresponding physical address is obtained through a page table.
[0073] The technical scheme of the embodiment of the present application configures a dynamic page table size according to the access locality feature and the data throughput feature, and selects a matching page table structure according to the dynamic page table size, so as to generate a page table according to the page table structure. Thus, by dynamically adjusting the page table size, the memory access efficiency can be optimized at runtime, the IOTLB pressure caused by the traditional fixed page structure can be avoided, and the problem of excessive external fragmentation can be solved.
[0074] Embodiment three
[0075] Figure 4 is a flowchart of an address management method provided by the third embodiment of the present application. The relationship between the present embodiment and the above-mentioned embodiments is that the abnormal behavior of each external device is monitored, as shown in Figure 4 The method comprises the following steps.
[0076] S301, according to the physical address range of each memory access request of each external device, obtaining the address entropy value of each external device.
[0077] When the external device interacts with the host memory through direct memory access behavior, it will read and write specific physical addresses. Accordingly, the physical address range of each memory access request of each external device can be recorded, and then the probability of each access address appearing in the access sequence is calculated, and the address entropy value is obtained according to the probability value; wherein the address entropy value is a data index for measuring randomness and uncertainty; in the embodiment of the present application, the greater the address entropy value, the stronger the randomness of the access behavior, that is, the more dispersed the access behavior; the smaller the address entropy value, the stronger the regularity of the access behavior, that is, the more concentrated the access behavior, that is, the access is concentrated in a small number of addresses.
[0078] S302, according to the data block size of each memory access request of each external device, obtaining the burst length of each external device.
[0079] The burst refers to the minimum continuous transmission unit triggered by a memory access request, and the burst length refers to the number of data transmissions in a burst transmission; the data block size refers to the total data amount required by a single memory access request for transmission, which will be split into multiple burst packets for transmission according to the bus data length, and the number of burst packets is the burst length; taking the above technical scheme as an example, if the total data amount required by a single memory access request for transmission is 128 bytes, and the bus data length is 4 bytes, that is, only 4 bytes can be transmitted at a time, then the quotient of 128 bytes and 4 bytes (i.e. 32 times) is taken as the burst length.
[0080] S303, according to the address entropy value, the burst length and the access frequency of each external device, obtaining an abnormal external device in each external device.
[0081] The access frequency, that is, the number of requests in a unit of time, takes the ratio of the number of requests to the statistical time as the access frequency; if the address entropy value of the external device is relatively high (for example, greater than or equal to a preset entropy threshold value) and the access frequency is also relatively high (for example, greater than or equal to a preset frequency threshold value), it indicates that the current external device has a high-frequency random access behavior, and at this time, the external device can be identified as an abnormal external device; if the ratio of the burst length of the external device to the historical average value is greater than a preset proportion threshold value, it indicates that the current external device has an abnormal burst length, that is, the transmitted data does not conform to the historical transmission habit, and it may have a risk of being hijacked.
[0082] In addition, different weights can also be configured for the address entropy value, the burst length and the access frequency, and the sum of the products of the address entropy value, the burst length and the access frequency and the respective weights is taken as the abnormal index of the current external device; the external device with an abnormal index greater than a preset index threshold value is taken as an abnormal external device, or the ratio of the abnormal index to the average abnormal index of all external devices is taken as an evaluation basis, and the external device with a ratio greater than a preset proportion threshold value is taken as an abnormal external device.
[0083] The technical scheme of the embodiment of the application obtains the address entropy value of each external device according to the physical address range of each memory access request of the external device; obtains the burst length of each external device according to the data block size of each memory access request of the external device; and obtains the abnormal external device in each external device according to the address entropy value, the burst length and the access frequency of each external device. Thus, according to the address entropy value, the burst length and the access frequency, effective detection of the abnormal external device is realized, and the access safety of the physical memory is further ensured.
[0084] Embodiment four
[0085] Figure 5 is a structural block diagram of an address management device provided by the embodiment four of the application, and the device specifically comprises:
[0086] The tag information acquisition module 401 is configured to, in response to obtaining the memory access request sent by the external device, perform decryption processing on the memory access request to obtain a security tag and an access tag of the memory access request; wherein the security tag comprises a device identifier, a process identifier and an encryption key;
[0087] The address mapping acquisition module 402 is configured to, if it is determined that the security tag passes the identity check and the access tag passes the permission check, judge whether there is address mapping information of the memory access request in an input-output translation lookaside buffer; wherein the address mapping information in the input-output translation lookaside buffer is related to the address access frequency and the type of the external device;
[0088] The physical address acquisition module 403 is configured to acquire the corresponding physical address from the input / output translation lookaside buffer if it is determined that the address mapping information of the memory access request exists in the input / output translation lookaside buffer.
[0089] The page table information acquisition module 404 is configured to acquire the corresponding physical address from a page table if it is determined that the address mapping information of the memory access request does not exist in the input / output translation lookaside buffer.
[0090] The technical scheme of the embodiment of the application, after acquiring the security tag and the access tag of the memory access request sent by the target external device, if it is determined that the request passes the identity verification and the permission verification, and the address mapping information of the request exists in the input / output translation lookaside buffer, the corresponding physical address is acquired from the input / output translation lookaside buffer; thus, not only the memory access request is comprehensively verified through the security tag and the access tag, the access control of fine granularity is realized, and the access safety of the physical memory is ensured, but also the address mapping information acquisition efficiency is improved through the input / output translation lookaside buffer, the delay time of the physical address conversion is reduced, and the performance bottleneck of the address conversion process is broken. If the address mapping information of the request does not exist in the input / output translation lookaside buffer, the corresponding physical address is acquired from a page table, and the complete conversion of all physical addresses in the physical memory is ensured.
[0091] Optionally, the address management apparatus is further configured to configure a dynamic page table size according to the access locality feature and the data throughput feature, and select a matching page table structure according to the dynamic page table size, so as to generate a page table according to the page table structure.
[0092] Optionally, the address management apparatus is further configured to acquire a page table type matched with the memory access request, and load a corresponding page table according to the page table type; wherein the page table type includes a tree-shaped page table and a hash page table.
[0093] Optionally, the input / output translation lookaside buffer includes a fixed region and a shared region.
[0094] The address management apparatus is further configured to configure the fixed region to a specified external device according to the access timeliness of different device types, and dynamically configure the shared region to a specific external device according to the access frequency.
[0095] Optionally, the address management apparatus is further configured to acquire a migration address corresponding to a memory migration event, and update the corresponding address mapping information in the page table according to the migration address; and acquire an expansion address corresponding to a memory expansion event, and update the corresponding address mapping information in the page table according to the expansion address.
[0096] Optionally, the address management apparatus is further configured to: obtain an address entropy value of each of the external devices according to a physical address range of each memory access request of the external device; obtain a burst length of each of the external devices according to a data block size of each memory access request of the external device; and obtain an abnormal external device in each of the external devices according to the address entropy value, the burst length and the access frequency of each of the external devices.
[0097] The apparatus can perform the address management method provided by any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of performing the method. Technical details not described in the embodiments can be referred to the address management method provided by any of the embodiments of the present application.
[0098] Embodiment five
[0099] Figure 6 A structural schematic diagram of an electronic device 10 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, electronic devices, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the present application described and / or claimed in this document.
[0100] As shown in Figure 6 The electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is in communication with the at least one processor 11, where the memory stores computer programs that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer programs stored in the read-only memory (ROM) 12 or loaded from the storage unit 18 into the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.
[0101] A plurality of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.
[0102] The processor 11 can be various general and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the address management method.
[0103] In some embodiments, the address management method can be implemented as a computer program tangibly embodied in a computer readable storage medium, such as the storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed onto the heterogeneous hardware accelerator via the ROM and / or the communication unit. When the computer program is loaded into the RAM and executed by the processor, one or more steps of the address management method described above can be performed. Alternatively, in other embodiments, the processor can be configured to perform the address management method by any other appropriate means, such as by means of firmware.
[0104] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (PLD), a computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.
[0105] Computer programs for implementing the methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program running on the processor implements the functions / operations specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.
[0106] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0107] To provide for interaction with a user, the systems and techniques described here can be implemented on a heterogeneous hardware accelerator having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the heterogeneous hardware accelerator. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.
[0108] The systems and techniques described herein can be implemented in a computing system that includes a back end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front end component, e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described herein, or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.
[0109] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.
[0110] It should be understood that the various forms of flow shown above can be re-ordered, added to, or deleted from without departing from the scope of the present disclosure. For example, the steps recited in the present disclosure can be executed in parallel, executed in sequence, or executed in different orders, as long as the desired results of the technical solutions of the present disclosure can be achieved, and the present disclosure is not limited herein.
[0111] The specific implementation described above does not constitute a limitation on the scope of protection of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.
Claims
1. An address management method, characterized in that, Applied to the input / output memory management unit, including: In response to receiving a memory access request from a target external device, the memory access request is decrypted to obtain a security tag and an access tag for the memory access request; wherein, the security tag includes a device identifier, a process identifier, and an encryption key; If the security tag passes the identity verification and the access tag passes the permission verification, determine whether there is address mapping information for the memory access request in the input / output translation backup buffer; wherein, the address mapping information in the input / output translation backup buffer is related to the address access frequency and the type of external device; If it is determined that the address mapping information of the memory access request exists in the input / output translation back buffer, the corresponding physical address is obtained through the input / output translation back buffer; If it is determined that the address mapping information for the memory access request does not exist in the input / output translation back buffer, the corresponding physical address is obtained through the page table.
2. The address management method according to claim 1, characterized in that, Before receiving the memory access request from the target external device, the process also includes: Configure dynamic page table sizes based on access locality characteristics and data throughput characteristics, and select matching page table structures based on the dynamic page table sizes to generate page tables based on the page table structures.
3. The address management method according to claim 1, characterized in that, After decrypting the memory access request, the process also includes: Obtain the page table type matching the memory access request, and load the corresponding page table according to the page table type; wherein, the page table type includes tree page table and hash page table.
4. The address management method according to claim 1, characterized in that, The input / output translation backup buffer includes a fixed region and a shared region; the address management method further includes: Based on the access timeliness of different device types, the fixed area is configured to a designated external device, and based on the access frequency, the shared area is dynamically configured to a specific external device.
5. The address management method according to claim 1, characterized in that, The address management method further includes: In response to the detection of a memory migration event, the corresponding migration address is obtained, and the corresponding address mapping information is updated in the page table according to the migration address; In response to the detection of a memory expansion event, the corresponding expansion address is obtained, and the corresponding address mapping information is updated in the page table according to the expansion address.
6. The address management method according to claim 1, characterized in that, The address management method further includes: Based on the physical address range of each memory access request of each external device, obtain the address entropy value of each external device; The burst length of each external device is obtained based on the data block size of each memory access request of each external device; Based on the address entropy value, burst length, and access frequency of each external device, the abnormal external devices among the external devices are obtained.
7. An address management device, characterized in that, Applied to the input / output memory management unit, including: The tag information acquisition module is used to respond to a memory access request issued by an external device, decrypt the memory access request, and obtain the security tag and access tag of the memory access request; wherein, the security tag includes a device identifier, a process identifier, and an encryption key; The address mapping acquisition module is used to determine whether the address mapping information of the memory access request exists in the input / output translation backup buffer if the security tag passes the identity verification and the access tag passes the permission verification; wherein, the address mapping information in the input / output translation backup buffer is related to the address access frequency and the type of external device; The physical address acquisition module is used to acquire the corresponding physical address through the input / output translation backup buffer if it is determined that the address mapping information of the memory access request exists in the input / output translation backup buffer. The page table information acquisition module is used to obtain the corresponding physical address through the page table if it is determined that there is no address mapping information for the memory access request in the input / output translation back buffer.
8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the address management method according to any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the address management method according to any one of claims 1-6.
10. A computer program product comprising a computer program that, when executed by a processor, implements the address management method of any one of claims 1-6.